Edit tour

Windows Analysis Report
https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe

Overview

General Information

Sample URL:	https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe
Analysis ID:	1560171
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Exploit detected, runtime environment starts unknown processes

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7600 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 7688 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

OpenWebStart_windows-x64_1_10_1.exe (PID: 3804 cmdline: "C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe" MD5: 899985795B87D9F86877595A8C004D40)

java.exe (PID: 6284 cmdline: "c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\bin\java.exe" -version MD5: 990B10C495E3E60ED7AF4BA310AEDE57)

conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4480, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe, ProcessId: 3804, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4480, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1, ProcessId: 7600, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FFE126D9448 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

9_2_00007FFE126D9448

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libzip\zip.pdb source: java.exe, 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: java.exe, 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\java_objs\java.pdb source: java.exe, 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmp, java.exe, 00000009.00000000.2740873098.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\hotspot\windows_amd64_compiler2\product\jvm.pdb source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libzip\zip.pdb(( source: java.exe, 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libjava\java.pdb source: java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: java.exe, 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmp

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF79F0 FindFirstFileA,FindNextFileA,strchr,FindClose,	9_2_00007FF650EF79F0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F15310 FindFirstFileExW,	9_2_00007FF650F15310
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D9EF0 wcslen,malloc,free,_errno,wcscpy,free,GetFileAttributesW,wcslen,wcscat,FindFirstFileW,free,GetLastError,wcscmp,wcscmp,wcslen,FindNextFileW,GetLastError,FindClose,FindClose,free,	9_2_00007FFE126D9EF0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB91C wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,wcslen,_errno,	9_2_00007FFE126DB91C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB198 IsDBCSLeadByte,_fullpath,strlen,IsDBCSLeadByte,strchr,isalpha,toupper,strlen,FindFirstFileA,FindClose,strlen,strlen,_errno,_errno,	9_2_00007FFE126DB198
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB5F8 malloc,_wfullpath,wcslen,wcsncmp,wcschr,towupper,_errno,_errno,free,wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,_errno,	9_2_00007FFE126DB5F8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D9C34 GetFileAttributesExW,GetLastError,FindFirstFileW,wcsrchr,wcscmp,FindClose,free,	9_2_00007FFE126D9C34
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DA5A8 GetFileAttributesExW,GetLastError,FindFirstFileW,FindClose,	9_2_00007FFE126DA5A8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13210E70 FindFirstFileExW,FindClose,wcscpy_s,	9_2_00007FFE13210E70

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\E4JA75~1.TMP\	Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/187595602/0e11e7a6-f296-4016-9dc1-a83eb621d062?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241121%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241121T125540Z&X-Amz-Expires=300&X-Amz-Signature=a248221241d7dcb97b5adb6f5cfd6839fd7720b81cb3a7c5836bea8b802a4058&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DOpenWebStart_windows-x64_1_10_1.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: objects.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodesC
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansionG
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace:
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/include-comments
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformanter
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/dynamicxml/int
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema:
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080257000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/features/xincludeC
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node7
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/input-buffer-sizece
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler=
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver/propertie5
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table6
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/locale
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/properties/security-managerI
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apache.org/xml/xmlschema/1.0/anonymousTypes
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: wget.exe, 00000002.00000002.2644115460.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643595853.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643618757.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2644315600.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: wget.exe, 00000002.00000002.2644115460.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643595853.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643618757.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2644315600.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/dom/properties/r
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/)
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd/XML11NSDoc9
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/ld
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-statering;Lj
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event=
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTD;
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchema
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.dom.DOMResult/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.dom.DOMSource/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXResult/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080099000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXSource/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature/xmlfilter
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stax.StAXResult/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stax.StAXResult/featurekH
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080099000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stax.StAXSource/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stream.StreamResult/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080099000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javax.xml.transform.stream.StreamSource/feature
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: wget.exe, 00000002.00000002.2644115460.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643595853.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643618757.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2644315600.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://openjdk.java.net/jeps/220).
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080358000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://timestamp.sectigo.com
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D675D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6DBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ej-technologies.com/shared-mime-info-ext
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ej-technologies.com/shared-mime-info-extss
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6DBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-infoass
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanismva/la
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/is-standalone
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/is-standalone#m
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/1
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/XmlFeatureManager
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/enableExtensionFunctions
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimiturable
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityReplacementLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getEntityCountInfo
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepth
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit))
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xmlSecurityPropertyManager;
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xalan
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xslt
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.apache.org/xslt;q
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/age
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080257000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces?
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080257000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation&
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/dom-nodeC
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handlercT
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.K
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D68DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.K/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D68DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.KT
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.SG
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D68DE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.net.s/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6392000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D63FA000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp, java.exe, java.exe, 00000009.00000002.2753759856.00000000D5580000.00000004.00001000.00020000.00000000.sdmp, java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://adoptium.net/
Source: java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://adoptium.net/java.vendor.url.bughttps://github.com/adoptium/adoptium-support/issues%d.%djava
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adoptium.netC
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080257000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080358000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://download-openwebstart.com/updates/updates.xml
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.00000000803E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JFormDesigner/FlatLaf
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D66FF000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JFormDesigner/FlatLaf/issues/56#issuecomment-586297814
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D675D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JetBrains/intellij-community/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D63FA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/adoptium/adoptium-
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D63FA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/adoptium/adoptium-...
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6392000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp, java.exe, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2753759856.00000000D5580000.00000004.00001000.00020000.00000000.sdmp, java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/adoptium/adoptium-support/issues
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://github.com/adoptium/adoptium-support/issuesgeneric-da-ea-disableassertions-enableassertions-
Source: wget.exe, 00000002.00000002.2643965268.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_H?
Source: wget.exe, 00000002.00000002.2643965268.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.ex
Source: wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/187595602/0e11e7a6-f296
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080358000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://openwebstart.com/
Source: wget.exe, 00000002.00000002.2644115460.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643595853.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643618757.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2644315600.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D666C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.00000000803E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.formdev.com/flatlaf/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D675D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.formdev.com/flatlaf/how-to-customize/
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D675D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.formdev.com/flatlaf/properties-files/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0D164	9_2_00007FF650F0D164
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F1A6EC	9_2_00007FF650F1A6EC
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0CAA4	9_2_00007FF650F0CAA4
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F07998	9_2_00007FF650F07998
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F15310	9_2_00007FF650F15310
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F13950	9_2_00007FF650F13950
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F17954	9_2_00007FF650F17954
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F1A968	9_2_00007FF650F1A968
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF9AA8	9_2_00007FF650EF9AA8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFF294	9_2_00007FF650EFF294
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFEA84	9_2_00007FF650EFEA84
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F109E8	9_2_00007FF650F109E8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F00A60	9_2_00007FF650F00A60
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0541C	9_2_00007FF650F0541C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F003D0	9_2_00007FF650F003D0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F13950	9_2_00007FF650F13950
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F07350	9_2_00007FF650F07350
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F10368	9_2_00007FF650F10368
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFF498	9_2_00007FF650EFF498
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFEC88	9_2_00007FF650EFEC88
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF7E28	9_2_00007FF650EF7E28
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0FED4	9_2_00007FF650F0FED4
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0BF24	9_2_00007FF650F0BF24
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F04F10	9_2_00007FF650F04F10
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F00E98	9_2_00007FF650F00E98
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFEE8C	9_2_00007FF650EFEE8C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F1C868	9_2_00007FF650F1C868
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF7F95	9_2_00007FF650EF7F95
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF878F	9_2_00007FF650EF878F
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFF090	9_2_00007FF650EFF090
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F08810	9_2_00007FF650F08810
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F00038	9_2_00007FF650F00038
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126E7AB0	9_2_00007FFE126E7AB0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126E6B90	9_2_00007FFE126E6B90
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D4FE8	9_2_00007FFE126D4FE8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D8480	9_2_00007FFE126D8480
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D4C54	9_2_00007FFE126D4C54
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1323A39E	9_2_00007FFE1323A39E
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132273E0	9_2_00007FFE132273E0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13213410	9_2_00007FFE13213410
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13207AA8	9_2_00007FFE13207AA8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132332B8	9_2_00007FFE132332B8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13232AE0	9_2_00007FFE13232AE0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1322816C	9_2_00007FFE1322816C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13228950	9_2_00007FFE13228950
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132081D8	9_2_00007FFE132081D8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132140E0	9_2_00007FFE132140E0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1323A39E	9_2_00007FFE1323A39E
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13205FC8	9_2_00007FFE13205FC8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1323169C	9_2_00007FFE1323169C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13215E80	9_2_00007FFE13215E80
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132216F0	9_2_00007FFE132216F0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13226720	9_2_00007FFE13226720
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13221F10	9_2_00007FFE13221F10
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13220570	9_2_00007FFE13220570
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13236580	9_2_00007FFE13236580
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13220E30	9_2_00007FFE13220E30
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1322363C	9_2_00007FFE1322363C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13214E10	9_2_00007FFE13214E10
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13224608	9_2_00007FFE13224608
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13206C74	9_2_00007FFE13206C74
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE132344A0	9_2_00007FFE132344A0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE14631190	9_2_00007FFE14631190
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE14635D5F	9_2_00007FFE14635D5F
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE14635565	9_2_00007FFE14635565
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE14638ED8	9_2_00007FFE14638ED8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE146332C8	9_2_00007FFE146332C8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE146353F8	9_2_00007FFE146353F8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A46280C	9_2_00007FFE1A46280C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A462F24	9_2_00007FFE1A462F24
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A4653DC	9_2_00007FFE1A4653DC
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A4C5878	9_2_00007FFE1A4C5878
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_0000026EA1897240	9_2_0000026EA1897240
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_0000026EA18963A1	9_2_0000026EA18963A1

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: String function: 00007FF650EF114C appears 33 times
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: String function: 00007FF650EF6548 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: String function: 00007FFE1A4610F0 appears 84 times

Source: api-ms-win-core-heap-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal52.expl.win@8/205@2/2

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650EF6640 GetLastError,FormatMessageA,MessageBoxA,fwprintf,LocalFree,

9_2_00007FF650EF6640

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FFE126D9DAC GetVolumePathNameW,GetDiskFreeSpaceExW,free,

9_2_00007FFE126D9DAC

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

File created: C:\Users\user\AppData\Local\Temp\e4jtw380430090

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe	String found in binary or memory: -help
Source: java.exe	String found in binary or memory: sun/launcher/LauncherHelper

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe "C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe"
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe "c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\bin\java.exe" -version
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe "c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\bin\java.exe" -version	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

File opened: c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\lib\amd64\jvm.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libzip\zip.pdb source: java.exe, 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: java.exe, 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\java_objs\java.pdb source: java.exe, 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmp, java.exe, 00000009.00000000.2740873098.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\hotspot\windows_amd64_compiler2\product\jvm.pdb source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libzip\zip.pdb(( source: java.exe, 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\workspace\openjdk-build\workspace\build\src\build\windows-x86_64-normal-server-release\jdk\objs\libjava\java.pdb source: java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: java.exe, 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmp

Source: api-ms-win-core-console-l1-1-0.dll.8.dr

Static PE information: 0x9A158DFF [Sat Dec 2 04:24:31 2051 UTC]

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650EF691C LoadLibraryA,GetProcAddress,GetProcAddress,

9_2_00007FF650EF691C

Source: OpenWebStart_windows-x64_1_10_1.exe.2.dr	Static PE information: section name: _RDATA
Source: msvcp140.dll.8.dr	Static PE information: section name: .didat
Source: sawindbg.dll.8.dr	Static PE information: section name: .00cfg
Source: unpack200.exe.8.dr	Static PE information: section name: .00cfg
Source: WindowsAccessBridge-64.dll.8.dr	Static PE information: section name: .gxfg
Source: WindowsAccessBridge-64.dll.8.dr	Static PE information: section name: .gehcont
Source: freetype.dll.8.dr	Static PE information: section name: .00cfg
Source: instrument.dll.8.dr	Static PE information: section name: .gxfg
Source: instrument.dll.8.dr	Static PE information: section name: .gehcont
Source: java.exe.8.dr	Static PE information: section name: .gxfg
Source: java.exe.8.dr	Static PE information: section name: .gehcont
Source: javaw.exe.8.dr	Static PE information: section name: .gxfg
Source: javaw.exe.8.dr	Static PE information: section name: .gehcont
Source: jli.dll.8.dr	Static PE information: section name: .gxfg
Source: jli.dll.8.dr	Static PE information: section name: .gehcont

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\npt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ktab.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\keytool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jli.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\wget.exe	File created: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\WindowsAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\nio.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jjs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\awt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\management.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmid.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java-rmi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\pack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\servertool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JAWTAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\klist.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JavaAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\policytool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\attach.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\server\jvm.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sawindbg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sspi_bridge.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\freetype.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\verify.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\kinit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2gss.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\lcms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\fontmanager.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FFE13236580 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_00007FFE13236580

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\npt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ktab.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\keytool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jli.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\orbd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\WindowsAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\nio.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jabswitch.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jjs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\awt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\management.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmid.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\tnameserv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java-rmi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\pack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\servertool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JAWTAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\klist.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JavaAccessBridge-64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\policytool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\attach.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\server\jvm.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sawindbg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sspi_bridge.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\freetype.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\verify.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\kinit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2gss.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\fontmanager.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\lcms.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

API coverage: 7.3 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

File Volume queried: C:\Program Files FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EF79F0 FindFirstFileA,FindNextFileA,strchr,FindClose,	9_2_00007FF650EF79F0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F15310 FindFirstFileExW,	9_2_00007FF650F15310
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D9EF0 wcslen,malloc,free,_errno,wcscpy,free,GetFileAttributesW,wcslen,wcscat,FindFirstFileW,free,GetLastError,wcscmp,wcscmp,wcslen,FindNextFileW,GetLastError,FindClose,FindClose,free,	9_2_00007FFE126D9EF0
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB91C wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,wcslen,_errno,	9_2_00007FFE126DB91C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB198 IsDBCSLeadByte,_fullpath,strlen,IsDBCSLeadByte,strchr,isalpha,toupper,strlen,FindFirstFileA,FindClose,strlen,strlen,_errno,_errno,	9_2_00007FFE126DB198
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DB5F8 malloc,_wfullpath,wcslen,wcsncmp,wcschr,towupper,_errno,_errno,free,wcslen,FindFirstFileW,free,FindFirstFileW,FindClose,wcslen,wcslen,_errno,	9_2_00007FFE126DB5F8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126D9C34 GetFileAttributesExW,GetLastError,FindFirstFileW,wcsrchr,wcscmp,FindClose,free,	9_2_00007FFE126D9C34
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126DA5A8 GetFileAttributesExW,GetLastError,FindFirstFileW,FindClose,	9_2_00007FFE126DA5A8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE13210E70 FindFirstFileExW,FindClose,wcscpy_s,	9_2_00007FFE13210E70

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FFE126DD548 GetSystemInfo,IsProcessorFeaturePresent,IsProcessorFeaturePresent,

9_2_00007FFE126DD548

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	File opened: c:\users\user\appdata\local\temp\E4JA75~1.TMP\	Jump to behavior

Source: java.exe, 00000009.00000002.2755858658.0000026E9FDE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wjava/lang/VirtualMachineError
Source: java.exe, 00000009.00000003.2747999662.0000026EB5FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: java/lang/VirtualMachineError
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Unable to link/verify VirtualMachineError class
Source: java.exe, 00000009.00000003.2747999662.0000026EB5FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: _well_known_klasses[SystemDictionary::VirtualMachineError_klass_knum]
Source: java.exe, 00000009.00000003.2747999662.0000026EB5FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )$T+com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2764538328.0000023DACE16000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000009.00000003.2747999662.0000026EB5FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3893713061.000000006646B000.00000002.00000001.01000000.00000009.sdmp, java.exe, 00000009.00000002.2750406984.000000006646B000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: &fSize of %s (%llu bytes) must be aligned to %llu bytes-2147483648vtable list too smallguarantee((*n) < count) failedC:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\memory\universe.cppGenesisheap address: 0x%016llx, size: %llu MB, Compressed Oops mode: %s:0x%016llx, Oop shift amount: %dCould not reserve enough space for %lluKB object heap32-bitZero basedNon-zero basedUnable to link/verify VirtualMachineError classJava heap space: failed reallocation of scalar replaced objectsUnable to link/verify Finalizer.register methodUnable to link/verify Unsafe.throwIllegalAccessError methodUnable to link/verify ClassLoader.addClass methodProtectionDomain.impliesCreateAccessControlContext() has the wrong linkageHeap{Heap before GC invocations=%u (full %u):Heap after GC invocations=%u (full %u): ,heapsymbol_tablestring_tablecodecachedictionaryclassloader_data_graphjni_handlesc-heapcodecache_oopsVerifySubSet: '%s' memory sub-system is unknown, please correct it[Verifying Threads Heap SymbolTable StringTable CodeCache SystemDictionary MetaspaceAux JNIHandles C-heap CodeCache Oops C:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\gc_interface/collectedHeap.inline.hppC:\workspace\openjdk-build\workspace\build\src\hotspot\src\share\vm\oops\arrayKlass.cpp[] - length: %dshould have a classguarantee(component_mirror()->klass() != NULL) failedmust be arrayguarantee(obj->is_array()) failedarray with negative length?guarantee(a->length() >= 0) failedshould be klassvtable restored by this callguarantee(is_constantPool()) failedA constant pool lockRESOLVE %s %s %s:%d
Source: wget.exe, 00000002.00000002.2643965268.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000009.00000002.2755858658.0000026E9FDA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650F0ECB4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00007FF650F0ECB4

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650EF691C LoadLibraryA,GetProcAddress,GetProcAddress,

9_2_00007FF650EF691C

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650F16FAC GetProcessHeap,

9_2_00007FF650F16FAC

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFB204 SetUnhandledExceptionFilter,	9_2_00007FF650EFB204
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFA944 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF650EFA944
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650F0ECB4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF650F0ECB4
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FF650EFB05C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF650EFB05C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126E8A84 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFE126E8A84
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE126E9614 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FFE126E9614
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1324D460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFE1324D460
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1463BDFC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FFE1463BDFC
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1463B354 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFE1463B354
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A46686C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFE1A46686C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A4673D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FFE1A4673D8
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: 9_2_00007FFE1A4CC6CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFE1A4CC6CC

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

Process created: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe "c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\bin\java.exe" -version

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/karakun/openwebstart/releases/download/v1.10.1/openwebstart_windows-x64_1_10_1.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/karakun/openwebstart/releases/download/v1.10.1/openwebstart_windows-x64_1_10_1.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://github.com/karakun/openwebstart/releases/download/v1.10.1/openwebstart_windows-x64_1_10_1.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650F1C6B0 cpuid

9_2_00007FF650F1C6B0

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: malloc,GetLocaleInfoA,strlen,malloc,GetLocaleInfoA,GetLocaleInfoA,malloc,GetLocaleInfoA,GetLocaleInfoA,strcpy,strcpy,malloc,strcmp,strcpy,strcmp,strcpy,strcpy,strcpy,	9_2_00007FFE126DD33C
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: malloc,GetLocaleInfoA,atoi,strcpy,strcmp,MultiByteToWideChar,strcmp,IsValidCodePage,GetWindowsDirectoryA,strlen,strlen,strcat,fopen,fclose,strcpy,	9_2_00007FFE126DD644
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	9_2_00007FFE13209B90
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	9_2_00007FFE1322F930

Source: C:\Windows\SysWOW64\wget.exe	Queries volume information: C:\Users\user\Desktop\download VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\3804 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\server\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6284 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\charsets.jar VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

Code function: 8_2_6646A23C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_6646A23C

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FFE126DCC3C GetTempPathW,_wcsdup,_wgetenv,_wcsdup,GetVersionExA,_strdup,memset,GetNativeSystemInfo,strlen,GetSystemDirectoryW,wcsncat,GetFileVersionInfoSizeW,GetFileVersionInfoSizeExW,malloc,GetFileVersionInfoW,VerQueryValueW,free,_strdup,_wgetenv,wcslen,_wcsdup,GetUserNameW,GetLastError,malloc,GetUserNameW,free,GetUserDefaultLCID,GetSystemDefaultLCID,GetUserDefaultUILanguage,GetStdHandle,GetFileType,GetStdHandle,GetFileType,GetCurrentDirectoryW,_wcsdup,

9_2_00007FFE126DCC3C

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Code function: 9_2_00007FF650F1A6EC _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

9_2_00007FF650F1A6EC

Source: C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

9_2_00007FFE126DCC3C

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	37 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JAWTAccessBridge-64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JavaAccessBridge-64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\WindowsAccessBridge-64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\attach.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\awt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_shmem.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_socket.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\fontmanager.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\freetype.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\hprof.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\instrument.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2gss.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pcsc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pkcs11.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jaas_nt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jabswitch.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java-rmi.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java_crw_demo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\javaw.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jawt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jdwp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jjs.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jli.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsdt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsound.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsoundds.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\keytool.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\kinit.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\klist.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ktab.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\lcms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\management.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\mlib_image.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\msvcp140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://xml.org/sax/properties/lexical-handlercT	0%	Avira URL Cloud	safe
http://javax.xml.transform.stax.StAXResult/featurekH	0%	Avira URL Cloud	safe
https://adoptium.netC	0%	Avira URL Cloud	safe
http://www.ej-technologies.com/shared-mime-info-ext	0%	Avira URL Cloud	safe
http://www.ej-technologies.com/shared-mime-info-extss	0%	Avira URL Cloud	safe
http://xml.apache.org/xslt;q	0%	Avira URL Cloud	safe
https://www.formdev.com/flatlaf/	0%	Avira URL Cloud	safe
https://openwebstart.com/	0%	Avira URL Cloud	safe
https://adoptium.net.K	0%	Avira URL Cloud	safe
http://xml.org/sax/features/validation&	0%	Avira URL Cloud	safe
https://adoptium.net.KT	0%	Avira URL Cloud	safe
https://www.formdev.com/flatlaf/how-to-customize/	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/dom-nodeC	0%	Avira URL Cloud	safe
https://adoptium.net.K/	0%	Avira URL Cloud	safe
https://adoptium.net.SG	0%	Avira URL Cloud	safe
http://www.freedesktop.org/standards/shared-mime-infoass	0%	Avira URL Cloud	safe
http://xml.org/sax/features/age	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.4	true	false		high
objects.githubusercontent.com	185.199.110.133	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://apache.org/xml/features/dom/create-entity-ref-nodes	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validation/dynamic	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validation/schema/augment-psvi	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adoptium.net/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6392000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D63FA000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080126000.00000004.00001000.00020000.00000000.sdmp, java.exe, java.exe, 00000009.00000002.2753759856.00000000D5580000.00000004.00001000.00020000.00000000.sdmp, java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://java.sun.com/xml/schema/features/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_H?	wget.exe, 00000002.00000002.2643965268.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/dom/create-entity-ref-nodesC	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/validator/dtd	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/input-buffer-size	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/datatype-validator-factory	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/validator/schema	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://timestamp.sectigo.com	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080358000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validate-annotations	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.formdev.com/flatlaf/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.00000000803E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handlercT	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/namespace-prefixes	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	false		high
https://adoptium.netC	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://openwebstart.com/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080358000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/entity-manager	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/dtd-processor	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/namespace-growth	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/string-interning	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/internal/parser-settings	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ccsca2021.cer0	wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.oracle.com/feature/use-service-mechanismva/la	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/dom/include-ignorable-whitespace	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D666C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/create-cdata-nodes	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://java.sun.com/xml/dom/properties/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://javax.xml.transform.stax.StAXResult/featurekH	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5EDB000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/stax-entity-resolver	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adoptium.net/java.vendor.url.bughttps://github.com/adoptium/adoptium-support/issues%d.%djava	java.exe, 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://www.ej-technologies.com/shared-mime-info-extss	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/stream/properties/reader-in-defined-statering;Lj	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://javax.xml.XMLConstants/feature/secure-processing	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.apache.org/xslt;q	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/xinclude/fixup-base-uris	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.freedesktop.org/standards/shared-mime-info	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6DBA000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/error-reporter	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/namespace-context	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validation/schema:	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/warn-on-duplicate-entitydef	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ccsca2021.ocsp-certum.com05	wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://javax.xml.XMLConstants/property/accessExternalSchema	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/include-comments	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/scanner/notify-char-refs	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/input-buffer-sizece	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	wget.exe, 00000002.00000003.2634144143.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/symbol-table6	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/dom/current-element-node7	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://java.sun.com/xml/stream/properties/ignore-external-dtd	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://javax.xml.transform.stax.StAXSource/feature	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080099000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/continue-after-fatal-error	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/standard-uri-conformant	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/document-scanner	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://objects.githubusercontent.com/github-production-release-asset-2e65be/187595602/0e11e7a6-f296	wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ej-technologies.com/shared-mime-info-ext	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6DBA000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://adoptium.net.K	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/validation&	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/features/use-entity-resolver2	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/entity-resolver	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://adoptium.net.KT	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D68DE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://null.oracle.com/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/generate-synthetic-annotations	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/allow-dtd-events-after-endDTD	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validation/balance-syntax-trees	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.formdev.com/flatlaf/how-to-customize/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D675D000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/namespace-binder	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://javax.xml.XMLConstants/property/accessExternalDTD;	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.oracle.com/xml/is-standalone	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adoptium.net.SG	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://javax.xml.transform.sax.SAXTransformerFactory/feature	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/validation	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080257000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://javax.xml.XMLConstants/property/accessExternalStylesheet	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/xinclude-handler	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/security-manager	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://java.sun.com/xml/dom/properties/ancestor-check	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833255121.0000023DAE397000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2824085550.0000023DAE317000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.apache.org/xslt	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5E8C000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080117000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://java.sun.com/xml/stream/properties/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/validation/schema	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://javax.xml.transform.stax.StAXResult/feature	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.0000000080000000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adoptium.net.K/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D68DE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.sun.com/xml/dom/properties/r	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.freedesktop.org/standards/shared-mime-infoass	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2800058108.0000023DAE8E5000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826224097.0000023DAE881000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2833378945.0000023DAE891000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2826098486.0000023DAE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/dom-nodeC	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D5F91000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/properties/internal/dtd-scanner	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.org/sax/properties/lexical-handler	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/schema/external-schemaLocation	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/dom/include-ignorable-whitespace:	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	wget.exe, 00000002.00000002.2644115460.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643595853.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2643618757.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2644315600.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634125563.0000000002B9F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2634064594.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/age	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.ex	wget.exe, 00000002.00000002.2643965268.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://apache.org/xml/properties/internal/error-handler	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2830419630.0000023DAE3FF000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3894460697.000000008046F000.00000004.00001000.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2799026905.0000023DAE340000.00000004.00000020.00020000.00000000.sdmp, OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000003.2822272851.0000023DAE3E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adoptium/adoptium-	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D63FA000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adoptium.net	OpenWebStart_windows-x64_1_10_1.exe, 00000008.00000002.3897411793.00000000D6984000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
140.82.121.4	github.com	United States		36459	GITHUBUS	false
185.199.110.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560171
Start date and time:	2024-11-21 13:54:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.expl.win@8/205@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OpenWebStart_windows-x64_1_10_1.exe, PID 3804 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with very long lines (363)
Category:	dropped
Size (bytes):	34826
Entropy (8bit):	4.8865268004683555
Encrypted:	false
SSDEEP:	768:L1T81qA68l1Za3GVgsKcHKcrOXL7cS4ZG6aur:L10cGVgdc8G
MD5:	73D7671CDB2EED1599677773C9165336
SHA1:	5375D97BF158F9CCDF8395DA3A1F227D4BFA1AEE
SHA-256:	D84A32D4C804EE6A9A7F9661AEAF28D77EC8498F9FAD0C107E6EB05587E5AF95
SHA-512:	69E207A67D095037EEE45B57FD41B6159C126B63A4FF9EEF49CEFB22CEDAEAA36506F2C2404DB89ED1AA0E11B1EC5356C925AC014F3E03B9BECED057B4545792
Malicious:	false
Reputation:	low
Preview:	SetupAppTitle=Setup.SetupWindowTitle=Setup - {0}.UninstallAppTitle=Uninstall.UninstallAppFullTitle={0} Uninstall.InformationTitle=Information.ConfirmTitle=Confirm.ErrorTitle=Error.SetupLdrStartupMessage=This will install {0}. Do you wish to continue?.LdrCannotCreateTemp=Unable to create a temporary file. Setup aborted.LdrCannotExecTemp=Unable to execute file in the temporary directory. Setup aborted.LastErrorMessage={0}.\n\nError {1}: {2}.SetupFileMissing=The file {0} is missing from the installation directory. Please correct the problem or obtain a new copy of the program..SetupFileCorrupt=The setup files are corrupted. Please obtain a new copy of the program..SetupFileCorruptOrWrongVer=The setup files are corrupted, or are incompatible with this version of Setup. Please correct the problem or obtain a new copy of the program..NotOnThisPlatform=This program will not run on {0}..OnlyOnThisPlatform=This program must be run on {0}..WinVersionTooLowError=This program requires {0} version

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_0_1mu2pq3.utf8

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with very long lines (363)
Category:	dropped
Size (bytes):	34826
Entropy (8bit):	4.8865268004683555
Encrypted:	false
SSDEEP:	768:L1T81qA68l1Za3GVgsKcHKcrOXL7cS4ZG6aur:L10cGVgdc8G
MD5:	73D7671CDB2EED1599677773C9165336
SHA1:	5375D97BF158F9CCDF8395DA3A1F227D4BFA1AEE
SHA-256:	D84A32D4C804EE6A9A7F9661AEAF28D77EC8498F9FAD0C107E6EB05587E5AF95
SHA-512:	69E207A67D095037EEE45B57FD41B6159C126B63A4FF9EEF49CEFB22CEDAEAA36506F2C2404DB89ED1AA0E11B1EC5356C925AC014F3E03B9BECED057B4545792
Malicious:	false
Reputation:	low
Preview:	SetupAppTitle=Setup.SetupWindowTitle=Setup - {0}.UninstallAppTitle=Uninstall.UninstallAppFullTitle={0} Uninstall.InformationTitle=Information.ConfirmTitle=Confirm.ErrorTitle=Error.SetupLdrStartupMessage=This will install {0}. Do you wish to continue?.LdrCannotCreateTemp=Unable to create a temporary file. Setup aborted.LdrCannotExecTemp=Unable to execute file in the temporary directory. Setup aborted.LastErrorMessage={0}.\n\nError {1}: {2}.SetupFileMissing=The file {0} is missing from the installation directory. Please correct the problem or obtain a new copy of the program..SetupFileCorrupt=The setup files are corrupted. Please obtain a new copy of the program..SetupFileCorruptOrWrongVer=The setup files are corrupted, or are incompatible with this version of Setup. Please correct the problem or obtain a new copy of the program..NotOnThisPlatform=This program will not run on {0}..OnlyOnThisPlatform=This program must be run on {0}..WinVersionTooLowError=This program requires {0} version

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_10_1mu2pq3_wnegrj.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	122818
Entropy (8bit):	7.99002475746015
Encrypted:	true
SSDEEP:	3072:UzLGcUxFmCd96pXj8IvUg1oBBMdi3AJ7XKDOk00MuN9kjr9:GycwECA9MGoB0iwVXkOkcuNCl
MD5:	825818C2E8112C2D85F63666ED66C092
SHA1:	A518E7C9F8A98DD5721BE9CC445EB81350F7E9F0
SHA-256:	FA8D10B506D6A98C309815822D00746E75762024B5781F9CE4A8F288F40E60A9
SHA-512:	F47D75992E66F7BCA35E3827FCED748E266868D7CB9F9F39E8529EB8A3D1E16A6F36BAD69302A36491948C0D10AC93365439FC894030D1AA8902CE48581390A0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............x.... .IDATx..}..mUq..D@.""....1v.h..Q..`L..Xb. &1&..h.EE.(v.X.`lX#v...XA..A.Js.....;3.\|....{..\.s.Y{.5..Y.R..#.4..M.lO.n..F..................tL.w.....y.[.....~..'./.pIIw.......];N..FZ.4...FZ.4..7/.n.`..wg.7!....l.&.....&...p&....3......4.FI#..i.5K.....[..)Z..L.K./.....Y.H.4.Hk.F.0.H+C..........v.p'...p....DW.8.......).~..t..\..3.H..F.0.H...p.+......;..r..B..8..I.N.........>.H+F#..i..t.........U4.M.~[Utu..\|...V......F.....4..D../.......i?..G....)..x._/..F...#..i.9/.......n...H..]S......Z9.8.H.%..`...6+..C.<......H+C.,..8._(..+..ic.....1.d...E.?........\|......#......F..i."....Q..H#-.&q......0.O...A...F.Ph..v.....c...V.&...p,.O...G..h..#..4.........o.t.o/..._..\\|....2....q.eW....7........*\..?..+.............kq..W.9MC.%....K.'Or...o....Y9.8}..n..6.d.l....~.\|.M......7..[mq}l......[..[...n.%nt.p..[c.m7...#._..a../w .4.zG#..i}...<......y./..w8..q.y....].s~s..:.B.{.oq.o/..._../......gO-:.TR....9.O...4.K...}K.k..FJs.2.T...2p..$.x

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_11_1mu2pq3.txt

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16268
Entropy (8bit):	4.654349029302555
Encrypted:	false
SSDEEP:	384:ThUwi5rpL676yV12rPd34ZomzM2FR+dWbE:TmFWixMFzMdT
MD5:	A6E0799BE57B9B4878A548A59F2B8B05
SHA1:	BC0A84F0F7AA4DE4022B58EE201B26D6E2B35FF2
SHA-256:	034D77656BCE8E5B4FDFA75B5CD837F82E47EC66D9EB4409E12FDF0A714FA432
SHA-512:	4DDAED36E51F49F9F8BDA1B528C86D3D9822DDFD81FFEDA0A7B9E8BB28A1C68CD26F4BED09287538A9491C1009842BEC4D3FD114E0BEC05D9E6EA11E628D672F
Malicious:	false
Reputation:	low
Preview:	GNU General Public License, version 2,. with the Classpath Exception... GNU GENERAL PUBLIC LICENSE. Version 2, June 1991.. Copyright (C) 1989, 1991 Free Software Foundation, Inc.,. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.License is intended to guarantee your freedom to share and change free.software--to make sure the software is free for all its users. This.General Public License applies to most of the Free Software.Foundation's software and to any other program whose authors commit to.using it. (Some other Free Software Foundation software is covered by.the GNU Lesser General Public License instead.) You ca

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_12_1mu2pq3_1l2apw7.ico

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	40430
Entropy (8bit):	7.989011554264237
Encrypted:	false
SSDEEP:	768:6O2JejbUnzfJ+kxTVdUkGU6AwmVftnlxOMazHLqOiivXxHaHrs4bQUUDqHsnxK:6OsoifJ+SVdUnfmVfZOnzHLqfivXdmrZ
MD5:	927CE2FE08765D4443868AA1E8B5C726
SHA1:	A11530D72A569E0C4294050799E1191C46BA5622
SHA-256:	3B11FF9908597B399C4D669A7366F5939F076363A88759DD509F93987B99F089
SHA-512:	61ED14DFF2B3D3A164D8E85EEDC493C5706A3CE2F6E7CABD9955AB1C8651AB59E8FD5C69D897C67B55DA9E78AAB8E32E6E55AE0EA0701765B4A50C420E343F07
Malicious:	false
Reputation:	low
Preview:	............ .........PNG........IHDR.............\r.f....IDATx..w.]Gy...{...bIV..-.{.aS..`.@.....H.@....5..c.)6`cp..r.l.V.mW.{...s.3..].,Y......33g..y..Q..~CZ..c...4.#...8`,0..._......z.....(..q}}@.....;...........`#..X._..:.^...=T.4@.\|S. .F..0..`.0...L.&...0.]..U.......#...k....`9..#..1.fP0.4.F......a.1...a.,`&0.......J}..`...X.,.../..0B.<(.^}.\|....._..b4.\.h.H`.F.7..y?.#...K..g..W..hP .}...@.......'..c..p._. Q/.......Oc...t.........................r.L_.L.\.\....(.ud.!..SA)P..@..(.......E..E.U.==Y.0..S.C............Q.$4}3.?;.;........T.....^..w.y.v6..`.....u..............zz......r,.J.2....b.W.V.P[SMmM5.u54..3......ondhs##..a..!..1..M....P_[Cu.n..K...3....K@..Z....Gr7P....t.\...y?........ttu.......Y.~3.6lf.....u[.....0w_..>.J%29..,...w.P:....R..j......fXs..F.`...L.3.I..f..L<h4..i......J.7....w.wcp..AA..ip.w...?.8........^kMGW7.[..x.:..\.U.Y.z=.7l.....nzz....R.E....u...y.<A\.<?...!.D+##tR:..X=._E]m5.u.47.3.QL.8....3s.xfN....Ch...U-^.`.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_13_1mu2pq3_x7nby6.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.5449883730924245
Encrypted:	false
SSDEEP:	12:6v/7QUs4w69XwECnCixg4LCbAInPY3IL7/a4eJtDaldry++zmB9CKADyXDxGx/IN:jhP6GEzNpb0K24atmHUU/mS1GxBJPND+
MD5:	F6DFE7474B27F1D3EADF2E2FBC22C255
SHA1:	92705F0C3ECE75FA49B764D305F6DAE4AFF9D224
SHA-256:	AD32F1717727377B4BB48BC8320E8E1BF87FF493FAAC1D17C554299A7D128C08
SHA-512:	3488809DB3696B07DCA2F1CB88546BD56244FFFD096B5A743053C9B1BD3AA8432676A9EE1349861E8F649C75A059FC0CEA4B3797A77A9C5EB781F5896FC147E3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a...$tEXtCopyright.Copyright 2015 INCORS GmbHz..6....tIME.......b.2.....pHYs...........~.....gAMA......a....SIDATx.SKhSA...y/.....%..E[..TD.7..Uq'.`[..t.V].....JA....nD..;....b....y...y.T.E. ...{.p....U.^..v....x[;.z][....mRo...6.SJm.^......=X9....~...0Q.e6=. ..<.[..7..t.(E..8PB.6.....R.qTa.....!..I6.'.R......nV.HkY.T.HN.v....d....:.qr.u...T.i.............i:.H\|.(..[wU.....x;hp8..""'..U.u.!.....Sk...z..........."hp.\.......I..."./.e.a.pd..lf.E/...'....a2...#9.{...X....p.:.~...f...Kf..f.].[......;.z.+..x..>-%..Yg.Y.X%..cw.Fy..Pk...@N...x5./kmT.Z.X......GZ..FE..m.D...q........X".....]]...ss.........R....L.nf.``.....$...9x..Es...1.@V.E.Gk.q.\|S....n..}D.-.k..?.y..1r3./..,n7..g^.r,.<2....IEND.B`.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_14_1mu2pq3_vd2dea.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	7.757480708460143
Encrypted:	false
SSDEEP:	24:+IUl1fq1s+02JleRZgOsGCEHekt5UaOZBgjSeTyQQuhQ:+IU/fZ2ze4XW5Ua6BgjVvQ
MD5:	5601E8E5929BF07F629EBB1810C53718
SHA1:	012C9F5D802A23A7097BB965F7E47E17B26E210D
SHA-256:	954D66D6A6FC037AB3C16009B479A233006023FC5D4A3CF073B241F75213D895
SHA-512:	68F98F6762214F9567587AA9A90114A62475E9F83B85D31E2B3D8F3561AEB05B39C1379DF10F533F80806419EA31940CD943060E3D8665EE8D1214E7C291B204
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz....:IDATx^.V.KSa.7.U77...Ms........AA.+.EB.... .....0..4+.....K..2...DQZ.t...;...w....^B.K..s...s~..9gyy.?9f....rT....k5...Z..Zmk...B..sP..... @....g.r...s).A@vg...5../qj.I...N8.v.D..$....]3..u[c.)..M....6.....\|w..........X~.'w.M$;..X........X.A..vAx.0^.a..paJ v.(..nr...8_.4........_f)..~!..[....G..U.F..)`.....$..z!...s......`zDI.o....d.A.O. .n..B/.....b....z{..(W<......xMq..P..3.&..L...!..dl.6^..l.O.@....]q....w.....B.....].D.v.t........H.........V.yK j.9...a....@..j..5.Fe.C0..(.$..E.ji..<..UW."H ....,...<....:.'..;p$..\|....}..l.O.q..!rR......?........i..J.....\..r...X{.I...%z..$.+.F.....V.t..T.S..<.d.X..'T..............h:].^!.!...q.-..5..D...\..T...F......'z,...A.8[..X.xH.`..i. `...U....!.@I.u..H........._b.t.GWd..%d.....A.J...A:c.1>.b.........@..R.)...Gq...}8..\|.b.!..].~....1i...!....O..I.....`q...$.U....x..RB....!...Xn....t.7..........j.....w.yI../m..:.5V>.zMDZ.hxF.\|2.^....nI.x.....C.2.9.j...D. ...

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_15_1mu2pq3_un9apv.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1884
Entropy (8bit):	7.849657857097283
Encrypted:	false
SSDEEP:	48:G7Z8bi/iDnEug/akdcfH5i6qGoADy0iXkJsH1UYUN1udNQ:qZ8bi/i7cSzfH86joAsXkJsV1Qd
MD5:	CB38F4B80A9AF329236D14AC8D613033
SHA1:	754C97FB765A31837DA76CE26135545C178630CC
SHA-256:	A8A3F5A384556D488EF854676879E8EDA3D1D357C8C733BBC692523D80FD702C
SHA-512:	6F77B7C27F46796330A82DB7D611D0FEEBB2DDE9C1FEA1C89B01A23EDD0606F359E4AB2FFCA2A9E76B4D8EB3C694DBA388859E96A0D24A37079FC8C9826E8F88
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......IDATx^.X]l.U.^Kk.?-..X.._....M0hCH.1.A.Z..>h4.h..........]....O.n....&...4.....g.........;3{g..N.3.mB...........^.........4H.....f&(.R.....;'.i.`.....s..S.D H.H..N...Y....$..f....y...&'.e's........H.8.....(..x&..6.s.{+.%kO7...9`6...w.$;R.....4....YHnuG.'=..C...B./.....N....h.............=.f a......L.@.....s..........3.-.81......Oq4..C...H......#.H...3i..t....hI.7iH.. ...l..1V....l.....j.\i.H...-...#..\|.!V..o...."R...Bze.h..rx...u....:....s.O.x..{E........V...s.1z>p.:.G./..f....1"...\|.).%.JR..F...;...9..zu.Y...X.T(..X..T.%2..k..P.....]m.B........ya.ta(uo..`..!.aa\|........x..n....`.......I..'[.....%9..a.....UB.O../h...e.e.@,.J. .WQraW.x...2..j...... ..jX\|xX !3..1'....%..z........\....u..MZk...i..".DUx...N.....@..A/oH..U....n.[3/..Z....Mx......4Q.H..MpJnq.(b..x..\+z..D....0U..........P..`o6.z.(o..5....H...Cr.....&...)9's.D.Ga..B.J?.d.r.\>....cN.).d#_.D....gg,0n..$.$#A.$!...h..# ...# .?.....r:....eN.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_16_1mu2pq3_1xth8wx.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4609
Entropy (8bit):	7.914321232819983
Encrypted:	false
SSDEEP:	96:xiIWSFsEnQHHtd0RjMvWDhBjowqCCDS9Y54eQt5U/BNCaU6kOcyr:xizXEC6RjMvKLCDS9BeQw/xca
MD5:	262F0C8BD3D376B56692F7DCA8F4AB9A
SHA1:	145E6287AC1FAF1AB9F7113BA5034CE3A59057C0
SHA-256:	213A468914C699AC60F85432B38478BD1DB7C07B7D5D69B6AA52F90FA4094752
SHA-512:	44C50B39093F00A21E6640384B92AEAD5268277BC2302D2A7C36C2502DC189BB15AE6F5A17C9A8AB4687940ADB025FB1A5CAEC0FAAF1CDD570C7F8064419CBCB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............>a.....IDATx^.y.\E..C.d..fC.!7..r(......@9...J@..T(H......,..D..&{esc...p.`...A1(7.....F?...d3....7of.........~....!....E."`...X.,.....E."`...X.,...@I}..3.Tkf.(.....KE...@...G. ...0..5.a..Dp........!..D..l.......'........`...@L.?....4..H(.......[N@..P.1..8..[..@@).>.. ....[F.... &.;.h.5)Y.........g..0......m.s.............i.. ....O..I?.........@L.?p[..]@.p-...n..+..7.$%.....n... ....D..ts..&8E....D.=......(..9.3\|.I.n!=DZ]....-.m..}...a.;..E".`....^.\|.....>r..-h.pxY..e...^.....yR.E.S....3.?#......8B.k...... <Q.NE...6.?@.y..!.w...#.6_.S...$.7....N%=L.o...X.7..?ja......&.ae.[.C.....Z.......[.z..#>N...n...Dp.....hB....E-../n.ij.o.J....I.3..~g....L.$..K..$. .../\Y..}..]).W\.=..jK.X^MU...r."....$."...t..9.-.)%WUxi}...D..........`....A.!f...5..W.s4(.....rF....;.n}.gD.'"....H.@4X.[.:.T.I.......#...\...u.....:f....%.....S......'.\c.......m3........?..Myrgh.....PNe+}{r.Hf....I....S'...\|~.:.....e..D'...-...\|=._.6..8..I..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_17_1mu2pq3_259ij1.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	7.915341695730156
Encrypted:	false
SSDEEP:	192:rThdpNi0Iy4J8o2aT2c7j1aeZ8BnPGazB0+r8OIvVmgfa:rThdpDIy5o2aT2cl+NFQ1VE
MD5:	3DF21A5C9E9ED0749F00BA1A4EBC2B21
SHA1:	39E74224B92CA3F3E9FC166D438A1B6623DD2561
SHA-256:	CB78EB088384FA5B98F08879D914AB5388E54707ED267A569E5FDEA16588913A
SHA-512:	7173AD64F0162192F2B735230F744BC89D0A0B24F490C694438CA98E5DE0B8A8440AC03D02D28BA93F3AA4DF5389A6C328552CA528C38AC74E6EE155D2E05EDF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............\r.f....IDATx..].t]U.N.f..6.-.h.{[...( ..X."....O.@...y.....=.c.....f..:..7L"P.+..q@..mr..M.{O.mx.II....9...[k....s.....O;-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..x.<..-...0..5....p&..\.......0&.wqF..D.......0"..1.......@. ...`L........@. ...."@........."...."@...........F.&..E. .....A...c"p+g. L....A...c"..".a..P...p......7sF..D.......@. ...`L....K.&..E. ...1....L.&..E. ........6g. L....A......0\..D.F.<A.(.#".."@.....%.-~..0Q.(..a.....n.. ...."@......\./B.&..E. ......q...A.(.c..E. ......VT.Y...\|.............),..1^..{...I..v....<\|].w(m....xy...#.G......btd.......BVu..u..c\._..\qS...yd....Yy._\|...j...........Zy'..."PT.y?D ....<.0b.Q.._...}.U....>U..)'.R....f........-...:.9... ..............D. ...}.........QX.YY.>RD.9..../.$?...g ...s.G\.A..........X..K.Xc.... .rkC..4Ef..6.'vO..b.......K.'I."..........3.l.Lxl.Q..]..+.._8k}4...}....0......./M{WY.... .....Cc......pwq]x........Xtw`...;..G.%p.C..S..4DsjB...#se.....=8..$..y..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_18_1mu2pq3_1w6mnzb.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 79 x 53, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3542
Entropy (8bit):	7.934758139281033
Encrypted:	false
SSDEEP:	96:Gv6AcFWY5n6Q4sBthggrDuqsbQl0sAH9V:OcFW864HhggrDTcQ2s+9V
MD5:	ECF60155174DA406082F3D3340155716
SHA1:	4B58A69AD39BB0E392484298F0D4BBAC522A9769
SHA-256:	8B6BCB4116ADFCB5F6733C7C37BB95A8EEEC84B21122C0FB241AFB2A84CF3348
SHA-512:	2771F0E31CFC4E848F2F8545AA310CC7F96799FFA1AC33F531A7572F6B1516CB3D5085C911E807D1EADDD06EB0335D28A5D3CD589247111DEED371AF22CF285F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...O...5........!....IDATx..[.T.G...T.#. .F`.x Q..(.x."......c....q.h.7..1h.@.(Q.BW%...&..QT.YTDP.s..UuOwOO.GO...]U]]U.....T5^..z&..eYS...@?.....h....#..>."...\... .@...F....<....c..M<...\|..........vI...+hE;.k.4w@k...vwA......t.3.....(~.A46.Z.......T...N"..........s.M........:.ax.....Z.`=.e...d0..<...6&...e......0.MqTR..4c0h.+K...F..qU...X..j..y......o.......t[...-...............!A..&...=.......V.[w)t.u.P+.2V......+......&.........g.&.f.........Q..I.Cq....de...#.@...8...z.S.^.UO.O.......3.../K8ey...I.$y....SB.0z`/XZ4..gs..e.J....I...A..R.-{.=5d0)Z.g0.gH..#....b.v.8..XNT.K...[.._.w..v5(.Vx.C.Y.[wKi;.+J!...qG.&.#.....$oW..z..q._.8#bE..\J.P^..y."...............L..'.\}*.,...k7...J@N...........f{.N>FU.a..e.<.......~..O7Z.j....Y...{.t..Z....%.B.;.M..p.D<.dJ...y0......8...+.X#....F.7.........U....h.RF.YS..g.?A..N..MN%(/0!.&...@....2....a@g......33..KJ..{..m.1...c.VXI.,.....p...O.8?5.22.x.Wn.m....B.}...3.....;bd...@....z+..9.....kj.G!iZ.2I

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_18_1mu2pq3_1w6mnzb@2x.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 157 x 106, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9279
Entropy (8bit):	7.9747882188939005
Encrypted:	false
SSDEEP:	192:MxpGlsUdQ4meCLnC/bCjRJpLXaYFRPx/ixPObA:oGls74meOiCv4mh9AObA
MD5:	9FD62E0CC34F2C3523137EF3C275DE9B
SHA1:	8A5DDAC77423469F607C110EE8A59F18AE027185
SHA-256:	7074AD997EA27FC69149DBAC99C6BD0FDFE95BD51D31434F554338C1153E513B
SHA-512:	DB664BA78BCF6321B80EB1386951875A98A4277DBE02B880C372342DD0E4FD55B9DF944282EA0BD762B09432861C09688F6719F9BE7716839C50847F43F6B842
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......j.......Sw.. .IDATx..].....~C_@A.\A.H.).""U.E.........^.ET...4Q.....Y...{.&E.4..l;...Lf.L..Y..s\|<.....d...$. ..". ..". .."H)H.Z.R../+..G........(. /.\|.r..j... ..E...N.8k......?......GH. 3.....(..Q..S....6.8.`.....#B..........%.ll...N.......+8t..._..KW.#.V......d..QQY.7.].s.](.@A.....77...u....I=&...X..T.. B...#Zk..n.c...X.e7~=.;..?..W....7..g...Q.R..J.-....A...a..i.fX.0].!].....Z](..u.v.~.]...\..p.n..tr3..=w.D.:......A..:..O.0&..$B...3...P.=u.sVnD...`...V=..@.......i..5.....V...E..P.dQq.!..,..)".K}T..l;....k09z.n3}L.g.7....M"j1....\...IA.}.....Q-th^..U(-.2..=....".K=d.$E_X.mR.J...mK'~W"=..?R....1.^@y...z..6r.&O.}.z..p..k2.....vCEH.:..`..b.4F..c.@\B...D". ....L!!...C-.hT..).\|......6G.(.2...7..J.....u..X).v..13.}.a..M.e.......JtB9.;......%.SF:......{v@....o...Z..!...=....?b.....50..E./u;"X...+"u....$.U...}.uc....2f..K.k...m......-.k.#....c.~.~....y.nT.".D..%..... ..l]o"..2..c...]/.@S...L.EH.r....@...w.!.x..)\..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_1_1mu2pq3.utf8

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	4.358106932062268
Encrypted:	false
SSDEEP:	12:0mFM0JSrJTXF7Sb8OmFdQA7HCLTXFMiCzVClbPCgIn:0m20JMb5w8tFYLTXFMiC+P3In
MD5:	EE120F1CA54A2CA5B56C19B77BC63EC1
SHA1:	BAC66F83D5A234DCC554A372DBD46A8694B4396D
SHA-256:	F452734A2EDEC2D79CCD30B52AF092032A8ED52E6DD9418FF3B7BBB10256D3F1
SHA-512:	836DAD9178E34428176FD94627D5BE8C98A5830A36905F3F9CD9485F0BB5D2AEAE5F31BBDF494E8DB3648B26D5B6F7316EBC5B344E95D08A3742B09BE230E984
Malicious:	false
Reputation:	low
Preview:	user.mode.title=Please chose an installation mode.user.mode.subtitle=This will influence the privileges the installer requires.user.mode.message=OpenWebStart can either be installed for the current user only or all users of the computer.\n\nInstalling for all users requires administrator privileges..user.mode.single.label=For the current user only (default).user.mode.multi.label=For all users (requires administrator privileges).

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_2_1mu2pq3.utf8

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Unicode text, UTF-8 text, with very long lines (470)
Category:	dropped
Size (bytes):	37408
Entropy (8bit):	4.947847135291103
Encrypted:	false
SSDEEP:	768:yQ75XU/ZdWPifvPVPQCI7hZ1huv6Bb/5qktfPyv0K/NktNj6dsPSDlPvOQzEC6eq:ymU/ZdWPif3Vo1TJ5GRlk+dsPSDlPvOn
MD5:	2E76C31CA925ED39856D1E1718F45F98
SHA1:	05D0DB33FE4406F047948F05308D020D7A6443A1
SHA-256:	4DB909FF6EB7371DDC79D8100E97F105ADA79ED2B5DF71D043DEA9083CDE7781
SHA-512:	FBF9CAF7ECE3B7057AF8B221B5C7F4FDAAF6EDC3584EC55246BA4CAB75C4B49E2CC9A2963BE5CF5DD68377B118F7948D67497AE9E28A57F53B6A1AC94AA4D051
Malicious:	false
Reputation:	low
Preview:	SetupAppTitle=Setup.SetupWindowTitle=Setup - {0}.UninstallAppTitle=Entfernen.UninstallAppFullTitle={0} entfernen.InformationTitle=Information.ConfirmTitle=Best.tigen.ErrorTitle=Fehler.SetupLdrStartupMessage={0} wird jetzt installiert. Wollen Sie fortfahren?.LdrCannotCreateTemp=Es konnte keine tempor.re Datei erstellt werden. Setup abgebrochen.LdrCannotExecTemp=Die Datei konnte nicht im tempor.ren Ordner ausgef.hrt werden. Setup abgebrochen.LastErrorMessage={0}.\n\nFehler {1}: {2}.SetupFileMissing=Die Datei {0} fehlt im Installations-Ordner. Bitte beheben Sie das Problem, oder besorgen Sie sich eine neue Kopie des Programms..SetupFileCorrupt=Die Setup-Dateien sind besch.digt. Besorgen Sie sich bitte eine neue Kopie des Programms..SetupFileCorruptOrWrongVer=Die Setup-Dateien sind besch.digt oder inkompatibel zu dieser Version des Setups. Bitte beheben Sie das Problem, oder besorgen Sie sich eine neue Kopie des Programms..NotOnThisPlatform=Dieses Programm kann nicht unter {0} ausgef

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_3_1mu2pq3.utf8

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.560363282360877
Encrypted:	false
SSDEEP:	12:0RFT0EiK2/38GlYnXVBif6XEinrSsM2Dvz1YQNnBqv:0RuEiK2/38MYnFBif8JnrvM2zhYQNnM
MD5:	4E821681C6F16D22D5529977F0B64596
SHA1:	1C33AB2B6E04DB558EA225808D988D0792C92FB6
SHA-256:	14E9EBE5EFAC61CE1A44F0504F0F9C09FB4A4309C8D8DAF75E89792112C0E558
SHA-512:	557E37AA4B4C5BAF77CDEB0F4FD639B95C9ADB5A1E97978A96884849C379DF4B5561FD8EB07653A1904B8C22CE47D043E5C916F03A3B56FD06A198B14A2361E9
Malicious:	false
Reputation:	low
Preview:	user.mode.title=Bitte w.hlen Sie einen Installationsmodus.user.mode.subtitle=Der Modus bestimmt welche Privilegien ben.tigt werden.user.mode.message=OpenWebStart kann entweder nur f.r den aktuellen Benutzer oder f.r alle Benutzer des Computers installiert werden.\n\nUm f.r alle Benutzer zu installieren ben.tigen Sie Administratoren Rechte..user.mode.single.label=Nur f.r den aktuellen Benutzer (Standard).user.mode.multi.label=F.r alle Benutzer (ben.tigt Administratoren Rechte).

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_4_1mu2pq3_1qcjq5g.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	659
Entropy (8bit):	7.625865525678373
Encrypted:	false
SSDEEP:	12:6v/7tAtIEqVfUKKfoL3NHlJaxrjqNdGoY2JcJU09ukH3MPPC6gVNPg7NqqAr:waIFkAL3NKxiNdzHav9ukY0VNPg789
MD5:	8FCE853B4F75C36BA74F59598B9F3416
SHA1:	F20EF20781C99E7A0A2F2EEA106C731ABACD74C1
SHA-256:	82EDB2058A84503519244B2624DD46351DF2D104C5700BE234099EE8A7A4865C
SHA-512:	CD548511E344F9E5235C6B082CFDBAF93F244F82748203AF9235EBF31F5657C28E0D9031689631846F28E4AC08706AE049805397D157D3581095C1AD21CA3019
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a...ZIDAT8..SmH.Q.~.1%X.o.[A.. ...5h..J.o.H...j.pF..".....W.t.~X.....}h..L....M.M%.B..y.....t^..}.=...s."........\q}.....@8..j..qi......I3...9.uS.L...=...........}.........B.....2.....p.A.............L)...Q..F,.G..A............nR..[$...\|...."Qf..A....J.d.j...6...B..s........\|.......~......2.H...N.JE.....V.Il)..S..x..gf-#.%..#.L..........r....0.m.Y:u^........t...A..A.W.ydHB+..t...b.. .4Z.q...iC.Z.uk5.6hK70#..F,&=(.......w.........q......P_'_..>h...F....IsCS.J....5..{..es........@......[(G..`.1.\|..a.?..p%.......]m.....d"&..M............<}...89...8..m..d.....`2Tv.p..52.....7..L.;.~.....IEND.B`.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_5_1mu2pq3_14adzqr.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	7.8522189812086465
Encrypted:	false
SSDEEP:	24:p04zysjjYT001L/vDPPmuS81Ylgu+ocy1XmdfRM8QgsAkGjwZ512FrsbeP+M59l4:ysjcAavDrbaanonXUhQgsAKCsQ59lt+Z
MD5:	970BBE75F9833D5B0135CFD10375100B
SHA1:	55346EA10453D9F74F5E73C24759178F83E18455
SHA-256:	259CAFCCD0BC2F4539EDA378555AFA3F01832CB2D40BFD36422ABB4495354AD5
SHA-512:	C5F92F36BB6AED0A42327683ACD3DC0694F0970DF49754583419537B1D40EBE0AF09432B6BBBED9C732EA4EF91C3A854B0913219B81BCB5BB04A556695A38066
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....IDATX..W}P.E....x p....c.....`..."2"z~ Z.&...M.1........f...."...Y.GdT..d.".....p.w.n.{w..w\|....{..>..>...!.=...b.L.0.......O...p../...x...=!0.@...g<........oF...)x.............7fM....l.....P.....>}WI9.......N.RB....0/....d.....H....Y.U!....auI..M..U.#i.L.4.......@.._..... v.e ....H^..OS.\|.`.....p%=;_..Xy..\|O...[.-i.-...4X..2..7\|}@........+f.Z.8S..Nh....S..d......=.5Y..-...Z#.>...".r.. ..<.bI..,...{...A.a......>(]].f.U..-ylg..\|.9.I..pw..7..7}..JW..g3...H..F/K.z.v}..n....P.......C.4.3./p.N.."".Z..C%..r=.e...4k.....$.o...E.v..T..bu..HZ....yGKQRq..S...M..X.s........-.O.hv....8Y.b.M.M.^.....5...G.....$Py.*..Q...I.j.).....!._R.....P.S..M.H..(>].#OA.!.......e......K..DM.....l.,.8"K..[..!...h....(..6..n..?At..i.......#.B]....m..F}i......6.)..4.g..G=..f9d..5.j..D.h4`..'T.}X...}!.........Y..l...A..6':..F.F.y]...)@.. ....B......K...'&#D..&...T.....J.F..#.bS..A.\|..LL&._..E4.e.Q....W..A...GK...1..E..d.P.at.......c...

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_6_1mu2pq3_1bf9cql.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.919509671227736
Encrypted:	false
SSDEEP:	48:VOhSHASn4ZBPx/orH6N4ICddOCsakt2LvWzRrZ+oI4UUgw9PUxv5wNYVX6lViLrt:3K5xeaNEdQCsa7MRrZHZFq5wNCX6l4kg
MD5:	A01E559736669075B475621B3954E0E6
SHA1:	66CA0E173EEF4AD8C9805094466ECF8AE597922C
SHA-256:	10BDAE568A334CCCC56A4E0BD2279F40FD4956EA817E1C5A7EBBA12C9BD78CB6
SHA-512:	E82CFCD376F2D9A6903498D63F48C7AD48717D1C6A37D3E037B5B3011B4A95E5F86A7DFE6F6E95761D7585C3FC94E0206FC6FE151E003A2D6A4A1AEBF44E8544
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W......nIDATh..Z.tMW..N..x$...D...1.+3..E.........mS......w...D;...W.....R.E.#D.$....}.Y.....9.....Y7w.s...........DQ.s(m...........X.]...@9...N.(...T..@....F.....1.s..QR^....TV..T'5l..6...n..amZ.G.H....&.........4.Z... 5k..}GN....X.6V.G!....{G.......<....G.J......`Yfv........U...+....q#LJ...S.>......M..zC.......Q\|...K.A.y......u .M~.)......... ...s....u..x"T..{."^.G....b.Dr..4.........3w..@.)7.....].%.>=:.&0...3.\|.wC7.S?..8}c.(.l.vZ..u."kE4.3...:I...E)..<x.:%a uY.........(.....OHt...OE.O.;..8I......jY..ls.....F}.......s...Q.#.@J...K~"07......y...d...+....#.=K2v..?z.GX...\.Q".~.3..&s..}...(.'0-3........\...f....(kE.g..&...&b..g.Q........]TrS...\..@..S.\..=...r....:.._T....Y.F.e@3........O.8\|P....ZJ.d..i`..{T.i.....Z.6..Qa....G..!.sO..x...T...lir.+...P.X.v.x.G.MZI......8.R6.}..W.)...7......X.[..a7?...1D..7..E...A........F.......bym..n\...Z.;.....1.5....:..w.C[-..M.[..v..]y.....`.....G.hEfQb../8.).Pg6{...j_p....

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_7_1mu2pq3_njuzm5.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3768
Entropy (8bit):	7.931480288191195
Encrypted:	false
SSDEEP:	96:KvKgZ4DOEXx9UwVz49KNEt3fl5TBZV541fL5VXdv:KvKgkhxfatvHT9O51t
MD5:	63E299009EBE4207216AE3AD21240F1D
SHA1:	EAF9C99EA74A91976CBB30478B8CD4D03292DA68
SHA-256:	D8F35FD663E92EEE7CD4D2EE0B9FC557E71E2F82FD56A314453760EA6D80ECAF
SHA-512:	74AA61C6A449ECED46C90D4474806FB4AF6CB3CB2B5ACD774A2E94E1897489794AEC8167C0ED44EC858DA508FC0B010324CA167439194E1AF8814FD2CD33AD79
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@......iq.....IDATx..[.x.E..{8.!..P..!........".Y.A..A..U..!......e.E9...... ..D.1..7(7..9.93._Uw.TwW.......}_.TW....^.zU..Bp.!.@K..t].5.T...u]. ..U.....p...-}..N1.#.'.t...-.u..&...l.M..p;.@Gu ...by..q....\|.,N.....Y.v#.97.PTR...+..J.Q.je.Y.Q.j.Id}4..@d.Zb...>.0_..[.........:..4..3-.kw.G....R7.".>$.....b.Yc...`..d..o..[e@......5;...[...v.. B:.L..m[.n....V<.......PZ...`6...B....[...-.`s...@%aH....%/...+....s).@.\|..{..y$/L.........q@..J.+?..F...1.uy..4.. .0..0.X..f..:.^/......FVP...P....F.D......w.:.!..,..&.&..k......Z:..\...9.e.m...Zt..........&...S:*vL0..U.uu1K{P.c.EL..&.D....u..n.[p.....:{9.}F'#..9.h.....R.._..G...#Q.VM..5...j...:......+#.....3.$..t..!bC......Vd..9s.}FO....`..$./..4...H;v...b..$mOQ,...O..J.c$e.V...5...s>....BV.N..q.O.c%^..7.\|.x.$...+..0..m"..k......s..b.&......l...6..1un.g"...W....&3..E(iR.#.f...p.f.l.m...2.....C.1\|.........).Z.......S..WY.-o.y.{....k.........}..9y.j.....X8.[YG..x.yO:..\....s

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_8_1mu2pq3_1reef1z.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11828
Entropy (8bit):	7.978571724823563
Encrypted:	false
SSDEEP:	192:zzde5oh2FzVaRHh0Szja/FcrimHq83ZD438fFxKoQd2LZB8deWeg:zzI5tFxQuDW1qicsegZB8wZg
MD5:	507A43CD970F8F2B1E491CD7F6B5E92E
SHA1:	2ACF236E4568CCA3B07632459F919E944AB0D1E2
SHA-256:	EE0B4F24344E966849CBDDA39AE3205C2BFAAEF1054457340B20945F72D6D760
SHA-512:	F07A1F990BDDF78C07C93261F8844359306173970AF9BD03B20DDB64E9219B9A6DB3FF828375B13E0C0CC904A472EE24DD70E7C1930B810F52301E27065D7ACD
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............>a... .IDATx..].._......I..PB"......."...I.-....[...Mh.".hP;.$).. j... $"!...#.[...{g9........G...;w..3g.3g....c..@g...l.`#{..........5...]...................d{.!.%.K...2.:t..;.....`[..[Nm...].o.x..+..\|.........@O.{..~%..m...x....5..]!...g....o_..?.G.~.....y...Y.3o!.Y....-.Kk....u..Y.....5V_.k..:Z..6.k...[.56...o...l.}t.}................N.....` ..S../Z.._./.xo...`:..)..7.?.z....7...6X.5...v...;w..wF.u..>..}.n..Nc.`y.J..........g~.;....^..w...p..2.....#=.. .J.......%....=v..?..:w..?....`l..d...F.......\|..q..x..W1..Y9..E...... `.=f.....$CQ^L.E...7.A?....p 6.p.T...\....1X...........o{.).=...:iJ@.................s~'......r.[...ko.......B.3.G....M.;...@.z..A..7.[...s.,.s.Mw....{......y.}%..h/6............j.z..:d?.............0..c.,.2.. ~0.a...uw.1O`..Z&...E..k.R......O;.N.E4..P..x.._..@<Ys..1..q.G...RK.+.V........p...f./\.d........Mj.^0.G*p.@k.....I&"..\E..@......Y.....t........o....`E...l'=.z......L....9..U.N.....

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_9_1mu2pq3_fwd21f.png

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	38429
Entropy (8bit):	7.989119083121517
Encrypted:	false
SSDEEP:	768:AIUH7C1WHaN7VhWnHCGTztt6EYrc0GepfXJzwInHIjGI7K6x:+HFU73opntt66ex1HIjG8n
MD5:	DD450873BB0530552E2ED752448D710F
SHA1:	509FDC893B99AA4C5CE72C43FE76EF59AE20940F
SHA-256:	F6117BDE927D8877F904460EE581A7AE1CF91413A3D6CE7BBDCD21BB8954D487
SHA-512:	F64F38D245A046BB34EC3DBF19867B5652705EB2339D1023CDF828CBBD0814C8C7BC0A7A52AD2DA61AFAA86DB36A7C3547D240591BD0DFFFE36A74D1139E3AD0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............\r.f.. .IDATx..]..^E..!.....{.?.J..{...;...b...+ .6PT.T..i.........H.m.?..wf.\|.}In.<Or.w.=[...l.1..Xjae"Z..6%.M..D.>..CD...k...D.J..M .."..:.GD.D4@D.h...'.9D4...'.G..G..D4...#.'R.....J+&m.....#...h..o...b...P'.&.pW.ww.w........B........mKD{..6Ir/MPi.w....h..>...V0.%.O#....nD....K.....0...AD...EDt....e.V0...k%...^@D;.-..A_b.....!<........`.@e..... ...h.....D.7"....M.....a..XtP.."..$.gQ}..[....I..\|..{b6=1{.=..,zb...=w.....,...4oA/..F........I.&P............I..+....Bk...........k.AOYwm.h.uh..[-..V%.%...Dt......+.@wac"z......S.o.j....;.{.\|..y......t....s.Poo_...e.H1...N....M..~pw.Ny.^.<q"...j......oH.o..m....6..n.m.....w"........f..3.`..J..=.....c.."..^.+.t.t.w...?Hs..Zr...!Y...6..%z..?f....CI5.H!..;...'.O{M.~K.y..h..o.-.P...DtV2.V..`...=lADo&.....c.......p+...+.g......&......cH...K.X....V.\)rObVW..O}.....0u5.V]y2....U....u{.c.m.0j5.JDg...h.X+[.a...9.GD.&.0....A...........~.B[L............@.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4jparams.conf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (573), with CRLF line terminators
Category:	dropped
Size (bytes):	118356
Entropy (8bit):	4.470048351013237
Encrypted:	false
SSDEEP:	384:OlkRfHupoBFpsypozv5YswU67PttqeFpZwm75ntY22ZxSjGeeEddRu/RiV1U7IMa:AkRfOWV/n1kKzi9RkCMVk0GWhD2EZHt
MD5:	8BB4B8E87CAE8523756302DE26B7975F
SHA1:	6D81EE5BE83FA8DFD897CE4445EB3D9C6A8227EB
SHA-256:	FC4DE36C78091054B1000A6BECCAAF62EAAAE6F84A7C52E283DCC79334078B55
SHA-512:	36E2B5B377704D9FE023CA4BDB781B23B9F3052A3FF7B9B2E90D97D7EBE632512068A643AA4891EAFDEDCC8CE71F3876441FCB3FCF48548D377B91193EBE10C1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<config install4jVersion="10.0.7" install4jBuild="10124" type="windows" archive="false" bitness="64">.. <general applicationName="OpenWebStart" applicationVersion="1.10.1" mediaSetId="114" applicationId="9615-4721-3936-4657" status="LCOK" mediaName="OpenWebStart_windows-x64_1_10_1" jreVersion="1.8.0_412" minJavaVersion="1.8" publisherName="Karakun AG" publisherURL="https://openwebstart.com/" jreSharingKey="" lzmaCompression="false" pack200Compression="false" installerType="1" addOnAppId="" suggestPreviousLocations="true" uninstallerFilename="uninstall" uninstallerDirectory="." defaultInstallationDirectory="{appdir}{/}OpenWebStart" privilegedInstallerRequest="true" />.. <languages skipLanguageSelection="true" languageSelectionInPrincipalLanguage="false">.. <variable id="en" name="English" messageFile="i4j_extf_0_1mu2pq3.utf8" customLocalizationFile="i4j_extf_1_1mu2pq3.utf8" />.. <variable id="de" name="German" messageFile="i4j_extf_2_1mu2p

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4jruntime.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2675279
Entropy (8bit):	7.875007125232941
Encrypted:	false
SSDEEP:	49152:KSRQlltpX/lRcUSIuVdMS3aGvsyNliMRf8OCz:KSRq3gUSl2S5syNnRi
MD5:	C1898F0CBB4964107F6BDDEC4EEADA7F
SHA1:	D1B280B45D7DF19AB71C50DCF62DEFC74416D018
SHA-256:	FC69BB8650AE94152F4E0DEF638EFA93E03D18B0A7BD368F04B7B74854B1CAC6
SHA-512:	927FC7B3F67A078A9862EB7D4048EA52EBF08D9F0BBBE7D8D0C273CD53055275BB108D7105B377F0429E5D823A4B340C03860B9B9F543B2F639ED7335223A863
Malicious:	false
Reputation:	low
Preview:	PK..........pT................META-INF/MANIFEST.MFUT...6@2b.....M..LK-...K-...R0.3......PK..............PK.........\:X................META-INF/UT...8..e..PK..............PK.........kiU................com/exe4j/UT.....kc..PK..............PK.........kiU............0...com/exe4j/Controller$LegacyStartupThread$1.classUT.....kc.R.n.@.=.....N/).n..p.@..[.<DTB2.R..o.%q.YWk...B.....>..B.:.".?D.ggg.9.........1.Q2.O..io..L'R..b....lvv8..x}...y..yOr5..........$0...Z.3T.L..;G.....Y....Q.....+..8.2.... 1.s.q.".:......b.Q.c5.0.I.z{$[..\|..Vq...<...F..l6P.M.kX7.m.-4l.p..f.c..]..S{6."..^.....N9..l....m..Cz....@......_>.....xL....A...J\|.M..>..R...#.c./..;EU........IJ..E6I..=Jf:.....&aj..+......3..[...S.........t/.....E..S"....[9..=..r.P2.......1...x.\|C.'.T...s..$.EN......mZ-:Y-...4..._.S....?PK..............PK.........kiU................com/exe4j/Controller$LegacyStartupThread.classUT.....kc.Tks.U.~N..&.........BZD....)..-6.L...[...@...O~Pg.q@.aT2.f...Tq.K...o....#

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\installer.ico

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	MS Windows icon resource - 12 icons, 16x16, 8 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	477478
Entropy (8bit):	4.56357806868144
Encrypted:	false
SSDEEP:	1536:/rlyMCTWxlfcvO4bXpzP/46LRiDP2x4eDRTrrBAAMrpP+7xZ333333333333333O:/wMCwuP/46LRiDP2xLVDWjrpP+79LY9
MD5:	9DEC4096DB2C9412293BEC0B3A69266D
SHA1:	563C7BE5BC5117451DA21C04F6730533676E6412
SHA-256:	4684532C12A9F825C6650DEAD47DA4113B499F650AEDC1D5EC327AE5293A330A
SHA-512:	567C5A98C3AE88C4CC079B71545FDC093BBA01C0F4A55A625A492087175783DAED58A0B322646CB222E61EC9CD397A5917635833EA7484C9E3178B73FAB12428
Malicious:	false
Reputation:	low
Preview:	..............h............. .h....... .............. .... .....>...00...........#..00.... ..%...2..@@......(...6X..@@.... .(B..^n..........(L............ .(...............($............ .( ...(..(....... ...........@.............................o.ZB..........wa=.....A,..........gQ-.....\|kQ.O6..ZG...q.....kW9.........W<..aG..R<..I6..H1............q.~jJ.....kT1.fN(.........t^:.....S9..gT8.I3..]J,.........D/....o.K3......iS......C-......P8..U:...kK.......n.F0..K4..\H.[I,.....iW8.zjQ...r.....................I2..jS0.v`<.....B-......D...D-..E/..L4..V;..X=..iV9.......o.............B-..D-..D/..E/..E0..G0..G1..H1..H2..J2......J3..K3..J6..T:..U;..V<..W<..X<......YB......[H*.fO(.iR..t^;...q.w`<.v`=...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre.tar.gz

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	gzip compressed data, original size modulo 2^32 101792256
Category:	dropped
Size (bytes):	39785766
Entropy (8bit):	7.999001880231723
Encrypted:	true
SSDEEP:	786432:7l0D2xRL8/1rkZARoF6bTcB9bJKjmSpRoGFxE5W+OIdDdpr:7xRLykZARoFEq6jmSHoGs5WORt
MD5:	3D89BB68ED29E3FDA98ADF308A780673
SHA1:	796D72DE4ED6370A3D2800D91C04C99BCFC0300A
SHA-256:	411AFCB917DA745BDFF80E245F6DF749383C38BF7C557CAC41B98018926187C2
SHA-512:	1219F379825997241E0ADB49130BDCE66561D17ACD3ACEA127F3D069E33749236D6DD5AE5CE30E727EC40AC3DC50AD9F918361A3C3E153F53E1D1B3BDE07CA33
Malicious:	false
Reputation:	low
Preview:	...........iw.W. ....3]"= DRK.RNfA$$...eY=5......TD.4...]...@$.t...'."....w...h.?ys.._...../.g.............4.=...........g/....{..........KY.YTuR...v.....~..sv.?...'..D......I..<....X....Ijg..'.M.ir9M......~...2.'.;..]....6.....s.Wx........a...Uv.Uu.]..tb..$-m.+..rV...xw...K.L..\|q9...8..y..?......www..\|.-...b...W.....{S....iYeEn.L.O...w...[;.{..74.U1..wY~m...`G5....[..q.s....9~.5...q...7...G.3..U..S..(.d.'3..&,`..J....FJ...e..,..L...ASL..2).]k/n.U...F....\|....v.I..V`zwSLS. ...`.=v.\|.....ba.0WV. ..V...u. ..i...,g..yM..I..j...1`.."..D....:.>uk....4.v.......bw.{:h.c{.(......+.._.....K..0;.a..xQ#Nw....'.C?Y{.........w..4@.V.i...W ....u.f....I./...#.R...q...?g....d...lL..03-S..........G...tlV..oI...0t?.N....~.I...b...-..$.<o/.......o....(.&.....p....7.F.b...E....h.....o...L.s...iRU...r...mpE......+.L.p.X..:.f..;.\|D9.@.....$..8..4.c..F...@..5..<?\|.V......\.]...n<.kb..<8...P....?..b....^.......s.<....;...<.c.\....}c..nm...g...o..2

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\ASSEMBLY_EXCEPTION

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	4.747042537008044
Encrypted:	false
SSDEEP:	24:b0fFDmMbmRMAOJDcJb3W2zeD34eXqC/5Wx/kaRilV8hWrwr1:b09PbmqAOJIW2KT4eXqC/5WFkaEQW8Z
MD5:	D94F7C92FF61C5D3F8E9433F76E39F74
SHA1:	7A9B074CA8D783DBE5310ECC22F5538B65CC918E
SHA-256:	A44EB7B5CAF5534C6EF536B21EDB40B4D6BABF91BF97D9D45596868618B2C6FB
SHA-512:	D4044F6CEB094753075036920C0669631F4D3C13203CAF2BEA345E2CC4094905719732010BBE1CAE97BC78743AA6DEF7C2AA33F3E8FCA9971F2CA0457837D3B0
Malicious:	false
Reputation:	low
Preview:	.OPENJDK ASSEMBLY EXCEPTION..The OpenJDK source code made available by Oracle America, Inc. (Oracle) at.openjdk.java.net ("OpenJDK Code") is distributed under the terms of the GNU.General Public License <http://www.gnu.org/copyleft/gpl.html> version 2.only ("GPL2"), with the following clarification and special exception... Linking this OpenJDK Code statically or dynamically with other code. is making a combined work based on this library. Thus, the terms. and conditions of GPL2 cover the whole combination... As a special exception, Oracle gives you permission to link this. OpenJDK Code with certain code licensed by Oracle as indicated at. http://openjdk.java.net/legal/exception-modules-2007-05-08.html. ("Designated Exception Modules") to produce an executable,. regardless of the license terms of the Designated Exception Modules,. and to copy and distribute the resulting executable under GPL2,. provided that the Designated Exception Modules continue to be.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\LICENSE

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19274
Entropy (8bit):	4.667864876938965
Encrypted:	false
SSDEEP:	384:sY2fSz/rGvS/66YsaZdIP3Lf4vAkMVhPGkupdDdicW:7vuvVmjkbylupdDdiZ
MD5:	3E0B59F8FAC05C3C03D4A26BBDA13F8F
SHA1:	A4FB972C240D89131EE9E16B845CD302E0ECB05F
SHA-256:	4B9ABEBC4338048A7C2DC184E9F800DEB349366BDF28EB23C2677A77B4C87726
SHA-512:	6732288C682A39ED9EDF11A151F6F48E742696F4A762C0C7D8872B99B9F6D5AB6C305064D4910B1A254862A873129F11FD0FA56FF11BC577D29303F4FB492673
Malicious:	false
Reputation:	low
Preview:	The GNU General Public License (GPL)..Version 2, June 1991..Copyright (C) 1989, 1991 Free Software Foundation, Inc..51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA..Everyone is permitted to copy and distribute verbatim copies of this license.document, but changing it is not allowed...Preamble..The licenses for most software are designed to take away your freedom to share.and change it. By contrast, the GNU General Public License is intended to.guarantee your freedom to share and change free software--to make sure the.software is free for all its users. This General Public License applies to.most of the Free Software Foundation's software and to any other program whose.authors commit to using it. (Some other Free Software Foundation software is.covered by the GNU Library General Public License instead.) You can apply it to.your programs, too...When we speak of free software, we are referring to freedom, not price. Our.General Public Licenses are designed to make sure that

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\THIRD_PARTY_README

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158253
Entropy (8bit):	5.019390757582419
Encrypted:	false
SSDEEP:	3072:8j33DuS8sY5sPfqN7amC3Xs4NZ1G8OANn76XBwCL3Ucw+4oHmZ/bcm9GdNhJ75eH:MqN2pZG3Ucw+4o7dfCRp
MD5:	136065A6C9A00495E3376565F605527A
SHA1:	6AF6BC09C09B32FA4933C624E111339CC75F3571
SHA-256:	F97187233B2D5C3F847087B8275289DE64BA0DF0690A3325D4BE11D861A69A9C
SHA-512:	C1045D6DDAD585017C194000261D4B94174482F5FA1847DC26056B683E699AF6A172EF93C626B4D23553CF3B736CEDA02C51C4068BF620CF663897AF841BB170
Malicious:	false
Reputation:	low
Preview:	DO NOT TRANSLATE OR LOCALIZE..-----------------------------..%% This notice is provided with respect to ASM Bytecode Manipulation .Framework v5.0.3, which may be included with JRE 8, and JDK 8, and .OpenJDK 8...--- begin of LICENSE ---..Copyright (c) 2000-2011 France T??l??com.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:..1. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...3. Neither the name of the copyright holders nor the names of its. contributors may be used to endorse or promote products derived from. this software without specific prior written permission...THIS SOFTWAR

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JAWTAccessBridge-64.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21896
Entropy (8bit):	6.465692233896692
Encrypted:	false
SSDEEP:	384:Ylzvd1ax/nZejuOU8JIYiaHZ8ZpH3GCJEqyh8xoOKd:svDaRnwjuxYiQZiRBEqO8x0
MD5:	0347F7E06C350C8DC6F175EECF6DD14C
SHA1:	91B965C7723447003C118DA20C8D931B27A8D4BC
SHA-256:	C75A22EE59300D87AC47CB34F2F7CB9530C7839E6511F08D6CE53FD9A2940DA1
SHA-512:	D298002B06EA0B4935831AC0EEF4ED5D9C80097E048D8332AB37BD40B605099CCB2D2056904FA48B9AD830FCEA11026072237BFF17E947F7D36B14D375F67493
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.b...1...1...1.v\1...1.f.0...1.f.0...1.f.0...1.f.0...1Fg.0...1.v.0...1...1...1Fg.0...1Fg.0...1Fg01...1Fg.0...1Rich...1................PE..d....2.f.........." .........................................................p......g.....`......................................... '.......(..d....P..P....@..t....,...)...`......@!..T............................!............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata..t....@....... ..............@..@.rsrc...P....P......."..............@..@.reloc.......`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\JavaAccessBridge-64.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156552
Entropy (8bit):	6.3042416239598245
Encrypted:	false
SSDEEP:	3072:xZJ75enjr1ZPTAh/razkw60EKr65LizjUu/rNI7gIL8SL9wFxHBiKzXDwE/qXvxd:vTkNyWjUADodRXl
MD5:	CE8FF6DBB161F5176EFEB1667953709F
SHA1:	091A3BFD18A8DAACED7E48E0E7E75CE1DEF445C5
SHA-256:	8CA8718791B056223FA8A836B3AF68E6A2352C25C800A10601C0E27E6BCEF571
SHA-512:	4460BC20C9367D2220A8C103DD2EEBB3AD6BA18A0905590C4F7A5544B7456FCF944AF49E0DA7F7C8F2EFF1C20945765643C4D9AE7A93D01CE21F59A4CDC951A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..?...?...?...6.@.5...m...=...m...-...m...7...m...=...t...:...?...w......:......>....,.>......>...Rich?...........PE..d....2.f.........." .........:......T...............................................\|^....`..........................................,..8....4.......`..P....P.......:...)...p..D.... ..T........................... !............... ..P............................text............................... ..`.rdata....... ......................@..@.data... ....@.......$..............@....pdata.......P.......&..............@..@.rsrc...P....`.......0..............@..@.reloc..D....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\WindowsAccessBridge-64.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	220552
Entropy (8bit):	6.447765509668585
Encrypted:	false
SSDEEP:	3072:LugfOJL+J3rnfvw4AzYBjfPho9SVKPpWnEIc7JvSt8nioL:L/Ot4nfvwbYZyMVoZdCM
MD5:	340BA76538C290E2C366C782D8287963
SHA1:	C86D5ED65C02F3B1014FFED09DC0BC8C2B384D29
SHA-256:	B83B043F730163943BA57D44D67649C002EDA9873CCF8FA628E348ABC5DA3F22
SHA-512:	3FE554B8743D5D8D9620A5374A350795EBC974CE4024B5C971A4B33EC109657F71A759E6BF2985F034EF6F3C054A6CE1D503535AA76EA84731BB5605D241B811
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Gw..&...&...&...^..N&...^...&...^...&...N...&...N...&...N...&...^...&...&...&..vO...&..vO...&..vO..&..vO...&..Rich.&..........PE..d....2.f.........." .........X.......z..............................................%.....`.............................................D.......<....`..`.......H....4...)...p..h.......T...........................p................................................text...p........................... ..`.rdata..............................@..@.data...8...........................@....pdata..H........ ..................@..@.gxfg........0......................@..@.gehcont.....P......."..............@..@.rsrc...`....`.......$..............@..@.reloc..h....p.......,..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.021368599475616
Encrypted:	false
SSDEEP:	192:2aW1hWtiUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfCynTvv2:5W1hWtiU8JIYiaHZ8ZpH3GCJE6yDv2
MD5:	40A28D3859FC10BD1FE9FBD5245ABB4B
SHA1:	BA6286FB9AC56CDD485FB424AD2D9F4343B424A4
SHA-256:	098E916BE2F4AA3C2F0C4610A09E563D0314264CCAB256F9E8AEB4DE25F44EB7
SHA-512:	6678DAFD6431AFBB6E1E7DA336764044B8483E1DE8E105121A15BDD33CAC3728A236B7D80E7897A2742558D1DE643691E3B6913E9B8830217D5D2F01F2B83D4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0......S.....`.........................................`...,............ ...................)..............T............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.030280717647128
Encrypted:	false
SSDEEP:	192:IUW1hWaUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHy5YPJJv:5W1hWaU8JIYiaHZ8ZpH3GCJEvySPJ9
MD5:	B4351603FA96746AAA6EC88FBFC3BA23
SHA1:	1EEB63D6A321458D15D9804F08386D30E5F82D44
SHA-256:	37C25F645BC4AEC5A3FC9D4F7C53ED2637B01D7F09F5D754B622F4F1967720A6
SHA-512:	865F878B39FA4FE1B6F3E6B97DCACF2ACCCB4ED9BFF7F26F2BF7527D6F64C736C9B1B28B6D14DE69714823D23E5A6508B2B109F51F01A6D3D889807FA6F07712
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....F.L.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.034203866718939
Encrypted:	false
SSDEEP:	192:uW1hWyUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfOyrDMJtj:uW1hWyU8JIYiaHZ8ZpH3GCJEWyEf
MD5:	4461EC0E3CFBC6713CF053AF09F737B6
SHA1:	6A7040B008A157E47C0217C3B9F3B1C10C6196B6
SHA-256:	7285C08AC1AA37FFD24855FD09BA5D7FCFA3F73B4FEC34CC423B996026ED9249
SHA-512:	6A62218132E9F9DA6C41468727868E65F1ED5BEE0C77699B1610E51FABA0854590904C12B1DBCDD1176D60A5434E36071C2D896013911CDF0B1AC6528209524F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....C............" .........................................................0.......7....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.082770014974615
Encrypted:	false
SSDEEP:	384:CBLW1hWHU8JIYiaHZ8ZpH3GCJE/Oxyf3elhn:CBOrYiQZiRBEokO7
MD5:	BCEA27A8EDD8FDE6CA6766CDAC92AA10
SHA1:	C038AED43856AB48B89F6BED280FC67D4272BBF8
SHA-256:	B42A286338DF3DFCE7FE5B8E4620B9FEAC3CF64BF75F4CD4A040962B42FEE3B0
SHA-512:	A57326C9491975A3C61C05957CDBCEE4B265D81828EB89276D438BEC2037CC9D9A0ACDA95AD8FA9B4651E8EE2C038D72D2FF0A4EA0703B731F6E5EBD3BB39B85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....Z..........." .........................................................0......x.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17288
Entropy (8bit):	6.92123785793929
Encrypted:	false
SSDEEP:	384:5BPvVXcW1hW0OU8JIYiaHZ8ZpH3GCJEYyqw6k:HPvVX/xxYiQZiRBEYQ
MD5:	8C65A86F3EC0D507BF16B21EE8F793E5
SHA1:	52DB48D848C754CCF8EE853422C3402CC6AE130D
SHA-256:	35EEA4D6A8B8779870ACFF717B445B74A834DB99C9491B89F0DA995A23D44481
SHA-512:	F1C14713CD0DA8DAB510748FC6623082F48E1911DAFCADB3EA32D9BBFFD8591E67951951D5D1E71CFC932DB5424D1E014A8296FD26FA3B320E921D8F5CDB3B49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Q............" .........................................................@............`.........................................`................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.053002453600339
Encrypted:	false
SSDEEP:	192:iXW1hWnUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEf3ywnaiwfUW5:uW1hWnU8JIYiaHZ8ZpH3GCJEvySZwfP
MD5:	C329BFA379D8B4D693D4C4FA9F33CA98
SHA1:	3A84EA6B723A14BC1B1FBDC87A03AB1F61A8987E
SHA-256:	2FE3323E28301F1D7FC7D198264AEED0D22018F76223A59300355BFF36066BD4
SHA-512:	4A597E5420E1E05CA831E50D854EDFA96ACBF8FE55807F7D85FC60B5B3B0C5AAE1541776D2C8C6160B078FC77AD9FC5DA587EC8C957F2DF12FA7EE47CA7424D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...,,.W.........." .........................................................0......13....`.........................................`...L............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.139818533410422
Encrypted:	false
SSDEEP:	192:GVrW1hWpUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfIyFoWBk:GVrW1hWpU8JIYiaHZ8ZpH3GCJEgyFo7
MD5:	9A9F8AF1CCFCB26E8D02DBA7CBFFFE21
SHA1:	B2F231D73413F1B2CDB6FDD9A7EFAFCFF0E1830A
SHA-256:	8E775E5DE51E18A8C0728B6642ACA44FBBDD8668CC6FEE4F4A9134F9EEC3D610
SHA-512:	ECF3F337BCE07645A00C4065885AE3F570F249595B8175DEE1A0ECF7D9F5055040C9BC5CEADB9A65084D2A0A6D211B733E0289C4F22595A23D25A80B1E545EB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0......$.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.061191185491273
Encrypted:	false
SSDEEP:	384:zW1hWoCU8JIYiaHZ8ZpH3GCJEwyKbIWO7:WBYiQZiRBEwoWO7
MD5:	6DC85AD8C6E723C0880B30841C3ECE46
SHA1:	609F1A017855CC255E774EBB8204C92A297C3ED2
SHA-256:	0A058BA5E916D46E12DF6F3B32FE5837DFE87BF3EBD0DEB8181D994A3AB0D5A1
SHA-512:	B2C2F7C12034F7D4AB2C1A692D8232C076C3597FA5F61B4947224B2BEAD7C0B9F2E93D9C43868F8B0ACE27C0B376EE5CC5CABEF7EE3C27A48D0F2C9CC82B01B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....QN.........." .........................................................0...........`.........................................`...`............ ...................)..............T............................................................................rdata..`...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.004350385814286
Encrypted:	false
SSDEEP:	384:KlgW1hWPU8JIYiaHZ8ZpH3GCJEIyai33L7c:iTYiQZiRBEIKc
MD5:	191949C24D50BDD9E371C36BE1CBFEF5
SHA1:	E4055BB4246E6C7A8826C4D5C0A5BD235DFD6C27
SHA-256:	5F42597148E7A86A0F580F1EDFC6F46B3F3098DB25F1F625C4570F14177730D1
SHA-512:	3BCE3D07F598F1BE7821132EDB2A8B3480796449577E1420B15100F28441751B5508BBEE9EA440B730A265950307C89504844DF8DF40BEB97D3354F5DCCA37D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...T.*..........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.069887554220159
Encrypted:	false
SSDEEP:	192:FW1hWMUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfmfynVpTzvp9U/:FW1hWMU8JIYiaHZ8ZpH3GCJE6yrTdm/
MD5:	9E03C4FE0D54088A317580E69662D32C
SHA1:	BE7FAD483E778A958018F1C646161DBEFAAEEF28
SHA-256:	D6BADCA3E6B9981E4D51B098289F6CC0B34C01A022CB9861084E98CA742DD8EA
SHA-512:	323E5DFFB6EAA9E4506125E2190EB7D2E4C679DF879754BA9C5203A1F23A94B0B96937A3CD5FA87F43BF872AD53AC7292E5434F7F5B206C2C415F5E7B529378F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...3Qb..........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	6.996738890766236
Encrypted:	false
SSDEEP:	384:3vuBL3BYW1hW+U8JIYiaHZ8ZpH3GCJEVybEoyy:mBL3BTMYiQZiRBEVg
MD5:	27F04AD955177C34501B3C24D4455097
SHA1:	983F3E816E239386C8656004020B4AD7D42ABB70
SHA-256:	AF4521552FDD7E9B0D1BAFF3C1E3EE2446CEE8D42C1B7BF58B340AC8FE748DFD
SHA-512:	4048746B39299131BD082FD3E126F526077137EF979AFBD6FC6EBE708C7DE8D1960A6AF27AC1B75E5B497D51BDF43C20722A213366D21D8C44470EF692C4EF5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...:............." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16264
Entropy (8bit):	7.031096139562774
Encrypted:	false
SSDEEP:	384:TOMw3zdp3bwjGjue9/0jCRrndb6kW1hWsU8JIYiaHZ8ZpH3GCJEUyPcFB2:TOMwBprwjGjue9/0jCRrndb0uYiQZiRO
MD5:	F37A60A452F61755FF6DA31F330C8D3F
SHA1:	5415FC373E7E2359F4E314C55C8A924C4419A3F0
SHA-256:	0278191274869E781661FCFDA331EB39E939730E6BDD55727F4D7AC392452C7F
SHA-512:	CDB8CFF7813EB85CFFAA0714693689E05E5C7FC3A32D01158F19C2F54962B5D6E0BB23662352471D344CA33C8A253B3A78BBF9C587C129A7779898A6C9AD1D46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....=X.........." .........................................................0......-=....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.038899732658852
Encrypted:	false
SSDEEP:	384:88W1hWjU8JIYiaHZ8ZpH3GCJEQyuh7Oeg:ILYiQZiRBEQSeg
MD5:	F821685553A70F3A39B1C2DE67A73860
SHA1:	ECE756CC92E2876F90F33F7F908E33251C6F9CB9
SHA-256:	2D702DEB1BE0DDEC929DC2618B414B26C98F61D2A17C0410738D38C981B31FF7
SHA-512:	DA40F95F1FD23F93C40653D4A363F497077964BE19CB349FC7C683BCBE429115D2C2A197075245539D48FFEC1D533DB771166DD2D490143032600B47770CD45B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....`Z.........." .........................................................0......&.....`.........................................`...l............ ...................)..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.142470508456808
Encrypted:	false
SSDEEP:	192:EW1hWsUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfiyjzUj5yu:EW1hWsU8JIYiaHZ8ZpH3GCJEKyj4gu
MD5:	EB0EFCC865648E20645048EAED44B9F7
SHA1:	048403E0DC8DDEEA80DA7A665980CB5F214F4132
SHA-256:	48F6DC39DECAF08D09AD179543B486D78AD43AA0297A6C1895C4998FA4E83021
SHA-512:	D97EDCFAA4BFC88ACA0E2B8F608DC86307E252CB2BEAE4079E1E6E743E938E9B72FEFBE3DBD453E8B0A7E14533D7961044ADBC1B9C2672A3D097B5667856C547
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...h..&.........." .........................................................0......va....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.011022849536188
Encrypted:	false
SSDEEP:	192:/nW1hW8USwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEffyjamK3FWL:/nW1hW8U8JIYiaHZ8ZpH3GCJEHyWv3FC
MD5:	8142B7AB5ABB3B0F7158D3334EF6F63C
SHA1:	28B0346711915DA2BCBE154FC0F2B88C3C308FE8
SHA-256:	C99390C8C400BE805E540C2F0F3E5F44C669E078C9FE980340947A59DE01FCE9
SHA-512:	AF97FD35D24E809900B1F93A409EBABFF2317C318C1DACD152C2E0312A57F313D9BF5921F032F9B286141DFD4FF0CB71F00F4B1296FED81D2BD2A53136A2F60E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+;P..........." .........................................................0............`.........................................`...H............ ...................)..............T............................................................................rdata..T...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	7.0412066044038175
Encrypted:	false
SSDEEP:	384:zWXk1JzNcKSIXW1hWWU8JIYiaHZ8ZpH3GCJEuyNaMa:zbcKSbcYiQZiRBEuPR
MD5:	6E8157CFF8CA6211B1591BB54BADDAE6
SHA1:	2891DBBD068BD87CBCCAACE86A7F999FB526AF38
SHA-256:	7B27E307E0291945CEA042A8DFFD7A81A09BC2827D23F25686D7ACE27D9362C5
SHA-512:	31EB9947494BE5C3DE6E77E36F03896967443C2BFC324D891A9DF28BC1020F4E3B672B3D9D21C39DE7606F5D6AF96AD447728073A5CF21DF8324B5FCB7D24323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...m..c.........." .........................................................0.......G....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.069594828285194
Encrypted:	false
SSDEEP:	384:nvtgDfIeFrW1hWvU8JIYiaHZ8ZpH3GCJEJye0fV+R:nvpeFuzYiQZiRBEJqC
MD5:	F03BCD4ED97F44B5593DE268DD2DF931
SHA1:	6710683BDF771E3AB02643B73645A1D55BF77F59
SHA-256:	F84D39F67467988B28B72613C20AA81113DA9F406C2590C0EC3D09C3810A3779
SHA-512:	36F4F5ECB8D8134279FA4411A9D1C89AB479E678CBD7F3AAD1ACC10D3BAF6E6B4E9156B57D6B680AAF03FB7F9970D3A1449876B85DF07BC349D080E5262B55DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13192
Entropy (8bit):	7.1824537986970185
Encrypted:	false
SSDEEP:	192:k4VW1hWtUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfqyczaEQog:kyW1hWtU8JIYiaHZ8ZpH3GCJEyyqaUg
MD5:	DDAEEBC7BC8AB791403006C5BE808C82
SHA1:	EB6DB7995A6FDE18F4461DD79CD623915EAC80D1
SHA-256:	931F6C6568AB0560E7B63D433B930B44551DAA6D35B456CC9D287B524992703E
SHA-512:	9135A7B5F76F1EB0A5194C37B41D60AD4CFC22BEE0E57E317125C04ED498289243327970F5587D153EF645750BB5CECD23894C9E2945C96E5B7F30B03CFA39C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...kl^w.........." .........................................................0......i.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.01766247829426
Encrypted:	false
SSDEEP:	384:kGeVWW1hWqU8JIYiaHZ8ZpH3GCJE9yuYWb:kGeVtYYiQZiRBE935
MD5:	B22191F14A8A381FCCE0081EBEECA442
SHA1:	94607C05CA95A0BE18559EFACC6C72876EB721B0
SHA-256:	64ECFBD682E04595FE39914584C6B298EB9C99166FB467ABD215208C708424D1
SHA-512:	565EFFD61BE94A9C1D8FF3073F0F6A676A9D43E13433770F1CC012848BF5A8A2ECA412630081DE9A07938FBA86B778E253A961C0649F593DB9FA49134BD91C08
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...9..\.........." .........................................................0......Ok....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.093211988681184
Encrypted:	false
SSDEEP:	384:tyMvxW1hWKU8JIYiaHZ8ZpH3GCJE8ykSL5:tyMvgUYiQZiRBE8+t
MD5:	8995A9838836DDF189DE6B59373E7037
SHA1:	56A4218ACD898F05C81E9ED07E10E1B7240B1392
SHA-256:	FBC5A419BAD11F5C013F9DBCBAF9F85D445152A5948A5335813C3A26B7BA03F4
SHA-512:	FC3F9ABB1ECDF882681072F1A295D01695E627554154F8ABB5B95F474D877AF5CDF45DBAB118A4D1F7DBA8DC2155FF7D74E04E37F33FFF2798BAB1774BB23D9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...c`.g.........." .........................................................0......RJ....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	6.963286989016427
Encrypted:	false
SSDEEP:	384:Vdv3V0dfpkXc0vVaRW1hWRU8JIYiaHZ8ZpH3GCJEqyJY/dB:Vdv3VqpkXc0vVaAJYiQZiRBEqpf
MD5:	F666D887E1A5180AE6ECF893BCFF57AF
SHA1:	9C31C95CAF3E207A13049A8CB52FE56754119623
SHA-256:	986DCD4C372364E33F0CEE1234BA9346CA915925710B9126F584CF2B12EAA4F6
SHA-512:	13B021C6805992312D28B32001609B0D7774C0FD8FFF15FAB58099E256B7B78F7495EC72D16F190EBE03F7032285A07D5A9360FAF1E07F7DE2505589E8F59D01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0......%T....`.........................................`...X............ ...................)..............T............................................................................rdata..X...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.109656359795579
Encrypted:	false
SSDEEP:	384:UtZ3mW1hWOU8JIYiaHZ8ZpH3GCJEvy75ah:I8YiQZiRBEvQY
MD5:	15FE6CDBB1209BC1413D828510523175
SHA1:	C6B6CCA53F45C5E201978423B639EDA5D2A34A7D
SHA-256:	80814DBF00F015EFA62FE499184CF4E247FDBCC9BDE49815C55ACB903383B867
SHA-512:	CD6F196C11AFFFFA79CBDF3C680A161AA473BDE88428B1D5C7B3934B4B2070D758D4626F52F3789663EA21C6CEA8B361923AEEC06D6F17CFADC7AE31C8035D40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d......&.........." .........................................................0......-~....`.........................................`...x............ ...................)..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.011150671401195
Encrypted:	false
SSDEEP:	384:pZXW1hWiU8JIYiaHZ8ZpH3GCJEJyZKHOOPp:pZiwYiQZiRBEJIKHDp
MD5:	C6385D00ABB798263509CC19219E0039
SHA1:	A292BA488E174EA4DF775173948167DA3640BB51
SHA-256:	FF342E65455702990D585C793259BB4897349FD8E4E88894696539A7E3A829D6
SHA-512:	2323CCA8F0A769B01ED90E2B4A3BDAFB9078C537C70B602EE87CF79FF78603FA9BC2D352D28B085F3F38C2A76F9E53F7429E4BB064F7126A081A477DD81098D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...B............." .........................................................0......A.....`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.096238436602079
Encrypted:	false
SSDEEP:	192:aW1hWBUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfGiy6bVwI0i:aW1hWBU8JIYiaHZ8ZpH3GCJEbyMwI0i
MD5:	8038DC9B2F62CC36D4A649874D5FF413
SHA1:	9150AAA083027E9370F45C2BEE51F5398BE529DE
SHA-256:	41D68FEDC2BD09A6FEC3EE7A883B825640756466448F0CB99D502023D776C5AF
SHA-512:	0316A072845FE1EF6AF8A6C8D6B0B3E4DFCFD48C305F78DACA057AF319720DD0B58F8DD47198109D601ECC5A52D679A8CDDA5520F2446A1B468A4899F91D8614
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...)3............" .........................................................0............`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.041992543677463
Encrypted:	false
SSDEEP:	384:QVGW1hWLU8JIYiaHZ8ZpH3GCJEIyYG1bc+BY:eDYiQZiRBEITGnG
MD5:	A307A4147379E3D48D8E06C43BB4256F
SHA1:	80D13DA418F20BE66D3EAF18F8C40A56B7CF078B
SHA-256:	554E669747ACCE7E76B5162BD0424C7C9FA17CDCD9B59DE8064E768080B5A976
SHA-512:	68B7DE15AC49623E328CA0B0C560DE2E6DD2710DCAB16DC94C6DBAA9FC3B8D12FE732434006DD430389020E41B74DE030E4394F4B3785B5FF7E6928DEB4CE4D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....8d..........." .........................................................0.......:....`.........................................`...<............ ...................)..............T............................................................................rdata..8...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.042928563872086
Encrypted:	false
SSDEEP:	192:a1W1hW1USwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEf7B0yXvQS3:a1W1hW1U8JIYiaHZ8ZpH3GCJETuy/QE
MD5:	10D181EFDF049B4D5D834739FB292880
SHA1:	5B65907A68118A747FE09C228C1AA68E83FE9F9E
SHA-256:	7D1420C0C16A904A0E4614CC18E46027D436C2555E6A844E16AEF1E4FEC8C3EC
SHA-512:	1006BE043130C834ED4FB3D8C2E505EC02942E99B61565C41F95EB204F2F359C83E380C5AEBEA7F0C1480A25763D1A15F3FD066B3C97B4CBDE9F4F28B15342EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....G.#.........." .........................................................0......._....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17800
Entropy (8bit):	6.81393252804666
Encrypted:	false
SSDEEP:	384:HuyhW1hWtU8JIYiaHZ8ZpH3GCJEWyzIJZw:CBYiQZiRBEW7w
MD5:	2B9DECCDC2B9AD5BB398EDDED0F0601B
SHA1:	B9A4FAF3376FC506A81309561219F5D0D049C65A
SHA-256:	934BF38A54268152CB2F88317C28D1888C69A9A47433E1396526D59F0DD26FE8
SHA-512:	1C45AC54194E0CEA38FEB11D81CB1C84A05EECEAC9BBBDC45CB373483B943EC505A8AC4F7DE1134688A0519AA48A5ECA9D6135483D9B5D81AA378CAC471088DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....(j.........." .........................................................@......n.....`..........................................................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.012498610818978
Encrypted:	false
SSDEEP:	384:3fW1hW9U8JIYiaHZ8ZpH3GCJEOygmjuhU:3q9YiQZiRBEOXnhU
MD5:	A1F4F534111496CDD3BD1895A77F4F08
SHA1:	889288E3691D269D452FBA828D090D4214A17CED
SHA-256:	37AB4C2DB98AB35145758D0FD5FBC4C77D176E274589D8E4585DD4B134C66FE3
SHA-512:	7B37F66A4345AE891DDAD8E538C43D45D61B53BC242B4B0D3213C7EC2C5E9FCC41B07E8F8C11CBA058F80D7F9953143A6902D26E409A559AB87BDFE7ED51DCB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0......%;....`............................................."............ ...................)..............T............................................................................rdata..2...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	7.024435409964293
Encrypted:	false
SSDEEP:	384:2q6nWm5CZW1hWFU8JIYiaHZ8ZpH3GCJERyykU+y:H6nWm5CIhYiQZiRBERZ
MD5:	ABA84CDF759F3CCD9BBC114D2D7EBDFB
SHA1:	0DAE1EF6DDBEDA361E233FCFF7D78700B134EA9D
SHA-256:	0B418059F65C96C8A966A0199DE704798C4BB4295803B9B027F12842F4D854AA
SHA-512:	B2FD449DDD20491979099C9E16EBC6111AAA3A5ED189DB80EB5E93CE6DADC8D2B3E538988D7FF0F008BAC9FF19BA971593E3579AE3CCC5BFCB7C61E5BE24BFC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...#..j.........." .........................................................0.......r....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	6.985117329940673
Encrypted:	false
SSDEEP:	384:0Y3eBW1hWaU8JIYiaHZ8ZpH3GCJE+yo4wk:EQoYiQZiRBE+0
MD5:	AA432ACE0FAAC496E196F214A96530CB
SHA1:	557774C72CA5D138D96D56F57D35BAFB66DC7F21
SHA-256:	1495B116CFDBC706DB97D7CD516DB87BEBBBC69E54DD460D7D39B1A26FC04F4D
SHA-512:	A2C9B39297BB111ADC894D4C1CFE7C95890E49BA489985E7AA7BEB297129F2300AB5847153D24069DFE13730D4D45E9AD721F787EFE34CCCC80CF2508A9D93EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....#..........." .........................................................0......1.....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.100110429002699
Encrypted:	false
SSDEEP:	192:TW1hWSUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEf+Vyg11:TW1hWSU8JIYiaHZ8ZpH3GCJEGVyg11
MD5:	DC2F79A4D4FF8FB5E925F4280948C945
SHA1:	CFB5D34B0418AB63FF80F42DF6D71261161D6D3B
SHA-256:	A6EE6E6928216497BC3A6FDFFE8AC57609B782DF7568325318074ADD6C0F3C88
SHA-512:	8454E05D27F4A218C4FD5C41482076C82DC867ABEDA773C166B2CA0D8ACBFF671D7AF5A81631FA67AFE08D464B570CDF217A3C77B5CDD8439198B8F1C84B9D16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0.......#....`.............................................e............ ...................)..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22920
Entropy (8bit):	6.545679774764539
Encrypted:	false
SSDEEP:	384:vQUbM4Oe59Ckb1hgmLNW1hW4U8JIYiaHZ8ZpH3GCJEkybhnI+:vRMq59Bb1jECYiQZiRBEk+I+
MD5:	402F56B4A217E8F41C868C451A1D2FC6
SHA1:	A165605C62A2231DF71738075E632C408ACF67CF
SHA-256:	2A6F86D8E528E19C678A89B946F15EAB3D46F627165ADA45BB60FECBF4739865
SHA-512:	95014918F332C6A573FA5AEBEECA0FBF05D489612413833654C1C403665F81D7A575A2621E01AF6E7D8CC050C657DF15CF00BEEA874E9E3E4BA17C8A58F8184C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+H............" .........,...............................................P...........`..............................................%...........@...............0...)..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21896
Entropy (8bit):	6.543954255052099
Encrypted:	false
SSDEEP:	384:Ny+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWNU8JIYiaHZ8ZpH3GCJEqyCL3WW:NZKrZPmIHJI6aBYiQZiRBEqzLl
MD5:	0FA160EBDAAE81862A2B88883566F899
SHA1:	490B64DCE8CAFA7D73A4D946B1779EDA6A4C01A1
SHA-256:	F0DE63FEEC5D6B908BBC02A3C8BDBFC87D184A43C509DA1C3176DE2B2F494820
SHA-512:	68F4F81488F71B6041014D1BE707378DC1728D6B9C19F8F7C7CDECEAF1619B1E6A7349B2964161DD1E94DA149A4DD9A5121CD9A2CFE8262F5581AC618883EE72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...V..*.........." .........(...............................................P......M.....`.............................................. ...........@...............,...)..............T............................................................................rdata...".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66440
Entropy (8bit):	5.697953129287171
Encrypted:	false
SSDEEP:	1536:a7bLPuDe5c4bFe2JyhcvxXWpD7d3334BkZn3P907ciDrM:ayDe5c4bFe2JyhcvxXWpD7d3334BkZn5
MD5:	76EEB985635EB71B0541335EFF83E230
SHA1:	8A0591774B080EF06966A636F75A2BDA8E0F68CD
SHA-256:	87CC55D14990FAB5A8CCE73106D8545D38AE59C3BB9485040AF5F5ADE3D7E7DB
SHA-512:	06B624B16270A61FFB745F9DB777C0EF51470FCDBE72684D08FAA3F954049755D506E5B1F82F2A4FBF87A984A6848BA490871BD705340E191FE9838FEEB42349
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...Y..b.........." .................................................................l....`.............................................-................................)..............T............................................................................rdata..=...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.005640037022501
Encrypted:	false
SSDEEP:	384:oKwW1hW6U8JIYiaHZ8ZpH3GCJEePyWFBlQ:5IYiQZiRBEePH+
MD5:	328D36C0527739041610864D00C94ED1
SHA1:	2339D59AA8EC6FB704ECCFDDBEFF8994C822D77B
SHA-256:	71E954BEC48746D33B5C75823C367412B3739CBA86B6F28B23121EC6B0A04FF2
SHA-512:	B40377FB71806A68124A9C4E1D6B00456FDA86E4547038FE5450CA967AF1A79D6818B697A731ACF2008416AD07A511307D0D9902CDC645F80F00FCC5E2BBFAFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...*j............" .........................................................0............`.............................................x............ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18312
Entropy (8bit):	6.819091914126433
Encrypted:	false
SSDEEP:	384:XtYr7zW1hWnU8JIYiaHZ8ZpH3GCJEbyqRxk:Xmr7WnYiQZiRBEbXK
MD5:	79C4F774C9A95DCDCEB71289D59DCD69
SHA1:	B88882D72A40DEA08B919B106EB23BC3C3E58A3C
SHA-256:	C4253E9A20E3E0F6437CD3DDC00D667BEB7E6330E4E985349F6FE721D689FA8B
SHA-512:	05995750BE7E95005EBE8BD6F7C6B16343F70DF619CA3FE6D6BE870D20CEE9834085A8717A9EAB86EDF03210ADA6991F7256958CED3C55F208CA2778DC8F0564
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....V.4.........." .........................................................@.......B....`.............................................4............0...................)..............T............................................................................rdata..D...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19848
Entropy (8bit):	6.750096552253246
Encrypted:	false
SSDEEP:	384:dZpFVhHW1hWeU8JIYiaHZ8ZpH3GCJEcypF:VowYiQZiRBEcU
MD5:	CD809EB5569F96AD57E32E76A6277DB4
SHA1:	D305C1F48E23841F0AF22AE32FEF26585D670131
SHA-256:	4C46AC68ABB3EAAE5CA3204601E9D188BDB649E236AE06AF8553DCA858A10B8E
SHA-512:	3D7105343620844A52EAF542E0DB6A762D2835EB9B2B05FFFE367C3912B461547C788DFBEB799011E4F70C62E8DE6A73180E99BA762E97B7291516933BC18C3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Z?..........." ......... ...............................................@......tS....`.............................................a............0...............$...)..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19848
Entropy (8bit):	6.732592635220981
Encrypted:	false
SSDEEP:	384:XiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWlU8JIYiaHZ8ZpH3GCJElyCGpq:X6S5yguNvZ5VQgx3SbwA71IkFhlYiQZF
MD5:	A896CC5ECD15A764FB3AFC6CF3AC0C30
SHA1:	D4F4932DCBD027FE00B74825A1DB59CC049C2BCC
SHA-256:	1E5E32E75B172743C729AC7A0FE7643217161CE6FC9E9D1746063B34297B59FC
SHA-512:	CD82AFF42F11E1CC31D967981CAF41056585A9F3E9886335814F8DA1EED87D5267249A33AAEFEF55AA3804E1722DEA658E5F374F9ECB8A7DCAAB4ADC8480742C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...\|P=z.........." ......... ...............................................@.......'....`..........................................................0...............$...)..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16264
Entropy (8bit):	6.919239016038727
Encrypted:	false
SSDEEP:	192:jJDmW1hWLUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfZye8Edyt2Ri:jUW1hWLU8JIYiaHZ8ZpH3GCJEhyzAyf
MD5:	3FAEF63E8A82DCCFDA4867DFFB219BF1
SHA1:	316579927C88B5930056CC6F6633125C622424A7
SHA-256:	358FDD9AA1582A7674B4A3E480F8FCE55D1E60CA1C6E3F4326C08538F378E390
SHA-512:	521A5566D104A622E08C9AAF3B9A36B00AE1FCC3FA35AE0C336037BA904CD5D4B89B208F6D1BD2777AAD04665CBF076E7E4EA1A8343CBAD931DC4D22290D4A2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0............`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.087749261169959
Encrypted:	false
SSDEEP:	192:OfHQdurW1hWbUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfzy2ABQ:OfVW1hWbU8JIYiaHZ8ZpH3GCJE7y2ABQ
MD5:	DD0ECDCC4A9AEA38525888493994EB93
SHA1:	2C39D950D61AE8BF86A35AB052979069E5D7CC6B
SHA-256:	6BC7AD2FA59D9D21921144F6D42C0A74DC109A72EDD2968C0AA9FCD9AA5D78E4
SHA-512:	E2C42CC4A2C960F162474E3A6E3AC07D25A4EEA2C68C050F5C3ABD2C365E3E84D47D6ADF374DE0372CB49A18DD6EBA87FB1DAC74DFD713328E5B26FF89DF9598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d..............." .........................................................0.......)....`.............................................^............ ...................)..............T............................................................................rdata..n...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\attach.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29064
Entropy (8bit):	6.457776764422193
Encrypted:	false
SSDEEP:	384:XqyrdDdBh2IRL8IxPa88FoKp7sx0xhuHwlfG0U8JIYiaHZ8ZpH3GCJE/yNQ2:XJr9h2IRwIgdr3GDYiQZiRBE/GZ
MD5:	59E8B3EAB985C0742D73D8E601E58D69
SHA1:	456F6C49664A2E3CA724D43565CCE333764159B7
SHA-256:	D6D2155D66205CBF80680F199FCD919B985452328E5B7AB1B96AB9F81093475F
SHA-512:	FA8A5AA8719630EE97665906A8CEF2A999CA51898A012EA3C984E1E85F0B69039C3C3F4BC50CC49404D84BA2DB3AD75AB78961A326199E565A07EBADA45FD870
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.*LT.yLT.yLT.yE,-yDT.y.<.xNT.y.<.xGT.y.<.xDT.y.<.xNT.y.,.xHT.y.=.xOT.yLT.y.T.y.=.xNT.y.=.xMT.y.=AyMT.y.=.xMT.yRichLT.y........PE..d....2.f.........." .........,......D"...............................................m....`..........................................<......L@.......p..x....`..X....H...)...........5..T............................6...............0..`............................text............................... ..`.rdata.......0......."..............@..@.data...H....P.......<..............@....pdata..X....`.......>..............@..@.rsrc...x....p.......B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\awt.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1502088
Entropy (8bit):	6.361258895465982
Encrypted:	false
SSDEEP:	24576:asd2qABOFdhXawZ0bt94hdiMbwNnzOZS/dupaEWbXvgCVehibRSyrcFKK:asd2qmOFdhX694hdiM/S/dupfWb/gC0d
MD5:	E1ACDEB936AB41BE9EA310217DD0878B
SHA1:	71DB56BD70E66C267DB8A50650231A075A0B17B3
SHA-256:	886C8FAE0F05091CA3EC87820AC446BF2DCD638D269B11EF53964E3522F31310
SHA-512:	9B9C5A79CE2709809AAF02D818C676A78E49567E4F13AFDD233A3D45C3F4710EB746D5ED930AA8003F89D92BE46AD467C22E44C26F6C2F7DB60448394CD48384
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................U......................\|.............................\|.....\|.....\|.....\|.9....\|.....Rich...........PE..d....2.f.........." .....v...................................................@............`......................................... .......,...\|........;......x........)......,9......T.......................(...............................`....................text...^t.......v.................. ..`.rdata...-...........z..............@..@.data...............................@....pdata..x............v..............@..@.rsrc....;.......<...L..............@..@.reloc..,9.......:..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_shmem.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36744
Entropy (8bit):	6.499801097298586
Encrypted:	false
SSDEEP:	768:McNn8cyz5qH96Zzq8ljW8XRRxYiQZiRBEC6Z8KP:98c65w8XRRx7ciDt1a
MD5:	18473B6A9F5E37632DFFB35D214813F2
SHA1:	5C6EC9A15905E3D96DFF5C982CEFC9D1B384C47D
SHA-256:	81EA5288F64464E0C0542FB100A6B6F03CDFBD0EBDA27E45D2138A6027204452
SHA-512:	D320A20B7CFC439D5860BE810268BBD951A5F901A2A8C70C84D187F512C8E063EB50A1662DDFC3020CFBEF5ECB3677FE458DA1730F5FE3CE3C1B90D09FAE15E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lrM.(.#.(.#.(.#.!k.. .#.z{"..#.ck".+.#.(."...#.z{&.#.#.z{'. .#.z{ ..#..z'.-.#..z#.).#..z.).#..z!.).#.Rich(.#.........PE..d....2.f.........." .....8...0......4=..............................................aR....`.........................................0`..X....c.......................f...)......(....X..T............................X...............P...............................text....7.......8.................. ..`.rdata.......P.......<..............@..@.data........p.......X..............@....pdata...............Z..............@..@.rsrc................`..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\dt_socket.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32136
Entropy (8bit):	6.40878215289343
Encrypted:	false
SSDEEP:	384:qScTFTVZK1jlzNXstRgYyBb4hcWzBHbmb4YuBRsU8JIYiaHZ8ZpH3GCJEDySzeOC:qScZxZq0DyByxVHbmF65YiQZiRBED0
MD5:	154E835B39A62EB2CB894B8364C29237
SHA1:	73FC4B55793DDBC28AB2DDDF26C589C5121D9829
SHA-256:	67305EDABEBCD0FD14A2B46176E2B7F0A5C705590720A0B95B49569B989075AA
SHA-512:	FB3C6F69AC49261FE88B15135671031BA75304598ABD1E8A7391C17E337AB84427A30E2D70EE5A351A69552B954BCDF11E6C514207324B75FBAC78E2CF50622E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"G#.C)p.C)p.C)p.;.p.C)p.+(q.C)p.+,q.C)p.+-q.C)p.+q.C)p.C(p.C)p.;(q.C)p.-q.C)p.)q.C)p..p.C)p.+q.C)pRich.C)p................PE..d....2.f.........." .....&...0.......+..............................................nn....`..........................................U..X...HV...............p.......T...)...........N..T...........................0O...............@..H............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\fontmanager.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	844168
Entropy (8bit):	6.56046679144231
Encrypted:	false
SSDEEP:	12288:XgehP5naDoGIrUteu1tKxMmOZD+MXVBQzs0FOkD68oVGSqrfEWm7BD2mI:XgeMoG0UtRtKxhWBQg0z6xHZAmI
MD5:	54B2FF27EAE0F32BB439CCFDFC174857
SHA1:	3DB68AEB14DB16B4DF8922479C1908F4F8690A5F
SHA-256:	A9FC3518553E19CF5236E1416B2968A96983DCEF6E49EBA677A252DF71267020
SHA-512:	3A3566A640DB9E54F4CE2CC6CCE9C3BC2DA4C4D4A23FFB10249BF59CC9769066057B48047DBA7888A897B9DD42B906AABFF3CDB8882890AD1EFC3325D1F3EE7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.E.).+V).+V).+V .V9.+V{.W+.+V.?.V.+V{..W=.+V{./W!.+V{.(W.+Vb.W!.+V..W,.+V).VX.+V...Wp.+V../W7.+V..+W(.+V...V(.+V..)W(.+VRich).+V................PE..d....2.f.........." .....D...........C...............................................)....`..................................................%..@............p...{.......)...........Y..T...........................`Y...............`...............................text...#B.......D.................. ..`.rdata.......`.......H..............@..@.data....!...@......................@....pdata...{...p...\|...*..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\freetype.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1343368
Entropy (8bit):	5.927591339711535
Encrypted:	false
SSDEEP:	12288:O520RsaGQmt9ASY9oo9UlMPHWqyHo9Zgj0II53uAKLh41zePfEWmiQwAmtFg4s:siaG9t9ASValW73j0vE4BeUZiRuH
MD5:	375E7033A3822B63264BB0A918E52FE0
SHA1:	EAAEE3CB5ADC044AA248231899BF03782510D62F
SHA-256:	DCB2ABA28CCE26FA8FDBFC923EBFDD06E7B12BE223E04B2B52D6D0F822E0FEE9
SHA-512:	317BCFE07EF8B5AC509DF8039DFBC367AED14AC8B7FDA257F9B02D21FE87C30E529287377AA062A411B625A8359A4FC425BBDFCCA745F3A37BD9E1822D18FDD7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l...h..l...o..l...i...l..}...l..i..l..h..l..o..l...m..l..m...l.1.h..l.1....l.1.n..l.Rich..l.................PE..d...&/.f.........." .........X......]D....................................................`..................................................s..(.......<............V...).......... ...8...........................`................p...............................text............................... ..`.rdata..6%...0...&..................@..@.data....0...`.......D..............@....pdata...............V..............@..@.idata..#....p......................@..@.00cfg...............,..............@..@.rsrc...<...........................@..@.reloc..Q!......."...4..............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\hprof.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	166792
Entropy (8bit):	6.419082845915359
Encrypted:	false
SSDEEP:	3072:CIL1AxMgtig4/GwNu8A+rBGSB+Y+/EtBc6rX0WzoB:/WxMtg4NNu8A+rBGCcmX6
MD5:	FF637A9386750AD5B81F025641848892
SHA1:	8F3AB7AB92B670314F441ACE81B3FA475FE0B24C
SHA-256:	A4E4566FDCBF4E71BEBEC7AEE358FB664D80064859577CB36AEE31D034D6E94C
SHA-512:	ABACE0C3B98DAA143FBAD635BEE125272559CC85D9865DABD52FB6D7E84D0AA797FCBB66DEB4835802FD46A93AB7D1DF3820251663E4A7EB99DB4D81E4E9398E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gA..# ..# ..# ..*Xy.1 ..qH..! ..-.& ..qH..( ..qH..+ ..qH..! ..hX..$ ..# ..u ..I..9 ..I.." ..I.." ..I.." ..Rich# ..........PE..d....2.f.........." ................$...............................................`.....`.........................................0<..d....<..........p....`..H....b...)......x.......T........................... ................................................text............................... ..`.rdata..>v.......x..................@..@.data........P.......:..............@....pdata..H....`... ...<..............@..@.rsrc...p............\..............@..@.reloc..x............`..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\instrument.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	219016
Entropy (8bit):	6.551163810991293
Encrypted:	false
SSDEEP:	6144:ICyi91Ui5nbYsDqH90OAE0OYqSyFtrUbkhoMRxT:ICbv1bYsiSO7BSyFtrUbkhoMRd
MD5:	BFA756C5C07C165C6E195635BD355246
SHA1:	7B8F92008A80A0B6BA9F3F64E67BF0E87E748F14
SHA-256:	3E59218B32518E7A767D838A02EB789FF0FC116A973616FFF8581365BDE59BF6
SHA-512:	F8A74455C68929B0E2749983C43081F03CE3FD4FE4347A708458BED23DC121406DBE47C6BF6C961D66CE0417835F98A388E7105DAC9BCBF46928B3AB70CF77EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^...?...?...?...G..X?...G...?...G...?...G...?...?...?..Q.Z..?...W...?...W...?...W...?..fV...?..fV...?..fVb..?..fV...?..Rich.?..................PE..d....2.f.........." .........P......D...............................................).....`.............................................\...<...(....p....... ..P........)......l.......T...........................p................................................text... ........................... ..`.rdata..............................@..@.data...............................@....pdata..P.... ......................@..@.gxfg........@......................@..@.gehcont.....`....... ..............@..@.rsrc........p......."..............@..@.reloc..l............&..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2gss.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49544
Entropy (8bit):	6.447886564525808
Encrypted:	false
SSDEEP:	768:xIF4X3YbTkk0egSfWpJ2SGuuGRNu0e3I9Qq3CEgCG+FyDU1M5o/oYiQZiRBEx3:29lWHHXEaQq3CEgCG+YDU1MK/o7ciDW3
MD5:	EF936ACCF5F61E7D34D715E9CAF115D6
SHA1:	3D23A0558A58EA315374631EAC2FC5369208E5D7
SHA-256:	B1B60E22DE429B49D8504CFDB0391135036C15F2C3FC50BB061353586A33CA61
SHA-512:	DCA9163A47BDC9FEA4698486727EC6C2E7F54B34B7F8FC18B11AE31F975198BBC8BF70DA75A558789CAC9448E20621DE2AE783922C0F20B5CF3EF714FD135005
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zpNR>. .>. .>. .7i..8. .ly!.<. .ui!.=. .>.!... .ly%.5. .ly$.6. .ly#.<. ..x$.=. ..x .?. ..x".?. .Rich>. .........................PE..d....2.f.........." .....T...H.......W...............................................`....`.................................................8...x........................)...... ...P...T............................................p..P............................text...3R.......T.................. ..`.rdata..t5...p...6...X..............@..@.data...X...........................@....pdata..............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pcsc.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25992
Entropy (8bit):	6.530518792396428
Encrypted:	false
SSDEEP:	384:BoOssTd/qqkggOlXD3N+XQnggIfU8JIYiaHZ8ZpH3GCJE3ykm+A:B3s8tqqnQvHGYiQZiRBE3hA
MD5:	018428327A4C422F2F15DBA11237115A
SHA1:	AC1303C6340C99D350C5F27A4E1A115838A5909E
SHA-256:	CD8A6EBBBF6900BE3FFB46B073194DDE000CB72088EBE3FFC462126ACACA847C
SHA-512:	1F4B013DD8204B1C060E89496A2046A0EF53AF0CD6F6A8C582E4672EC71E0CBDE24581983401E9BDA1DEA3FF396D0CBD76A17FDA774C2CDAB4FDFD841D3083A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xg.xg.xg.q.^.~g...zg.....yg...sg...pg...{g.3..}g.xg.Wg....zg....yg...2.yg....yg.Richxg.........PE..d....2.f.........." .........$............................................................`..........................................8.......;.......p..x....`..X....<...)..........`2..T............................2...............0..x............................text............................... ..`.rdata..\|....0......................@..@.data...8....P.......0..............@....pdata..X....`.......2..............@..@.rsrc...x....p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\j2pkcs11.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76680
Entropy (8bit):	6.346533501038012
Encrypted:	false
SSDEEP:	1536:9hedCVtUP7r+59k3HW37OlwoUGaWp4RRNqxV6FSP59XvhRFPSe3QNsqVolyHbMPf:GdZP7r2UHW3qlwoUGiRX4yAKotd
MD5:	6F72455380D2BB6AABB396FBA537BC96
SHA1:	4CFE18290F41CEB8AE9B206A4F4C721DFAB72B7F
SHA-256:	9EC36C94FA1EE3E7EC97FC31BE6476332ED62953FAD2E82916CD692D1D5D9D55
SHA-512:	AB7E3E72C6732278300AB174B84D3D8B78D558B7980F42AB614F44F663B63BE68139DDF77C710A923DD5258845667CE3E876AC607421DDDE6634822E964B657B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c....................................................................:.......:.......:.....:.......Rich............PE..d....2.f.........." .........T...............................................@......v.....`.........................................`...<............ ..........p........)...0.. ...0...T............................................................................text.............................. ..`.rdata...6.......8..................@..@.data...X...........................@....pdata..p...........................@..@.rsrc........ ......................@..@.reloc.. ....0......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jaas_nt.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27528
Entropy (8bit):	6.585897956451821
Encrypted:	false
SSDEEP:	384:Q944aOlGDFS18v9C9IjCHwBeGaNU8JIYiaHZ8ZpH3GCJEzyBJnhfosf:3/hS1N9I+DGaQYiQZiRBEzcLf
MD5:	04470688955A55D94874313D75463BCF
SHA1:	A87AB09122D2DEB78C05E4C656BBB18E00EF503D
SHA-256:	698ACC0CA31CB72D39D0E8DB3BC285F991A72DB477A235E6DCA44784A1C6C842
SHA-512:	669E5D47E8ADD3078A8898BE06F16CE9BA2F7710476BB611F6EB894D0E8A00ADF9E33B1C6A8CB4617615663863C0BC344097041AEF9474ABA71B776E9C5A6C92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].................K.....K.......K.......K.......K.......R..........."..................'............Rich....................PE..d....2.f.........." ......... .......$..............................................P.....`..........................................>.......>.......p..x....`.......B...)...........7..T............................8...............0...............................text...3........................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata.......`.......:..............@..@.rsrc...x....p.......<..............@..@.reloc...............@..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jabswitch.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44936
Entropy (8bit):	6.04923468931228
Encrypted:	false
SSDEEP:	768:6Jo7Itpr93j9PnO1H4YJqIfrHppsnyfyd2YiQZiRBE4Zi:6S78pHnO1YYJqIfrc8yd27ciDbZi
MD5:	7B78053135842AB4740988195300F80E
SHA1:	415C407B9D4132F462E82A1F1FCC0F64C745D16A
SHA-256:	363F616DEA3691E01DF986EA4FE5C63C5908AB8BC31D85E7DD26F84B9E2C2874
SHA-512:	8B5EE3F4C28515EF90AF7A0950208415B92CA7A06C665FD9175211790CBF221ADC489025CA1E4CFACBC22131101E83A2EB7055232C589B940F1C3088BF904C38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z0J\|4cJ\|4cJ\|4cC..cZ\|4c..5bH\|4c..1bW\|4c..0b@\|4c..7bH\|4c..5bC\|4cJ\|5c)\|4c..1bK\|4c...cK\|4c..6bK\|4cRichJ\|4c........PE..d....2.f.........."......8...J.......2.........@....................................TS....`.................................................4{..................`........)...........q..T...........................`q...............P..X............................text...87.......8.................. ..`.rdata...7...P...8...<..............@..@.data...@............t..............@....pdata..`............v..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java-rmi.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.543969750462236
Encrypted:	false
SSDEEP:	384:5blVtnWiUa4bFI6iYeEOU8JIYiaHZ8ZpH3GCJEHyM7m48:zifFqtExYiQZiRBEH0
MD5:	4BE39E2FF177AA2B783DBD9DD9988C7E
SHA1:	1E1CE4AD999A9FC30BE0D65D5866C2B79BE8AAB0
SHA-256:	111EE593A5DABA9894CD61493D3A188D1F6860B4535503BFB012D51B8D88542D
SHA-512:	3C59F0F3FBA916A48D647F0763E5EE2CD5F6F84104839EC5332BCA3C253E4718CBA443DB022C85AC0FB2C2E7CF536E2CD53843D3BF683D345AD4EB040405058C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f..........".........."......$..........@.............................p............`..................................................(.......P..0....@..8....4...)...`..$...."..T............................#............... ...............................text............................... ..`.rdata..>.... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...0....P.......&..............@..@.reloc..$....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	167304
Entropy (8bit):	6.440334068978186
Encrypted:	false
SSDEEP:	3072:eeAMwWRZQr1heBRIAX8/zaWFsboxzHieSt/VZVGuJrgW7JLMLok3:elgs1UEfaKqJKQG3
MD5:	6E3D5D77984B659CA837A096D83A9B63
SHA1:	56CE7D1E456B720345B8E3CC458091ED7388AC9B
SHA-256:	75A9383E96350FED40D30E7A73FAB93E1FED873B8296AEAD2A6D698BFE9FDBB9
SHA-512:	8DEDAB7DA6F8BF49AE8241FDEF3537D77463D9EF1C72F0E89FE69563201A991A8E472F7CE43114464AC49FB2693FB0620CA4BCF7011B6B7B10464330881CF656
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V>..8m..8m..8m..m..8m..9l..8m..<l..8m..;l..8m..9l..8m..=l..8m..>l..8mi.9l..8m..9m..8mi.<l..8mi.8l..8mi..m..8mi.:l..8mRich..8m........PE..d....2.f.........." ................<...............................................t0....`.........................................p....=......@.......p....p..t....d...)..............T............................................... .......@....................text............................... ..`.rdata..............................@..@.data........P.......4..............@....pdata..t....p.......J..............@..@.rsrc...p............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	315784
Entropy (8bit):	6.621954730102745
Encrypted:	false
SSDEEP:	6144:4Q7GzIdOOEOqcL43SKhzcQCH5UbVYW3TCP/7k/92:41GOOqcc3SgQQJxDt12
MD5:	990B10C495E3E60ED7AF4BA310AEDE57
SHA1:	67D895303DEDADB76171EAE5CA545684439617E5
SHA-256:	CDE27451C4EE3ECD8E7954B79B69506A42FA064B9E7C445AB8AF8667B0B22DA0
SHA-512:	0680183B3A6EFDBDB3BAD59F77554D74BB99E6F869446E22B671F50F2353903D0F56A294BAC37DE8223BEBE4ABD4DB446B37C0B6E2802BC14AE57B944D991BAC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z............c..9....c......c.......k.....s......s......s......c............=r.....=rS....=r.....Rich............PE..d....2.f..........".................0..........@.....................................B....`.....................................................d........o... ..4 .......)......H...@...T............................................................................text...`........................... ..`.rdata..............................@..@.data...8"..........................@....pdata..4 ... ..."..................@..@.gxfg...P"...P...$..................@..@.gehcont............................@..@.rsrc....o.......p...0..............@..@.reloc..H...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java_crw_demo.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35208
Entropy (8bit):	6.677571096035446
Encrypted:	false
SSDEEP:	384:BB/apIy0kJo26spOeQ5ZZbycN8jfzGQoUU8JIYiaHZ8ZpH3GCJEhySaKK:L/TQJ3pOBZLuLzGQojYiQZiRBEh7XK
MD5:	F99A86A12815D53F27B884BB20ACD457
SHA1:	94B0EFDA2C8FA9808A067F704423F21A5C3F6335
SHA-256:	C80DE6597AB2747AB2D85426B0C9591E10B55E68B06BB501AB26D89FD6E69BE9
SHA-512:	3BB518CC1FD478885E62DF466B3E801CC164F788B2BBA8A39B303FA16902723CAB1C52927DDCEF3E1D156D5A69C1011AC98A597D6FEF9D6301AC0FDD052772D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... Zq.sZq.sZq.sS..sRq.s...rXq.s...rYq.sZq.svq.s...rQq.s...rRq.s...rXq.s...r[q.s...r[q.s..as[q.s...r[q.sRichZq.s........PE..d....2.f.........." .....<...&.......A....................................................`..........................................]..t....]..................`....`...)...........U..T............................V...............P..`............................text....;.......<.................. ..`.rdata..r....P.......@..............@..@.data........p.......T..............@....pdata..`............V..............@..@.rsrc................Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\javaw.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	315784
Entropy (8bit):	6.624259103311568
Encrypted:	false
SSDEEP:	6144:bxDlW7cWuOwRDKD21C9s17I1wNaqYguyha4J7k/wI:bWgWyR2D2M+lgqrZeYI
MD5:	58823D3877AD11AC254C917B89242DEE
SHA1:	9EA16D7D95FE67134A89B6A7D738972626FC5211
SHA-256:	89BF25AF176C688626DA1037B906677EB281FC2CEDAE2797B0F610D9969A462D
SHA-512:	62AC17277AB8505F5B1252D6D8DC26C41CCD75412779EC1D996CE2D7DD3F15869D494461C16362326D250C0B1A69B129E40B4659F6A2A85348EF2947B8A03F4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!.{.r.{.r.{.r...s.{.r...s.{.r...s.{.r+.rr.{.r...s.{.r...s.{.r...s.{.r...s.{.r.{.r.{.r...s.{.r..Jr.{.r...s.{.rRich.{.r................PE..d....2.f..........".................8..........@....................................v&....`.....................................................d........o... ..@ .......)......L...0...T............................................................................text............................... ..`.rdata..............................@..@.data...@"..........................@....pdata..@ ... ..."..................@..@.gxfg...`"...P...$..................@..@.gehcont............................@..@.rsrc....o.......p...0..............@..@.reloc..L...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jawt.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20872
Entropy (8bit):	6.544070353413089
Encrypted:	false
SSDEEP:	384:fEgjymwa+amY6+4etfiU8JIYiaHZ8ZpH3GCJESyKFWhJ:MsymwzaZTXtdYiQZiRBESrCJ
MD5:	CE4B3C2271845630D8E57A3EEF984593
SHA1:	1E70DF3DBAF3D43948B9D57BCE134406E574F261
SHA-256:	249ADBADDA0E495750B38F29A858BD954DF57121393970DAF35D27CF145B471C
SHA-512:	1D156A8AC93C77936D823F4AE840E4AA66B12924DDE3588578C0D54D63B347C7162EE42AEA8D5ADD3B1D9047E56F3D687C8E8BD00FAFFBBDE655DC510445F010
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........o.r.<.r.<.r.<..4<.r.<...=.r.<...=.r.<...=.r.<...=.r.<...=.r.<X..=.r.<.r.<.r.<X..=.r.<X..=.r.<X.X<.r.<X..=.r.<Rich.r.<........................PE..d....2.f.........." .........................................................p......%.....`......................................... '..H...h'..d....P..p....@..h....(...)...`......p!..T............................!............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata..h....@....... ..............@..@.rsrc...p....P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jdwp.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210824
Entropy (8bit):	6.3902329117457075
Encrypted:	false
SSDEEP:	6144:LEYfMIncJ8w+iwoi4m16vkgM+objT3s4c8MKK5uQhllgaUzpUEEyn1em0jaxExL8:LBncJ8w+1oXm16vkgM+objL9hMb5uQh4
MD5:	F72D5A2C731A6F6E7D978AD32210223F
SHA1:	4B77945F5B8FDC08D8AA856F68F23A305A51C62F
SHA-256:	5426A4578F6788373754287489BAAAED5825703971E8A729E43C76034685B7A6
SHA-512:	B694E3AC7C60FAC53660544B79CBA167827301DA64E797D03D5986EEB740900C120562AA41528D97F9D8732A1559CC038C9C96CF12C334064C831BBFBA580194
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............j..j..j.....j...k..j...k..j..k..j.30...j...o..j...n..j...i..j...n..j...j..j......j...h..j.Rich..j.........PE..d....2.f.........." .....d...........l.......................................`......`.....`.............................................d...T........@..p.... ..X........)...P......P...T...............................................X............................text...sc.......d.................. ..`.rdata...\|.......~...h..............@..@.data...0...........................@....pdata..X.... ......................@..@.rsrc...p....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jjs.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.5582742088281565
Encrypted:	false
SSDEEP:	384:Sjk+VCAP6UWQEGplDbF1meE5U8JIYiaHZ8ZpH3GCJEuyihRCOn:SnV9P8hGp5F1LEcYiQZiRBEu3htn
MD5:	DC61B9DD7C8F51410C0ED2C38C01FA06
SHA1:	5ABD1393B99F5B69CD1FC359B530677A7556CDB9
SHA-256:	DBC9369C8DFF0D2E4A92A6AB8A1DCB7F324A2871EF5AEC64B8CB3B2A57D9E7A1
SHA-512:	D0B23753C63170856C9AA88F5361AAD25AFDE63A4A4539EFEF8CA929DA79BD5BC50C0B31F88A643EA497269AC353CD44DB0E9F7F194969E35F387ABC2AAF0E44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................T(.......P.......@..8....4...)...`..,...."..T...........................P#............... ...............................text............................... ..`.rdata..v.... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jli.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287624
Entropy (8bit):	6.565119524205053
Encrypted:	false
SSDEEP:	3072:elrQXh4ap8idEINZHFfPjyupUWiPJCrRJtPMOkFL6AqgdgaZmRXpURY9pEJrkL8D:elrQXt6oTl3uWiPiZILLqi56Xp99Ft2H
MD5:	CBF927041591882D8AC42E9A8DDE0B64
SHA1:	F4AF4271E0DA1916CEE12E876D5831FDE3F95693
SHA-256:	F847190B0832CD903BF76E47565B333B7C7D73FAD39A7D87129A3BFAB9C6FD80
SHA-512:	FA0B544D3F7E94017951FD0DBB4722F091A7EDB4B8162BD5A243B0EDC88230E8AAA338F8A11250807E049FB20810CB33200580B89A2A70671E7463806D93AED9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.v.q...q...q...:.......:...x...:...\|....L.v...#...Q...#...~...#...y...:...x...q.................p.....p......p...Richq...................PE..d....2.f.........." ................................................................E....`......................................... ...p.......d.......h....0..p ...:...)......@.......T........................... ................................................text............................... ..`.rdata..............................@..@.data....!..........................@....pdata..p ...0..."..................@..@.gxfg....!...`..."..................@..@.gehcont.............,..............@..@.rsrc...h...........................@..@.reloc..@............2..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jpeg.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177032
Entropy (8bit):	6.500575191033524
Encrypted:	false
SSDEEP:	3072:f4fI7fjS7eJfIdkAttrFY6SJqXUymHazVMmmzxNyroLIPdt5fyTQYoq:f4fIjjS6gdhrr9SJqrmHazVMmKxUrPY/
MD5:	0904739B5C55BE028B5ED1A3C93BC785
SHA1:	A2C61F93CF153B452AAD5DA0DC47F427B68C4AAA
SHA-256:	831582863FB89E2D0522270CCA8236C5D4354F9E8A851BBDBDE7C564C44C3B7B
SHA-512:	FF6B05875C1EA4B26DAFF22F0D007C597192BE273DDA2D1F38005E19C3AD66D64946F305D4ECDBBF4FDA5C078EAD5BD2C5D96E38FD0394B15E355E9767D9C132
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z.....,...,...,.cD,...,.s.-...,.c.-...,7..,...,.s.-...,.s.-...,.s.-...,.r.-...,...,...,.r.-...,.r.-...,.r(,...,.r.-...,Rich...,................PE..d....2.f.........." .................................................................D....`.........................................@p...... v..........p.......@........)...... ....I..T...........................pI............... ...............................text............................... ..`.rdata..0\... ...^..................@..@.data................f..............@....pdata..@............h..............@..@.rsrc...p...........................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsdt.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25992
Entropy (8bit):	6.4877219953340175
Encrypted:	false
SSDEEP:	384:DfuRWJf1e1zJG9BTkrwnGPwPKzgAQeNdU8JIYiaHZ8ZpH3GCJEtysyj:ruR2AZJGrGwnn6qYiQZiRBEts
MD5:	D8E2EEEEFBB222088861F5DE4D42B99E
SHA1:	6768AAEC96AAE9E0F90DC905889FEE0CE21F9D83
SHA-256:	9DA33BBB9C5BCAE618B3A7BA754C1EC3ED99554898392B1CD8316C7D8D71FA79
SHA-512:	E7582EF91D28CFDBDF6F102E8E8DB53933FC62F8A271D51C8502AA1C55766097EEDD133AD87529C9756E5E4F954F2E91C73755B23EE0F2C4C416B5BE4264CFE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.5.8...n..>...w..?...<.......n..7...n..4...n..>.....>.....=....Y.=.....=...Rich<...................PE..d....2.f.........." .........$......$.....................................................`..........................................:..(....;..d....p..p....`.......<...)..........p4..T............................4...............0.. ............................text............................... ..`.rdata.......0......................@..@.data...8....P.......0..............@....pdata.......`.......2..............@..@.rsrc...p....p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsound.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43400
Entropy (8bit):	6.499824931738572
Encrypted:	false
SSDEEP:	768:A9cuau+2V72zJ3R5O/PzKnYaxMn74BRxYiQZiRBE/S:A9cLz5yzKnzxMn74BRx7ciD4S
MD5:	62B62F0BE4CC668F1A66A823EA46DCF7
SHA1:	6DF30820FD0874576BEB1CD316351F7964A2ED08
SHA-256:	C8D160CD6D86F9B2AD4B201D54E3C62F4D3176E47A898F335E5B1A500CB17A0D
SHA-512:	1EB40E00E55A03338B4D163A62977790E8104E864A2B050DD9E4EC16995EB478C51B00B81858D89A612EDAC0D7E4EA90679D176DB7915784135E03D6E6FC9FAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{..{..{..r.3.s..)...y..)...w..)...s..)...y..0...~..{..+.....z.....w.....z..._.z.....z..Rich{..........................PE..d....2.f.........." .....H...<......8P..............................................`.....`..........................................o..D....x..........x.......l........)..........@g..T............................g...............`...............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...0............p..............@....pdata..l............r..............@..@.rsrc...x............z..............@..@.reloc...............~..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\jsoundds.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38792
Entropy (8bit):	6.614893107197957
Encrypted:	false
SSDEEP:	768:lUnuO+VvZLaICImRU0R9KjDqYiQZiRBEa8iX:lPNhCNgjDq7ciDtRX
MD5:	A7B3C9274AE3B9E1A8B28FE23259154F
SHA1:	110E6DF91481AB47FE7CE77B379722F5BEA64972
SHA-256:	7C586371C0F531C2BFE26C90A67F7966929148DF471C31AC17A190CF9A15535B
SHA-512:	47B0388EB1019CA6781525695A551DDCFF624C412E59DFA459DA7B8B868490C71CF8AD08D12FBAA062B722D1EEBAA55C86344BA980AA40A9AE6E0A375915F0B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.L...",..",..",...,..",H.#-..",H.'-..",H.&-..",H.!-..",Q.#-..",..#,-.",..'-..",..&-..",.."-..",...,..",.. -..",Rich..",........PE..d....2.f.........." .....D...6.......J..............................................{.....`..........................................k......(p.......................n...)...........c..T...........................0d...............`...............................text...@B.......D.................. ..`.rdata..(....`.......H..............@..@.data...(............`..............@....pdata...............b..............@..@.rsrc................h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\keytool.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.561218929580577
Encrypted:	false
SSDEEP:	384:xjk+VCgP6UFMwbFelqueE1U8JIYiaHZ8ZpH3GCJErypL:xnVtP77F1zEYYiQZiRBErS
MD5:	76CE7737864D806F3FEA860120A19431
SHA1:	1C4F40A0D358E86FF496BC87E08A41A0C5CBFE92
SHA-256:	AAD592E1357D0E332660CE6C29637D25ACD88A3B1A7B258EA706E8C5AEFE3E1C
SHA-512:	94F2007D29F5FB3D4E6A56B97E069E7993F3229732D98208BC770D13C54F2A3D7B45A1E027F63421504F21F655727C81C214099AE63AB1FB8A495B9B29329753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p......4.....`.................................................\(.......P..$....@..8....4...)...`..,...."..T...........................P#............... ...............................text............................... ..`.rdata..~.... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...$....P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\kinit.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.55961576628128
Encrypted:	false
SSDEEP:	384:0jk+VCAP6U4WCozbF99pOeEZU8JIYiaHZ8ZpH3GCJEayVoj2vl:0nVdP2WPXF9TTE8YiQZiRBEaSo2l
MD5:	4F995221348B2A2784C601181C78972C
SHA1:	4E9B918BFA329660FC35728BA1880CED30E385E4
SHA-256:	1F775820890B5B6F8CACDEA07038C2C4B4ACA67D15339FB50B7A274CBE5E2788
SHA-512:	1FD412EA151A95B1A6A7DA4C9A42DF27FF142CF0E23CFDB53AE0FAA71D45199A6FFE2808804D294A0D83D0E7C2FE13BA0645CAB36FC221F333F168BEDE956F69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................d(.......P.......@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\klist.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.560440076446053
Encrypted:	false
SSDEEP:	384:Ajk+VCAP6U4W0UzbF9DAeEmU8JIYiaHZ8ZpH3GCJEJy3P0:AnVdP2WtXF9D1EpYiQZiRBEJX
MD5:	44F650160F1E99196650CED6201202D0
SHA1:	DF793DDD504622557228FEB450B71C1BF2113ADA
SHA-256:	167816BFC8AF6C21B0B9CB29AAEE051382A095B15AC42137B21E7F53370E5B76
SHA-512:	08007457BF269E9CD7B545F2CEC40407715A7341DC8D8A722CF150E62F6BEFDFA00AC0FE371AC8880C3CAE0835B1F13DBDFCE8A01B38B22271A8A54CC47889D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................d(.......P.......@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ktab.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.56244225629764
Encrypted:	false
SSDEEP:	384:wjk+VCAP6U4Wj2zbF9xueEvU8JIYiaHZ8ZpH3GCJEoyXOYS:wnVdP2WaXF9xzEWYiQZiRBEoOy
MD5:	CE8A24923C866EA9F829AB3A2BB0CA9C
SHA1:	6A528C05103BB0A1CCEBB97C5A8BB93D271CA099
SHA-256:	39CF5AEA3D161B96E27D5640B9C3A8204130A1C87838998C06D24430CB137B4B
SHA-512:	F34982C09CE8727361EB0FF6F1AAD8F743DD3E4295CC2859D5114ABD67B5F37844C2C1B37357EB9D032723D17FDADA4461ED5743DEE92CCA07820D180D72AE2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................d(.......P.......@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\lcms.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247688
Entropy (8bit):	6.40247659820482
Encrypted:	false
SSDEEP:	6144:5JruPRhNno42kBLg9uP1+74/LgHmPr9qvZqhLanLTLzLfqeqwLBCRI7OLmRhHznU:vH42kBLg9uP1+74/LgHmPr9qvZqhLanc
MD5:	F1515CF6FEB5497754C13F5932870B07
SHA1:	B171D4B1C9470DD03CD9097B01C0A25F64875D88
SHA-256:	977ED479A13798AE6F3AD636D25D2F3FBF8FCE19809BF59B9117B3DDDAEC72E2
SHA-512:	96CDD3832EB958227B4943FEE9FD21DA7839BECEE10C7BCC03807354D4D08BFA0806B843B0E61907E0AB37A0819FB12C6E989C343E695364D88C8AA32A33A3F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h^.,?..,?..,?..%G5.<?..~W...?..gG...?..~W.. ?..~W..$?..~W../?..V..)?..,?..t?..V..7?..V..-?..VY.-?..V..-?..Rich,?..........................PE..d....2.f.........." ................D...............................................f.....`..........................................@..D....B..........p........'.......)......x.......T...............................................8............................text............................... ..`.rdata..F...........................@..@.data...pO...P...2...:..............@....pdata...'.......(...l..............@..@.rsrc...p...........................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\management.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44424
Entropy (8bit):	6.457075193383932
Encrypted:	false
SSDEEP:	768:deop6WNbsVmHMz5sPIebkcp0W8K1SS+ntBSXhYiQZiRBEeS1:o7VmEebzpx8KgS+tgXh7ciDFA
MD5:	22CEFEC45593A04C54836E4C7C19EB53
SHA1:	4656C25A0D102F1E2D4717F0DD1BE20E438E55BD
SHA-256:	6E9A90E2A11F9D5DC16C0C9402825646C097D1C60EC5E8070C2DD9ED9FEFAB70
SHA-512:	F4B8BCC5F8854F3575AECC2CE800FC3652EED0F9096055732077A20EABCDC0056BA650BEEB52A3BB409DE6BEED2208685A637BF2639DB7EBAAAFFD413CB08C81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.........................................................."............"......"......"......"......Rich....................PE..d....2.f.........." .....<...J.......?...............................................K....`.........................................@d..0...p\|...........................)......D...p\..T............................\...............P...............................text...s:.......<.................. ..`.rdata...6...P...8...@..............@..@.data................x..............@....pdata...............z..............@..@.rsrc................~..............@..@.reloc..D...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\mlib_image.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	696200
Entropy (8bit):	6.515163125189602
Encrypted:	false
SSDEEP:	12288:hbFSudEMuPBUj86KMt3Pamdd73QdHnxB9G0AUE8g9RZC97Rrkkx9:mudEMuPBUoQddUdHxLG0AJ8g9RZC91kA
MD5:	0E88155C2D9C1409A45BC7C5C8F11B44
SHA1:	45D3B81A1A38C124F542EC2E7268C3BACADA2475
SHA-256:	04F1E3EF28412AA2ACB1FEDBE95251747F3474372DA513A703C003C08B78A097
SHA-512:	11CD64347F86C6A4EA4C2FA1B93CBBD78D9ACB8C1FD8386AD43C249D7558AA492F6E4A6CE7C00183FE8EE7A264E517C3DAA5430B7955D2072876B200CBF57D7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+"..JL..JL..JL..2...JL.."M..JL..2M..JL..JM..JL.."I..JL.."H..JL.."O..JL.e#H..JL.e#L..JL.e#...JL.e#N..JL.Rich.JL.........................PE..d....2.f.........." .....V...".......\...............................................n....`..........................................^..$...._..d...............T....v...)..........p&..T............................&...............p...............................text....U.......V.................. ..`.rdata.......p.......Z..............@..@.data........p.......P..............@....pdata..T............T..............@..@.rsrc................p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	621960
Entropy (8bit):	6.343616812856225
Encrypted:	false
SSDEEP:	12288:UO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFC:f3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOj
MD5:	B6D10A28535FFC91167E41D08B770F1E
SHA1:	BAFC8EE45F761B9534009A06ABB823D4294F2D32
SHA-256:	326494E6F30D6161BF308DFFB3CE40ECA5ED8FEEA56F1C7D464EFAA1FA1BF1E1
SHA-512:	A6977411A530CAD3521E90877B276449C4B44EAF4A0006063D3DF2B1610D1F0C834B0AB2C5280C9619EB356FE4D5EEFB7BCE3C59936534E4D211B492736A6464
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... ...............................................GA....`A............................................h....................0..t@...T...)..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\net.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106888
Entropy (8bit):	6.398037453057503
Encrypted:	false
SSDEEP:	3072:SfoDjcaPrXArEkijY2CXhH8I8zcG3G/Peoa:0o0MZk12CXB8riS
MD5:	3976BCC73F0F07F22B6F1A64B8519282
SHA1:	0EAF172CAABC1EB0458A19A97089980BFDC39B7C
SHA-256:	DB936717C7C91A040208CBEAE4101CA6D531E49541784AC2E9C2E7367E5207DB
SHA-512:	C0C9C489B9148B8932003DD357B874EFDE4F588CA2B55A29AF0631A80542F6893CCA29AF9ECC339EBD28FA7023D78C4CECD73874B15773E41F90730C815EA429
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............B...B...B..>B...B..C...B..C...B..C...B..C...B..C...B...B5..B..C...B..C...B..C...B..C...B..RB...B..C...BRich...B........................PE..d....2.f.........." ................4.....................................................`..........................................J.......i..........h.......\....x...)...........8..T............................6..................(....G..`....................text............................... ..`.rdata...f.......h..................@..@.data...0............d..............@....pdata..\............f..............@..@.rsrc...h............r..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\nio.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67464
Entropy (8bit):	6.416979130384497
Encrypted:	false
SSDEEP:	1536:QEQSt6isQ134X9wweoNJ3yLCnuF7ciDj8:MSk2+X90i3gCnuFoN
MD5:	F1A4ADBA2FA6D2CC9AAFC772333F0AC9
SHA1:	5D853B89759F32956C52BAC6D0C97883912EEE22
SHA-256:	F8EBB62305D95F3B37DF9330BBEE14EF987F5F3B295452BC5F554249B704B7EB
SHA-512:	B48A868FD1A009F8CC1F3C1525A27C29D55F887218C85AB0685EE053F1D333627D6E40F1E0D622F54A3E1BC888DA72C33CA549BCB621C61141BE14F9D5E9F244
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D................................................2..........=..........2......2......2.}.....2......Rich....................PE..d....2.f.........." .....r...n......Dw.......................................0....../.....`..............................................)..............h.......$........)... ..........T........................... ...................X............................text....q.......r.................. ..`.rdata..JU.......V...v..............@..@.data...............................@....pdata..$...........................@..@.rsrc...h...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\npt.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26504
Entropy (8bit):	6.522483042053243
Encrypted:	false
SSDEEP:	384:M5tFSBrAFx0lt2x7Ta5VUYFgG8K+U8JIYiaHZ8ZpH3GCJE/yV+a:MXFSxYalt2xfiuJG8KYiQZiRBE/e
MD5:	30969C0B3FD646F8536242A8276281D2
SHA1:	8FB7AC0EA74A219D096CF42A5096F65419A2F6AB
SHA-256:	74CD1E15D93864967EC72C66D561C7F3AE1C84FE59EFFF0F940864D1D94BB298
SHA-512:	14751BD7390870675F67428EB8E51649C4CA78B3419CFB9CF81B6D5611171CBD14F96E68F00CB164CB7AE224CACD30B7E61FBE6CA169B1AD9346482EE5FF51DA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...G...G...G...?#..G.../...G...?...G...G...G....w..G.../...G.../...G.../...G..'....G..'....G..'.O..G..'....G..Rich.G..........PE..d....2.f.........." .........$......D!..............................................C.....`.........................................@:..`....:.......p..h....`..X....>...)...........3..T........................... 4...............0...............................text............................... ..`.rdata.......0....... ..............@..@.data...8....P.......2..............@....pdata..X....`.......4..............@..@.rsrc...h....p.......8..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\orbd.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24456
Entropy (8bit):	6.494061485194721
Encrypted:	false
SSDEEP:	384:xYwRSUf8FbFT5qeEaU8JIYiaHZ8ZpH3GCJEZySVF:625yFV3EtYiQZiRBEZR
MD5:	A640122DB7DD17876268B8D25EA90C19
SHA1:	1D6219D04B305AA19ECD5B0604EA9D18DB388118
SHA-256:	7AEA9209B8D4B5C92011D5E9697DF08A13BBC72B9EA04C4B0131A94B7EA8EC09
SHA-512:	CAAA85E918D5B93BCA66A50D7E53098C69912A27CC311C7F379F8E877C069794909AA72AC38BFD55C6F3735BE801104785C8CDA73673226516A01F681025A8E2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........$...... ..........@....................................3.....`..................................................(.......`.......P..8....6...)...p..4....#..T............................#............... ...............................text............................... ..`.rdata....... ......................@..@.data........@.......$..............@....pdata..8....P.......&..............@..@.rsrc........`.......(..............@..@.reloc..4....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\pack200.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.5581344974225635
Encrypted:	false
SSDEEP:	384:2jk+VCgP6UMDQVJEbFOyeEWU8JIYiaHZ8ZpH3GCJE7y+qmBa/:2nVtPCACFO/EZYiQZiRBE7rBBa/
MD5:	3E3BB601ED0B4C35FA97B5672B54FBE1
SHA1:	2F3A6E4F8D69C66560BFD416B486328935981E3D
SHA-256:	0C7713E404C7B186E8E9CC3A5B869EF9678EF8C87229F2FE52FC9341D7A779AB
SHA-512:	817E52CA2C57ECFABC6F6BF63B9D4708F5DDF2DB94810099E1F2FF82535A75B15FE09E50F5E52D358B28F826CDA11D7F4BC9358FE74FA59C2141AD7FED34783C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p......w.....`.................................................l(.......P..$....@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...$....P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\policytool.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.555697573223464
Encrypted:	false
SSDEEP:	384:ijk+VCAP6UBYKN5bFTMbEueEjU8JIYiaHZ8ZpH3GCJEQydw5:inV9PLYetFkEzEaYiQZiRBEQT
MD5:	1DE442F9D24C811FFA7028217010712C
SHA1:	A9C11E75920D7A61B8F6747B0CC7B4E58C815FBB
SHA-256:	EFB83DAD624E218FC604A7831B073B65CF9DA5FC80B672E8EAE1FEF039C2A9DC
SHA-512:	FE907BB0E7E565B6A8815572B282B0195D14849706238738B469D5E6F57D5C2168CE740F667A652FE79D6A6E22261CFE6E64704503EB86C135C788D41D563205
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................t(.......P..8....@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...8....P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmid.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.559223560662857
Encrypted:	false
SSDEEP:	384:ajk+VCAP6UWCmGRlDbF+k2XeEIU8JIYiaHZ8ZpH3GCJE+yEkQ:anV9P8ZGR5F5hE3YiQZiRBE+H
MD5:	D9FE5A486F065675DF8F5FD2A990FE9B
SHA1:	7641D23425D7D60A0A2AA430BE90999BF2E024DC
SHA-256:	ECF4AA7FCB135AFBB5C4ED1C973D3590E386E306734C98C0609E87C6C68B9135
SHA-512:	E6B091913F47DAEE8ACF9408D93CD4763939E662BE55A06C3334AFF4833879B8DE9A88562893143B3D332FDB84E79878C4E35F472442BC2C8D8A467FACA5DEEE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................T(.......P.......@..8....4...)...`..,...."..T...........................P#............... ...............................text............................... ..`.rdata..v.... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\rmiregistry.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.555700123606228
Encrypted:	false
SSDEEP:	384:Djk+VCAP6U4WzjzbF+yTEeEfU8JIYiaHZ8ZpH3GCJELyry:DnVdP2WXXF1ThEGYiQZiRBELV
MD5:	EAF714E477B7BFB87C6F11A04C4A2344
SHA1:	95CACFB8C54D13C74E3C4B7C333A28C002BBFF37
SHA-256:	7CF042188B4816A455163FDD52BC98C91D1F43A66ED1671A0D9DBC794C092DFD
SHA-512:	C6739C58E1A2828F1FC69A0504A5C76E102F6A2B0D12DD6AA1EC8A4830B5C7B8C9BBD89B766DB41D7678A1FF7EE4340C033655557FADE801E5E07E9CCDBC7BB6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p............`.................................................d(.......P..8....@..8....4...)...`..,...."..T...........................P#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...8....P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sawindbg.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70536
Entropy (8bit):	4.938044123117757
Encrypted:	false
SSDEEP:	768:wnWGUbpm47R/9e6CKHiECu13HQaq6/NYiQZiRBETajzi:4ytR/9eeHNx9Q6/N7ciDwui
MD5:	83C6649C9E9CCEF5A83596366429E4EC
SHA1:	364BDD5D82E3748029C667FDDB971DF076BCD745
SHA-256:	F7F8FE67306AE2035841D7AE742B53387425DFA0D1E04D209FEFDC8597F43911
SHA-512:	A734558577DE0BD3046DECDEBEB9D055DF4A021DC5229E7FDF6795CD0F1D0B0F56880DA26D08543566FD67A1281A6273DF13550CAF5EDE9CCC1DE49AD3666390
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.F...(...(...(.......(._.)...(._.-...(._.,...(._.+...(.F.)...(...).;.(...-...(...,...(...(...(...*...(.Rich..(.................PE..d....0.f.........." .........X......M........................................@......j.....`.............................................o...X........ ...................)...0..`...`...8...............................................X............................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....pdata..x...........................@..@.idata..............................@..@.00cfg..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\server\Xusage.txt

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	4.176285626070561
Encrypted:	false
SSDEEP:	24:N3ZYKm8fuW6psByGJjR0X46kA2SsGFhD+GbpGCOhLRr3n:mOLUskGJjyltsGFV+GbpGCOTr
MD5:	B3174769A9E9E654812315468AE9C5FA
SHA1:	238B369DFC7EB8F0DC6A85CDD080ED4B78388CA8
SHA-256:	37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
SHA-512:	0815CA93C8CF762468DE668AD7F0EB0BDD3802DCAA42D55F2FB57A4AE23D9B9E2FE148898A28FE22C846A4FCDF1EE5190E74BCDABF206F73DA2DE644EA62A5D3
Malicious:	false
Reputation:	low
Preview:	-Xmixed mixed mode execution (default). -Xint interpreted mode execution only. -Xbootclasspath:<directories and zip/jar files separated by ;>. set search path for bootstrap classes and resources. -Xbootclasspath/a:<directories and zip/jar files separated by ;>. append to end of bootstrap class path. -Xbootclasspath/p:<directories and zip/jar files separated by ;>. prepend in front of bootstrap class path. -Xnoclassgc disable class garbage collection. -Xincgc enable incremental garbage collection. -Xloggc:<file> log GC status to a file with time stamps. -Xbatch disable background compilation. -Xms<size> set initial Java heap size. -Xmx<size> set maximum Java heap size. -Xss<size> set java thread stack size. -Xprof output cpu profiling data. -Xfuture enable strictest checks, anticipating futur

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\server\jvm.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8566664
Entropy (8bit):	6.319180268142768
Encrypted:	false
SSDEEP:	98304:dQXkpl7JbsUBqwWH3JR7M8b29GD1kXkndxlFK9:dQXkpltbsCqwY5R7qGhkXknPlFK9
MD5:	F8BCD5091990610ABB05614DA97B5CF5
SHA1:	A053454868B2BA9F39C0394376B144478D62568B
SHA-256:	7980121279043F45875DAFD6C93D629C232FB7BD9515161AC1E10BB18BB374D5
SHA-512:	B07E2FBC6C9EE9CC1174D6DDC8CBA732A2A60C381E7734BC5098E5CB8A483E7B12591294A66433036C73379CB339F15AAF84B05CF89C7BB2DECF4A55D98657A7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yg..4..4..4..4..4...5..4O..4..4...5..4...5..4...5..4...5..4..4..4x..5j..4x..5..4x..4..4x..5..4Rich..4........................PE..d...)0.f.........." ......Z...'.......Z..............................................m....`...........................................t......v.\|............@~..^.......)..........`.k.T.....................k.(.....k...............Z..............................text.....Z.......Z................. ..`.rdata..."....Z..$....Z.............@..@.data...xZ....v.......v.............@....pdata...^...@~..`...R{.............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\servertool.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	6.557428275261103
Encrypted:	false
SSDEEP:	384:Hjk+VCAP6UBYv685bFTMbDQXeE/U8JIYiaHZ8ZpH3GCJEhy6ItaI:HnV9PLYvjtFkDbEmYiQZiRBEhsT
MD5:	4A089DB2A59B36430B608C36EA5285B3
SHA1:	E632B2AA02303F1FD89C4D88EC8E6540169FDD9E
SHA-256:	34CCDF82BCF7E779BE27CE6F09DD8ED0B7D97D1D11A3B82DB7CA005373E284CD
SHA-512:	43BA0861AB4500B61326FD1242A67E10AA7D7C4D98407884C6687D382AAF9725C95F94B1D3530EEBC1C8BACA8411B4C07ACDD90A3A08F4B207793BD907F2472A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........".................@.............................p......$o....`.................................................t(.......P..8....@..8....4...)...`..,....#..T...........................`#............... ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata..8....@.......$..............@..@.rsrc...8....P.......&..............@..@.reloc..,....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\splashscreen.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	218504
Entropy (8bit):	6.722434256803477
Encrypted:	false
SSDEEP:	6144:8JAiIpiVseNB1iOkf8kkc9axI34RGVP0Vkx8:/j0x1ikkkgIRG6H
MD5:	F202D84058F042A3CD0CDC207BFD4A8D
SHA1:	0DC961484B086F417919F959AABD7948C91C168C
SHA-256:	46C40F815E9DF43C8713CBC35DC9ADBF5A0BDEE15A5FC6E3A6D97F0F64D89A46
SHA-512:	18AF22BA3CA817B47CAC0DDFF9A0A617E56322B6DF7FF4449C16047D27289126C3571BDF328F6F1FD15513FCBED04FFDBE471BD5E2FEE726FBF961E15AFFB0FB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v..............o.............s.G..........................o..........n...D~.....D~......D~......D~......Rich............PE..d....2.f.........." .....N...........T....................................................`..................................................................`.......,...)..............T............................................`..........@....................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data....5... ......................@....pdata.......`......................@..@.rsrc................&..............@..@.reloc...............*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sspi_bridge.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43400
Entropy (8bit):	6.4102681568978
Encrypted:	false
SSDEEP:	768:CnyFD/wzbKTRQDN8CdLZ75jNr+ebUOXvDlmRYiQZiRBEMg5KR:WSw3AsbxxvU8vDlm7ciDvz
MD5:	2192F6C13DE24CF969E491B47EA0A142
SHA1:	2D09547089AFE54AF2E3C8F62876C520B215BBD2
SHA-256:	8D38D5CE744C51B7282279A225642DBF1CB452D0E8C1D1F9880228606EBCF8D7
SHA-512:	FD02EA3835AD4BF14ECF7594BCE115641C8D4927D4FBAD44E55955D02AC5B795243D7D0C79D06C949747CA97D9E4CB028EA2B62E373FFF03EFED60DA2F822E1D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.d.`...`...`...i...j...2...b...2...h...2...b...+...e...`...)...2...t.......a.......a.......a...Rich`...........PE..d....2.f.........." .....H...:.......J...............................................+....`.........................................P\|..`.......................8........)......T....p..T........................... q...............`..X............................text...^F.......H.................. ..`.rdata...(...`...*...L..............@..@.data...P............v..............@....pdata..8............x..............@..@.reloc..T............~..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunec.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144264
Entropy (8bit):	6.267955335664011
Encrypted:	false
SSDEEP:	3072:fwbT7/oytJXT5IOPHfrJru2heI143Ks869M+Xoy:27/oy/5IOPHfV7hp14EgM+
MD5:	5637B5D58B3949CAD0FB9250E080F45A
SHA1:	AFAD830583BF4DA024DD9E8C5CEFA5260A6F8D82
SHA-256:	19C25B2B8566702A1B5F38A86F3EEC2EFAC741BC6A6E1F0101D900950DC5811A
SHA-512:	8A0509C3B62283475765450614F2B907364F127F31DEE4C771DC2F26EE93611EE98CB140B43E0E44C4BF6BFF1F30088B7FE7B09E98FB5E9A25B070D5860F712A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N/..N...N...N...6...N..X&...N..A6...N...N..8N...B..N..X&...N..X&...N..X&...N..'...N..'...N..'...N..'z..N..'...N..Rich.N..................PE..d....2.f.........." .........................................................@............`.............................................p...`........ ..p................)...0..........T...........................@................0...............................text............................... ..`.rdata..>....0......................@..@.data...............................@....pdata..............................@..@.rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\sunmscapi.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46984
Entropy (8bit):	6.3435563087087
Encrypted:	false
SSDEEP:	768:49v3NO6ME5aNHMkb/IP1RWuISwks0mBUBdZ8jM5vnYiQZiRBEfwZ:49v3bwxTbE/vwks0m6BdZ8jM5vn7ciDj
MD5:	B2694BAE9E26CD2C0DD211C855A711FB
SHA1:	9212CC84378DE9860820FF74D184E6C44DD049C2
SHA-256:	70CE9E764F4B99868241BFC3717484AAD443515D9A9D7EE9F8BE2D42950642F9
SHA-512:	9507A1C1B1FF01D764965312B3B0AE46AF37487CF45A0F28A4AF1AE8D55735A8007C18DAF7F65A185A4A3E5ED4EF64CB946F58F61B54A00964871DC474DC441C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`...............y......i......i......i......i......y.............Sh......Sh......Shf.....Sh......Rich............................PE..d....2.f.........." .....R...>.......N..............................................7.....`.............................................................................)......@... z..T............................z...............p...............................text....P.......R.................. ..`.rdata...)...p...*...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\tnameserv.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24456
Entropy (8bit):	6.495344693396049
Encrypted:	false
SSDEEP:	384:FYwPSUnASN0lbFzp5yeEZU8JIYiaHZ8ZpH3GCJETysnUBe:uE6eQFd5/E8YiQZiRBETFUBe
MD5:	D90C080D95E173E0C88F2B1B748AD9FB
SHA1:	60CA274EE50B1C691261C6856DD81135E9B81697
SHA-256:	4C2F16A1721E3E9A6BF8CBB77A3475399761AA68AAECC2A4630F2480F05A1ABD
SHA-512:	AAD4772045A2F7A962202FE33CE6910CCBF3241AFEFDD0422F31487B7179259050AC971FBB4C8C225CF431E2458D056B8143A57DC64EFC203298118CC636F5E7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n...o...n...o...n...k...n...j...n...m...n.5.o...n...o...n.5.j...n.5...n.5.l...n.Rich..n.........................PE..d....2.f.........."..........$...... ..........@..........................................`..................................................).......`..0....P..8....6...)...p..4....#..T............................$............... ...............................text............................... ..`.rdata....... ......................@..@.data........@.......$..............@....pdata..8....P.......&..............@..@.rsrc...0....`.......(..............@..@.reloc..4....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1011592
Entropy (8bit):	6.662599033447696
Encrypted:	false
SSDEEP:	24576:skmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkN:9mZFHhp9v1Io3h0TN3pvkN
MD5:	C45823A0A1163E3BFA7CB40A7F06F169
SHA1:	9CAF2E714099590707FC6FDAAD051EB2CFB7CC80
SHA-256:	562A101B3D0DD3B057CAD924BB226F32FD3DD686B7C7C1AB9FC5153DD0913645
SHA-512:	279DA0D8558A748493A2F0D7448F70401730CB0E117794F570AC13F528DB91D0B5276C74548B9836D057B38ACAD30EDBCC09C11773BF5157A9D03B07E3D30089
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...)......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88456
Entropy (8bit):	6.325721546429761
Encrypted:	false
SSDEEP:	1536:OZItUJIVlWaxyKJiiij2kVlqEJB0DuvHIvbUVuZKw/VqbIQQuFTGk77ciDwi:OCt+IVl1bC7JB0DuvHIvbUVuZKw/VqbH
MD5:	B71BEF62D70522E46E171C0D0ED57AB8
SHA1:	FE83DCBDC6A23E805E5AE0FE8E26E7CEA6BFDC2C
SHA-256:	FF632D474EA182A37ACC6CE6A791B1FEBBF0FA1A29746F89F0BA5CFA4C29C631
SHA-512:	C54D3720E3A3702698226C6A9D8AA3DB24279EA42281A3595598AFD106492BB1BA5B14761F96809CD711E0DC773D05BD00136C4BC0FFCA851347EB8637356A36
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.t...'...'...'.i '...'.y.&...'.i.&...'..t'...'.y.&...'.y.&...'.y.&...'9x.&...'...'...'9x.&...'9x.&...'9xL'...'9x.&...'Rich...'........PE..d....2.f.........." .........l...........................................................`..........................................................`..x....P.......0...)...p......0...T............................................................................text...c........................... ..`.rdata..^D.......F..................@..@.data........0......................@....pdata.......P......."..............@..@.rsrc...x....`.......*..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\unpack200.exe

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	223624
Entropy (8bit):	5.724118607882275
Encrypted:	false
SSDEEP:	3072:M3OS/edk6k0bEEAYwbUAgrlfq5W+ySK7IwB4CfZiCn2oL/:M3OS/edk6/vIAMW+ySK7IwBRZiM/
MD5:	673B8E3533AAF042B5CBADE4BAFE93EB
SHA1:	07045AC0C2B0473565D472D5879A0C055450E232
SHA-256:	81F020599657C28DF4633BE462763357CD1FC268B7597C4E16CF9B161D6A05E7
SHA-512:	CBC4580CF484FC66C768F4F2F6CCA7861E193014AAC06B2CC20C1AAB9394935A038F51F69848209D831637A07DADB130953080922791F1A3DF73BAB3DCA99384
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$./#`oAp`oAp`oApi..pvoAp2.@qboAp+.@qcoAp`o@p/oAp..pcoAp2.DqroAp2.EqjoAp2.BqcoAp..EqjoAp..DqgoAp...paoAp..CqaoApRich`oAp........PE..d....2.f.........."......0..........d..........@..........................................`.................................................HW...............0.......@...)..............8...........................0................P..H............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....pdata..,....0......................@..@.idata.......P......................@..@.00cfg.......p.......0..............@..@.rsrc................2..............@..@.reloc...............:..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79752
Entropy (8bit):	6.497612770764874
Encrypted:	false
SSDEEP:	1536:Y3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EW7ciDKI:Y66dsFeeBGPj1L6LGY+ecboCWow
MD5:	E4258A6F2E4AFF273F92776547F10437
SHA1:	8CEE464B9F0DAE280ED59C40A17E95C4BE4E074A
SHA-256:	FAF667AD056EB35A438B6E21E3E735E05D41F17E64EC845EAA264A360D5A2E3E
SHA-512:	7E75A4C950C615A3EF0C01FDEDA3005FAA09836EF65F1B1403240A0CA5A1A4FBFDE78F960838A33B10B166D13C122F898C56A85379F195BF113B2AC533DCA780
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZWB..6,..6,..6,.....6,..N...6,..6-.26,.L^/..6,.L^(..6,.L^)..6,.L^,..6,.L^...6,.L^...6,.Rich.6,.........................PE..d.....0].........." .........R...............................................P......./....`A............................................4............0....... ...........)...@..t...P...8............................................................................text.............................. ..`.rdata...6.......8..................@..@.data... ...........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..t....@......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\verify.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55688
Entropy (8bit):	6.554645755590889
Encrypted:	false
SSDEEP:	1536:m3Dzui26kCpC59STB1Koa2hzaNA7ciDx2:Kzd26Bg9gk2hzaNAod
MD5:	3204F14A9E60763502EAE7CA7C7968EF
SHA1:	850B68ADCDBDCF2C1698B91772C6DBD25AC563BA
SHA-256:	671A23A8FBAF0AA297186BD5DBCCC7FDFC52E1C8695BAF479C5836283A776D82
SHA-512:	C1AFA1E607953B80DB0CBC42C42235820391EC9D66162475B748546F90ACE93CB47F9A347D2156F19D8E63F1BAD4C7CA5C475A5E7450AF14E75100C49FEFECA3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.U...;...;...;.......;.V.:...;.O.:...;..R....;.V.>...;.V.?...;.V.8...;...:...;...:.J.;...?...;...;...;......;...9...;.Rich..;.........................PE..d....2.f.........." .....j...H.......n..............................................^~....`.................................................8...........x................)..............T...........................p...................x............................text...Ch.......j.................. ..`.rdata..l3.......4...n..............@..@.data...............................@....pdata..............................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\w2k_lsa_auth.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31624
Entropy (8bit):	6.496632884051355
Encrypted:	false
SSDEEP:	768:FbHCklsI6I3g9NoZTU35QUOHkbGGGGNET7T7T7T7lWa/qBXPuYiQZiRBECk504:8KsI6I3g9NoZTU35QUOHkbGGGGNET7Ti
MD5:	87612EF76A9B2123FEC54E0C71C4D2E0
SHA1:	AE79463DB45DB971146D88C32AECA395820262BC
SHA-256:	10F5F8F4F8606C26A5F43504FBFF946D73CEAADF1A49855B86A97F1FACA3A8EE
SHA-512:	FAF518E32B41E108B7D28EBD4278745438AA8995E279A5710F5177ABBC3BFB904D4425DA566546525E202C14B32FDC4CC981A766051F8F33EEE005208C8E1DB5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p............ia.....y......y......y......y......i............x......x......x......x.....Rich............PE..d....2.f.........." .....$...2......D)..............................................V?....`..........................................T.......U...............p..p....R...)...........M..T...........................@N...............@...............................text....#.......$.................. ..`.rdata.......@.......(..............@..@.data........`.......F..............@....pdata..p....p.......H..............@..@.rsrc................L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\zip.dll

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89480
Entropy (8bit):	6.789042713049443
Encrypted:	false
SSDEEP:	1536:3s958XTjmAlPTnYVqPId6CUWMQthIOQIO6Ho0hVeiAKt7ciDqOB:3sH8XTjmwbLUUWj5G6HJVexKtoiB
MD5:	52E5477B82EE6D54838CD2FDE785A4E2
SHA1:	FD0E15AA969F50099BEF4938FA62D5472E0300CD
SHA-256:	AE2B86D0738EDA3EBE31F44669288726788D4638ADFDB46864FAFCD4244B3472
SHA-512:	0FA02E8C2A1BBE34922829DF698933448A5877272FB79DCC2F8FE415EE529BB67E1DD0CE0FABD6AC81E33D4BAC595FA2A07AF4416D749A175576FD0CB1948DA4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...F...F...F......F...G...F..G...F..B....F...C...F...B...F...E...F.:.G...F...G...F.:.B...F.:.F...F.:.....F.:.D...F.Rich..F.........PE..d....2.f.........." ................ ...............................................9.....`..........................................+..4...43.......`..h....P.......4...)...p..\...`!..T............................!..................(............................text...c........................... ..`.rdata...k.......l..................@..@.data........@.......$..............@....pdata.......P.......&..............@..@.rsrc...h....`......................@..@.reloc..\....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\accessibility.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.558376029276625
Encrypted:	false
SSDEEP:	3:LFpfBZgZLXnuWxVEzERMLVAAiuKIn7IRAdSPGGzJzGBXlnfMaAHCR1vn:L7APWzTLVAkIiSPhZGBX5kaAHCXn
MD5:	2ED483DF31645D3D00C625C00C1E5A14
SHA1:	27C9B302D2D47AAE04FC1F4EF9127A2835A77853
SHA-256:	68EF2F3C6D7636E39C6626ED1BD700E3A6B796C25A9E5FECA4533ABFACD61CDF
SHA-512:	4BF6D06F2CEAF070DF4BD734370DEF74A6DD545FD40EFD64A948E1422470EF39E37A4909FEEB8F0731D5BADB3DD9086E96DACE6BDCA7BBD3078E8383B16894DA
Malicious:	false
Reputation:	low
Preview:	#.# Load the Java Access Bridge class into the JVM.#.#assistive_technologies=com.sun.java.accessibility.AccessBridge.#screen_magnifier_present=true..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\amd64\jvm.cfg

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	5.001620365378865
Encrypted:	false
SSDEEP:	24:vDoH/2QHrQEQtmKy/aOkHtbVJyqTbVKm2YPcH0nm3XWNeOoXHjifIBMB1XqfIi:+rHIty/qHh+m2YPOWU2fL1Xqfd
MD5:	C60E77FF5F3887C743971E73E6F0E0B1
SHA1:	9B0CFD38EC5B7BD5BD1C364DEE2E1B452A063C02
SHA-256:	23F728CC2BF14E62D454190EA0139F159031B5BD9C3F141CA9237C4C5C96EC1D
SHA-512:	07ACA3DE1A03A3B64B691FD41E35E6596760BAF24C4F24E86FCA87D2ACF3A4814B17CD9751ADC2DCD0689848F3D582FB3EE01D413E3A61D1D98397D72FE545E9
Malicious:	false
Reputation:	low
Preview:	#.# .# .# Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floo

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\calendars.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2479
Entropy (8bit):	5.223707333360392
Encrypted:	false
SSDEEP:	48:HrHIty/qHh+m2YPOW7qOVu2HX1C5MCmCkcJFvRL:H8ThI1GtszlPFvB
MD5:	FD47532D0C6AE3BEC63F2F1CE3336A6B
SHA1:	E969A98067073C789B02168B211277EB393DB634
SHA-256:	9B72CFAD9723C8B33EED3E18BDA69BE3F50740F8C11456487D3098E288359BFA
SHA-512:	AB5975CA676F7F08EAC58902C352ED9BC67E03B75D6C0155AE75A1A4CC478905FA153F8DD7C1BCE0162C3C17E738B550F43D6341B437502F71B54152B307F6E5
Malicious:	false
Reputation:	low
Preview:	# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floor, Bosto

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\charsets.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3095125
Entropy (8bit):	6.63417342813965
Encrypted:	false
SSDEEP:	49152:7niNS4TQLAYsBvbOKY/0fmNdc1sy/lbgO+/m:7niw4s6U86cumlbgG
MD5:	A6D710492ACF946C667E3F4C9AAF2A34
SHA1:	674A0527722FDEAD28852732649450184046B9AA
SHA-256:	7A50AB0BD77BA9159BA2F6C1B042708A636BC2A667C6B13577AE6EC2988E8C87
SHA-512:	C8FDC190AFDC253C592A6E35487CDD5C08BA532CC6E17DBC73E98BBF28B8C1C3770FA650B67048666F9B4CAB6BFFC1AFAF4D713A40E9C20D55F528047F5B8FCF
Malicious:	false
Reputation:	low
Preview:	PK........9..X................META-INF/....PK........9..X.7..D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_75 (Oracle Corporation)....PK........[..XUi..............sun/nio/cs/ext/Big5.class.......4."..........t....t............................................................................................................................................................................................................................................................................................................................................................................~.........b2cSBStr...Ljava/lang/String;...ConstantValue...b2cStr...[Ljava/lang/String;...b2c...[[C...b2cSB...[C...b2cInitialized...Z...c2b...c2bIndex...c2bInitialized...<init>...()V...Code...LineNumberTable...historicalName...()Ljava/lang/String;...contains...(Ljava/nio/charset/Charset;)Z...StackMapTable...newDecoder..#()Ljava/nio/charset/CharsetDecoder;...newEncoder..#()Ljava/nio/charset/Ch

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\classlist

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84355
Entropy (8bit):	4.927199323446014
Encrypted:	false
SSDEEP:	1536:4X/nxfn5rxLyMznYolTzlff5OK3COHoHNG5rb/cxNwmCX1g86K2oWdAqNqc+KMjD:qxn5rxLyMzbf5OK3CJNG51g86A
MD5:	7FC71A62D85CCF12996680A4080AA44E
SHA1:	199DCCAA94E9129A3649A09F8667B552803E1D0E
SHA-256:	01FE24232D0DBEFE339F88C44A3FD3D99FF0E17AE03926CCF90B835332F5F89C
SHA-512:	B0B9B486223CF79CCF9346AAF5C1CA0F9588247A00C826AA9F3D366B7E2EF905AF4D179787DCB02B32870500FD63899538CF6FAFCDD9B573799B255F658CEB1D
Malicious:	false
Reputation:	low
Preview:	java/lang/Object..java/lang/String..java/io/Serializable..java/lang/Comparable..java/lang/CharSequence..java/lang/Class..java/lang/reflect/GenericDeclaration..java/lang/reflect/AnnotatedElement..java/lang/reflect/Type..java/lang/Cloneable..java/lang/ClassLoader..java/lang/System..java/lang/Throwable..java/lang/Error..java/lang/ThreadDeath..java/lang/Exception..java/lang/RuntimeException..java/lang/SecurityManager..java/security/ProtectionDomain..java/security/AccessControlContext..java/security/SecureClassLoader..java/lang/ClassNotFoundException..java/lang/ReflectiveOperationException..java/lang/NoClassDefFoundError..java/lang/LinkageError..java/lang/ClassCastException..java/lang/ArrayStoreException..java/lang/VirtualMachineError..java/lang/OutOfMemoryError..java/lang/StackOverflowError..java/lang/IllegalMonitorStateException..java/lang/ref/Reference..java/lang/ref/SoftReference..java/lang/ref/WeakReference..java/lang/ref/FinalReference..java/lang/ref/PhantomReference..sun/misc/Cleaner

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\cmm\CIEXYZ.pf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Microsoft color profile 2.3, type lcms, XYZ/XYZ-abst device by lcms, 784 bytes, 28-12-2006 18:07:22, no copyright tag "lcms XYZ identity"
Category:	dropped
Size (bytes):	784
Entropy (8bit):	2.42970830905406
Encrypted:	false
SSDEEP:	12:Pg2lA1s9flg6lwTltOskA555m2kA555m2kA555R:zA1s9flg6lslJ
MD5:	09BFDCD5B55FE322FAF0A4CF94F289C2
SHA1:	FB7D37DB9AD5679600A27352AA1998D5BCDC9311
SHA-256:	98CF012F6122C833B1FF4FBBE37F43A808D769D9B10BA43F3411728E7BB58BEA
SHA-512:	F62D3F6762F6649F97B0DF031C2C381BB4553C7B5CDB39C8ED87E8256EC560437B7D60E728FD10A581EFB5F4DDD3D213C9B25707830E32845B451CD9DC3540F5
Malicious:	false
Reputation:	low
Preview:	....lcms.0..abstXYZ XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc...D...ldmdd.......gwtpt........A2B0...,...LB2A0...x...Lpre0.......Ldesc........(lcms internal).................................................................................desc........lcms XYZ identity...............................................................................desc........XYZ built-in................................................................................XYZ ...............-mft2........................................................................mft2........................................................................mft2........................................................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\cmm\GRAY.pf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Microsoft color profile 2.3, type lcms, GRAY/XYZ-mntr device by lcms, 556 bytes, 28-12-2006 18:07:22, no copyright tag "lcms gray virtual profile"
Category:	dropped
Size (bytes):	556
Entropy (8bit):	2.4790708147231753
Encrypted:	false
SSDEEP:	6:g/2YeNcjylAll1NfAL+V9pglgkX/lDP89YMOlI/lZcHd2Mlll:g1Ac2lA1NIL+3pglg6lDkTOmlZc4kll
MD5:	FD6340C81F2ADC503AEA746B79A96979
SHA1:	D73ABFDF682FD0F570775B90E40D714976339F33
SHA-256:	D3FD8CB41B7EF8C5EA53BFECB1AD6D4762197C8EAB04444545E083DFF6F86FA9
SHA-512:	A2C861B66C78C66119172A57AD96BC68CC51959B4A41D300C30FE16E4D10077A8F6B0328ACDA14602C054BD291DA49865C77B8358A285211DF7E10011DD06934
Malicious:	false
Reputation:	low
Preview:	...,lcms.0..mntrGRAYXYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc...,...tdmdd.......hwtpt........kTRC........desc........(lcms internal).................................................................................desc........lcms gray virtual profile...............................................................................desc........gray built-in...............................................................................XYZ ...............-curv............

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\cmm\LINEAR_RGB.pf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ColorSync color profile 2.3, type lcms, RGB/XYZ-mntr device by lcms, 488 bytes, 28-3-2008 14:24:37, transparent, relative colorimetric "linear sRGB"
Category:	dropped
Size (bytes):	488
Entropy (8bit):	3.1769785389298173
Encrypted:	false
SSDEEP:	12:scdIhpzWllDGnYAsFoDAlAPWrNBRPRjtlhhlhhll:sc2hIllSnYz3lRBNpJN
MD5:	CFECF0A79F8E6DC8D8120302F2A2E837
SHA1:	7576E83E5911096471A97F5E73F3238C6FFE6976
SHA-256:	790DA58CCC79D03658283652716EC9896ED31E0392D818E60F6832815EE79F4C
SHA-512:	B5A90B49AD4DF94BB7E4D88796BAA7D6F908D892815BC3B59E441B3A9262682EAA5610052D75F76B87B85A577D2E12096676D6C56152B0E80DAE6D7B72EA31A1
Malicious:	false
Reputation:	low
Preview:	....lcms.0..mntrRGB XYZ ...........%acspAPPL...................................-lcms................................................desc.......fcprt...X....wtpt...h....rXYZ...\|....gXYZ........bXYZ........rTRC........gTRC........bTRC........desc........linear sRGB.................................................................................text....none....XYZ .......:........XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv............curv............curv............

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\cmm\PYCC.pf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ColorSync color profile 4.0, type lcms, 3CLR/XYZ-spac device by lcms, 234080 bytes, 10-4-2008 10:24:22, transparent, relative colorimetric, 0xf0e75c55d21e4d8c MD5 'PYCC from PCD 045'
Category:	dropped
Size (bytes):	234080
Entropy (8bit):	5.916799738162389
Encrypted:	false
SSDEEP:	3072:kPQxu94sua+Gl+tqocgEBRQTbwAIoF1r+KRlN13yFs+75rcjG1sIGH69Jwf4CVoy:kPQxu9iaOtxOQAB81iyxyWs5gH
MD5:	2F3658826C5402382E78BFDA48A78A6B
SHA1:	DA0DB2D41E6CEAD9E38A7E4A5C08FA7E90E57B22
SHA-256:	0031AA2B8B4D490369A2A601AE0D95505DF0CB86C0504F080C02ED87E84B3DDC
SHA-512:	F1114143E1F656DFD68E3F32D87439DFC1DDDB859E2664DA3E902FEEBE3AC63E04213230C9FF3EC630E390EB3A85E2FD483A6E5AD2992BF3D89D1129FAF86BF5
Malicious:	false
Reputation:	low
Preview:	...`lcms....spac3CLRXYZ ............acspAPPL...................................-lcms..\U..M..C......................................desc.......>cprt........wtpt...(....chad...<...,B2A0...h..x@A2B0..y.....mluc............enUS...".....P.Y.C.C. .f.r.o.m. .P.C.D. .0.4.5..mluc............enUS........XYZ .......R........sf32.......?.......(.......................ymft2..........{8...............~...G...\|.......6....... .A.a...........".C.c...........%.E.t...............y.`.C " .!.".#w$C%.%.&.'V(.(.).>.+.,S-.-..U../.0F0.1.2(2.3a3.4.5,5.6W6.7\|8.8.9+9.:E:.;Z;.<j<.=w=.>.?.?.@.@.A.A.B.B.B.CvC.DjD.E\E.FJF.G5G.H.H.I.IwI.JYJ.K9K.L.L.L.M_M.N7N.O.OwO.PJP.Q.Q.Q.RPR.S.S.S.TKT.U.UvU.V;V.V.W_W.X X.X.Y?Y.Y.ZZZ.[.[r[.\+\.\.]>].].^M^._._Z_.`.`d`.a.aka.b.bpb.c.crc.d.dqd.e.ene.f.fif.g.gag.h.hWh.h.iKi.i.j=j.j.k,k\|k.l.lil.m.mTm.m.n<n.n.o#opo.p.pUp.p.q7q.q.r.rcr.r.sBs.s.t.tht.t.uCu.u.v.vdv.v.w<w.w.x.xXx.x.y,yry.y.zDz.z.{.{Y{.{.\|(\|l\|.\|.}9}}}.~.~H~.~....U......_....&.g....,.m.....1.q....3.s....3.s....2.q....

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\cmm\sRGB.pf

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Microsoft color profile 2.3, type lcms, RGB/XYZ-mntr device by lcms, 6876 bytes, 28-12-2006 18:07:22, no copyright tag "sRGB built-in"
Category:	dropped
Size (bytes):	6876
Entropy (8bit):	7.544186956447987
Encrypted:	false
SSDEEP:	96:/Kmx6MT0D5MdtbZPAVwzVZ6MT0D5MdtbZPAVwzVZ6MT0D5MdtbZPAVwzVR:/TzYNMtKwBYNMtKwBYNMtKw/
MD5:	F6439592EF7CED5ABDD4AB4CBA3777FB
SHA1:	11C7BE03D659C369474A6F2231561350AE7889AB
SHA-256:	87E382B9336E6A0417A4D860173109AB319A029CF2972E19833A3327C65BD7E4
SHA-512:	9029BE4A78E1A3C59FB2587D9A8E9EDFB08415C9D4EC4C5956808C0144DCDE6FD78F50A5D6E7A3AD441BE332C9207BC93B83A4B96ED6AFDFF257D5CC7DEADE10
Malicious:	false
Reputation:	low
Preview:	....lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc...t...hdmdd.......hwtpt...D....rXYZ...X....bXYZ...l....gXYZ........rTRC........gTRC........bTRC........chrm.......$desc........(lcms internal).................................................................................desc........sRGB built-in...............................................................................desc........sRGB built-in...............................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|...............................................................%.+.2.8.>.E.L.R.Y.`.g.n.u.\|.........................................&./.8.A.K.T.].g.q.z...............................!.-.8.C.O.Z.f.r.~......................... .-.;.H.U.c.q.~.......................+.:.I.X.g.w....

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\content-types.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	5.037985807321917
Encrypted:	false
SSDEEP:	96:r45Vf4fq7MBzO4pYEZ2MQ6KXr3NO0slzMX+W1CuHvvABbiAQ+xaW/ioLHTU+Wsch:r4KJO4mEZ2MQ6Cr3NO0slzMX+WIuHvvv
MD5:	F507712B379FDC5A8D539811FAF51D02
SHA1:	82BB25303CF6835AC4B076575F27E8486DAB9511
SHA-256:	46F47B3883C7244A819AE1161113FE9D2375F881B75C9B3012D7A6B3497E030A
SHA-512:	CB3C99883336D04C42CEA9C2401E81140ECBB7FC5B8EF3301B13268A45C1AC93FD62176AB8270B91528AC8E938C7C90CC9663D8598E224794354546139965DFE
Malicious:	false
Reputation:	low
Preview:	#sun.net.www MIME content-types table.#.# Property fields:.#.# <description> ::= 'description' '=' <descriptive string>.# <extensions> ::= 'file_extensions' '=' <comma-delimited list, include '.'>.# <image> ::= 'icon' '=' <filename of icon image>.# <action> ::= 'browser' \| 'application' \| 'save' \| 'unknown'.# <application> ::= 'application' '=' <command line template>.#..#.# The "we don't know anything about this data" type(s)..# Used internally to mark unrecognized types..#.content/unknown: description=Unknown Content.unknown/unknown: description=Unknown Data Type..#.# The template we should use for temporary files when launching an application.# to view a document of given type..#.temp.file.template: c:\\temp\\%s..#.# The "real" types..#.application/octet-stream: \..description=Generic Binary Stream;\..file_extensions=.saveme,.dump,.hqx,.arc,.obj,.lib,.bin,.exe,.zip,.gz..application/oda: \..description=ODA Document;\..file_extensions=.oda..application/pdf: \..de

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\currency.data

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	data
Category:	dropped
Size (bytes):	4172
Entropy (8bit):	3.268390536494904
Encrypted:	false
SSDEEP:	48:MlWAFFGFSupi9VBjOtF8CSh8kkC6/wU4XRr/bVdxe+0fBJ:MlWAEi9VBjOtzSh8kk0/pdTkr
MD5:	10FCC6F8A55D9C540D8ECF0D4EAA20C7
SHA1:	5EC5ED05B691703A383E89CDB80FA141840825B5
SHA-256:	8CBED7C71C51E38EF2DF7D6B5941384C1C691D9CF84DE5039EB36CCE7B57ED08
SHA-512:	68747B3154E2838C88AA6D41F532F54078DB73CC636D5ADF48471B54A10BF0BF6E97A8185129EA52B23B6BC5D1A226E71DE5EBDF7EF72A3C4EC3FC32C547A84A
Malicious:	false
Reputation:	low
Preview:	CurD..........................@C..,M...................... K...C..PF..4@...........R...........C......TF...........M..DL...C.......S..........<M...c...................C...C...A..........hK...C...M.......... O.......M..PC...C..........@E...............E..............`.......pX...O...........B...C.......O...D..............,J..........................................@J..............XO..........................................0C...........................O...........................................M.......A...............................................................C...O...................................................................O..........TK...........R...O..............8C...........................P.................. C..............................................`C..........PK......................0F..pE...................................Q...............................R.......Q...........c...Q...................................................................................C

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\access-bridge-64.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	197144
Entropy (8bit):	7.790745434371327
Encrypted:	false
SSDEEP:	3072:tLY46IBGq/+Epwh76ViVL1GtqIvpGNZmncvXPW88EKHfw6/vzSHCXufysnHfCd:eoS7IQovp6Zmcv/ZkHf5nrNcO
MD5:	C784CDA27462E13221B0113D06F53835
SHA1:	DF3EF7E0AA0370C3F28A69787A0C209766BD7F9E
SHA-256:	ABF6085D5749A69198896785DEA2561545236BBB4F1836A02B360C0D115E7539
SHA-512:	FB65C2B1A002FCF6C8691FDC90819F6B277B191D97BA7AB3D60CE391462C0C14581A32335F6928B64FB7C123E233D6191A91FAB3D8054786835106AAC2B08C5D
Malicious:	false
Reputation:	low
Preview:	PK........C..X................META-INF/......PK..............PK........C..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u........h..%&.8.....%...k.r.r..PK...7..C...D...PK........e..X............/...com/sun/java/accessibility/AccessBridge$1.class.S.n.@.=.........6.....BU.D.T..CQ.x.8+...F.u...$...>..B.....5.....9.gfg......St....,........sp....z. ......".e........MG.\|N..(...a.=..9!Tz.@..GJ.W./...s<..8&t.9...m......8..Jt.`..:....Q.?.a....H......y.$.Y..a.....m.c5...K.....'.....Y.`^.5..\|..z_.q.....]2p....[..P..b.A.C...W..j..(H3.....a.~...;.Z.^,.T...6QB..L.+g...%l_R....H.V..el&..#F.~6.1.9.C.g$M.+.vn..&........k 8 ...._..."G=.6P.#._@.o(}.........s`..Oy..A.Q&\|...._a...c...2.....g$.+..k..:n.s7q..x....?PK....&.........PK........e..X............0...com/sun/java/accessibility/AccessBridge$10.class.T[O.[....e`.. .7.j.v.. zT.Rh...c..a.SF..2........o..&.^..}.7...m....I....\|.~....(nu.....$9....L...i.......3.:0....#.9I.k..F.c.U.U\bH,Ynz.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\cldrdata.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3861926
Entropy (8bit):	7.967085578036977
Encrypted:	false
SSDEEP:	98304:WZnyulpDGqsQMdHxgtWHBNC2VxNVVdEd5EQ3nPSlc5VO+jEm:WZnTVsliEHBNpDfA5/2E4+Ym
MD5:	99296501A882CC0F3498F407BDB6440B
SHA1:	7A872F8883B8923563D9B20143A6C574CD64EF1D
SHA-256:	579ADAEEA1D3F72E11E5C0DFE09DEA8A5C45999E959C3EE379A76F9E9D08DB17
SHA-512:	9912FF4D4EE44E49701D369FB95816ECE05FE522572DBF40D19778E8BE539EF949EB8F8B87AAE61CF3ABAE953EC29B14BB889155C04DD616CC564BBC9AE390C5
Malicious:	false
Reputation:	low
Preview:	PK........:..X................META-INF/......PK..............PK........:..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.q.B........E..%.).N. e.z......E..9....E..E.%@...\.\.PK..'cm.N...Z...PK........[..X................sun/text/resources/cldr/aa/FormatData_aa.classmPMO.@.}........(.@..xB....!b,1i8..6X..I.5._.'.....(..".9.yy3.f?..?..`?...6T.5l....aG......=...mqN.......t...:6g.;`^....d.L..\0.\|.b...w&.....c.;...8%H...........RqA.......b. ..p./G......B0..K.Sx6...>4\....Zy.!..".R.N....T....=..c~d.7...3(5.<.....a;F....\....a8@..a.@..d^.]YV"k....U...2'#...rX.K...ue...O....bZ.:CB...jZ.]3...2M.s....3}.ct%.GV..PK...]..d.......PK........[..X................sun/text/resources/cldr/af/FormatData_af.classuV.x[W.>...a[y......R.+-..K].I.4..(...b.=....a.h...({..B!...{.U......w../...y...?.;w>.u..w..A.......xE.nFxe.nAx...^.p+.k.^..z.7 ...M.oFx..[...v.3..!.....Bx7.{.nGx/....@x?...."..A..!\|....G.>..1..#\|....B......A.,...>..../"\|...._A.*........o"\|.....A...........".

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\dnsns.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	7.787625950895255
Encrypted:	false
SSDEEP:	192:w5jIgB7WbMCNktQrQRCWc/RB+nNhf91SlJpX7FasLM:wZB7WbM7GrmCWcENh11oh8
MD5:	13282B8E035BF4393E4E10EB0E04394F
SHA1:	4C5F1306CD3467EC232BC4B7C0C382165715A133
SHA-256:	762AB9A733E346E724B3E795424C6CC6CD332B6AE92ED975368431ADE94981D6
SHA-512:	A9A456D6A212C591A5088F0A02F04C81DB4D4EBDE5378113AA2ABA1971D1C962E1FE3BBEF131173B04D85941445D6C822B120EEF5334476FE34A436C25574819
Malicious:	false
Reputation:	low
Preview:	PK........:..X................META-INF/......PK..............PK........:..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u........h..%&.8.....%...k.r.r..PK...7..C...D...PK........Q..X............2...sun/net/spi/nameservice/dns/DNSNameService$1.class.S]O.A.=......./@."e.,(>AH.` )..g.......l../j....LD..F_.M.xw.j.....s.{g.~.........d.n...9.0e.N..i.E.......~A.&.H..7....[<.7\|....]f_.....r.)W....~(B....nM..F.Z!.z.....Ye.(...B.3..2.AM0......pO..x.!.#.0U.I.G..Tu.&..L.......e.![.U..;...-.2.6.<.02P..9...R.......la....H....!.."-..H..E].Z.k^.W:p.J^s. .x .c..7j>.A..T...TfG...f....!.6zm.p.F..-.q.K.....1.!.w.C+,2..J....0.!C...0Lw...@..s[.cmp%I-.5..o...1.D].]q..4..-.t1...m.q.3.;\....D.+/..../...N....uv...R.\|<<.2M...4...O.yz.FA...).3{.....7....]..g.i..9&m.[.......K_.}.,;)}F..VR.w........\|I.+..B.a...F.-C....h......Y...N...t..D.:.<..d..u`..r..B...PK..K.".u.......PK........Q..X............2...sun/net/spi/nameservice/dns/DNSNameService$2.class.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\jaccess.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	44516
Entropy (8bit):	7.904959824338064
Encrypted:	false
SSDEEP:	768:wYVfhaqfgKbWnXuZzQvfhPJryQCtkZQnWn109eqJZjE4c:wKfhaWgfnXugf5cQlQnWn10oqL3c
MD5:	0E01AB1956AC3364F5AF3AFF4788E220
SHA1:	8223006259E1F46672D3E1F3416DC88CA7C218FD
SHA-256:	3EB740A78D2CF93307C97C40EDADDDCD06E16F76EC5722AE4DD9298A979EDAFA
SHA-512:	B4FA071A6A7E55E144C3B96FCFCD627965A96BB5E4D41CA0123ADB79B66FA020C6728CFE9304B74A83A09E46305CDA37E3DF5463E80FBD638A565AB7D04425EE
Malicious:	false
Reputation:	low
Preview:	PK........C..X................META-INF/......PK..............PK........C..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u........h..%&.8.....%...k.r.r..PK...7..C...D...PK........0..X............Z...com/sun/java/accessibility/util/AccessibilityEventMonitor$AccessibilityEventListener.class.Wkp.........5..5..A6`l..C\j.A...eb)..)dm....J+..h...I.&&...L.4.3.$.aH.q.....M...i..m......KNf4.y..~.9g.>.....[p.:....n..p....(........#.D'".ta/.>.D7.\|.s.!..f.o......#\w?o...;q..]x....B...~.....t..4>?.#N.1$Aw........;..#j.HJ0%..p...M.5...V[.. .........P...).qZ)......a-i...H2.EM..H.2l.H.eX_.>..(..J_..Lj.Z\3G...,...C\|.....T..$,.q.OX...[.u..Qg..6..:...iz.q.-....:sD@9j.2[..w..I3a.r....cXM..m..}P..J.WU.d`o.nhD.3.=).)..o2..F...8^k...f)t.........G...e\|.....C*K."#.F...,.m.q..I8)....$..x^......e..?..c.D..8..e..7...U..8..dl...rc.s.7d..3...x.....E`.....n/.8.qY......i.~BQ..\.1.K2~.K...s.C.YN...@.Lh...i....PwwW.W...2.z....<%..F..+..xW.e...K.W0...3......J..)S.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\localedata.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1183367
Entropy (8bit):	7.964850421256839
Encrypted:	false
SSDEEP:	24576:yNusYmxyNW0ZOOWxOj28T73tW5r3B4eFJ:yNusYHIstT73tW5rnFJ
MD5:	28D9746A1998A4B6AEA2489F472458F3
SHA1:	B10513AE231B77DB888A96C178DDE97596BF6942
SHA-256:	3F9A2AEA5B9A05A12C8D99409F0F16BEDD9A8F92A6E3277C7FC31B3A345B1736
SHA-512:	26A608C94239614F56AD19C7F23C29AEFB53A0995AB7BE67B04B044E5AEAB5C3B8A2E658576681670620A94F46BFFF61885BE715B01C8D6BF597FEADEAF11AEC
Malicious:	false
Reputation:	low
Preview:	PK........;..X................META-INF/......PK..............PK........;..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u........h..%&.8.....%...k.r.r..PK...7..C...D...PK........X..X............,...sun/text/resources/ar/CollationData_ar.classm..O.A...Y[("...E..Q.....z....M.1A.f....m.n.G\|._.WP@.R^T.D._.......b.N.H.....<..!._....!...j...#bCD.U...1"6ED.#[..xp....;.:"....Q..O.'..:....3..5.~.J.~2.8.a.......e/....S....A.#.c.l...<n.ljM%.^.O%.y.w.K.;jD.X...._......,.B'\.;'.K.{...x.G..cL...9^`..x.W..0F....!...P.8&0.)..[..+.e.T.\.+w."g.YW.E...]....[....c....}.(.b..m1n..<`..[,..-&m...C.....W....}..k>y..x.....X K.fY..1.1..L.z.;.K.....n}..4...f0..\|6.}..0..X."..+=.........n...6.Y.............l.o..%..w.8Ks..gq......3t/8C.........~<..<.3<....%....0F...(r..1..\5s..UO..jf..L..f...........................!.!.!.!.!.!.a..............................n&..... ..3.76.....#....l.OD......G.../..J.W.....k5.V..........?.V..6...F...t.....X...X.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\meta-index

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	4.996457872285593
Encrypted:	false
SSDEEP:	12:gtJz677x6CF/tEifvg7+VrwY107kX+TcPvjbn9rw6Kf1071QTflK9mV39eZRV3PE:EV677x6CFRfYyV86xX+4jz98ht4QLlQk
MD5:	378BACF86424AF40D102B109176BD37A
SHA1:	A218A25F131CBB38F4F11E8EAB0602B3AABB81F7
SHA-256:	87E75D66805D429CDF4CDD24672B5528CD30C7B0509A3F07C6B78B30CA2A52B1
SHA-512:	F5EA5C89258934C4A12DE0CCA21C4DF05371DECF0E9644F218EC3AA3C2D2AD92207BC5119A91B84C3E9F77E9373502AC891154ADBB50D6D7CCE8DFD30580405E
Malicious:	false
Reputation:	low
Preview:	% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..! access-bridge-64.jar..com/sun/java/accessibility/..! cldrdata.jar..sun/text..sun/util..# dnsns.jar..META-INF/services/sun.net.spi.nameservice.NameServiceDescriptor..sun/net..! jaccess.jar..com/sun/java/accessibility/..# localedata.jar..sun/text..sun/util..# nashorn.jar..jdk/nashorn..META-INF/services/javax.script.ScriptEngineFactory..jdk/internal..! sunec.jar..sun/security..! sunjce_provider.jar..com/sun/crypto/..! sunmscapi.jar..sun/security..! sunpkcs11.jar..sun/security..# zipfs.jar..META-INF/services/java.nio.file.spi.FileSystemProvider..com/sun/nio/..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\nashorn.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	2033828
Entropy (8bit):	7.933896378291121
Encrypted:	false
SSDEEP:	49152:2Ac2apcUT/33sSQhxsU2Tcbsu3r3daaJlGVdjqlbV9+z:2Ac8W/sj0U24su7tZJELqla
MD5:	1AE7352B995ACA7A58DD21D16C7AA98C
SHA1:	28BED68360C3EC88C1237559B0723B0D9BCA474B
SHA-256:	135E3DEBEF00296CBC206D736898CDA8D5AED33AA78D860EF4AFB4E7CBACBE52
SHA-512:	CFA7AF65784316FABD4D50AE73E10EC19C8984FB69055973DFDF0D0A232C1020CEF40E762005D9C504587DB07A9690B4663798C6BE5D30138552D65278F95ED6
Malicious:	false
Reputation:	low
Preview:	PK........6..X................META-INF/......PK..............PK........6..X................META-INF/MANIFEST.MFm....0.E.&...:...@:.....W.g..W.v..E4,...{o.d.........J9+=B.F... W.5.....(..8.k.0$K.!h.l^. .....N-Z..g5t8...H8;t...)..a.5.k1...g.-Nd.3...O.pa.m.--..p..PK...p.........PK........2..X............6...jdk/internal/dynalink/beans/AbstractJavaLinker$1.class.S.N.Q..N[.mY.".....T......7.%....A...t..n..m........k51.....2..H.51....o..\|..9?~~;....9..J.Y.g...5......M%.4......z....=..v.OF"..7.#....-.e......nU...G^ K.a/.BF.....y.....C.C.^..!.R.eH.....j....aK.M...3].....=..;'.;]j..>C....#.:..Z.(.N...JvEX.I.e..A..."j...C....t.C.q..:..>.J1}...z`..v...[.. .QTa..kXeX..'.1O.c..1...x..W..a.....3.Gl.VG8.C.tE5P...rN.&.v.....F.V.{.say.0^~m.....e....VW.B..x.h..u.i.K..F..j.[;;..Z.z.^f.8.q~.nR.n....Q.2..$.)B.$..\|.;.....'.&. .j\|@.E....FP#....A-..."...b.n.".H/c..Ho..s.I./.X..p...}..]F....SP.L.u."@..$o.9.b.'.!.;X~6..PK..]./.<...H...PK........2..X............K...jdk/interna

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\sunec.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	38957
Entropy (8bit):	7.8922428988854
Encrypted:	false
SSDEEP:	768:jrVsF4g/0Ur56ielXUtFpq/ga4SlKIy1SRjVNt/gDgQanQ3ta6iaZHsQxGhaozVn:fng/0Ut67RUtFpQNTyE7NtgDgQanGc/P
MD5:	5C68E38E9A4E8E4E6BC7AF60E3A5EE8C
SHA1:	51F3A588D03DF9D83E37192B35761C6BAB45A111
SHA-256:	86EA97BDAED1B19372A6EEAFFF88E2B251AD8C4F68C5DB4CF827BB5D9DCB8452
SHA-512:	E67D1403F70DE9D76EA9F1AAADFB48C880B776B464B81AFCB4A66D4F190749AD58F703228EAD9BD8ACA221CF059CBDB498EAF11308E8F9932912FB84B6DCC0D6
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MFu..j.@.D....-.B.....l.B....i.qZ...X....9.H.()wg.7.f.5.K..@9..V..Z.Hb$>.Hu....;...sx5g....y......L..}.^.......dR.9...~..c..5....-.6p..i.e4.u..'F...3<....K..H...,..6..G..E..;y7>..b.%.<v.....PK..1.'.....t...PK........f..X............&...sun/security/ec/ECDHKeyAgreement.class.Y.\|T...y............ ...I.....@.R.....3s.y..Z.K[m.b.V...n[....V'.t.uK........n.]..w..n.ae....$.A.o..s.=.;..un.....\-.......X.S.\|.R<...'....q...Nhx.O..V.q\|F..<.F..v!...I...0..q..u..q...qF..../.%7....9.........K\|A._tc..U./....)..T.{Y._VH..f_U........%....\|S..;..r........{7...Qt.Q..u.\....}.O......~...~.F'.t.....5....t....WnlpT.k7.........}J.....(.^..[7v..hJ-C8G..5..J4)..=RN\RA.E...T.gq...Z.5....:.G...j......nY .5....H.x...\..j[.S.K4.\..Y..CcF..j....;h....3......h....3...=..!......}j.yOe..!...d...H...P4.\'(ml.-(..../.5.S.a3....s.mFG..K`...Y...YK.jb.0.A+.PW.&

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\sunjce_provider.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	277281
Entropy (8bit):	7.891665260119691
Encrypted:	false
SSDEEP:	6144:7mse9qwebCf4Eafl80bg6v/r/VTcb8etxYlqveGz0:7u9Z6Cf4bd80bdXr28etCHGz0
MD5:	DE037D1B6CDD8B22D8AD4437D6E95FB5
SHA1:	90EB938D67C8A04903E2E81714442447AE0F0935
SHA-256:	81AE9BF629BA500866BCF568733670B9E2D4F560266615ABA83F43DD4BF14F4D
SHA-512:	6A82AD3C070A1444764174A2E3E6680F15BB21E0CCF64A4ADB698C1102CCEE717104155D817F267765BC0CF12AB0D5EDE72ED3100F4AAD7EF18A61FC282D8629
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MFu..j.@.D....-.B.....l.B....i.qZ...X....9.H.()wg.7.f.5.K..@9..V..Z.Hb$>.Hu....;...sx5g....y......L..}.^.......dR.9...~..c..5....-.6p..i.e4.u..'F...3<....K..H...,..6..G..E..;y7>..b.%.<v.....PK..1.'.....t...PK........e..X............<...com/sun/crypto/provider/AESCipher$AES128_CBC_NoPadding.class.P.J.@..mc.........CCEDP....JZ...J.,u%.M[.<....?J\|..B...aw..?>..b.@......t4tl3.....+.b....9I....!...'\......O.j.oE..z7.#.g.:/.2....P...^..zwU...c..l..v...T....NU..!W..T..\|L.c/..a(...]u....,..C{}.P.n.F..J.Z. ....rf.sE....\|!.k....6..FU.NhPwD>#..7.....(..^..(.>.?.2I.P.El..P...)...f..PK......'.......PK........e..X............<...com/sun/crypto/provider/AESCipher$AES128_CFB_NoPadding.class.P.J.@..mc..........""(BM..JZ.x-i..+.&l....I....Q.^...f................Ml....c..t#.Ho.......D.g....^..r..OCr.q.....u....\.=.+..;.;..7.u{=.{...=.....hi'..g.5N#;V.J.\..cR..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\sunmscapi.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	43965
Entropy (8bit):	7.871775463431008
Encrypted:	false
SSDEEP:	768:jp76v46ZRz//PdylPACw2EctYPSRPXMFRVDz8UTWbzPNvLhZ1G+UOgRtAladNBmj:t76v46rz//PdyFZw2EX4MFRVDz8UojNt
MD5:	5A46B60C8B4542161C857C728AF0F2D7
SHA1:	8EDA1AC6D633476055A684FF9CFDCFFCA598FA77
SHA-256:	28AD70DA26F852DCFC25D4870887EF0F912D3D28D5F25BB899519E9352063869
SHA-512:	7A763E938040C513DC36EA300C7EB4AD9ED6E7052F8A3CFFCB28A5BA2A82EFBEAF871D5489D060D3709DA20958C09B257ABA0D5AACB0E2505037E09D36767E98
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MFu..j.@.D....-.B.....l.B....i.qZ...X....9.H.()wg.7.f.5.K..@9..V..Z.Hb$>.Hu....;...sx5g....y......L..}.^.......dR.9...~..c..5....-.6p..i.e4.u..'F...3<....K..H...,..6..G..E..;y7>..b.%.<v.....PK..1.'.....t...PK........f..X............,...sun/security/mscapi/CKey$NativeHandles.classuRMo.@.}.8ql\.h........p(..(...B..Z!q..uI..v....s."..*..?....9TB.....73...}.p..6L.-.1....s..3&.....h.K^F..h.X..s5..... Y..-6.W^......_.B...U.)..f.o.Pv..t...rl#...u.K.Fj&.)...W.$..(...#_5.Mc.{}G....(:(.r`.2Qup...q....~....GA2.vc_..O..d...S.nuT.6...ga..zG...Z.........D`.8...u..+.O..H.Wq\..j..Mn>..C.v...N..1ZE.9b....Z...&..ho..>..N.N......$....L..J....AjM...A\v_..p..s..W...KG{(./.]=.jn.vK..}6c`...`.E`.n.......V.P.!&..e<f..\.0..#.@....?..8m.Yab....!.3<78.Yr.K.J..k.{..E./PK.............PK........f..X................sun/security/mscapi/CKey.class.U.s.U...f......).#...L.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\sunpkcs11.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	281834
Entropy (8bit):	7.955886052598762
Encrypted:	false
SSDEEP:	6144:isJ7DI2StVnT8eLXAQLwNmBUdbk1/ikpjixLEjlCozv:i+pebcc5uLEJr7
MD5:	6FDB06C66C821DB0B688975D7E9C1466
SHA1:	A052BFA8BB07841A91FD852460ED434374980A03
SHA-256:	75DEFC4EFA556BF7C09E21820DF8247E4B936437CFCAB7C7DF51F2FCA11C6A4B
SHA-512:	AC5770D77D2A2ABE6DC2972802E432608FA742EDCEB24F5BD117B4E734013FE57B88C3B899DC6BDD3DBB6931E3B627753BA76D560E03323988D0C31FCE613034
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MFu..j.@.D....-.B.....l.B....i.qZ...X....9.H.()wg.7.f.5.K..@9..V..Z.Hb$>.Hu....;...sx5g....y......L..}.^.......dR.9...~..c..5....-.6p..i.e4.u..'F...3<....K..H...,..6..G..E..;y7>..b.%.<v.....PK..1.'.....t...PK........f..X............ ...sun/security/pkcs11/Config.class.:.`TU...7.L^........&.B.....R4.%.....H2.g&...Zv.bYwU.....h....`.v]u.e.].R.9..7.....{.m.~..#.>...%v\|./..v.[....t\|._uP.5..n.7....o9..o3........w.......g.....\|..c....).......k_0.'./.\|..k...@....7.G.o...v.....{....1q..0.....;.M. ..%B8.-...9`..P.8@...Ri..3P..... ..4...wT.A..TE...4.-t.....r..b..M.C.Pn.1..`8.\|...F0....x..F9 M.v@=~..a0..8...L`Pd..U......W...%.....b2.S..=U.E..1.1.U\..qVs9C.3....2.g.X.......y\.W.........BU.qY.b=..6.....W..J.f.W.x..'.x.*UQE...T...%..Vq..-<}...zU\..e..a..:D..W...8Q...hTE...yKy..U.T.U4.b.Nb...h.5\.e...5..uL}.ZU.U....vU.Tq.Cl...:......bp.*...."l....Ol

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\ext\zipfs.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	72054
Entropy (8bit):	7.949837630895611
Encrypted:	false
SSDEEP:	1536:MXjSKV0Bi1BlOLrzzFnkaeRQPucovnDX5pmU2j+OE4UsMMDp/yu:MTSKV0Ql2rtkT2S3YPELK7
MD5:	BA81E2C9EF80A068861703EF0FA0A04E
SHA1:	031E08F4178958B65007A96577699B5BD4F59D27
SHA-256:	BF331A4660F708311457BAA7828C7290E1BD9EEA3BE16DF16CB9A898BBEB2BF9
SHA-512:	096B694F112E14E6E0BE512F5AF1F87069F2B33D75EA626C7168E0CF23DCF488A9A67799A35D6DDB6F91FB14DD1EF4A1FBDE9EF155281FD6741709328B30C6A8
Malicious:	false
Reputation:	low
Preview:	PK..........X................META-INF/......PK..............PK..........X................META-INF/MANIFEST.MFm.=..@.D....[j.QQ.t.,.DQ..%n`.n/l.........o.....br&.8H...../.y.....R.AS8.....8:Ja.....`%.k.....u6../...cI9...?..sG..-.>+k2%.tM...`..fS.u.._...a,.zX...5.e.."K.9.......PK..K^.....A...PK...........X............-...com/sun/nio/zipfs/JarFileSystemProvider.class.U]S.U.~NH.a.@..B.\.!.$.U[.X..J..H..G...$,Mv.....z....9...........Z.d..a.1.y...<..s.y...~....x&c......q..B.`B.......'b.4...'e.1%......i!f../aV.L......B,.XD..KX.......V..^..@....`SD..`[.C._0.'..p.2.EF...SV.3t-.&OW.Yn....i....vx..=..]}O.J.Y.2.m..q.Tmc.Z.....H.arW[[I.7.L...F.k.E&...../.z.J...,U. QD...%....v...".+s.-f.....e..3....."..bvu[..b..Ag.<I7U.^J..j....~.W\.2....i.j..1C7..:..U.QM.UG.d.c`4.8.Pf..MA.E.;0...1.r..bX..$l>h..%..,h...."^=m.90]}.T.}'.&...B;m.-.9.\T....x.p.laD.....#..U.r..P..o...(.a.....`.E.....1..4-......fT......H.kN..1....r.Z"7.J+d....B5.'U...e.).!...rt...^.p3..k.8.j.:..k5T

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\flavormap.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3928
Entropy (8bit):	4.86616891434286
Encrypted:	false
SSDEEP:	96:pTgwOsORUjdjTD6QfxWkVIyiVyV2mjuVwwY:Jgw5TjdjTtpWk6ylV2zwwY
MD5:	D8B47B11E300EF3E8BE3E6E50AC6910B
SHA1:	2D5ED3B53072B184D67B1A4E26AEC2DF908DDC55
SHA-256:	C2748E07B59398CC40CACCCD47FC98A70C562F84067E9272383B45A8DF72A692
SHA-512:	8C5F3E1619E8A92B9D9CF5932392B1CB9F77625316B9EEF447E4DCE54836D90951D9EE70FFD765482414DD51B816649F846E40FD07B4FBDD5080C056ADBBAE6F
Malicious:	false
Reputation:	low
Preview:	#.# This properties file is used to initialize the default.# java.awt.datatransfer.SystemFlavorMap. It contains the Win32 platform-.# specific, default mappings between common Win32 Clipboard atoms and platform-.# independent MIME type strings, which will be converted into.# java.awt.datatransfer.DataFlavors..#.# These default mappings may be augmented by specifying the.#.# AWT.DnD.flavorMapFileURL .#.# property in the appropriate awt.properties file. The specified properties URL.# will be loaded into the SystemFlavorMap..#.# The standard format is:.#.# <native>=<MIME type>.#.# <native> should be a string identifier that the native platform will.# recognize as a valid data format. <MIME type> should specify both a MIME.# primary type and a MIME subtype separated by a '/'. The MIME type may include.# parameters, where each parameter is a key/value pair separated by '=', and.# where each parameter to the MIME type is separated by a ';'..#.# Because SystemFlavorMap implements Flavor

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\fontconfig.bfc

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	raw G3 (Group 3) FAX
Category:	dropped
Size (bytes):	3778
Entropy (8bit):	4.416740385938501
Encrypted:	false
SSDEEP:	96:iX/WgWWWW81dp83p3j7WOk4BxciETBT5BLrws+LW/Be6J2:iXtWWWW8/e53PNxci8juWW
MD5:	AD8365719B70A2DEADE79683D8986A15
SHA1:	88CBF37D05F28691B7F82E74FA891792E93B41B9
SHA-256:	B2AB990DF3C4C1C2EC4317AAF22C946DF17F0796727DBDA712402307C56558AC
SHA-512:	287B19B6996A189BAA3CF2894A57917B14B0615D551C5248AD55860678E5D6E58DD21247799BEBE91B8236FC2F5300399FCFC1BB159EDB9AE8D663805C6A30F1
Malicious:	false
Reputation:	low
Preview:	...&.........:.^.p.........#.a...........6.>.:.-.9.<.=.3./.0.;.4...2.8.1.5.7................................................................................................................................................................................. .!............. .!.................................................................................E.D.J.G.B.H.F.C.@.A.?.I...........................................................................................!.".#.$.%.&.'.(.).*.+.+.+.+.+.K.O.W.`.h.g.Z.Y.f.X.T.^.a.b.c.[.Q.\.R.U.L.S.P.].e.N.V._.d.M.i.l.....t.s.n.}.\|.......r.q.~.u.m.y...v.z.x.{.........j.w.k.o.........p.......................................................................................................................................................".......#........... .................#.(.-.2.7.<.A.F.K.P.U.[.a.g.m.s.y.........................................................!.).6.<.I.V.e.l.~.............................&.2.>.H.S.\.h.q.}.............................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\fontconfig.properties.src

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11575
Entropy (8bit):	5.215183795812278
Encrypted:	false
SSDEEP:	192:XThf+e6a1nsNi8bTeOiO/Ywca9nB2RwhCdvBQGuo6wj:XThflnHIR9B2Rwhifj
MD5:	D4D5981664D4CB0EBCB6F3BF63505B29
SHA1:	4720B7407706F4E0D80CB458194E74F8FC3B83F1
SHA-256:	F13DF9360E93B24820B24652473F6CB0F4F70FC346AA3B408ACB94ED59CAC0AC
SHA-512:	3658FF76C882511E7EE3821BBD31C3CE0D3FF263CE5F69659F54732667CBB9148ADFBD0BBAEA916071E1D38DB671BF6DDAC84DDD3362CFF0DDF21C7CC1240DF2
Malicious:	false
Reputation:	low
Preview:	#.# .# Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floor,

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\hijrah-config-umalqura.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14959
Entropy (8bit):	3.6828553232288717
Encrypted:	false
SSDEEP:	96:S8ThI1EgZass+YXdGOS8NhN9Yd9Yq67IwOYUuUS9O0:bThpyJO/BFi9YqAInYUuUmO0
MD5:	7B451352F9F9EAC657D963C5D2921DDA
SHA1:	D8C664AC3E18A044465B4F76311661A4F7F045A2
SHA-256:	3456982DE9EBA535337852F02852E26E4ED197EBD9D8356977E6DA4ED9075538
SHA-512:	822BE7D4E40408DCB0788EFC521FB13EAF3650DB4F934CFBD37D00C0026D35D254CF415D5AD7273C78FCED84A582BCCF101E413C0686095CDDE4BFA93F883E13
Malicious:	false
Reputation:	low
Preview:	# Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floor, Boston, MA

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\cursors.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	4.9763389414972465
Encrypted:	false
SSDEEP:	24:RlwQtG0Bf29d3ptAMZGpfFGZWpHN07mBpQKf4TpxV4jp504Tz8pFMafpXs:RlwQM0BfEpZSKyCycXW44Cfy
MD5:	269D03935907969C3F11D43FEF252EF1
SHA1:	713ACB9EFF5F0B14A109E6C2771F62EAC9B57D7C
SHA-256:	7B8B63F78E2F732BD58BF8F16144C4802C513A52970C18DC0BDB789DD04078E4
SHA-512:	94D8EE79847CD07681645D379FEEF6A4005F1836AC00453FB685422D58113F641E60053F611802B0FF8F595B2186B824675A91BF3E68D336EF5BD72FAFB2DCC5
Malicious:	false
Reputation:	low
Preview:	#.#.# Cursors Properties file.#.# Names GIF89 sources for Custom Cursors and their associated HotSpots.#.# Note: the syntax of the property name is significant and is parsed.# by java.awt.Cursor.#.# The syntax is: Cursor.<name>.<geom>.File=win32_<filename>.# Cursor.<name>.<geom>.HotSpot=<x>,<y>.#. Cursor.<name>.<geom>.Name=<localized name>.#.Cursor.CopyDrop.32x32.File=win32_CopyDrop32x32.gif.Cursor.CopyDrop.32x32.HotSpot=0,0.Cursor.CopyDrop.32x32.Name=CopyDrop32x32.#.Cursor.MoveDrop.32x32.File=win32_MoveDrop32x32.gif.Cursor.MoveDrop.32x32.HotSpot=0,0.Cursor.MoveDrop.32x32.Name=MoveDrop32x32.#.Cursor.LinkDrop.32x32.File=win32_LinkDrop32x32.gif.Cursor.LinkDrop.32x32.HotSpot=0,0.Cursor.LinkDrop.32x32.Name=LinkDrop32x32.#.Cursor.CopyNoDrop.32x32.File=win32_CopyNoDrop32x32.gif.Cursor.CopyNoDrop.32x32.HotSpot=6,2.Cursor.CopyNoDrop.32x32.Name=CopyNoDrop32x32.#.Cursor.MoveNoDrop.32x32.File=win32_MoveNoDrop32x32.gif.Cursor.MoveNoDrop.32x32.HotSpot=6,2.Cursor.MoveNoDrop.32

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\invalid32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_CopyDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	165
Entropy (8bit):	6.347455736310776
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrBwM7Qt/wCvTjh2Azr8ptBNKtWwUzJ7Ful5u44JyYChWn:KP0URwMcx3UAzADBNwUlBul5TLYMWn
MD5:	89CDF623E11AAF0407328FD3ADA32C07
SHA1:	AE813939F9A52E7B59927F531CE8757636FF8082
SHA-256:	13C783ACD580DF27207DABCCB10B3F0C14674560A23943AC7233DF7F72D4E49D
SHA-512:	2A35311D7DB5466697D7284DE75BABEE9BD0F0E2B20543332FCB6813F06DEBF2457A9C0CF569449C37F371BFEB0D81FB0D219E82B9A77ACC6BAFA07499EAC2F7
Malicious:	false
Reputation:	low
Preview:	GIF89a.. ................!.......,...... ...vL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.. V..9'......f.T....w.xW.B.....P..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_LinkDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	168
Entropy (8bit):	6.465243369905675
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrZauowM7Qt/wCvTjh2Azr8ptBNKtWwUzJZmQYRNbC1MIQvEn:KP0UpawMcx3UAzADBNwUlZaCzn
MD5:	694A59EFDE0648F49FA448A46C4D8948
SHA1:	4B3843CBD4F112A90D112A37957684C843D68E83
SHA-256:	485CBE5C5144CFCD13CC6D701CDAB96E4A6F8660CBC70A0A58F1B7916BE64198
SHA-512:	CF2DFD500AF64B63CC080151BC5B9DE59EDB99F0E31676056CF1AFBC9D6E2E5AF18DC40E393E043BBBBCB26F42D425AF71CCE6D283E838E67E61D826ED6ECD27
Malicious:	false
Reputation:	low
Preview:	GIF89a.. ................!.......,...... ...yL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.6.'.....`1]......u.Q.r.V..C......f.P..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_MoveDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 31 x 32
Category:	dropped
Size (bytes):	147
Entropy (8bit):	6.147949937659802
Encrypted:	false
SSDEEP:	3:CruuU/XExlHrSauZKwM7Qt/wCvTjh2Azr8ptBNKtWXOh6WoXt2W:KP0UvEKwMcx3UAzADBNXOh6h9p
MD5:	CC8DD9AB7DDF6EFA2F3B8BCFA31115C0
SHA1:	1333F489AC0506D7DC98656A515FEEB6E87E27F9
SHA-256:	12CFCE05229DBA939CE13375D65CA7D303CE87851AE15539C02F11D1DC824338
SHA-512:	9857B329ACD0DB45EA8C16E945B4CFA6DF9445A1EF457E4B8B40740720E8C658301FC3AB8BDD242B7697A65AE1436FD444F1968BD29DA6A89725CDDE1DE387B8
Malicious:	false
Reputation:	low
Preview:	GIF89a.. ................!.......,...... ...dL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj.....-.kj..m.....X,&.......S..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
SSDEEP:	3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low
Preview:	GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'\|N...."U........(8HXhx.X..;

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jce.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	96898
Entropy (8bit):	7.892071966864073
Encrypted:	false
SSDEEP:	1536:Uh/eNOC2BVtmSb5yZDudaet6se6sWphz7T9gJo/VLBU0w/NT//6LhRBSJ1YKSzFm:Dj2BVtwuda8GWpngaVLo16Lf2SG9
MD5:	6F041C2C6142155527A6505DE37643ED
SHA1:	4431C99F34B0F6D4B2323C67FAB8803438C59A4C
SHA-256:	713499D9D76AE8E4009BEF6550AB900F827814830D347E387F263B4E87C3F06F
SHA-512:	5FA49939226DBDBFEB326D8C082294915B8F88D34A9C8E09F55E3860817893CBEF42795693FA8A67732E9DAFEDC11B47CB0BA8D14D63F34B6B02C451FB033F0D
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MFu..j.@.D....-.B.....l.B....i.qZ...X....9.H.()wg.7.f.5.K..@9..V..Z.Hb$>.Hu....;...sx5g....y......L..}.^.......dR.9...~..c..5....-.6p..i.e4.u..'F...3<....K..H...,..6..G..E..;y7>..b.%.<v.....PK..1.'.....t...PK........e..X............&...javax/crypto/AEADBadTagException.classm..J.@....[$............."Bk..d(#qR.T.c....\|.....?A\..s~..w..}...8D.F.+FV-.YX'Tc.)..2.U....&.:.....W.S..<....l~..gJ..m.\'.%..WZ.L.F2..Q.N........;.$Rz\|j.. .F..T..h.......7..$.'..X.6......9^.4IB..".......A.Y.5@.B.....2X.E....N.'..7..4Pb...Z\|.^.......I..#...q.1;.....PK..\|99.........PK........e..X............&...javax/crypto/BadPaddingException.classmOKJ.A.........+.Bb.G!+..... B4..L.Z..3#..<....<.{..E..Cp!...W........@.u.9,YX.b..UB-.F.` M.B}wyJ.+B...(.:.. .......L(...cB..= ./....:y.Js+..+.f.^<.7.z..c...c.N?L.'.5....F.>/.&.....].+.....a....3.q...$.[iU$..x.^H-.........w.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jfr.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	889607
Entropy (8bit):	5.887553758008623
Encrypted:	false
SSDEEP:	6144:/tQiroOdgbLsUfol74NFQ1y1bnCu15yN+G2LZ5XTZqlXiDUyW4WfgSowRV0nFAYb:1XdasiQUEu1c+BlAlWFVDr
MD5:	C23CFF9E687B613099E279F17077A479
SHA1:	FE1EF2783FE573E47FD8253E7A2CE47607DB10CD
SHA-256:	6A4D3FC4DE1AF8326E1A3D3083D3699E65F75ABC4B57F00CFEF24C9911818177
SHA-512:	4AEEEE27313EADD4C740792CAF835D457619C433181C2382CEFBC8637BAD200075058B722254FE8C7EB26EFC0665D8F30F72AFD1079E21DD291EDD7CF068B62A
Malicious:	false
Reputation:	low
Preview:	PK........:..X................META-INF/....PK........:..X...3...3.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Temurin..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_412..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_75 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK........M..Xu.c.. ... ......jdk/jfr/AnnotationElement.class.......4.w..u.........7.........A.................................................Y...............................A.................................u.........P.........7..............7....7....7............,....,............0..........2....0..........P....P..........P....7.......P..........P....A....A....A.........P....,..........J.........,.........................u..........P..................................A....P............7..............A. ..Y....!.."..A.#..A.$..P.%..&..'..(..)....+..,...type...Ljdk/jfr/internal/Type;...annota

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jfr\default.jfc

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	29075
Entropy (8bit):	4.598288848780925
Encrypted:	false
SSDEEP:	192:/vWjn+DUXUv6NKKqW2Q0hG6lPBZi4Rt0ng3Ca66L3gq:/vWjn+DUXSF1WGG6l5taahgq
MD5:	4A17A34EA96B3DEE68CC173FF1317948
SHA1:	FD81084A9B8407B60B457B9AA95C8BFF31E78BB7
SHA-256:	07905E9FC1BE1A17FB74DF479BEDCF40FDEB0427722B0E2D12AF96A4705A5E6A
SHA-512:	7D73113C38B49C024902972135B2243A2D2223E4A3CB3DB51AA84A79495FF953FCB41E7556F26E9B8F131C6565011C95D92769613265998F2586691CE15C17F0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="2.0" label="Continuous" description="Low overhead configuration safe for continuous use in production environments, typically less than 1 % overhead." provider="Oracle">.. <event name="jdk.ThreadAllocationStatistics">. <setting name="enabled">true</setting>. <setting name="period">everyChunk</setting>. </event>.. <event name="jdk.ClassLoadingStatistics">. <setting name="enabled">true</setting>. <setting name="period">1000 ms</setting>. </event>.. <event name="jdk.ClassLoaderStatistics">. <setting name="enabled">true</setting>. <setting name="period">everyChunk</setting>. </event>.. <event name="jdk.JavaThreadStatistics">. <setting name="enabled">true</setting>. <setting name="period">1000 ms</setting>. </event>.. <event name

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jfr\profile.jfc

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	29033
Entropy (8bit):	4.595518174775472
Encrypted:	false
SSDEEP:	192:/9WAI3LHXIFIKKp5xQ0N+0SPBZiIJt0ng3Ca66L9Hq:/9WAI3LHX6ls5t+0S5NaaXHq
MD5:	35922901E0D5D7D88E6EE01DC7FE3CE0
SHA1:	1ECE05FBFE6DA2CD68A09EB04F4BB1FB930378C0
SHA-256:	0207C7DDBBA287366723ECC65641B0E1F03195895D4A39F36D8E1D135DF13E84
SHA-512:	F64FF26C637BF984CB50342408CE7E4A6E93A5996C77754018E5104DA521F142109A48F6B295DB7BBAF58BBD07BD0FB7B5827A769303528FBC6EC30E57E50567
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="2.0" label="Profiling" description="Low overhead configuration for profiling, typically around 2 % overhead." provider="Oracle">.. <event name="jdk.ThreadAllocationStatistics">. <setting name="enabled">true</setting>. <setting name="period">everyChunk</setting>. </event>.. <event name="jdk.ClassLoadingStatistics">. <setting name="enabled">true</setting>. <setting name="period">1000 ms</setting>. </event>.. <event name="jdk.ClassLoaderStatistics">. <setting name="enabled">true</setting>. <setting name="period">everyChunk</setting>. </event>.. <event name="jdk.JavaThreadStatistics">. <setting name="enabled">true</setting>. <setting name="period">1000 ms</setting>. </event>.. <event name="jdk.ThreadStart">. <setting name="

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jsse.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1922690
Entropy (8bit):	5.933078122374002
Encrypted:	false
SSDEEP:	12288:yN5znh6wnwoYp+UGreu53u0w8Cge9AbqBpIeQOod:UDh6347rD+oG9AbqkeQO6
MD5:	695C2C65244D72257C3D877ACA99F073
SHA1:	2F0ECAF8A2FF281E835A5002139F23CD4613E3D7
SHA-256:	DE2B6C65FC6BFBF68C34371675CA0917029875A6D34A0C3E0C0BEEF172416B58
SHA-512:	FA144019B6F3029B8B5CDB4BD185B4FE118C2D8098F3352BAA185BF45A6559329B2AC2B31366D1940C5DD77DD152C110AEBAC3DB5F033E521FD833B38CD04549
Malicious:	false
Reputation:	low
Preview:	PK........;..X................META-INF/....PK........;..X...3...3.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Temurin..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_412..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_75 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK........<..X....E...E...+...com/sun/net/ssl/internal/ssl/Provider.class.......4...............................serialVersionUID...J...ConstantValue.,..c".J-...<init>...()V...Code...LineNumberTable...(Ljava/security/Provider;)V...(Ljava/lang/String;)V...isFIPS...()Z...install...SourceFile...Provider.java......................%com/sun/net/ssl/internal/ssl/Provider...sun/security/ssl/SunJSSE.1.......................................!...........................)................"........+......................./............."........*+...................3...4.)...................................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\jvm.hprof.txt

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	4226
Entropy (8bit):	4.708892688554676
Encrypted:	false
SSDEEP:	96:CYrYJDrYJ+RvJ3z3d9uGG7hPxTRnhTbraYfwE5DyK:CYrsDrsgvJ3z3buGG7LvSmhDz
MD5:	C677FF69E70DC36A67C72A3D7EF84D28
SHA1:	FBD61D52534CDD0C15DF332114D469C65D001E33
SHA-256:	B055BF25B07E5AC70E99B897FB8152F288769065B5B84387362BB9CC2E6C9D38
SHA-512:	32D82DAEDBCA1988282A3BF67012970D0EE29B16A7E52C1242234D88E0F3ED8AF9FC9D6699924D19D066FD89A2100E4E8898AAC67675D4CD9831B19B975ED568
Malicious:	false
Reputation:	low
Preview:	Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:.. - Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... - Neither the name of Oracle nor the names of its. contributors may be used to endorse or promote products derived. from this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS.IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,.THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR.PURPOSE ARE DISCLAIMED.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\logging.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2455
Entropy (8bit):	4.47026133037931
Encrypted:	false
SSDEEP:	48:EmdS5PQQL8pRNYHjVsnkYXxtOGh1xdvjMgxH:G9NL3HjVLG1XrM8H
MD5:	809C50033F825EFF7FC70419AAF30317
SHA1:	89DA8094484891F9EC1FA40C6C8B61F94C5869D0
SHA-256:	CE1688FE641099954572EA856953035B5188E2CA228705001368250337B9B232
SHA-512:	C5AA71AD9E1D17472644EB43146EDF87CAA7BCCF0A39E102E31E6C081CD017E01B39645F55EE87F4EA3556376F7CAD3953CE3F3301B4B3AF265B7B4357B67A5C
Malicious:	false
Reputation:	low
Preview:	############################################################.# .Default Logging Configuration File.#.# You can use a different file by specifying a filename.# with the java.util.logging.config.file system property. .# For example java -Djava.util.logging.config.file=myfile.############################################################..############################################################.# .Global properties.############################################################..# "handlers" specifies a comma separated list of log Handler .# classes. These handlers will be installed during VM startup..# Note that these classes must be on the system classpath..# By default we only configure a ConsoleHandler, which will only.# show messages at the INFO and above levels..handlers= java.util.logging.ConsoleHandler..# To also add the FileHandler, use the following line instead..#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler..# Default global logging level..# This

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\management-agent.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.990839618083078
Encrypted:	false
SSDEEP:	6:5jTtaB4r/RjTtGzbdy/oocjZDMX2K5YZ5/C3RxxTtkm4xEqaVgxmzbdGh/4:5jAGJj0q1cxMXPA/C3RxsuqaKx2K/4
MD5:	93838CCFA6C5F6D0325AC9AB3B178AB3
SHA1:	55B8BB85B097AD944DC9DABA2DD88F4EDE7A314C
SHA-256:	9A39428E867677FD5C03D40C0FC85C7EDB69838E0CD910339AD0083D135701FB
SHA-512:	A6B05BDC69F0FBEF008D2925B28B56F8F7DACB572BF32FF44B5456B5DF77C5EA596DAA8FF1E2C14DEEC752F67A9F98FBD8CEA21E457C61989893265EA384B587
Malicious:	false
Reputation:	low
Preview:	PK........:..X................META-INF/......PK..............PK........:..X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.JM,IM.u........h..%&.*8.....%...k.r9....:.$..[).....&.%....E..r.\.E....y...r..PK......k.......PK..........:..X..............................META-INF/....PK..........:..X....k.....................=...META-INF/MANIFEST.MFPK..........}.........

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\management\jmxremote.access

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3998
Entropy (8bit):	4.420205717459709
Encrypted:	false
SSDEEP:	96:OWi7j79eK8MCN/xK4ijnv+wtosJj/D9mQyZWZuQgQX+dv:OWiv7b8rNXE+wusxr9m5WZuVDv
MD5:	F63BEA1F4A31317F6F061D83215594DF
SHA1:	21200EAAD898BA4A2A8834A032EFB6616FABB930
SHA-256:	439158EB513525FEDA19E0E4153CCF36A08FE6A39C0C6CEEB9FCEE86899DD33C
SHA-512:	DE49913B8FA2593DC71FF8DAC85214A86DE891BEDEE0E4C5A70FCDD34E605F8C5C8483E2F1BDB06E1001F7A8CF3C86CAD9FA575DE1A4DC466E0C8FF5891A2773
Malicious:	false
Reputation:	low
Preview:	######################################################################.# Default Access Control File for Remote JMX(TM) Monitoring.######################################################################.#.# Access control file for Remote JMX API access to monitoring..# This file defines the allowed access for different roles. The.# password file (jmxremote.password by default) defines the roles and their.# passwords. To be functional, a role must have an entry in.# both the password and the access files..#.# The default location of this file is $JRE/lib/management/jmxremote.access.# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# (See that file for details).#.# The file format for password and access files is syntactically the same.# as the Properties file format. The syntax is described in the Javadoc.# for java.util.Properties.load..# A typical access file has multiple lines, where each

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\management\jmxremote.password.template

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	4.492265087792545
Encrypted:	false
SSDEEP:	48:MGS+Hpamow7YNkjP9YZAuFovuAnNpG1GMV/BWEUHXYE9nN6k5:Mdm7RT9tvuAnujaE0rN6g
MD5:	7B46C291E7073C31D3CE0ADAE2F7554F
SHA1:	C1E0F01408BF20FBBB8B4810520C725F70050DB5
SHA-256:	3D83E336C9A24D09A16063EA1355885E07F7A176A37543463596B5DB8D82F8FA
SHA-512:	D91EEBC8F30EDCE1A7E16085EB1B18CFDDF0566EFAB174BBCA53DE453EE36DFECB747D401E787A4D15CC9798E090E19A8A0CF3FC8246116CE507D6B464068CDB
Malicious:	false
Reputation:	low
Preview:	# ----------------------------------------------------------------------.# Template for jmxremote.password.#.# o Copy this template to jmxremote.password.# o Set the user/password entries in jmxremote.password.# o Change the permission of jmxremote.password to read-only.# by the owner..#.# See below for the location of jmxremote.password file..# ----------------------------------------------------------------------..##############################################################.# Password File for Remote JMX Monitoring.##############################################################.#.# Password file for Remote JMX API access to monitoring. This.# file defines the different roles and their passwords. The access.# control file (jmxremote.access by default) defines the allowed.# access for each role. To be functional, a role must have an entry.# in both the password and the access files..#.# Default location of this file is $JRE/lib/management/jmxremote.password.# You

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\management\management.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14749
Entropy (8bit):	4.570460272626401
Encrypted:	false
SSDEEP:	384:Fcsmpsj42wbZTHV+Dq3xtP3xPqaNC/R1a:msmpsjL0ZTHV++3xtpi68Xa
MD5:	99E8FBEBA4807939D64405F3C5CA5973
SHA1:	F6B4C642B3907FE90401417D1E698C491842B34A
SHA-256:	57B2702C8A4158AE72C3616300EFDC81D690D617C1D1CE2A66B1C95E0DBE0D57
SHA-512:	3C80B277BE3FF45B468C624538F394D7FF6E38442B25A75E1CA764264194F2619F3B7A8FC20FA8F8DB1DD94657080ADF6928B0BF369D376CB52898B68EB981BB
Malicious:	false
Reputation:	low
Preview:	#####################################################################.#.Default Configuration File for Java Platform Management.#####################################################################.#.# The Management Configuration file (in java.util.Properties format).# will be read if one of the following system properties is set:.# -Dcom.sun.management.jmxremote.port=<port-number>.# or -Dcom.sun.management.snmp.port=<port-number>.# or -Dcom.sun.management.config.file=<this-file>.#.# The default Management Configuration file is:.#.# $JRE/lib/management/management.properties.#.# Another location for the Management Configuration File can be specified.# by the following property on the Java command line:.#.# -Dcom.sun.management.config.file=<this-file>.#.# If -Dcom.sun.management.config.file=<this-file> is set, the port.# number for the management agent can be specified in the config file.# using the following lines:.#.# ################ Management Agent Port ################

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\management\snmp.acl.template

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	4.371600962667748
Encrypted:	false
SSDEEP:	48:MkX7W6+IX6XXZAHAvuAn97+onkFOqRCjEhd//SVBteM8hq/unuxsIsxuEAJw2n:MU6bpjvuAnEokSIU/uuxJn
MD5:	71A7DE7DBE2977F6ECE75C904D430B62
SHA1:	2E9F9AC287274532EB1F0D1AFCEFD7F3E97CC794
SHA-256:	F1DC97DA5A5D220ED5D5B71110CE8200B16CAC50622B33790BB03E329C751CED
SHA-512:	3A46E2A4E8A78B190260AFE4EEB54E7D631DB50E6776F625861759C0E0BC9F113E8CD8D734A52327C28608715F6EB999A3684ABD83EE2970274CE04E56CA1527
Malicious:	false
Reputation:	low
Preview:	# ----------------------------------------------------------------------.# Template for SNMP Access Control List File.#.# o Copy this template to snmp.acl.# o Set access control for SNMP support.# o Change the permission of snmp.acl to be read-only.# by the owner..#.# See below for the location of snmp.acl file..# ----------------------------------------------------------------------..############################################################.# SNMP Access Control List File .############################################################.#.# Default location of this file is $JRE/lib/management/snmp.acl..# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# or by specifying a system property (See that file for details)..#...##############################################################.# File permissions of the snmp.acl file.##############################################

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\meta-index

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	4.932378569095038
Encrypted:	false
SSDEEP:	48:EE796OfecH2M5tP5iMmC5KOAY2HQii+r4kzteKk:EnKHJbP5lmC5KOA3HQii+Ekz8Kk
MD5:	515D7A1FED569AF7A4E65580D993B16C
SHA1:	7AEF4C3DC21F89132D15C5CCA021B36717944F39
SHA-256:	DAA262732F1F698294822C762D8E33DB636AD67F21B402EAC70F78F315403FBF
SHA-512:	16FFEE33DF2916D07CC08B9166FD898AE7C005208F680F97EE94ECE1C97C78B33D56021CDAEE6F73F07155A9ED807C30EC1025FCEEC7E771FD199D96C44362EC
Malicious:	false
Reputation:	low
Preview:	% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..# charsets.jar..sun/nio..sun/awt..! jce.jar..javax/crypto..sun/security..# jfr.jar..jdk/jfr..jdk/management..! jsse.jar..sun/security..com/sun/net/..! management-agent.jar..@ resources.jar..com/sun/java/util/jar/pack/..META-INF/services/sun.util.spi.XmlPropertiesProvider..META-INF/services/javax.print.PrintServiceLookup..com/sun/corba/..META-INF/services/javax.sound.midi.spi.SoundbankReader..sun/print..META-INF/services/javax.sound.midi.spi.MidiFileReader..META-INF/services/sun.java2d.cmm.CMMServiceProvider..javax/swing..META-INF/services/javax.sound.sampled.spi.AudioFileReader..META-INF/services/javax.sound.midi.spi.MidiDeviceProvider..sun/net..META-INF/services/javax.sound.sampled.spi.AudioFileWriter..com/sun/imageio/..META-INF/services/sun.java2d.pipe.RenderingEngine..META-INF/mimetypes.default..META-INF/services/javax.s

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\net.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5352
Entropy (8bit):	4.817652960703195
Encrypted:	false
SSDEEP:	96:6AcEvVEtGObfObz3Obm0ObPOnte3CO0V+r/aJ7SFvgTzDuBnZky:YEVGG4f4z34m04Pet5m27SRgTe9f
MD5:	8BC6628D01BAD30798440CC00F638165
SHA1:	FD9471742EB759F4478BB1DE9A0DC0527265B6EA
SHA-256:	31CE7CE29C66A1696A985A197195B5E051B2C243EA83E9D1DE614F0C4B4F7530
SHA-512:	8DA3439774A07A6309F985D1A29DDA5383975BBDF6B8E2809BAB69A2C44F65D3DE2A546231ED6E183864193F834C9A7042FDCC4EE10181D0BD3891363032C242
Malicious:	false
Reputation:	low
Preview:	############################################################.# Default Networking Configuration File.#.# This file may contain default values for the networking system properties..# These values are only used when the system properties are not specified.# on the command line or set programatically..# For now, only the various proxy settings can be configured here..############################################################..# Whether or not the DefaultProxySelector will default to System Proxy.# settings when they do exist..# Set it to 'true' to enable this feature and check for platform.# specific proxy settings.# Note that the system properties that do explicitely set proxies.# (like http.proxyHost) do take precedence over the system settings.# even if java.net.useSystemProxies is set to true...java.net.useSystemProxies=false..#------------------------------------------------------------------------.# Proxy configuration for the various protocol handlers..# DO NOT uncomment th

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\psfont.properties.ja

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3793
Entropy (8bit):	5.260880283220047
Encrypted:	false
SSDEEP:	48:R8grHIty/qHh+m2YPOWK89HoIbTUjbyuJdI2FylXLr96cpcnnI0adbEk+IqdouZ:yg8ThI1Y6CiPFylXLrMGyJU+B
MD5:	D4C735BF5756759A1C3BC8DE408629FC
SHA1:	67C15E05A398B4CE6409D530A058F7E1B2208C20
SHA-256:	5A4BD51B969BF187FF86D94F4A71FDFBFA602762975FA3C73D264B4575F7C78F
SHA-512:	8124B25DECFA64A65433FF2CE1F0F7BDF304ABE2997568ABC35264A705F07152AA993B543DA37C4132B4B1B606743C825C90A0EB17B268518D478F5CF0889062
Malicious:	false
Reputation:	low
Preview:	#.#.# Copyright (c) 1996, 2000, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floor, B

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\psfontj2d.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11390
Entropy (8bit):	5.012862319190609
Encrypted:	false
SSDEEP:	192:FTh7Pwn+Cyub3Ee4OECKDIcYOhAgZ50OKDQLT2IcpRuWRbHr9NRXUh/QTv9Ho39I:FThTxzubEFOEscAW5VKsCfHz8RPxGt
MD5:	17B15D370018ACC01550175882C7DA91
SHA1:	4EDD9E0FC3D30FBDCABCDCAAB3BC0B3157FC881E
SHA-256:	780C565D5AF3EE6F68B887B75C041CDF46A0592F67012F12EEB691283E92630A
SHA-512:	E4EE92D4598385CB2F6F3A4DB91DDABD7E615DC105ED26CDC5B5598D01C526CEA7726FF93F92A308350229F2E5A5DD64CC0C38865DD97666368A330B410D4892
Malicious:	false
Reputation:	low
Preview:	#.#.# Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved..# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER..#.# This code is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License version 2 only, as.# published by the Free Software Foundation. Oracle designates this.# particular file as subject to the "Classpath" exception as provided.# by Oracle in the LICENSE file that accompanied this code..#.# This code is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or.# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License.# version 2 for more details (a copy is included in the LICENSE file that.# accompanied this code)..#.# You should have received a copy of the GNU General Public License version.# 2 along with this work; if not, write to the Free Software Foundation,.# Inc., 51 Franklin St, Fifth Floor, Boston,

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\resources.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3516891
Entropy (8bit):	6.070853899885793
Encrypted:	false
SSDEEP:	49152:flBykJjESzIdSzNEtI1ZprAJv/QJaLgIYv++VKjQVBijWEb/Fdoyvk8gzDSgyaKd:xKlzp
MD5:	BB8BD3AED76DCDD89641B6DA6C779378
SHA1:	842EFBEE5211676FB4830340919C8BA272CDEEDD
SHA-256:	DBDAAF4733556FDC24C45C844B64B698B61DE2E26C8EEF188A556945E1157873
SHA-512:	91F455D2E9FF12997431B095DD9C6F787EDD37D39F9C467CF20817D8DC8A4B00E90275708392A4DB5E9239FC4CF5A7AC3BA92DCA79F6E029C7AEDFDBED46CBE0
Malicious:	false
Reputation:	low
Preview:	PK........I..X................META-INF/....PK........I..X...3...3.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Temurin..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_412..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_75 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........X....$...$.......META-INF/mailcap.default#.# This is a very simple 'mailcap' file.#.image/gif;;..x-java-view=com.sun.activation.viewers.ImageViewer.image/jpeg;;..x-java-view=com.sun.activation.viewers.ImageViewer.text/;;..x-java-view=com.sun.activation.viewers.TextViewer.text/*;;..x-java-edit=com.sun.activation.viewers.TextEditor.PK...........X..{~2...2.......META-INF/mimetypes.default#.# A simple, old format, mime.types file.#.text/html..html htm HTML HTM.text/plain..txt text TXT TEXT.image/gif..gif GIF.image/ief..ief.image/jpeg..jpeg jpg jpe JPG.image/tiff..tiff tif.image/x-xwi

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\rt.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	63186152
Entropy (8bit):	5.97038754335313
Encrypted:	false
SSDEEP:	786432:MRufysdMnEtn85FAA4oLN+eu2wnTmTjjK:5MntTjjK
MD5:	736656AB99B3D41F2B23464F23F23B0A
SHA1:	8EC8CA09CC3684EE8FAB8F32DAA446CD4523604B
SHA-256:	9E71FE571A240580A5D1F291B65FED758E2AA21E405A3BD4823371FC8489A983
SHA-512:	CE5BC67885CCD7EE9A1FC755BD4629A99B753A02F3743BF0065F24567C278AD51C5BB01AC6379A1FF2E6018BDA1842E61AE4F481447A545FA9D152810222149E
Malicious:	false
Reputation:	low
Preview:	PK........I..X................META-INF/....PK........I..X................META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Temurin..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_412..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_75 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....Name: javax/swing/JCheckBoxMenuItem.class..Java-Bean: True....Name: javax/swing/JDialog.class..Java-Bean: True....Name: javax/swing/JSlider.class..Java-Bean: True....Name: javax/swing/JTextField.class..Java-Bean: True....Name: javax/swing/JTextPane.class..Java-Bean: True....Name: javax/swing/JTextArea.class..Java-Bean: True....Name: javax/swing/JList.class..Java-Bean: True....Name: javax/swing/JFormattedTextField.class..Java-Bean: True....Name: javax/swing/JApplet.class..Java-Bean: True....Name: javax/swing/JSpinner.class..Java-Bean: True....Name: javax/swing/JLabel.class..Java-Bean: True....N

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\blacklisted.certs

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2488
Entropy (8bit):	4.089749677426746
Encrypted:	false
SSDEEP:	48:NvY6cQYAcJrrDQPUs4M4eKaZp2bKj4j/DCxqhDlCEof4eS/b:NvY6meUTM4eKaZp2Hj/M8CEO4eQ
MD5:	19E78890D61C0DFC65B291341C08BEBA
SHA1:	EE0288462FC32992A0F9DFAB5AEB3385412F0C4F
SHA-256:	96572F243F31C2EF81A6E627542E596F6A9295CFF3C7AE095C1B595CB1457DED
SHA-512:	C6D8D4EE0EB7EEB14532512FF4310DFF9DD4F31D112716FC67A1052D37EEF18D4BD6EB58301C76167AD35D31E73F5B28993F4DA8C5DE2DBE3836A5EF7E9C8B7E
Malicious:	false
Reputation:	low
Preview:	Algorithm=SHA-256.03DB9E5E79FE6117177F81C11595AF598CB176AF766290DBCEB2C318B32E39A2.08C396C006A21055D00826A5781A5CCFCE2C8D053AB3C197637A4A7A5BB9A650.14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD.1C5E6985ACC09221DBD1A4B7BBC6D3A8C3F8540D19F20763A9537FDD42B4FFE7.1F6BF8A3F2399AF7FD04516C2719C566CBAD51F412738F66D0457E1E6BDE6F2D.2A464E4113141352C7962FBD1706ED4B88533EF24D7BBA6CCC5D797FD202F1C4.31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133.3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66.3E11CF90719F6FB44D94EAC9A156B89BEBE7B8598F28EC58913F2BFCAF91D0C0.423279423B9FC8CB06F1BB7C3B247522B948D5F18939F378ECC901126DE40BFB.450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2.4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE.4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176.535D04DFCE027C70BD5F8A9E0AD4F218E9AFDCF5BBCF9B6DE0D81E148E2E3172.568FAF38D9F155F624838E2181B1CEB4D8459305EE652B0F810C97C3611BFE19.585CFE6

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\cacerts

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java KeyStore
Category:	dropped
Size (bytes):	170880
Entropy (8bit):	7.644420208925934
Encrypted:	false
SSDEEP:	3072:G+qOCE9K/BT6yIjIVPRmBp72/UJ2Gpp2Njm1n6Gnp/JeJZkhF+:GPZT6yoIVJmBWUJ2Gpg61n6EFJeJae
MD5:	FD9904CF70C3B251B998F2A3416DC509
SHA1:	26E72DB92186F5B45D0213EB54C28CE65EDF3BD0
SHA-256:	23337BB1466BCB5CA81851130CAE947893BCC8D12E1BACE2DBAF1E90FEE9CE9B
SHA-512:	E19986B2D279C79E4048ECC982761FFAE145BCC7FD133B1D4AA4AF8555736A00193B18335B0A65A39E3F1237F048E903F6ED25895A090DB87BE0CA339A01622E
Malicious:	false
Reputation:	low
Preview:	.................Ecn=security_communication_rootca3,o=secom_trust_systems_co._ltd.,c=jp.........X.509....0...0..g.........\|7@...g0....H........0]1.0...U....JP1%0#..U....SECOM Trust Systems CO.,LTD.1'0%..U....Security Communication RootCA30...160616061716Z..380118061716Z0]1.0...U....JP1%0#..U....SECOM Trust Systems CO.,LTD.1'0%..U....Security Communication RootCA30.."0....H.............0..........rI.0..\|.@.X.:.a..Pni<5..[s..gL!._5.9>+.`.m+..q...V....r. .t...Q..t.......R..@=u......~v...R......4...i<w.d.......P.......Mr......M..d.~.f.5q...L.q@X...s..>P../&=~\#.yp......Aq{......../U.F\|Z;X;...-.%.zN.D.!.... n\|...[...b...'G..9C....A.Ts .-l.......o......gg+..X\.j..^.k.A~W.uDPU.Z.a!.a.....-./.a....{.{4g.....\|..S..J. V.p=+.,....G.G.x..1.o>..i.{.......3..K-.p;q.+{&'.............~z...8-.....?..;B...n}.._a...:jH.&U".]_..'3...t.[R GkEM"w.U'...."T...O.......(.....%R.4fO#..w....W0....W.........B0@0...U......d.\|.Xr...)4.o.....0...U...........0...U.......0....0....H........

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\java.policy

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2665
Entropy (8bit):	4.453327420854418
Encrypted:	false
SSDEEP:	24:hjrUah3ontU2H+h/ic1mo8vwwQcNpIjLSkLuodAZdgh1y0ykt0wSDW:R4fc17wVNwltpKW
MD5:	5FBEC8F223297B802A58AD215E8742AB
SHA1:	D41A3E69977D3774DBC379D2F6F87A8AEFB3DBC6
SHA-256:	164DEE2520126C729D9BBB80BE71BC733720F9F6A6BFE1A40E9D45EA99EDBB48
SHA-512:	36A269E3CB22639DACA2DBF7A5D71690A20ACF0B8C4E902CB508A21EEDB6AEC8B9F5D049A0AF5D3010B7160A09EE730D08322065C3A4AD6992E1573208D4AF3C
Malicious:	false
Reputation:	low
Preview:	.// Standard extensions get all permissions by default..grant codeBase "file:${{java.ext.dirs}}/*" {. permission java.security.AllPermission;.};..// default permissions granted to all domains..grant {. // Allows any thread to stop itself using the java.lang.Thread.stop(). // method that takes no argument.. // Note that this permission is granted by default only to remain. // backwards compatible.. // It is strongly recommended that you either remove this permission. // from this policy file or further restrict it to code sources. // that you specify, because Thread.stop() is potentially unsafe.. // See the API specification of java.lang.Thread.stop() for more. // information.. permission java.lang.RuntimePermission "stopThread";.. // allows anyone to listen on dynamic ports. permission java.net.SocketPermission "localhost:0", "listen";.. // "standard" properies that can be read by anyone..

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\java.security

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	55408
Entropy (8bit):	4.83092308417566
Encrypted:	false
SSDEEP:	768:Y8obod6U3O5O9Wgw2+JuN2gQ01pdYRE0G+fqLWHo69QZW93jfGgqcNhXLJ4TP1zg:Y2pD2RG+fqLWI1Ze6hczKTP1KkJwF/
MD5:	3B08A876C54533BAE6D6AC64FCF7E858
SHA1:	9F5AA238E8DAEF49E8CAB7996D2691C9A595D4B1
SHA-256:	1A3F6E8A81923C2A9FABA075D4499DD0934119937D4A44D5009F0B9D192A988F
SHA-512:	DACA9A28C49C745470E34329A19691404B3D125C9F73DC9A3E344B9D3CEF7F704AA843F8D07202D69D03994DC17E5C1C4E7829A077B5880CA3C6392AB0F7FC2B
Malicious:	false
Reputation:	low
Preview:	#.# This is the "master security properties file"..#.# An alternate java.security properties file may be specified.# from the command line via the system property.#.# -Djava.security.properties=<URL>.#.# This properties file appends to the master security properties file..# If both properties files specify values for the same key, the value.# from the command-line properties file is selected, as it is the last.# one loaded..#.# Also, if you specify.#.# -Djava.security.properties==<URL> (2 equals),.#.# then that properties file completely overrides the master security.# properties file..#.# To disable the ability to specify an additional properties file from.# the command line, set the key security.overridePropertiesFile.# to false in the master security properties file. It is set to true.# by default...# In this file, various security properties are set for use by.# java.security classes. This is where users can statically register.# Cryptography Package Providers ("providers" fo

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\policy\limited\US_export_policy.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.775568922899519
Encrypted:	false
SSDEEP:	12:5jvGJjtqN0W7m/qGhjEiHDuEq5DKxJMx20qQ2iHC8VX:9vGt82WQqGldHa1sJMxpBfHRVX
MD5:	C70964D0234F7085BDAFBE34D4ECBF80
SHA1:	BF4F0E876FBA11CF01F70AD3F82AE010B126E963
SHA-256:	C77CD9FE6BE5F85D9C74A5CBAA6914971903476A38457F3FDF9D653630D2B572
SHA-512:	DD3DC61276BD7C81B8F192A2E34CAE5D3D5AEA30CA1BB86E8D3375A760DC9D0778354F65B7749461C668D7122CEC8D57C4F4B9349C7B10C5E0F1299286FE7682
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r..,(....)J.K/.R(.....,IM..&...N. ..z......E..9....E..E.%@.4y.x..PK..D...[...`...PK...........X................default_US_export.policy=.1..0.E... 9@'.....(m.R;r\D..;....p!.g..............%%..b..!.+....\A2@uQc_......._q..=c..\.....?...S..PK...(T\|s.......PK.............X..............................META-INF/....PK.............XD...[...`.................=...META-INF/MANIFEST.MFPK.............X.(T\|s.........................default_US_export.policyPK....................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\policy\limited\local_policy.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	6.528895731558876
Encrypted:	false
SSDEEP:	24:9vGt8YwqmPwpOixvbzLTSFj/5jQrH358EYwOp9xJOxC/qpa:9etL1mPwJP+p/5jQb3969xJOxC/Sa
MD5:	6C88D90AFCF6FFD5F97BDB1A22067A75
SHA1:	56563DF1ED80419FD56C70B37924E573D830D255
SHA-256:	882C5684E66182D9A701E6D6B669D9F7E6A5B18AEA19AA20E55BDAE6B36C321E
SHA-512:	DAC71DE680177E75318D076B5A127823FB0B0CFB0EC131900377C575F45C69B44D6777A45A0A3C87A5604932AE3DA97EF115858361D254EEB77CE90975968F32
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r..,(....)J.K/.R....,IM..&...N. ..z......E..9....E..E.%@.4y.x..PK......Y...^...PK...........X................default_local.policy...j.@.....C.A6(..<.z../.M.fd.1..J...&-.E.d..3\|.........ld......x..4....../>:....b+...i./.N.EQ@.....L.B.i.B.X....RydC!P..U.>.........vWe3xW.9l0..X.e.H.\|.<..\|X..a.X...+V.#r...p\|.r..s....9./p....o...]W..PK..;.=f........PK...........X................exempt_local.policy..N.0....Oq..!..R"..H..;..\|..,..w.+qiw...O...$./KVa..n%p..("'...e....P.4.....9..{.9F...J...1....2h.._.Is+r.Ps.+7...opq*..R..x..\|YI...X.....$q...[.=.....{..E.G...Kk......\S.J.2.._...........PK.............PK.............X..............................META-INF/....PK.............X....Y...^.................=...META-INF/MANIFEST.MFPK.............X;.=f..........................default_local.policyPK.............X.............................e

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\policy\unlimited\US_export_policy.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.775568922899519
Encrypted:	false
SSDEEP:	12:5jvGJjtqN0W7m/qGhjEiHDuEq5DKxJMx20qQ2iHC8VX:9vGt82WQqGldHa1sJMxpBfHRVX
MD5:	C70964D0234F7085BDAFBE34D4ECBF80
SHA1:	BF4F0E876FBA11CF01F70AD3F82AE010B126E963
SHA-256:	C77CD9FE6BE5F85D9C74A5CBAA6914971903476A38457F3FDF9D653630D2B572
SHA-512:	DD3DC61276BD7C81B8F192A2E34CAE5D3D5AEA30CA1BB86E8D3375A760DC9D0778354F65B7749461C668D7122CEC8D57C4F4B9349C7B10C5E0F1299286FE7682
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r..,(....)J.K/.R(.....,IM..&...N. ..z......E..9....E..E.%@.4y.x..PK..D...[...`...PK...........X................default_US_export.policy=.1..0.E... 9@'.....(m.R;r\D..;....p!.g..............%%..b..!.+....\A2@uQc_......._q..=c..\.....?...S..PK...(T\|s.......PK.............X..............................META-INF/....PK.............XD...[...`.................=...META-INF/MANIFEST.MFPK.............X.(T\|s.........................default_US_export.policyPK....................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\security\policy\unlimited\local_policy.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.8723099130259975
Encrypted:	false
SSDEEP:	12:5jvGJjtqN0W7m/qGhjQPWRtGQNpn7usuxJMx2k8dl/:9vGt82WQqGlQPWXNnqzJMxY/
MD5:	A08DA3918BD673F3DC6661E94634C244
SHA1:	983D38533FEC76A2857D37DDAE9C9C3A7FF91CD0
SHA-256:	B38B5E31A46C5EF5BD409D2AE6C96FA1B437297AA3D6D388EE229D6873161A40
SHA-512:	643C85D4C82EB50B561ECCBC78BBC3A931C1300D5D2067DD66887906479005272D7E2CD815C098E733BCFEBDFFB286B7508CFC38DCA62EBBBDD643523B654553
Malicious:	false
Reputation:	low
Preview:	PK...........X................META-INF/......PK..............PK...........X................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r..,(....)J.K/.R(.....,IM..&...N. ..z......E..9....E..E.%@.4y.x..PK..D...[...`...PK...........X................default_local.policy=....0....5.]@N(.p....$....]>..w. ...23!`..b...Q..Z.6L..S...`R<.....+...$.U......f...v.......[B..d...!.J............./....s.?0.}...PK..e..c........PK.............X..............................META-INF/....PK.............XD...[...`.................=...META-INF/MANIFEST.MFPK.............Xe..c..........................default_local.policyPK....................

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\sound.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	4.681309933800066
Encrypted:	false
SSDEEP:	24:va19LezUlOGdZ14BilDEwG5u3nVDWc/Wy:iaLGr1OsS5KnVaIWy
MD5:	4F95242740BFB7B133B879597947A41E
SHA1:	9AFCEB218059D981D0FA9F07AAD3C5097CF41B0C
SHA-256:	299C2360B6155EB28990EC49CD21753F97E43442FE8FAB03E04F3E213DF43A66
SHA-512:	99FDD75B8CE71622F85F957AE52B85E6646763F7864B670E993DF0C2C77363EF9CFCE2727BADEE03503CDA41ABE6EB8A278142766BF66F00B4EB39D0D4FC4A87
Malicious:	false
Reputation:	low
Preview:	############################################################.# Sound Configuration File.############################################################.#.# This properties file is used to specify default service.# providers for javax.sound.midi.MidiSystem and.# javax.sound.sampled.AudioSystem..#.# The following keys are recognized by MidiSystem methods:.#.# javax.sound.midi.Receiver.# javax.sound.midi.Sequencer.# javax.sound.midi.Synthesizer.# javax.sound.midi.Transmitter.#.# The following keys are recognized by AudioSystem methods:.#.# javax.sound.sampled.Clip.# javax.sound.sampled.Port.# javax.sound.sampled.SourceDataLine.# javax.sound.sampled.TargetDataLine.#.# The values specify the full class name of the service.# provider, or the device name..#.# See the class descriptions for details..#.# Example 1:.# Use MyDeviceProvider as default for SourceDataLines:.# javax.sound.sampled.SourceDataLine=com.xyz.MyDeviceProvider.#.# Example 2:.# Specify the default Synthesizer by it

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\tzdb.dat

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	data
Category:	dropped
Size (bytes):	104175
Entropy (8bit):	7.15726854965428
Encrypted:	false
SSDEEP:	1536:c0ELmJI53atcLsXM8Za9ubP0fF43o6/////VM5PamddarHavGkuhBJPu9d7:cDtzAXM8skzxn9md4r6VuhBxu9d7
MD5:	ED561A16B3B4D87C128A378AFF3BB64F
SHA1:	221EA2EBD7C8A08DF23CA2CB3D1237C5C56291C4
SHA-256:	D44AA187D93266FCF4AA4C647FA31EDC196F0B5CC99E4FEEA36A9A0BA5F5DC5D
SHA-512:	2EF1ACE1F5C7C262E6BCE398649D1E104468AE4DF27615F24D29C5DDD6BB30F6BACE1CD664507F0FB9BC0E5E814A96C24DBB7A015F75831411D9EEA97E5410DB
Malicious:	false
Reputation:	low
Preview:	...TZDB....2024a.[..Africa/Abidjan..Africa/Accra..Africa/Addis_Ababa..Africa/Algiers..Africa/Asmara..Africa/Asmera..Africa/Bamako..Africa/Bangui..Africa/Banjul..Africa/Bissau..Africa/Blantyre..Africa/Brazzaville..Africa/Bujumbura..Africa/Cairo..Africa/Casablanca..Africa/Ceuta..Africa/Conakry..Africa/Dakar..Africa/Dar_es_Salaam..Africa/Djibouti..Africa/Douala..Africa/El_Aaiun..Africa/Freetown..Africa/Gaborone..Africa/Harare..Africa/Johannesburg..Africa/Juba..Africa/Kampala..Africa/Khartoum..Africa/Kigali..Africa/Kinshasa..Africa/Lagos..Africa/Libreville..Africa/Lome..Africa/Luanda..Africa/Lubumbashi..Africa/Lusaka..Africa/Malabo..Africa/Maputo..Africa/Maseru..Africa/Mbabane..Africa/Mogadishu..Africa/Monrovia..Africa/Nairobi..Africa/Ndjamena..Africa/Niamey..Africa/Nouakchott..Africa/Ouagadougou..Africa/Porto-Novo..Africa/Sao_Tome..Africa/Timbuktu..Africa/Tripoli..Africa/Tunis..Africa/Windhoek..America/Adak..America/Anchorage..America/Anguilla..America/Antigua..America/Araguaina..America/

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\lib\tzmappings

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9577
Entropy (8bit):	5.17061677089257
Encrypted:	false
SSDEEP:	192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4SV0l2:qqgniTyq06a2
MD5:	62BC9FA21191D34F1DB3ED7AD5106EFA
SHA1:	750CC36B35487D6054E039469039AECE3A0CC9E9
SHA-256:	83755EFBCB24476F61B7B57BCF54707161678431347E5DE2D7B894D022A0089A
SHA-512:	AF0DDB1BC2E9838B8F37DC196D26024126AC989F5B632CB2A8EFDC29FBCE289B4D0BAC587FE23F17DFB6905CEADA8D07B18508DB78F226B15B15900738F581A3
Malicious:	false
Reputation:	low
Preview:	#.# This file describes mapping information between Windows and Java.# time zones..# Format: Each line should include a colon separated fields of Windows.# time zone registry key, time zone mapID, locale (which is most.# likely used in the time zone), and Java time zone ID. Blank lines.# and lines that start with '#' are ignored. Data lines must be sorted.# by mapID (ASCII order)..#.# NOTE.# This table format is not a public interface of any Java.# platforms. No applications should depend on this file in any form..#.# This table has been generated by a program and should not be edited.# manually..#.Romance:-1,64::Europe/Paris:.Romance Standard Time:-1,64::Europe/Paris:.Warsaw:-1,65::Europe/Warsaw:.Central Europe:-1,66::Europe/Prague:.Central Europe Standard Time:-1,66::Europe/Prague:.Prague Bratislava:-1,66::Europe/Prague:.W. Central Africa Standard Time:-1,66:AO:Africa/Luanda:.FLE:-1,67:FI:Europe/Helsinki:.FLE Standard Time:-1,67:FI:Europe/Helsinki:.GFT:-1,6

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\release

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.6536050074013735
Encrypted:	false
SSDEEP:	12:GXk1bPpSnjlIq+y3ZgM33YXLQChve33cquIjm153l3tjew:GXcTphq+y3qM47Zc9vjm1Nl3tN
MD5:	94010A4F174BE0B50918F8262581B916
SHA1:	A679783A8B4E47B98B1079731BC2174FE2D51190
SHA-256:	FA830B93B1CFFD95B0D480B5AE3AD2101B9172C9B94173450072CC1DDF501691
SHA-512:	69E7783C768C61D840793E18D5FD02EAC49A27228C362407F9564BED7B88CA8B8BDD4360319056B7CD9362A7F89F2DC736E1587A708E9A739F18C02A5DB45808
Malicious:	false
Reputation:	low
Preview:	JAVA_VERSION="1.8.0_412".OS_NAME="Windows".OS_VERSION="5.2".OS_ARCH="amd64".SOURCE=".:git:a99e882fa6d1+".IMPLEMENTOR="Eclipse Adoptium".BUILD_SOURCE="git:9143b4bfec40787b46ca7ec7f8e2ef5c1bf0160c".BUILD_SOURCE_REPO="https://github.com/adoptium/temurin-build.git".SOURCE_REPO="https://github.com/adoptium/jdk8u.git".FULL_VERSION="1.8.0_412-b08".SEMANTIC_VERSION="8.0.412+8".BUILD_INFO="OS: Windows Server 2022 Version: 10.0".JVM_VARIANT="Hotspot".JVM_VERSION="25.412-b08".IMAGE_TYPE="JDK".

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\stats.properties

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.065305213384857
Encrypted:	false
SSDEEP:	6:NoQesbjGRWe/PWCHC8X9hfPcDZMTG+7IcEM9hYhiMObInx:N9esHGRW+PWCHC83nsZoccZ9hhMObs
MD5:	717FB1041096A65D60D913046FC7B46C
SHA1:	63F576DF2584EA17BAF05E9575149AE8715A7A21
SHA-256:	896D5F03AEA4EDC7B51FA09AF6C96BD01D9F0C25E2804BC0BAC263EBB6225F61
SHA-512:	185C9ED81EB5AF895B2C9E835CF9D2F20EF2612BDD676B64C83C69670A85FA38B56B8DDC6445B4336D19B5F71D936A166B4A75DE7CE7832A8CA7AB42BCB05010
Malicious:	false
Reputation:	low
Preview:	#install4j content files.#Wed Jun 12 12:58:06 CEST 2024.components.0=0.content.count.0=13.content.size.0=17059804.dirName=OpenWebStart_windows-x64_1_10_1.dat.entries.size.0=0,928336,95936,308416,117845,136221,1848400,248,1849424,248,10845977,929,927824.file.name.0=0.dat.file.size.0=13398815.setCount=1.

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\user.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	33619
Entropy (8bit):	7.677330047540817
Encrypted:	false
SSDEEP:	768:fOpm2+z3teHWL4XO06lPzz19QvQIT9IVLK5Y6xU9hdI3kdoz:Wf+z3wHWL4XO0+7iQIh8uxU9hdI3tz
MD5:	E4EC34FF490087EFC462870B5F25C05A
SHA1:	37508C826E1E3B2528F037EDE659B52778A6F7B5
SHA-256:	7D04EE8635D65B54FCC544C6574B150030D4AC1CEAA42029C8159AF6FDFC1287
SHA-512:	255E6CFE5453FDD12CB6B8C5AAFFDD76D9F3EABFBE8895721DD08B7912C865A100FC221FC72878EC9B17796C215F963E264E7AD6F1611AFE8C3D0F3D30FC2E43
Malicious:	false
Reputation:	low
Preview:	PK.........V.X................com/PK.........V.X................com/install4j/PK.........V.X................com/install4j/script/PK.........V.X.$....._.../...com/install4j/script/I4jScript_Internal_0.class...._................Q.J.P.=.WJ[....ua\.\T.T.J..j.n.6^..$7....n.(...~.8.....2...3.....o... ....V:0.u+=;p\|.7v..k._.um...{.k!E(...]...i.'..@.J.m......C...Fj^4U..pC...C.......[.6!U.d.I...C.0.PZ..7...+.y.4C.sf"ln5~j.}e;..3v.;W..YL..!C.L..4f-..J.....<.v%k..b..:\.e\|...r..U....a;..+....\..VY..x.;Pg.ZF8.M....ky...#....].ND..xB.).O#....,..y...e..9......0.1.7.\|........lOL.`.w,<a)u.t.!....b'..1.....\..PK.........V.X5.........../...com/install4j/script/I4jScript_Internal_1.class.....................R.n.@.=..C..4}..JIy.I..(. $. .E......&..&rlk<..X........N.}dQ/.{.s.....?..Q3.`....n....V`+.k.U.v..A..B..9.o .p.4]...#1E..>..4Q3...$w.B..sw[O.......)\..N(.\|.!.P.R?bH...C...E.I\.#.9...t..p.....9.(b...=.}....e{.....kN.....59....q..3....w.,3,...[.w...,V.6.O....^.....}...

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\user\flatlaf.jar

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	758100
Entropy (8bit):	7.946007026365599
Encrypted:	false
SSDEEP:	12288:ZzLE5jBSaUMxw/tHP9X6WilWi76e9efnFK54SYEHFTWjNiAcJkgamo2pRe:xE5jBBbuVFXuWy6BfnwuSYEui5kDGQ
MD5:	3BE3E794C51133EFBF70680228D7B793
SHA1:	825D8457D285EA452AA7FE37DEED574534E5407C
SHA-256:	AF3E1670AFCA1AD3F455D496332D7AA59BE666E723426095C682997FE1E9ACF1
SHA-512:	6C1F346FE64906E00CEE1D966E88B2EB411E7CD2EF3C7E7009775D2CA152AD53DE2D050C384B56CFA37AD513BC1CE3A319384390125E83C100AA7EB584B3050D
Malicious:	false
Reputation:	low
Preview:	PK.........\:X................META-INF/..PK..........pT................META-INF/MANIFEST.MF.M..LK-...K-...R0.3......PK.........kiU................com/..PK.........kiU................com/install4j/..PK.........kiU................com/install4j/runtime/..PK.........kiU................com/install4j/runtime/flatlaf/..PK.........kiU.4k.....,...?...com/install4j/runtime/flatlaf/FlatLafLookAndFeelHandler$1.class.T[O.A.=S(K...Q.o(...V.......6..B.e;....n1.d.......g1!..~.?...n......3....93.......4.jnJ.Q..]._...ak.\Z..[W.8......1rq..........`..ueK.t..K..u.......3....a.Y..0........0..t.e....R5.5-.&.pYtJ.6.....\|....3..Z.`..NY.SP...m)6.b..Uu...q......C.Sf......s1.2......<H'y.$......j.......=....FD4.\|...,....\|..P...W.b.X4.0v.......m..i.4C.].."........#K..91=.....pJ.&."O.Dtx.a...j:...:.".zwL.5.;....z..a.k`.?..=..H\r2.E...J"...rbV..o.!...\|&.N.....+;cG...G....".;.....j=w.......L. =...IG.}.F ....1.M../..4..d....A.=.....e......#b.0...b.].1C..f....9.`.,Y*.k:.....\.ju

C:\Users\user\AppData\Local\Temp\hsperfdata_user\3804

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.64458514814259
Encrypted:	false
SSDEEP:	192:QQqw8GOYSpZxeTebXnegiqVrXGPTetbQJ5wM:L8DYSpveTeLnegiP
MD5:	29C765ADEC9B0A675D5CED882A147C00
SHA1:	C3E21250C6C341B6AEFEA072C57A338CB3BA9769
SHA-256:	C0138B03E6318C8636B1C504D48326D445ED92E2C78F885351E28B2B72AA8DF0
SHA-512:	4DE962668D2355E5A192A2FEE044C6FD8763936BFDF97804D80F64029D06E07938CF5707EA9F45EDE400475EF6D84B6DE08D8DEB7828CF9CB492E5682BE3215F
Malicious:	false
Reputation:	low
Preview:	........hI........I..... .......8...........J...0...sun.rt._sync_Inflations.....g.......8...........J...0...sun.rt._sync_Deflations.....a.......@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6284

Download File

Process:	C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4434728234492669
Encrypted:	false
SSDEEP:	96:Ly4rsDG8GSidE5+yOkVwVIVKXSVA8rB1+B2+DrRaU4X2gtST/8:LylK8GRE5+jkw5XSd2hDrRaU4X2gtST
MD5:	F4274E7FE131599BC972FE3E6FBEA989
SHA1:	B633952A5F0FB32C63108190DFDCFC783FDFB5D5
SHA-256:	EE3E3A41CBD5449DC9142AAB6E9E43A6B8E76FBECF9C44E1102FCF74FBFF99C3
SHA-512:	39DF680E14AC78FD49FF796F8495F14FEC365C0677ACC9697CD48EC7DCCBCD2F5CF1D968B16F0786A99E0F9B9BCD33E52DCF5C8712C64359BDFB15B5F22826FB
Malicious:	false
Reputation:	low
Preview:	.........C.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\i4j_log_OpenWebStart_1752523011779975933.log

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3080
Entropy (8bit):	5.141068274907771
Encrypted:	false
SSDEEP:	48:2DbJPsHD7SDMKcWt6HoD2OqZMWXER2yBE9bcD9DNPLTU87l/CMDZA7TixAAu:2DbJEaMLrMGGDNDfhl+vhd
MD5:	60A8778500B45E395DE712146636130A
SHA1:	82A1D454107A1639F64ED42A80F5CAF78C10F42C
SHA-256:	1B1E44857A59308F01826ACA5D9C0C04AA73DD6651719F24101595C87AD6E709
SHA-512:	D0A4532CF41B3891A23BCB821214B5F10D9299C8A938074D1E34BCBD3BE737471037CC34B133199B947FA4B67054F87B08BAA78FCEC8564ADC6D58DADE70EA68
Malicious:	false
Reputation:	low
Preview:	[INFO] Logger started at 2024-11-21 07:57:33..[INFO] Executable name: C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe..[INFO] install4j version: 10.0.7 (build 10124)..[INFO] Properties: ..-- listing properties --..java.runtime.name=OpenJDK Runtime Environment..exe4j.moduleName=C:\Users\user\Desktop\download\OpenW.....sun.boot.library.path=c:\users\user\appdata\local\temp\e4j.....exe4j.semaphoreName=Local\c:_users_user_desktop_download.....java.vm.version=25.412-b08..user.country.format=CH..java.vm.vendor=Temurin..java.vendor.url=https://adoptium.net/..path.separator=;..exe4j.consoleCodepage=cp0..java.vm.name=OpenJDK 64-Bit Server VM..file.encoding.pkg=sun.io..user.script=..user.country=GB..sun.os.patch.level=..install4j.exeDir=C:\Users\user\Desktop\download\..java.vm.specification.name=Java Virtual Machine Specification..user.dir=C:\Users\user\AppData\Local\Temp\e4j.....java.runtime.version=1.8.0_412-b08..java.awt.graphicsenv=sun.awt.Win32GraphicsEnvironment..j

C:\Users\user\AppData\Local\Temp\i4j_nlog_1.log

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (410), with CRLF line terminators
Category:	dropped
Size (bytes):	19273
Entropy (8bit):	5.448163474653881
Encrypted:	false
SSDEEP:	192:X1yFa617cZvNhR3K2H02FN5UOrq2hlfJCoj2Ld4fhNh8rZ0BsM4iMuLtui:XuaVN3K2HnbrqKB9yJHi
MD5:	458D9C1F00B3D27931DA15BD6FD3E93B
SHA1:	C4386DC441C385F244BC54E57CAB916D5830A5B5
SHA-256:	243EBE75798438994DC6F92161FECB1204D86B827BE6C89E3EA8341F5083E7D7
SHA-512:	88B55C74122591A1B78E1D362CCD0ECB2CF740769B6E7B54BE214D483A08EE76245D8FA655660B1EE205E457E1A023E9BAD398CDEEAA03D01170CE554F6911C4
Malicious:	false
Reputation:	low
Preview:	.Started executable C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe at Thu Nov 21 07:57:21 2024....[0:0] restrict DLL directories..[0:16] init file name C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe 67 0..[0:16] number of sections: 7..[0:16] size of optional headers: 240..[0:16] resSectionTableStart: 792..[0:16] rawDataSize: 3072, rawDataOffset: 1154048..[0:32] sun.locale.formatasdefault is false..[0:32] language/country is en_GB..[0:32] ignoring java options environment variables..[0:32] using _putenv_s in ucrtbase.dll 00007FFE2003AA00 00007FF7C1D9C110..[0:47] change working directory to C:\Users\user\Desktop\download..[0:47] single instance mode..[0:47] semaphore name Local\c:_users_user_desktop_download_openwebstart_windows-x64_1_10_1.exe, code 0, value 0000000000000130..[0:47] Init done..[0:79] Starting work..[0:125] number of sections: 7..[0:125] size of optional heade

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Reputation:	low
Preview:	........................................J2SE.

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (557), with CRLF line terminators
Category:	modified
Size (bytes):	91584
Entropy (8bit):	2.3324473421422898
Encrypted:	false
SSDEEP:	768:IwdD1G8VaFibXRiL51yPZD7akYkwsDx3i1sj275v:IzOVakLnDxy
MD5:	2920874F957E824551D08B11691B96E3
SHA1:	17E0B95533507CF8D274BD9E32AA89DE560A4AD9
SHA-256:	ACAD623B680139849BF95BFB123F0648EBEBD54085B68621C2E147D7F0E23A4B
SHA-512:	EE43FE11E847A09EF0C1BA248817ADA5ABDABF57BAFD04117EFE94414633E0DC51894DF9AD919EF69CAFA91C7F2EF6DDFBF8384E8F4D586967BBA543380F6D1F
Malicious:	false
Reputation:	low
Preview:	--2024-11-21 07:55:38-- https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe..Resolving github.com (github.com)... 140.82.121.4..Connecting to github.com (github.com)\|140.82.121.4\|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/187595602/0e11e7a6-f296-4016-9dc1-a83eb621d062?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241121%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241121T125540Z&X-Amz-Expires=300&X-Amz-Signature=a248221241d7dcb97b5adb6f5cfd6839fd7720b81cb3a7c5836bea8b802a4058&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DOpenWebStart_windows-x64_1_10_1.exe&response-content-type=application%2Foctet-stream [following]..--2024-11-21 07:55:40-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/187595602/0e11e7a6-f296-4016-9dc1-a83eb62

C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58803280
Entropy (8bit):	7.993993891248962
Encrypted:	true
SSDEEP:	1572864:m09LWhFoq9c84tKeWj3RrQhSHhJ9OK4rq6Nz2RZeEGEHj:m0kXC5tgRraSH8nrq6QTHj
MD5:	899985795B87D9F86877595A8C004D40
SHA1:	55EDAF73DFD5087C321F59023FB8165768F0396C
SHA-256:	1C8FCFF487A686297F61DAB156AE42C89C082E91457911AE52F443F119472214
SHA-512:	71E5EF0A16F87435EF574126D8CD7DA7FA5A9381545FB9D9287D9D1BCFDE99F1872ACCF234114F9695ED443A22F7691EE0ACB6EC489F4E6381919AEE8034AF17
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Q..V.`...`...`..^....`....o..`.......`.......`..^....`......E`..^....`..^....`...`..9a.......`......8`.......`....m..`.......`..Rich.`..........................PE..d.....e.........."....$............`P.........@..........................................`..............................................*.. ...x........\... ..PF......P,...........>...............................=..@...............@............................text............................... ..`.rdata...7.......8..................@..@.data...T(..........................@....pdata..PF... ...H..................@..@_RDATA..\....p.......>..............@..@.rsrc....\.......\...@..............@..@.reloc..............................@..B........................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:55:39.099431038 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:39.099462986 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:39.099555969 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:39.101321936 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:39.101331949 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:40.535775900 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:40.535938978 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:40.537848949 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:40.537861109 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:40.538206100 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:40.539453983 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:40.583334923 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:41.202675104 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:41.202919960 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:41.202965021 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:41.202970982 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:41.203022957 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:41.220762968 CET	49730	443	192.168.2.4	140.82.121.4
Nov 21, 2024 13:55:41.220782042 CET	443	49730	140.82.121.4	192.168.2.4
Nov 21, 2024 13:55:41.474404097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:41.474441051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:41.474528074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:41.478475094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:41.478487968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:42.788712978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:42.788873911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:42.790976048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:42.790987015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:42.791337967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:42.792535067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:42.839325905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.291528940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.292857885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.292908907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.292954922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.293025017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.293097019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.300293922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.309427977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.309581995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.309597015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.309628010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.309695959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.317033052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.325472116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.325537920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.325547934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.370388031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.411851883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.463984966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.464025974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.510847092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.515582085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.519293070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.519397974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.519419909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.527115107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.527714014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.527734041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.534805059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.534914970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.534925938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.542174101 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.542237997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.542243958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.550024033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.550122976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.550129890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.561858892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.561950922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.561955929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.561975002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.562057018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.567889929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.573793888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.573847055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.573857069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.573872089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.573928118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.579876900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.586002111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.586076975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.586095095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.591882944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.591952085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.591958046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.598603964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.598673105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.598678112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.651490927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.713454962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.715711117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.715801954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.715833902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.720705986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.720782995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.720798016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.725646019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.725709915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.725724936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.730557919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.730631113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.730647087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762139082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762176037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762198925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762264967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762267113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.762285948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762327909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.762341976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762357950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.762367964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.762399912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.808248997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.808267117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.808319092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.808365107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.808439016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.808480978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.808507919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.839672089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.839729071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.839809895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.839828968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.839854956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.839884996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.940762997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.940788984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.941011906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.941042900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.941102028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.964854956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.964876890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.964982033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.964998007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.965055943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.986932039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.986980915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.987086058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:43.987099886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:43.987162113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.009095907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.009140968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.009221077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.009234905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.009289026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.027848959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.027895927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.027981997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.027993917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.028053999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.050132036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.050163031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.050265074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.050278902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.050339937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.136816025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.136873007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.136924028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.136954069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.136981964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.137013912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.147778988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.147855043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.148006916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.148006916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.148040056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.148096085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.163976908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.164010048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.164119005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.164134979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.164201975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.178337097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.178359032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.178436041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.178441048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.178493977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.185700893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.185724020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.185796976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.185808897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.185868979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.192864895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.192889929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.192961931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.192991018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.193022966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.193048954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.233566046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.233597040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.233709097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.233742952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.233800888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.241342068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.241364002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.241444111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.241458893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.241522074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.348217010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.348239899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.348388910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.348421097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.348495007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.355756044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.355775118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.355858088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.355870008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.355938911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.362400055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.362416983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.362499952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.362513065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.362575054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.370167017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.370187998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.370270967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.370285034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.370346069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.378047943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.378067017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.378144979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.378156900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.378218889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.385159016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.385180950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.385277033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.385291100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.385354042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.444345951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.444364071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.444472075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.444506884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.444572926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.451975107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.452038050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.452110052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.452124119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.452193022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.558809042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.558845997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.558980942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.559051037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.559123039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.566533089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.566555977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.566667080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.566682100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.566756010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.573085070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.573100090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.573214054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.573226929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.573338032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.581053019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.581072092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.581154108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.581166983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.581226110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.588455915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.588469982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.588563919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.588593006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.588646889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.595793962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.595815897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.595912933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.595927000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.595984936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.654964924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.654983997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.655085087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.655108929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.655172110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.662772894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.662792921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.662870884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.662883043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.662945032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.769933939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.769952059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.770080090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.770093918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.770175934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.776520014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.776546001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.776647091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.776664019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.776731968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.785665989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.785696983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.785754919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.785768986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.785794973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.785830021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.793123960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.793144941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.793205976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.793220997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.793301105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.800929070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.800946951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.801012039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.801026106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.801084042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.808106899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.808128119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.808193922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.808208942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.808263063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.866540909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.866594076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.866655111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.866683006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.866707087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.866746902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.873648882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.873697042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.873734951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.873749018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.873774052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.873811960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.980727911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.980846882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.980976105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.981045961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.981105089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.981127977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.988198042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.988244057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.988295078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.988317966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.988342047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.988382101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.995116949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.995165110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.995238066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.995253086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:44.995309114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:44.995309114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.002657890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.002733946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.002779007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.002793074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.002820015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.002851009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.010391951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.010438919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.010482073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.010494947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.010520935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.010543108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.072546005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.072592020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.072791100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.072813034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.072886944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.078560114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.078603983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.078664064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.078679085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.078716993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.078737020 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.086189985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.086241007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.086280107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.086293936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.086319923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.086348057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.190970898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.191025019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.191097975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.191118956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.191147089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.191188097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.198529005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.198577881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.198620081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.198633909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.198659897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.198693037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.206243038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.206285954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.206330061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.206343889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.206367970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.206407070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.212984085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.213027000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.213067055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.213079929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.213104963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.213143110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.220712900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.220757008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.220808029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.220822096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.220845938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.220880985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.281232119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.281285048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.281353951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.281380892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.281408072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.281445980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.287745953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.287789106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.287823915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.287839890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.287870884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.287894011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.296319008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.296360970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.296420097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.296433926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.296480894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.296500921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.402236938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.402283907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.402398109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.402415037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.402478933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.409008980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.409051895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.409121990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.409141064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.409168005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.409203053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.416655064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.416697025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.416765928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.416784048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.416809082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.416838884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.424237967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.424252987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.424340010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.424355030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.424428940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.430922031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.430938959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.431005955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.431024075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.431046963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.431086063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.493592024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.493608952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.493832111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.493870974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.493937969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.498090982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.498106003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.498189926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.498203993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.498280048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.505801916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.505817890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.505897999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.505912066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.505973101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.612966061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.612987995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.613106012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.613173962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.613245010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.620347023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.620361090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.620434999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.620450974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.620507002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.627285004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.627300978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.627381086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.627397060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.627449989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.634934902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.634949923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.635041952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.635073900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.635140896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.643016100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.643028975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.643114090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.643127918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.643172979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.701421976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.701457024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.701556921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.701581001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.701643944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.707936049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.707951069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.708039999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.708055019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.708118916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.715583086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.715598106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.715670109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.715683937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.715748072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.823132992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.823153973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.823363066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.823379993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.823437929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.831058025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.831073046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.831154108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.831167936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.831227064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.838504076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.838519096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.838601112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.838614941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.838675022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.845483065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.845523119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.845597029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.845611095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.845669985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.853260040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.853274107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.853348017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.853367090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.853435993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.912770033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.912792921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.912956953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.912992001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.913067102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.919262886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.919277906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.919370890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.919385910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.919440985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.926831961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.926846981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.926923037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:45.926932096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:45.926978111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.033720970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.033742905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.033879042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.033948898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.034022093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.041721106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.041737080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.041826010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.041841984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.041907072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.050549030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.050623894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.050656080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.050673008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.050702095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.050721884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.056426048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.056471109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.056520939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.056533098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.056560040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.056606054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.063909054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.063952923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.064028978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.064040899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.064086914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.064086914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.122730017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.122777939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.122864008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.122878075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.122910976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.122951984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.129174948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.129231930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.129295111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.129323959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.129348040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.129378080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.136723995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.136748075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.136826038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.136832952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.136888981 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.244507074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.244569063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.244745970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.244780064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.244856119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.252005100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.252106905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.252170086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.252186060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.252212048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.252259016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.259687901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.259735107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.259783983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.259794950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.259823084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.259850979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.266474009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.266524076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.266618013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.266637087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.266655922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.266689062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.274146080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.274190903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.274240017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.274252892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.274280071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.274307966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.333399057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.333481073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.333556890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.333597898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.333692074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.333722115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.339818954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.339869976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.339935064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.339948893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.339975119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.340008974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.347804070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.347865105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.347893000 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.347904921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.347929001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.347971916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.455095053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.455141068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.455197096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.455225945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.455257893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.455281973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.463535070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.463583946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.463669062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.463686943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.463713884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.463737011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.471550941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.471591949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.471657038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.471673012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.471695900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.471738100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.477396965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.477444887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.477516890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.477544069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.477576017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.477598906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.484945059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.485009909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.485038996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.485075951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.485090017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.485125065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.544049978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.544117928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.544177055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.544214964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.544239998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.544264078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.550609112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.550654888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.550687075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.550700903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.550734997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.550751925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.558307886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.558350086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.558541059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.558556080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.558618069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.666001081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.666064978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.666102886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.666117907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.666162968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.666179895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.673824072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.673854113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.673923969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.673933983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.673955917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.673979998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.681082010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.681129932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.681183100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.681196928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.681225061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.681246042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.687910080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.687953949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.688000917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.688013077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.688041925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.688083887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.695525885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.695574045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.695630074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.695648909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.695673943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.695709944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.759145021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.759165049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.759358883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.759426117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.759591103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.766005993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.766026974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.766105890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.766120911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.766176939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.772922993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.772989035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.773025990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.773041010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.773092985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.773092985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.876393080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.876442909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.876506090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.876528978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.876588106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.876588106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.884023905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.884095907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.884124994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.884138107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.884162903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.884206057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.891623974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.891669035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.891710997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.891721964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.891750097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.891772032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.899523020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.899569988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.899617910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.899630070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.899656057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.899691105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.906172991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.906236887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.906296015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.906347990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.906394005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.906411886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.969851971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.969899893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.970082998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.970145941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.970185995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.970210075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.976948977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.977009058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.977065086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.977080107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.977107048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.977169037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.984463930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.984510899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.984554052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.984566927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:46.984591961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:46.984630108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.089052916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.089124918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.089162111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.089190960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.089241982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.090377092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.094856977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.094904900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.094959974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.094971895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.095000029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.095041990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.102366924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.102484941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.102535009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.102546930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.102571964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.102611065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.110112906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.110162020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.110209942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.110220909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.110255003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.110295057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.116785049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.116858006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.116874933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.116885900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.116935968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.116964102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.180811882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.180879116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.181117058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.181173086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.181246996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.187836885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.187912941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.187948942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.188014030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.188054085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.188079119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.195302963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.195338011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.195382118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.195413113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.195442915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.195462942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.299000978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.299038887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.299200058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.299231052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.299287081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.305515051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.305541039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.305603027 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.305613041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.305639982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.305658102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.313220978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.313246012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.313304901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.313313007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.313342094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.313365936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.320795059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.320822001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.320904016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.320943117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.321353912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.321353912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.327511072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.327536106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.327615976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.327630997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.327675104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.391295910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.391359091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.391535997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.391535997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.391551971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.391597033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.398392916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.398416996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.398485899 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.398494005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.398533106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.406081915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.406111002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.406158924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.406164885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.406189919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.406263113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.509572983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.509605885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.509718895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.509736061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.509799957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.516196966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.516216993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.516391039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.516397953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.516448021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.523857117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.523880959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.523956060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.523962021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.524024010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.531449080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.531487942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.531529903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.531536102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.531567097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.531583071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.538187981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.538213968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.538254976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.538259983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.538295031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.538312912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.602302074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.602330923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.602374077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.602385044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.602399111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.602423906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.609236956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.609261036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.609296083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.609302044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.609317064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.609338045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.616863966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.616885900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.616930008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.616935968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.616949081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.616975069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.720355988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.720424891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.720499039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.720566988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.720649958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.720649958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.726931095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.726984024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.727035046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.727050066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.727078915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.727111101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.734646082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.734695911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.734745979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.734757900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.734785080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.734813929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.742258072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.742301941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.742342949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.742355108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.742379904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.742413998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.749991894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.750056028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.750082016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.750093937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.750130892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.750150919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.812808037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.812860012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.813035965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.813035965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.813054085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.813122988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.820538044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.820585012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.820632935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.820643902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.820672989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.820700884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.827192068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.827238083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.827279091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.827291012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.827342987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.827342987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.931031942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.931093931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.931236982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.931236982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.931260109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.931329012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.945976973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946022987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946171045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.946171045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.946192980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946259022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.946350098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946408987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946420908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.946434021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.946466923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.946486950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.952963114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.952991962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.953039885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.953052044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.953069925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.953089952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.960691929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.960720062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.960793972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:47.960809946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:47.960855961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.024041891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.024128914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.024267912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.024267912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.024350882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.024418116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.030803919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.030848026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.030900955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.030915022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.030951023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.030972958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.038465977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.038520098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.038594961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.038608074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.038641930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.038661003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.142132044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.142210007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.142247915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.142272949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.142302036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.142327070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.148705006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.148778915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.148802996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.148816109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.148849010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.148888111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.156250954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.156285048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.156331062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.156342983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.156371117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.156400919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.164375067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.164423943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.164462090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.164474010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.164500952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.164542913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.170720100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.170769930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.170836926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.170849085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.170897961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.170897961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.234626055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.234644890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.234767914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.234790087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.234855890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.241560936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.241578102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.241656065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.241671085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.241730928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.250390053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.250406981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.250494003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.250507116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.250565052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.352462053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.352483988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.352597952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.352662086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.352744102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.359962940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.359982014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.360064983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.360079050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.360138893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.366707087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.366738081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.366795063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.366808891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.366841078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.366862059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.374506950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.374530077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.374725103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.374739885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.374799013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.382026911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.382052898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.382111073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.382126093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.382153988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.382174969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.445096016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.445116043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.445341110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.445379019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.445462942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.452718019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.452734947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.452801943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.452816963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.452879906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.459386110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.459403038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.459490061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.459503889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.459573030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.563085079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.563105106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.563179016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.563201904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.563258886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.570585012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.570602894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.570677996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.570691109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.570745945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.577310085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.577326059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.577394962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.577416897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.577471018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.584975004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.584990025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.585077047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.585113049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.585177898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.592545986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.592570066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.592755079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.592770100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.592825890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.656089067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.656112909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.656203985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.656239986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.656301975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.662811041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.662827969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.662930012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.662945032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.663002014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.670546055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.670562983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.670655966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.670670986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.670732021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.773773909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.773801088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.773881912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.773920059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.773979902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.781256914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.781271935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.781338930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.781375885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.781409979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.781434059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.788985968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.789002895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.789067984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.789088011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.789110899 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.789149046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.795663118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.795676947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.795737028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.795753956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.795775890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.795809984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.803596973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.803622961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.803669930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.803685904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.803708076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.803726912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.866775990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.866799116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.866873980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.866894007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.866919994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.866942883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.874459982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.874475002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.874531984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.874548912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.874571085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.874607086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.881139040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.881154060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.881218910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.881234884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.881258011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.881305933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.984297991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.984316111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.984541893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.984586000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.984652042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.991873026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.991890907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.991993904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.992047071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.992104053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.999576092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.999592066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.999689102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:48.999736071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:48.999810934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.006262064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.006277084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.006360054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.006383896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.006424904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.013871908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.013886929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.013994932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.014025927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.014072895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.077706099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.077768087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.077989101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.077989101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.078037977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.078100920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.084393978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.084459066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.084502935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.084520102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.084556103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.084584951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.091947079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.091994047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.092045069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.092060089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.092093945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.092113972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.195028067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.195091009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.195255995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.195255995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.195291042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.195338011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.202770948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.202831984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.202884912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.202903986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.202933073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.202948093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.210319996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.210367918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.210407019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.210429907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.210447073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.210478067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.216897964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.216947079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.216995955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.217015982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.217037916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.217062950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.225054979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.225096941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.225147009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.225182056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.225198984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.225231886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.288198948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.288264036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.288412094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.288412094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.288445950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.288510084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.295696974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.295716047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.295794964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.295810938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.295871019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.302443027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.302465916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.302547932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.302580118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.302642107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.407454014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.407502890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.407753944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.407754898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.407824993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.407896996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.413438082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.413456917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.413536072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.413554907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.413610935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.420937061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.420952082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.421042919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.421053886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.421103001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.427618980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.427637100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.427725077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.427732944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.427782059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.435782909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.435805082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.435874939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.435883999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.435931921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.499751091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.499775887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.499860048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.499901056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.499968052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.506464958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.506481886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.506576061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.506594896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.506655931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.513169050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.513185024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.513267040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.513283014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.513350964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.616761923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.616816998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.616952896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.616952896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.616985083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.617028952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.624236107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.624284983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.624336958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.624388933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.624417067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.624444008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.630996943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.631040096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.631083012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.631120920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.631140947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.631171942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.638638020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.638717890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.638725996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.638756037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.638782978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.638797998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.646222115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.646265030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.646306038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.646333933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.646365881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.646390915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.710246086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.710295916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.710472107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.710472107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.710495949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.710546017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.717813969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.717854977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.717894077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.717902899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.717931986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.717948914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.725308895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.725332975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.725380898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.725389004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.725415945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.725425959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.827944040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.828022003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.828053951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.828098059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.828119993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.828151941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.835561991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.835613012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.835661888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.835680008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.835709095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.835750103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.843038082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.843085051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.843135118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.843158007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.843182087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.843219995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.849714041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.849760056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.849814892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.849828005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.849853039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.849881887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.857316017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.857358932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.857408047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.857429981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.857453108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.857482910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.920823097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.920871019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.921029091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.921068907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.921134949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.921134949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.928641081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.928683996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.928740978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.928774118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.928800106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.928841114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.935838938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.935883999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.935925961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.935961008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:49.935987949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:49.936012030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.039107084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.039180040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.039352894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.039402008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.039468050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.039568901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.045850039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.045914888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.045945883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.045977116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.046011925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.046051025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.053771019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.053812981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.053872108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.053901911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.053927898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.053966045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.060969114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.061013937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.061132908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.061156034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.061181068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.061220884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.067981005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.068022966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.068072081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.068085909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.068115950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.068151951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.132174015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.132229090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.132401943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.132452965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.132522106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.138973951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.139020920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.139080048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.139107943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.139134884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.139167070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.146604061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.146648884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.146698952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.146713972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.146742105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.146780968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.249608040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.249681950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.249869108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.249933004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.250000954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.250000954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.256258011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.256299973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.256361961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.256377935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.256406069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.256433964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.263943911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.263988972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.264029026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.264060974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.264090061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.264111042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.272617102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.272670031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.272708893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.272717953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.272742033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.272758007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.279269934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.279345036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.279356956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.279376984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.279407978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.279422045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.342529058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.342559099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.342680931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.342732906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.342793941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.349771023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.349816084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.349880934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.349901915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.349940062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.349965096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.357297897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.357345104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.357404947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.357424974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.357451916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.357482910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.460208893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.460290909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.460436106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.460477114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.460536003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.466941118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.467005968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.467036963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.467046022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.467073917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.467089891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.474987984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.475059032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.475083113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.475095987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.475162983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.475183964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.482381105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.482439995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.482470989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.482491016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.482522011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.482548952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.488797903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.488863945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.488902092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.488929987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.488956928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.488987923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.552786112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.552855015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.552908897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.552942991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.552969933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.553009033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.560579062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.560602903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.560687065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.560713053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.560774088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.568407059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.568423986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.568500996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.568516016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.568578005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.670115948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.670130968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.670286894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.670310020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.670376062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.677819014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.677833080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.677910089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.677920103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.677974939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.685585976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.685600996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.685674906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.685688019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.685781002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.693083048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.693097115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.693164110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.693175077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.693238974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.699819088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.699835062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.699908018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.699918032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.699968100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.763906956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.763922930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.764024973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.764044046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.764095068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.771471977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.771492004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.771608114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.771634102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.771718979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.778227091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.778243065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.778330088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.778347015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.778407097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.881753922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.881768942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.881992102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.882044077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.882117033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.889276981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.889358997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.889394045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.889416933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.889446974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.889477968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.895836115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.895881891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.895951986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.895975113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.895998955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.896034002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.903383017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.903431892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.903482914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.903506994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.903532982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.903563023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.913355112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.913413048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.913434982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.913443089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.913479090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.975095034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.975152016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.975215912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.975266933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.975297928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.975343943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.982048035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.982079983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.982141018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.982172966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.982199907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.982234955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.989624977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.989646912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.989743948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:50.989761114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:50.989820004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.091867924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.091893911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.092010021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.092053890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.092128038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.102246046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.102266073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.102408886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.102431059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.102492094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.106287003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.106307030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.106400013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.106416941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.106477976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.113977909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.113997936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.114073992 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.114089966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.114119053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.114144087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.121592999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.121613026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.121690035 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.121726036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.121784925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.186074972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.186108112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.186250925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.186288118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.186362982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.192771912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.192807913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.192895889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.192936897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.192970037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.193011045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.200655937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.200680017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.200762033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.200778008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.200844049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.302422047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.302447081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.302697897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.302762032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.303091049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.310167074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.310189009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.310281992 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.310312986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.310385942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.317291975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.317312956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.317404032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.317416906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.317478895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.324639082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.324657917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.324759007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.324770927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.324835062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.332227945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.332247972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.332333088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.332346916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.332412004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.398905993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.398932934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.399180889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.399249077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.399326086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.404544115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.404565096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.404653072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.404670000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.404737949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.413172960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.413192034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.413281918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.413295984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.413358927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.513128996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.513153076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.513411999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.513449907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.513511896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.521485090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.521507025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.521604061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.521620035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.521686077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.527472973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.527493954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.527580023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.527592897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.527664900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.535162926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.535182953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.535268068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.535280943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.535345078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.542716026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.542736053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.542814016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.542826891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.542891979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.607225895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.607249975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.607480049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.607552052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.607635021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.614919901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.614938974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.615020037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.615034103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.615101099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.623214006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.623233080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.623310089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.623325109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.623421907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.723848104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.723881960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.724114895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.724152088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.724210978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.849173069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.849205017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.849419117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:51.849492073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:51.849657059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.091156960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.091171980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.091238022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.091464996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.091464996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.091521978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.091609001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.098931074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.098953009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.099037886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.099056959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.099121094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.106370926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.106409073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.106467009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.106504917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.106537104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.106564999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.113548994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.113579988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.113637924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.113651991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.113679886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.113709927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.121994972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.122030973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.122096062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.122112036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.122140884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.122164011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.128266096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.128285885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.128375053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.128391027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.128457069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.136146069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.136167049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.136250019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.136265993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.136323929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.142863035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.142883062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.142993927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.143009901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.143101931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.150439024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.150460958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.150587082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.150607109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.150664091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.158226967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.158250093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.158355951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.158374071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.158438921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.164824963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.164846897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.164947987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.164964914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.165021896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.173140049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.173161030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.173269033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.173283100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.173345089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.179658890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.179681063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.179765940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.179780006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.179841995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.187289000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.187319994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.187377930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.187391996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.187422991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.187443018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.194979906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.195030928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.195074081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.195087910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.195115089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.195143938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.203649044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.203670025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.203752995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.203768015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.203829050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.210560083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.210604906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.210658073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.210684061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.210727930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.210757017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.216639996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.216660976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.216741085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.216757059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.216818094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.224179983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.224201918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.224287033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.224302053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.224363089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.239444971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.239471912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.239569902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.239584923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.239645958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.247530937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.247561932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.247648001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.247663975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.247807980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.255192995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.255239964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.255306005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.255335093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.255366087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.255397081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.352061033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.352083921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.352257013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.352257967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.352282047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.352485895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.354811907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.354840994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.354902029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.354917049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.354960918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.354980946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.357728958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.357748985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.357825994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.357840061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.357898951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.359838009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.359863997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.359951973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.359966993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.360027075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.362510920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.362557888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.362597942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.362611055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.362639904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.362664938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.448869944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.448893070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.448967934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.448992014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.449019909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.449039936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.451924086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.451946020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.451996088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.452008963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.452033997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.452058077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.453924894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.453946114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.454015017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.454029083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.454060078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.454087019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.562921047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.562953949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.563106060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.563106060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.563146114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.563210011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.565668106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.565684080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.565759897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.565774918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.565830946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.568428993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.568444014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.568516016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.568531990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.568589926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.570513964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.570532084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.570602894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.570616961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.570677042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.573364019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.573379993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.573451996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.573466063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.573518991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.659672976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.659689903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.659761906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.659790039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.659842968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.662658930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.662672997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.662731886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.662748098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.662796974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.664552927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.664566994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.664628983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.664648056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.664671898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.664694071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.774254084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.774276018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.774418116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.774451017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.774518013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.776880026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.776896954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.776968956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.776983976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.777054071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.779475927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.779496908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.779572964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.779587030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.779635906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.781585932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.781601906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.781670094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.781683922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.781747103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.784414053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.784430981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.784579992 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.784595013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.784651995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.871011019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.871040106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.871156931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.871180058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.871243954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.872908115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.872925997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.873004913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.873018980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.873075962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.876045942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.876063108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.876132965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.876147985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.876213074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.984874964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.984889984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.985008955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.985033989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.985081911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.986887932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.986910105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.986965895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.986974001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.987015963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.989654064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.989665985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.989746094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.989753962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.989794970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.992578030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.992593050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.992650986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.992657900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.992697954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.994690895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.994704008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.994760036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:52.994766951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:52.994806051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.081300974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.081319094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.081409931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.081419945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.081460953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.084287882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.084306002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.084381104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.084388018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.084433079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.086163044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.086179972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.086242914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.086251020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.086291075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.195389986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.195410013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.195614100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.195699930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.195770979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.197846889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.197861910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.197935104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.197952032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.198014021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.200153112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.200181961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.200231075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.200247049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.200273991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.200297117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.203020096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.203037024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.203111887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.203125000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.203176022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.205154896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.205177069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.205248117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.205267906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.205317020 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.293548107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.293570042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.293667078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.293692112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.293745041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.296379089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.296407938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.296453953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.296473980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.296498060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.296528101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.298607111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.298624992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.298688889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.298703909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.298753023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.405878067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.405905962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.405994892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.406014919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.406068087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.407936096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.407949924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.408023119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.408037901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.408096075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.410710096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.410723925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.410790920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.410804987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.410870075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.413604021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.413618088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.413686991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.413700104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.413753033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.415653944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.415667057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.415725946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.415746927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.415771961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.415807009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.502863884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.502878904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.502966881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.502988100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.503047943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.505435944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.505449057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.505512953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.505527973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.505583048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.507517099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.507530928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.507618904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.507647991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.507702112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.626858950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.626883030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.626946926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.627019882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.627057076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.627080917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.629687071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.629702091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.629736900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.629753113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.629780054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.629800081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.631798029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.631813049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.631864071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.631877899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.631905079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.631922960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.634537935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.634568930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.634613991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.634628057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.634654045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.634674072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.637376070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.637403011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.637443066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.637456894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.637480974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.637511015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.713639975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.713660955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.713845015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.713876009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.713963985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.716723919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.716779947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.716814995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.716830015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.716855049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.716886044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.718404055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.718450069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.718491077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.718503952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.718530893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.718565941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.837708950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.837764025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.837841034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.837884903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.837918043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.837943077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.840428114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.840473890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.840527058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.840540886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.840568066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.840609074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.842502117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.842549086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.842597961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.842612028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.842636108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.842669010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.845309019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.845351934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.845392942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.845407009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.845431089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.845458984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.848062038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.848117113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.848153114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.848165989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.848191977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.848213911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.924371958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.924421072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.924494028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.924525023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.924552917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.924576998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.926729918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.926779032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.926819086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.926832914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.926858902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.926883936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.929539919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.929588079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.929621935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.929635048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:53.929681063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:53.929681063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.048311949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.048342943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.048464060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.048507929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.048578024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.050782919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.050810099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.050868034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.050883055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.050911903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.050961971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.053544998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.053569078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.053642988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.053657055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.053715944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.055705070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.055728912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.055778980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.055795908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.055824041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.055859089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.058795929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.058821917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.058886051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.058900118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.058927059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.058964014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.135169983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.135237932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.135416031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.135437965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.135508060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.137305021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.137361050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.137422085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.137440920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.137469053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.137495041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.140274048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.140319109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.140364885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.140374899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.140404940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.140418053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499025106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499042988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499100924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499150038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499185085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499206066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499234915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499624968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499648094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499692917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499701023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499716043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499741077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499742985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499769926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499777079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499797106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499810934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499828100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499828100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499844074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499866009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499902010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499903917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499918938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499948025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.499962091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499977112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.499983072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500001907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500011921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500022888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500051022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500060081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500082970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500082970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500106096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500111103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500122070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500138044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500164986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500186920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500320911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500333071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500354052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500394106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500401020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.500416994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.500439882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502135038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502298117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502383947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502389908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502414942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502444983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502458096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502542019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502583981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502609015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502619028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502645016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502661943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502706051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502744913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502768993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502775908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502801895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502820969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502861023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502903938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502934933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502940893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.502966881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.502979040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.503019094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.503065109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.503084898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.503093958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.503120899 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.503135920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.503180027 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.556360006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.556394100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.556505919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.556529999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.556574106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.559026957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.559051037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.559102058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.559111118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.559161901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.561009884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.561037064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.561089993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.561096907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.561124086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.561140060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.681044102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.681075096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.681269884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.681293011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.681339025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.683830976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.683851957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.683921099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.683931112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.683974028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.686641932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.686664104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.686717987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.686727047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.686773062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.688718081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.688740015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.688806057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.688813925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.688860893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.691483974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.691508055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.691572905 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.691581964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.691617012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.767242908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.767272949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.767362118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.767375946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.767425060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.770005941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.770026922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.770093918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.770102024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.770148039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.772403002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.772427082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.772483110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.772490978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.772533894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.893030882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.893064976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.893177032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.893198967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.893243074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.895292997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.895328999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.895375967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.895385981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.895416021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.895428896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.898075104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.898102999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.898154974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.898164034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.898185968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.898200989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.900840044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.900861979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.900906086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.900914907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.900940895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.900954008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.903016090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.903039932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.903083086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.903090000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.903131962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.977845907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.977871895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.978056908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.978070974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.978123903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.980802059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.980827093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.980886936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.980895996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:54.980923891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:54.980938911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.101404905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.101432085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.101536036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.101617098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.101706982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.102749109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.102768898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.102854013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.102870941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.102935076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.105560064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.105581045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.105639935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.105655909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.105684996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.105720043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.108412027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.108433008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.108500957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.108514071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.108575106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.110575914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.110594988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.110661030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.110672951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.110730886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.113399029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.113419056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.113473892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.113487005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.113512993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.113548994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.188823938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.188848972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.188931942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.188947916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.189004898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.190768957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.190792084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.190877914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.190891027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.190953016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.312028885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.312060118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.312139988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.312175989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.312196016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.312227964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.314213037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.314243078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.314325094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.314341068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.314398050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.316206932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.316232920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.316301107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.316314936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.316342115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.316380978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.319248915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.319277048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.319355965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.319367886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.319397926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.319415092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.321943998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.321969032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.322046995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.322058916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.322114944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.323939085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.323960066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.324040890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.324053049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.324114084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.399437904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.399492025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.399549007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.399585009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.399605036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.399635077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.401758909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.401804924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.401853085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.401866913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.401896954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.401922941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.523562908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.523631096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.523694038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.523762941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.523833036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.523833036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.525131941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.525182009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.525233030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.525253057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.525284052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.525310040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.528244019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.528301954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.528351068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.528364897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.528394938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.528417110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.531063080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.531086922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.531156063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.531168938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.531196117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.531215906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.533649921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.533670902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.533741951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.533755064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.533783913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.533807993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.535293102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.535321951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.535445929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.535460949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.535516977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.613023043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.613089085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.613107920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.613123894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.613162994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.613183975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.615258932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.615305901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.615354061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.615365982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.615394115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.615417957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.734019041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.734093904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.734122992 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.734149933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.734175920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.734196901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.735511065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.735558987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.735594034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.735605955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.735656977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.735657930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.737585068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.737633944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.737675905 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.737689972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.737719059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.737737894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.740777016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.740823030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.740854979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.740866899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.740909100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.740909100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.743510962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.743555069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.743596077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.743608952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.743638039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.743666887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.745202065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.745244980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.745282888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.745295048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.745326042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.745342970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.822870016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.822940111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.822978973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.822993994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.823025942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.823040962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.825680971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.825726986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.825767040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.825778961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.825807095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.825845003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.944272041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.944324017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.944358110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.944389105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.944412947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.944447994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.945761919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.945811033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.945847988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.945859909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.945887089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.945904970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.948503017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.948554993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.948601961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.948615074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.948646069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.948664904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.951481104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.951523066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.951564074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.951575041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.951603889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.951622963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.953414917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.953476906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.953507900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.953519106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.953550100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.953567028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.956218004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.956264973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.956301928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.956314087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:55.956355095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:55.956373930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.033637047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.033680916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.033721924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.033735991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.033761024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.033788919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.036617994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.036660910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.036691904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.036704063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.036731005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.036758900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.156155109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.156203985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.156256914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.156306028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.156339884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.156363010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.158289909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.158334970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.158360958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.158375025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.158402920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.158437967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.159780979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.159838915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.159861088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.159873009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.159899950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.159929037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.162677050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.162718058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.162755966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.162767887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.162791967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.162825108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.164879084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.164938927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.164958954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.164971113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.164998055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.165014029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.167001009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.167045116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.167120934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.167133093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.167186975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.245691061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.245734930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.245775938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.245845079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.245902061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.245903015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.247639894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.247679949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.247714996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.247731924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.247761965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.247781992 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.365792990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.365856886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.365905046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.365979910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.366023064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.366044998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.367221117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.367275000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.367312908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.367330074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.367388010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.367388010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.370045900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.370093107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.370130062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.370143890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.370171070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.370213032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.372085094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.372126102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.372159958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.372173071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.372200012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.372220039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.374984980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.375025988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.375056982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.375067949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.375098944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.375114918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.377809048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.377851009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.377882004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.377895117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.377921104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.377940893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.455454111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.455516100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.455555916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.455624104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.455670118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.455670118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.458005905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.458055973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.458092928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.458107948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.458141088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.458162069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.576235056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.576294899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.576351881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.576421022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.576461077 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.576493979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.578407049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.578449965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.578505993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.578517914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.578579903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.580496073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.580540895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.580585957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.580601931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.580629110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.580732107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.583211899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.583254099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.583292007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.583303928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.583329916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.583349943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.586097956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.586139917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.586184978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.586196899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.586237907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.586237907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.588320017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.588361979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.588397980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.588409901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.588448048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.588466883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.666135073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.666184902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.666234016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.666258097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.666281939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.666301966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.668257952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.668302059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.668343067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.668366909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.668394089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.668423891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.786915064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.786978006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.787009001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.787081957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.787118912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.787173986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.788731098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.788780928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.788827896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.788841963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.788897991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.788897991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.791240931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.791287899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.791346073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.791364908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.791388988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.791457891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.794210911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.794259071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.794295073 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.794306993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.794332981 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.794368029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.796181917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.796226025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.796257019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.796268940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.796294928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.796319962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.798969030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.799015045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.799040079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.799052000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.799077034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.799113989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.877291918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.877350092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.877378941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.877394915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.877458096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.877485037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.879448891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.879492998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.879530907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.879543066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.879595041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.879595041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.997873068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.997920990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.997948885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.997984886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:56.998009920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:56.998225927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.001708031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.001751900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.001807928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.001821041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.001868010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.001992941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.002748966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.002794981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.002846956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.002857924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.002883911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.003053904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.005716085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.005757093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.005795002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.005806923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.005836964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.005856037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.007638931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.007679939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.007718086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.007730007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.007756948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.007797003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.010346889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.010376930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.010428905 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.010442972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.010468960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.010502100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.088236094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.088257074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.088323116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.088344097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.088371038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.088388920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.090301037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.090322971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.090367079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.090380907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.090406895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.090426922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.209146023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.209180117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.209223032 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.209244967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.209273100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.209337950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.210685968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.210705996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.210756063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.210769892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.210794926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.211143970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.213824987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.213845015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.213901043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.213918924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.213970900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.216228008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.216248989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.216295958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.216311932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.216340065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.216403961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.219033003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.219068050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.219103098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.219116926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.219142914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.219254971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.221211910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.221230984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.221277952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.221292973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.221338987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.221434116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.297720909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.297755003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.297810078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.297831059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.297858953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.297884941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.300107002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.300127983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.300189018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.300203085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.300234079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.300271034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.419559002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.419581890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.419648886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.419681072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.419707060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.419806957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.421907902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.421927929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.421971083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.421984911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.422014952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.422036886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.423908949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.423933029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.423978090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.423990965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.424019098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.424053907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.426662922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.426682949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.426743984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.426774979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.426842928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.429482937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.429502964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.429563046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.429578066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.429644108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.432312965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.432334900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.432388067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.432400942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.432449102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.432449102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.508258104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.508277893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.508341074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.508358002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.508444071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.510720015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.510740042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.510809898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.510823965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.510875940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.630573034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.630600929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.630791903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.630812883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.631248951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.632289886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.632312059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.632366896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.632381916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.632425070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.632481098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.634991884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.635011911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.635063887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.635082960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.635107040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.635181904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.637813091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.637835026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.637883902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.637897015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.637944937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.640578032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.640599966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.640656948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.640671015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.640742064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.642697096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.642718077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.642776012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.642791033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.642859936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.718926907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.718951941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.719012022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.719032049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.719059944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.719079971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.721923113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.721944094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.722008944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.722023010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.722078085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.842437029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.842473030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.842555046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.842581034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.842742920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.844183922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.844204903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.844268084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.844284058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.844338894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.846779108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.846797943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.846849918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.846863985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.846890926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.846960068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.849591970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.849611998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.849672079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.849687099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.849744081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.851865053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.851886988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.851948023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.851962090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.852019072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.854734898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.854756117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.854810953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.854825974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.854887962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.929630995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.929655075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.929725885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.929742098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.929804087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.932343006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.932362080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.932434082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:57.932449102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:57.932512045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.052973032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.052998066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.053205967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.053236961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.053307056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.055174112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.055202961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.055258989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.055274963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.055303097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.055377007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.057334900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.057364941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.057411909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.057425976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.057452917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.057528019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.060218096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.060240030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.060307026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.060327053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.060353041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.060451031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.062879086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.062899113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.062959909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.062974930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.063028097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.064951897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.064973116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.065030098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.065043926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.065099955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.140136003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.140156984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.140234947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.140253067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.140315056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.142631054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.142651081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.142721891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.142736912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.142797947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.263782024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.263812065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.264014959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.264040947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.264106989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.265916109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.265938044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.265994072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.266009092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.266035080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.266113997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.268695116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.268718004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.268770933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.268785000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.268810987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.268891096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.271723032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.271744967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.271807909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.271822929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.271877050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.273699999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.273721933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.273780107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.273794889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.273850918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.276437044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.276458025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.276520967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.276535034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.276587963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.351533890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.351557016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.351811886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.351859093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.351927996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.354084969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.354105949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.354171038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.354187965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.354218006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.354583979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.474639893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.474668980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.474775076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.474821091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.475013018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.476634026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.476677895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.476722956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.476747036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.476772070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.477158070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.479445934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.479465008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.479523897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.479542971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.479568005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.479701996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.481537104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.481555939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.481627941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.481643915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.481707096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.484261990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.484281063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.484354019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.484368086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.484426022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.487242937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.487263918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.487353086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.487366915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.487431049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.561592102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.561619997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.561682940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.561701059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.561734915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.561757088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.564527988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.564578056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.564629078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.564644098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.564673901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.564693928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.685342073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.685372114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.685432911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.685456038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.685486078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.685508013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.687581062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.687599897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.687654018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.687668085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.687699080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.687720060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.690146923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.690167904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.690226078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.690241098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.690289021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.692289114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.692310095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.692359924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.692374945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.692401886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.692419052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.695020914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.695039988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.695097923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.695112944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.695139885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.695173025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.697822094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.697840929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.697884083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.697901011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.697927952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.697947979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.772380114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.772409916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.772591114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.772609949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.772670984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.775240898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.775262117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.775351048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.775366068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.775414944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.895910025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.895936012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.896148920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.896194935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.896267891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.898241997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.898262024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.898336887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.898353100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.898408890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.900239944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.900262117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.900321007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.900337934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.900367022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.900392056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.903093100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.903115034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.903167963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.903181076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.903211117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.903228045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.905924082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.905944109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.906008005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.906022072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.906081915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.908035994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.908058882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.908112049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.908129930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.908154964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.908193111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.983798027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.983819962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.984062910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.984127998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.984208107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.985881090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.985901117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.985976934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:58.985992908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:58.986058950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.106518984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.106543064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.106746912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.106812954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.106884003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.108957052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.108975887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.109054089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.109071016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.109132051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.111062050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.111083031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.111145973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.111160994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.111219883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.113826036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.113845110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.113910913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.113924980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.113990068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.116878986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.116898060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.116972923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.116987944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.117043972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.118973970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.118993044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.119062901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.119077921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.119137049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.193622112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.193643093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.193830013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.193895102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.193958998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.196501017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.196521997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.196597099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.196628094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.196656942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.196696043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.317290068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.317310095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.317382097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.317383051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.317457914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.317512989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.319377899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.319399118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.319485903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.319531918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.319560051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.319581985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.322134972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.322154999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.322191954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.322200060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.322213888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.322237968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.324328899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.324347973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.324393988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.324403048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.324425936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.324449062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.327053070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.327089071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.327105045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.327112913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.327136993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.327152014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.329808950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.329828024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.329865932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.329873085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.329888105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.329910040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.431648016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.431689978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.431823015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.431894064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.432065964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.434683084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.434701920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.434778929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.434797049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.434845924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.527874947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.527894974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.528106928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.528175116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.528239012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.530230045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.530247927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.530327082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.530343056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.530406952 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.532356024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.532375097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.532454014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.532469988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.532522917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.535177946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.535198927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.535269022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.535284042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.535339117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.537939072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.537959099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.538031101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.538044930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.538099051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.540426016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.540446043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.540517092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.540532112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.540585995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.642951012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.642972946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.643202066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.643265963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.643352985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.645498037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.645517111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.645606995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.645622015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.645684958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.738754988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.738775015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.739008904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.739087105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.739269018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.742480993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.742499113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.742594957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.742613077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.742681026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.743935108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.743954897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.744029999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.744045973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.744112015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.746823072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.746841908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.746921062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.746934891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.746999025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.749254942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.749277115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.749351978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.749366999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.749430895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.751229048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.751249075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.751326084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.751341105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.751399994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.853241920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.853266001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.853616953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.853656054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.853718996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.856021881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.856065989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.856116056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.856125116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.856177092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.949388981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.949417114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.949527979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.949592113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.949659109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.952023983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.952044964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.952124119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.952141047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.952203989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.954058886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.954078913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.954150915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.954171896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.954232931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.957097054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.957122087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.957196951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.957212925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.957272053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.959522963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.959562063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.959604025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.959619999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.959651947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.959685087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.961710930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.961730003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.961807013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:55:59.961822987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:55:59.961886883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.075196028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.075217962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.075424910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.075459957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.075536966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.077333927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.077356100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.077435017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.077451944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.077510118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.159991026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.160018921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.160212994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.160244942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.160306931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.161941051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.161962986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.162046909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.162061930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.162126064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.165388107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.165407896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.165477037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.165492058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.165520906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.165560007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.167548895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.167568922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.167638063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.167653084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.167712927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.169640064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.169660091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.169737101 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.169750929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.169819117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.172358990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.172378063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.172450066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.172465086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.172524929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.290268898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.290297985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.290518999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.290546894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.290608883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.292329073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.292349100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.292418957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.292427063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.292480946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.370467901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.370508909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.370764017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.370764017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.370789051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.370979071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.373135090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.373167038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.373209000 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.373218060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.373258114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.373280048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.376046896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.376066923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.376121044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.376130104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.376178026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.378063917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.378084898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.378144026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.378154039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.378201008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.380805969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.380835056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.380880117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.380891085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.380907059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.380937099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.383754015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.383774042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.383826971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.383836031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.383878946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.501677990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.501708031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.501756907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.501785040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.501801968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.501832008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.504451990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.504472971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.504519939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.504533052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.504549026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.504575968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.582747936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.582781076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.582842112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.582861900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.582876921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.582906008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.584989071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.585020065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.585066080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.585078955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.585110903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.585131884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.587768078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.587794065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.587852001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.587861061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.587889910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.587910891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.590688944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.590709925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.590773106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.590780973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.590814114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.590854883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.590908051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.593430042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.593456030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.593517065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.593523979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.593580008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.595602989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.595659018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.595705986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.595714092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.595741987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.595762968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.712515116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.712549925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.712627888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.712646961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.712698936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.714617014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.714639902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.714705944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.714715958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.714766026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.792185068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.792212963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.792265892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.792284966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.792320967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.792340040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.794748068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.794769049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.794806957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.794816971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.794867039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.796824932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.796849012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.796883106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.796891928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.796926975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.796951056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.799767017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.799827099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.799839973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.799858093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.799896002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.799916983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.802470922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.802515030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.802534103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.802540064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.802597046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.804622889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.804663897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.804701090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.804707050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.804773092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.923116922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.923162937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.923347950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.923348904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.923369884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.923424959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.925204039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.925244093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.925292015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.925299883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:00.925337076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:00.925359964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.002805948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.002922058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.002940893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.002968073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.003007889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.003032923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.005156040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.005198002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.005242109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.005251884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.005291939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.005314112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.007906914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.007947922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.007998943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.008008957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.008040905 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.008064985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.009954929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.010004997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.010040998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.010055065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.010082006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.010099888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.012834072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.012873888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.012914896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.012922049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.012960911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.012981892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.015774965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.015824080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.015862942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.015868902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.015904903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.015928030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.133774042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.133836031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.134001970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.134021044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.134175062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.135823965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.135865927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.135907888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.135915995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.135947943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.135965109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.213648081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.213696957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.213953972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.213973045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.214025974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.216154099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.216197014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.216236115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.216247082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.216273069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.216286898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.218327045 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.218394041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.218419075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.218426943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.218453884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.218467951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.221111059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.221158028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.221199036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.221206903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.221236944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.221251965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.223942041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.223984957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.224019051 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.224026918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.224052906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.224067926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.225951910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.225994110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.226031065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.226037979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.226063967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.226079941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.344594955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.344645023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.344790936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.344790936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.344813108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.344861031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.346677065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.346721888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.346764088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.346776009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.346795082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.346887112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.424593925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.424645901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.424808025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.424808025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.424827099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.424877882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.426775932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.426829100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.426855087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.426863909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.426888943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.426906109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.429498911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.429543972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.429574013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.429582119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.429605961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.429627895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.431560993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.431603909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.431634903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.431643009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.431667089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.431685925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.434403896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.434446096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.434484959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.434493065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.434521914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.434539080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.437238932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.437284946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.437319040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.437330961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.437355995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.437371969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.555011034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.555063009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.555107117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.555130005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.555299044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.555299044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.557859898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.557934046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.557938099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.557965994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.557998896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.558017969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.634870052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.634917021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.635063887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.635083914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.635230064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.637497902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.637542009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.637581110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.637588978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.637623072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.637640953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.639497995 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.639573097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.639573097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.639600992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.639631033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.639648914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.642294884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.642322063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.642371893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.642380953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.642395973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.642422915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.645072937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.645093918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.645159006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.645168066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.645214081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.648156881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.648175955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.648231030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.648247004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.648292065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.766012907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.766040087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.766134977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.766155005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.766199112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.768191099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.768208981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.768296957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.768306971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.768347979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.845839977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.845861912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.845909119 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.845927954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.845944881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.845967054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.848191977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.848206997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.848261118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.848269939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.848309040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.850271940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.850286961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.850344896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.850353003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.850395918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.852999926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.853015900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.853079081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.853094101 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.853138924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.855875015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.855890036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.855952978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.855962038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.856004953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.974714994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.974734068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.974775076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.974798918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.974814892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.974852085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.976906061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.976933002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.976968050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.976979971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.976995945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.977021933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.979099035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.979116917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.979176044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:01.979182959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:01.979233027 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.057411909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.057430029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.057616949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.057646036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.057730913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.059339046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.059353113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.059426069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.059439898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.059487104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.062118053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.062136889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.062187910 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.062196970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.062225103 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.062237024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.064939022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.064954042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.065012932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.065023899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.065068007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.067048073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.067061901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.067121983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.067131996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.067177057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.185533047 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.185575008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.185657024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.185682058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.185733080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.187611103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.187625885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.187689066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.187700033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.187743902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.190181971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.190197945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.190253019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.190260887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.190304995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.268059015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.268074036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.268250942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.268271923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.268321037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.270497084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.270512104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.270576000 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.270586014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.270631075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.273287058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.273319006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.273377895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.273386955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.273428917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.275477886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.275492907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.275549889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.275558949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.275602102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.278124094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.278139114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.278199911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.278211117 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.278253078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.396138906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.396183014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.396401882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.396424055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.396471024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.398583889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.398598909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.398658037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.398668051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.398711920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.400703907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.400719881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.400778055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.400787115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.400831938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.478748083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.478770018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.478857994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.478883028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.479015112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.481350899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.481367111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.481430054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.481439114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.481477022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.483990908 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.484005928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.484076023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.484086990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.484131098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.486190081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.486205101 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.486270905 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.486283064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.486329079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.488840103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.488857031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.488920927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.488929987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.488969088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.610410929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.610430002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.610505104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.610527992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.610575914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.850657940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.850683928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.850725889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.850747108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.850771904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.850801945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.850817919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.852639914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.852686882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.852699041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.852729082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.852746010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.852770090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.855474949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.855535030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.855544090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.855557919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.855623007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.858292103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.858333111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.858361006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.858371019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.858400106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.858414888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.860908985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.860953093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.860977888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.860991001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.861021996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.861048937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.862999916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.863044024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.863071918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.863080025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.863106966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.863132000 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.865832090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.865874052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.865895033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.865902901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.865932941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.865946054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.868618011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.868633032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.868690968 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.868702888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.868743896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.871032953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.871047020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.871093988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.871103048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.871134996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.873136044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.873151064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.873184919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.873193026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.873220921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.873234987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.900300980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.900315046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.900372028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.900398016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.900441885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.902393103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.902406931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.902463913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.902475119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.902522087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.905143023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.905178070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.905224085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.905268908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.905276060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.905314922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.907937050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.907960892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.907996893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.908006907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.908035040 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.908050060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.910037994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.910052061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.910098076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.910106897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:02.910135984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:02.910152912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.028326988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.028367996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.028531075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.028553963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.028606892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.030713081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.030729055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.030785084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.030793905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.030838966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.032782078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.032798052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.032862902 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.032871962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.032916069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.111438036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.111455917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.111526012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.111546993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.111673117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.113912106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.113925934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.113995075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.114008904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.114054918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.115720987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.115736008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.115813017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.115823984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.115840912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.115870953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.118484974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.118499041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.118565083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.118577957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.118623018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.121361971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.121376991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.121448994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.121460915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.121500969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.239308119 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.239330053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.239506960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.239531994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.239588022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.240746975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.240792036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.240828037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.240839958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.240869045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.240884066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.243518114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.243534088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.243613958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.243627071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.243674994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.321671009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.321693897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.321949959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.321969986 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.322017908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.323966980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.323985100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.324052095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.324063063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.324105978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.326735020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.326756001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.326814890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.326822996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.326867104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.329711914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.329725027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.329788923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.329797983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.329842091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.331618071 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.331640005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.331684113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.331692934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.331720114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.331729889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.449762106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.449779987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.449858904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.449878931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.449928045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.451148033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.451164007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.451229095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.451239109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.451282978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.454030991 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.454046011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.454106092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.454114914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.454158068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.531991005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.532008886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.532219887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.532300949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.532368898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.534095049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.534110069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.534182072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.534200907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.534266949 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.536956072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.536969900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.537039042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.537051916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.537108898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.539669037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.539685011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.539750099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.539763927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.539824963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.541806936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.541821957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.541889906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.541903973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.541959047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.661091089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.661107063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.661315918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.661381006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.661449909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.663425922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.663440943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.663520098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.663539886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.663598061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.665796041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.665811062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.665899038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.665915966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.665971994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.743360996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.743391037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.743597984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.743623018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.743688107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.745512962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.745531082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.745605946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.745621920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.745671988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.748274088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.748286963 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.748359919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.748373985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.748431921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.751086950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.751101017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.751174927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.751189947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.751244068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.753245115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.753262043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.753340960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.753374100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.753428936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.871167898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.871186972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.871263981 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.871287107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.871442080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.873611927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.873635054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.873684883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.873699903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.873728037 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.873748064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.875685930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.875699997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.875771046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.875787973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.875835896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.953435898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.953463078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.953528881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.953594923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.953633070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.953655958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.955457926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.955475092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.955547094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.955583096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.955647945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.958353043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.958374023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.958431959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.958448887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.958475113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.958506107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.961114883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.961129904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.961205006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.961220980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.961280107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.963927031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.963960886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.964001894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.964018106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:03.964044094 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:03.964114904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.082037926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.082052946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.082134008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.082166910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.082218885 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.084028959 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.084074974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.084103107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.084112883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.084139109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.084153891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.086081982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.086098909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.086160898 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.086170912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.086225986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.164278030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.164294004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.164484024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.164518118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.164570093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.166924953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.166939020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.167004108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.167012930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.167057991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.168982029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.168997049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.169064045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.169073105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.169116974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.171786070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.171801090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.171863079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.171871901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.171921015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.174748898 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.174776077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.174824953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.174834013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.174863100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.174871922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.298564911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298644066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298779964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.298779964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.298835993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298870087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298902035 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.298939943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.298943996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298965931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.298994064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.299006939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.299030066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.299057007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.299098015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.299113989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.299175024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.299190998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.299243927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.376312971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.376374006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.376538038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.376538038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.376605988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.376676083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.378617048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.378662109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.378746986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.378762007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.378793001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.378910065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.381504059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.381582975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.381613016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.381627083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.381652117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.381675005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.383725882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.383766890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.383811951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.383825064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.383852005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.383879900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.387186050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.387263060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.387295008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.387361050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.504327059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.504353046 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.504645109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.504714966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.504791021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.506710052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.506731033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.506803989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.506820917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.506880999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.509556055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.509574890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.509646893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.509660006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.509715080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.588609934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.588651896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.588850021 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.588850975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.588895082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.588970900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.589561939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.589581013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.589637041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.589653015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.589695930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.591799021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.591840982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.591892958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.591917992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.591938972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.591960907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.594430923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.594449997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.594523907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.594553947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.594571114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.594598055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.597441912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.597462893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.597528934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.597556114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.597604990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.714970112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.714994907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.715076923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.715152979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.715193033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.715215921 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.717242956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.717262983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.717333078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.717365980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.717427969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.720288038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.720310926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.720385075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.720422983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.720479012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.796147108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.796181917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.796245098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.796292067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.796327114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.796355009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.798818111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.798845053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.798894882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.798909903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.798934937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.798965931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.800882101 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.800908089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.800956011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.800971031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.800996065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.801018953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.803730965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.803759098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.803809881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.803822994 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.803848028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.803880930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.806638956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.806663990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.806710958 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.806724072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.806750059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.806766987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.924729109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.924757957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.924812078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.924837112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.924865007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.924887896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.926981926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.927009106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.927062035 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.927105904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.927135944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.927161932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.929878950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.929907084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.929953098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.929991961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:04.930006027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:04.930114985 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.006524086 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.006560087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.006732941 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.006733894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.006768942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.006827116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.009310961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.009334087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.009411097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.009428024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.009488106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.011446953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.011466980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.011559010 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.011571884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.011626959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.014345884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.014367104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.014420033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.014434099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.014460087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.014494896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.017138004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.017163992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.017232895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.017261028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.017319918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.135165930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.135199070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.135293961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.135334969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.135505915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.137270927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.137293100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.137449980 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.137465954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.137558937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.140111923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.140146017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.140194893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.140209913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.140237093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.140266895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.217077971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.217098951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.217338085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.217381001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.217457056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.219921112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.219942093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.220041990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.220057964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.220119953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.222147942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.222167015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.222249031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.222263098 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.222323895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.224828005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.224848032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.224963903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.224977016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.225040913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.227587938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.227615118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.227706909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.227721930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.227782965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.347152948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.347176075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.347501993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.347570896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.347759962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.349549055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.349569082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.349658966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.349674940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.349740982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.352336884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.352358103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.352438927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.352453947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.352514029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.427637100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.427659988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.427930117 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.427994013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.428086996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.430454969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.430474043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.430552959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.430569887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.430634975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.432557106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.432575941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.432646990 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.432662010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.432688951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.432729959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.435350895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.435369015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.435451984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.435483932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.435548067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.438169956 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.438188076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.438270092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.438294888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.438354969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.557879925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.557899952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.558007002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.558084965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.558248043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.559876919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.559896946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.559987068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.560019970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.560085058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.562748909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.562767029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.562841892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.562870979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.562931061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.638284922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.638303041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.638402939 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.638438940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.638633966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.641144037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.641174078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.641238928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.641259909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.641299963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.641319036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.643196106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.643215895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.643309116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.643330097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.643388987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.645973921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.645993948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.646074057 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.646084070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.646138906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.648907900 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.648927927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.649019003 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.649029016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.649085045 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.768996954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.769025087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.769143105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.769180059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.769243002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.771267891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.771289110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.771467924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.771482944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.771543026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.773365021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.773385048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.773459911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.773473978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.773535013 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.848896027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.848917961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.849004030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.849025965 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.849092960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.851686001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.851706028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.851782084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.851800919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.851866007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.853745937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.853766918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.853837967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.853852987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.853914976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.856550932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.856570005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.856646061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.856657028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.856722116 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.859406948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.859426975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.859498978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.859513044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.859575033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.979320049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.979346037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.979423046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.979494095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.979531050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.979574919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.981271029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.981291056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.981347084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.981362104 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.981417894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.981443882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.984128952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.984148026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.984224081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:05.984237909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:05.984301090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.059268951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.059288025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.059397936 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.059463024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.059536934 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.061775923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.061794996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.061882019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.061897039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.061964035 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.064943075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.064965010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.065064907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.065078974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.065143108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.067502022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.067522049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.067598104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.067610979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.067679882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.069591999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.069612026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.069704056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.069716930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.069787979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.189922094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.189949989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.190049887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.190084934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.190146923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.191915989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.191936970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.192013025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.192023039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.192053080 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.192071915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.195856094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.195883989 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.195979118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.196012020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.196072102 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.270580053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.270646095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.270733118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.270757914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.270793915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.270813942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.273202896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.273248911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.273298025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.273309946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.273356915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.273375988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.276093006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.276138067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.276194096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.276205063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.276247025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.276267052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.278311968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.278361082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.278407097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.278418064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.278462887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.278482914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.280890942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.280932903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.280982971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.281009912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.281045914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.281080961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.282772064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.400958061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.400978088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.401103020 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.401168108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.401240110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.403012037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.403028011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.403179884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.403196096 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.403260946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.405958891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.405976057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.406054974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.406086922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.406168938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.481586933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.481635094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.481717110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.481739998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.481789112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.481808901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.484386921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.484437943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.484488964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.484503984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.484535933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.484570026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.487206936 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.487251043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.487306118 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.487334967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.487369061 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.487390995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.490143061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.490185976 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.490235090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.490247011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.490294933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.490325928 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.492050886 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.492073059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.492152929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.492166042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.492224932 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.611329079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.611351013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.611531973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.611618042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.611686945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.613156080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.613169909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.613256931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.613271952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.613332987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.616107941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.616125107 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.616211891 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.616226912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.616283894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.693063974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.693082094 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.693171024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.693192005 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.693253994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.695601940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.695621014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.695700884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.695714951 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.695779085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.697698116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.697714090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.697815895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.697828054 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.697887897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.700589895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.700604916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.700690031 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.700702906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.700767994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.703299999 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.703320026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.703397036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.703409910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.703470945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.822344065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.822391987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.822453022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.822478056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.822511911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.822539091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.824376106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.824421883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.824475050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.824487925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.824536085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.824554920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.827097893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.827140093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.827177048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.827182055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.827234030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.903459072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.903486967 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.903564930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.903604984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.903667927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.906187057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.906208038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.906292915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.906306982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.906369925 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.908288002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.908307076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.908377886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.908391953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.908452034 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.911103010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.911122084 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.911194086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.911206961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.911263943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.913841009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.913863897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.913934946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:06.913947105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:06.914006948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.033157110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.033219099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.033286095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.033313036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.033344984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.033365965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.035720110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.035764933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.035815954 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.035839081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.035870075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.035895109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.037786007 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.037841082 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.037895918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.037910938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.037966967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.038016081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.113962889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.113987923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.114098072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.114118099 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.114183903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.116619110 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.116637945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.116707087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.116720915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.116750956 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.116774082 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.121530056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.121609926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.121643066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.121656895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.121684074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.121716022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.123023987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.123075962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.123132944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.123145103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.123178959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.123205900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.125752926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.125797033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.125875950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.125875950 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.125891924 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.125952959 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.251909971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.251986980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.252058029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.252098083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.252134085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.252161026 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.253763914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.253873110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.253875971 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.253906012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.253945112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.253973007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.256308079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.256375074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.256397963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.256419897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.256448984 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.256479025 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.324804068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.324822903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.324943066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.324990988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.325057983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.327510118 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.327526093 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.327605009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.327655077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.327718019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.330353975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.330367088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.330439091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.330460072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.330512047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.332036018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.332051992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.332120895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.332138062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.332186937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.334836006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.334851980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.334932089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.334963083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.335016012 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.462047100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.462110043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.462315083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.462359905 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.462444067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.464004993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.464051008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.464102983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.464119911 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.464164972 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.464191914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.466876984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.466918945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.466968060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.466980934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.467022896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.467041969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.535516024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.535561085 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.535655975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.535666943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.535691977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.535717964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.537503004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.537564993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.537607908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.537616014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.537647009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.537663937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.540339947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.540383101 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.540431976 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.540441036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.540477991 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.540488005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.543245077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.543284893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.543330908 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.543339014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.543373108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.543390036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.545341969 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.545422077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.545445919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.545453072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.545499086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.672909021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.672966003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.673125029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.673125029 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.673160076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.673222065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.675173044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.675225973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.675277948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.675297022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.675329924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.675353050 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.678046942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.678091049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.678160906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.678173065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.678203106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.678246975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.745840073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.745899916 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.745973110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.746006966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.746032000 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.746067047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.748248100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.748298883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.748347998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.748372078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.748397112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.748425007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756443024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756493092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756541014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756572008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756596088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756633997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756690025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756731987 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756762028 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756772041 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756804943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756830931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756869078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756912947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756944895 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.756953955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.756987095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.757010937 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.883725882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.883781910 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.883974075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.884007931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.884077072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.885696888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.885739088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.885850906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.885860920 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.885905027 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.885926008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.888406992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.888473034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.888494015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.888501883 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.888565063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.956475973 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.956532001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.956610918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.956646919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.956662893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.956700087 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.959037066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.959079981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.959144115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.959158897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.959193945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.959223986 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.961781025 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.961822033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.961869955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.961884022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.961924076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.961970091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.964714050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.964754105 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.964838982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.964855909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.964932919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.966707945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.966779947 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.966815948 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.966830015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:07.966865063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:07.966887951 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.340063095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.340079069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.340131998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.340190887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.340230942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.340251923 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.340291977 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.459614992 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459666014 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459764004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.459783077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459816933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459840059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.459847927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459867001 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459891081 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.459943056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.459956884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.459975958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460010052 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460074902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460197926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460218906 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460242033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460275888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460324049 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460340023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460375071 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460388899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460408926 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460422039 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460433960 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460463047 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460515022 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460876942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460896015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.460967064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.460980892 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461035013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461041927 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461052895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461076975 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461114883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461133957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461143970 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461206913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461221933 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461240053 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461316109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461328983 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461389065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461461067 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461782932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461802006 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461864948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461874008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461889029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461911917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461921930 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461947918 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.461957932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.461986065 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462018967 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462150097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462155104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462171078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462220907 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462232113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462250948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462272882 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462282896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462321043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462331057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462357998 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462399960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462804079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462831020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462905884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.462919950 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.462979078 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.468334913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.470144033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.515667915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.515695095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.515793085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.515813112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.515877962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.518182993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.518205881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.518286943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.518301964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.518362999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.520004988 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.520021915 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.520103931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.520117998 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.520179987 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.588119984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.588139057 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.588254929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.588274002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.588331938 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.631211996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.631230116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.631371975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.631403923 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.631479979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.633558035 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.633574009 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.633663893 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.633678913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.633743048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.636482954 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.636498928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.636565924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.636579990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.636698008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.639152050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.639167070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.639286995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.639300108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.639362097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.726265907 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.726286888 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.726454973 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.726520061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.726588011 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.728328943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.728343964 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.728431940 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.728452921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.728518009 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.731157064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.731173038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.731252909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.731283903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.731355906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.799179077 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.799206972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.799361944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.799411058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.799485922 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.842250109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.842269897 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.842350006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.842365026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.842418909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.844624043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.844644070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.844733953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.844742060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.844794989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.847342968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.847414017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.847430944 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.847438097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.847477913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.847501993 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.849625111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.849643946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.849734068 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.849747896 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.849801064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.936584949 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.936609030 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.936750889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.936794043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.936865091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.938805103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.938823938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.938911915 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.938927889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.938992023 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.941605091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.941626072 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.941700935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:08.941711903 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:08.941766024 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.010189056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.010211945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.010341883 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.010390997 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.010459900 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.052820921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.052846909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.052911997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.052946091 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.052964926 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.052999020 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.055479050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.055500984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.055551052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.055571079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.055587053 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.055613041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.058166981 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.058192015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.058235884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.058247089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.058270931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.058293104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.060226917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.060246944 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.060291052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.060297966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.060328960 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.060348988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.147146940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.147169113 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.147314072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.147344112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.147403955 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.149631023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.149651051 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.149724007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.149733067 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.149784088 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.152451038 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.152467966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.152537107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.152545929 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.152597904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.220690966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.220706940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.220834017 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.220880032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.220952988 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.263344049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.263359070 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.263454914 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.263474941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.263533115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.266294003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.266308069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.266382933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.266391039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.266438007 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.268992901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.269006968 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.269077063 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.269085884 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.269129038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.269154072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.271003008 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.271017075 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.271100044 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.271114111 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.271321058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.357506990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.357522011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.357620001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.357646942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.357700109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.360688925 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.360703945 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.360788107 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.360796928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.360842943 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.362905979 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.362921000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.362997055 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.363007069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.363065004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.431224108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.431246042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.431464911 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.431497097 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.431574106 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.474711895 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.474777937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.474836111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.474879980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.474910975 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.474939108 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.476712942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.476758003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.476802111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.476814032 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.476860046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.476883888 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.479625940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.479706049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.479726076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.479732037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.479785919 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.481761932 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.481803894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.481842041 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.481847048 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.481875896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.481892109 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.568726063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.568772078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.568924904 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.568926096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.568957090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.569016933 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.570995092 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.571038961 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.571082115 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.571089029 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.571141005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.573802948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.573847055 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.573890924 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.573896885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.573932886 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.573960066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.642052889 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.642102003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.642177105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.642225027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.642260075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.642301083 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.685555935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.685612917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.685692072 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.685738087 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.685767889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.685795069 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.687791109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.687834024 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.687886953 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.687900066 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.687948942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.687968969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.689862013 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.689903021 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.689951897 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.689964056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.690001965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.690022945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.692545891 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.692590952 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.692640066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.692653894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.692682981 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.692707062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.779539108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.779613972 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.779649019 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.779685974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.779705048 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.779736042 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.781918049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.782025099 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.782138109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.782221079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.783976078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.784048080 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.784070015 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.784082890 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.784125090 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.784147978 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.852749109 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.852804899 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.852884054 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.852885008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.852925062 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.852981091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.895770073 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.895824909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.895873070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.895895004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.895919085 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.895948887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.898607016 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.898690939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.898698092 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.898716927 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.898757935 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.898777962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.900681019 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.900723934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.900760889 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.900774002 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.900799036 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.900826931 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.903501034 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.903546095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.903582096 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.903605938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.903635979 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.903660059 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.995490074 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.995533943 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.995641947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.995696068 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.995754957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.995754957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.997314930 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.997355938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.997400999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.997425079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:09.997456074 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:09.997478962 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.000153065 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.000195980 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.000247002 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.000262022 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.000300884 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.000324965 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.063246012 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.063311100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.063360929 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.063380957 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.063416004 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.063438892 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.106914043 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.106962919 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.107026100 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.107044935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.107079983 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.107099056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.109301090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.109345913 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.109395027 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.109406948 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.109453917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.109476089 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.111397028 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.111445904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.111494064 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.111505985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.111547947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.111567974 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.114259958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.114310026 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.114352942 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.114363909 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.114408016 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.114428043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.205594063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.205642939 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.205729008 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.205785036 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.205836058 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.205858946 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.208277941 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.208319902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.208369970 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.208383083 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.208436966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.208460093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.211015940 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.211057901 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.211116076 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.211127996 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.211172104 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.211194038 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.273422003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.273513079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.273534060 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.273570061 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.273802996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.273802996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.317823887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.317854881 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.318078995 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.318125010 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.318195105 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.319797039 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.319818974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.319894075 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.319910049 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.319976091 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.322613955 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.322633982 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.322709084 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.322725058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.322786093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.325372934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.325392962 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.325467110 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.325479984 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.325557947 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.416336060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.416366100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.416574001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.416574001 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.416616917 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.416682005 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.418878078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.418898106 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.418992043 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.419013023 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.419075966 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.421664000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.421684027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.421758890 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.421775103 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.421835899 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.483922958 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.483944893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.484052896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.484086037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.484246969 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.528768063 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.528795004 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.529059887 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.529094934 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.529150963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.531438112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.531461000 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.531537056 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.531558037 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.531624079 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.533627033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.533647060 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.533699989 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.533713102 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.533744097 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.533781052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.536367893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.536389112 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.536478996 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.536494017 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.536552906 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.626957893 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.626981020 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.627168894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.627170086 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.627224922 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.627290964 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.629229069 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.629251003 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.629332066 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.629348040 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.629410982 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.632010937 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.632031918 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.632117033 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.632134914 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.632198095 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.695162058 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.695189953 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.695417881 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.695457935 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.695528030 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.739370108 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.739396095 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.739500046 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.739528894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.739689112 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.741827011 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.741848946 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.741919994 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.741935015 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.741997957 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.744514942 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.744589090 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.744597912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.744636059 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.744673014 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.747855902 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.747914076 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.747945070 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.747961044 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.747997999 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.792359114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.837506056 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.837537050 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.837579966 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.837599993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.837750912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.837750912 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.837804079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.837865114 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.840321064 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.840367079 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.840411901 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.840428114 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.840457916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.840481997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.842025042 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.842063904 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.842111111 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.842122078 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.842145920 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.842185020 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.905601978 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.905644894 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.905834913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.905834913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.905880928 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.905941963 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.950241089 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.950285912 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.950342894 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.950390100 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.950419903 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.950453997 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.952548027 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.952588081 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.952646971 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.952682018 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.952709913 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.952744961 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.955288887 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.955367088 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.955380917 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.955399990 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.955436945 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.955456018 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.957392931 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.957432985 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.957477093 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.957490921 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:10.957516909 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:10.957542896 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.048154116 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.048197031 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.048422098 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.048423052 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.048470974 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.048536062 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.050333977 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.050375938 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.050434113 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.050446033 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.050474882 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.050499916 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.053280115 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.053320885 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.053375006 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.053400993 CET	443	49731	185.199.110.133	192.168.2.4
Nov 21, 2024 13:56:11.053426981 CET	49731	443	192.168.2.4	185.199.110.133
Nov 21, 2024 13:56:11.053463936 CET	49731	443	192.168.2.4	185.199.110.133

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 13:55:38.861509085 CET	192.168.2.4	1.1.1.1	0x13db	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:55:41.231502056 CET	192.168.2.4	1.1.1.1	0x79b3	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 13:55:39.088313103 CET	1.1.1.1	192.168.2.4	0x13db	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:55:41.471085072 CET	1.1.1.1	192.168.2.4	0x79b3	No error (0)	objects.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:55:41.471085072 CET	1.1.1.1	192.168.2.4	0x79b3	No error (0)	objects.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:55:41.471085072 CET	1.1.1.1	192.168.2.4	0x79b3	No error (0)	objects.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:55:41.471085072 CET	1.1.1.1	192.168.2.4	0x79b3	No error (0)	objects.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	140.82.121.4	443	7688	C:\Windows\SysWOW64\wget.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 12:55:40 UTC	268	OUT	GET /karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: github.com Connection: Keep-Alive
2024-11-21 12:55:41 UTC	982	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 21 Nov 2024 12:55:40 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/187595602/0e11e7a6-f296-4016-9dc1-a83eb621d062?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241121%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241121T125540Z&X-Amz-Expires=300&X-Amz-Signature=a248221241d7dcb97b5adb6f5cfd6839fd7720b81cb3a7c5836bea8b802a4058&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DOpenWebStart_windows-x64_1_10_1.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-11-21 12:55:41 UTC	3381	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.199.110.133	443	7688	C:\Windows\SysWOW64\wget.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 12:55:42 UTC	699	OUT	GET /github-production-release-asset-2e65be/187595602/0e11e7a6-f296-4016-9dc1-a83eb621d062?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241121%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241121T125540Z&X-Amz-Expires=300&X-Amz-Signature=a248221241d7dcb97b5adb6f5cfd6839fd7720b81cb3a7c5836bea8b802a4058&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DOpenWebStart_windows-x64_1_10_1.exe&response-content-type=application%2Foctet-stream HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: objects.githubusercontent.com Connection: Keep-Alive
2024-11-21 12:55:43 UTC	823	IN	HTTP/1.1 200 OK Connection: close Content-Length: 58803280 Content-Type: application/octet-stream Last-Modified: Thu, 13 Jun 2024 08:43:05 GMT ETag: "0x8DC8B84D82B457F" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f96e5359-401e-0066-4b8e-2dae75000000 x-ms-version: 2024-08-04 x-ms-creation-time: Thu, 13 Jun 2024 08:43:05 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=OpenWebStart_windows-x64_1_10_1.exe x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Age: 2879 Date: Thu, 21 Nov 2024 12:55:43 GMT X-Served-By: cache-iad-kjyo7100118-IAD, cache-ewr-kewr1740023-EWR X-Cache: HIT, HIT X-Cache-Hits: 3655, 0 X-Timer: S1732193743.070896,VS0,VE8
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 51 01 fc 56 15 60 92 05 15 60 92 05 15 60 92 05 5e 18 91 04 1b 60 92 05 b1 1e 6f 05 19 60 92 05 b1 1e 96 04 07 60 92 05 b1 1e 91 04 1f 60 92 05 5e 18 96 04 00 60 92 05 b1 1e 97 04 45 60 92 05 5e 18 97 04 c2 60 92 05 5e 18 93 04 1e 60 92 05 15 60 93 05 39 61 92 05 0c 1f 96 04 1a 60 92 05 0c 1f 97 04 38 60 92 05 0c 1f 92 04 14 60 92 05 0c 1f 6d 05 14 60 92 05 0c 1f 90 04 14 60 92 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$QV```^`o```^`E`^`^``9a`8``m``
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 18 00 48 ff c1 48 83 f9 02 7c ee 48 8b c7 48 8b 5c 24 38 48 83 c4 20 5f c3 cc cc cc cc cc 48 83 ec 28 48 8d 41 27 48 3b c1 76 27 48 8b c8 e8 5b 35 03 00 48 8b c8 48 85 c0 74 11 48 83 c0 27 48 83 e0 e0 48 89 48 f8 48 83 c4 28 c3 e8 ad a4 03 00 cc e8 17 05 00 00 cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 41 80 78 19 00 49 8b d8 48 8b fa 48 8b f1 75 25 4c 8b 43 10 48 8b d7 48 8b ce e8 d2 ff ff ff 48 8b cb ba 30 00 00 00 48 8b 1b e8 32 35 03 00 80 7b 19 00 74 db 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 74 24 18 57 48 83 ec 60 83 64 24 48 00 48 8b f9 48 8b 09 48 8b da 48 8b d1 48 8b 41 08 48 89 44 24 40 80 78 19 00 75 2d 45 8b 08 48 89 44 24 40 44 39 48 20 7d 0b 83 64 24 48 Data Ascii: HH\|HH\$8H _H(HA'H;v'H[5HHtH'HHHH(H\$Ht$WH AxIHHu%LCHHH0H25{tH\$0Ht$8H _H\$Ht$WH`d$HHHHHHAHD$@xu-EHD$@D9H }d$H
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 08 49 8b c0 c3 cc cc cc cc cc cc cc 48 83 ec 48 48 8d 4c 24 20 e8 e2 fc ff ff 48 8d 15 db 83 09 00 48 8d 4c 24 20 e8 71 40 03 00 cc 48 83 ec 28 48 8d 0d 05 b6 06 00 e8 60 21 03 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc b8 a8 17 00 00 e8 b6 35 03 00 48 2b e0 48 8b 05 44 e1 09 00 48 33 c4 48 89 84 24 90 17 00 00 41 b8 70 17 00 00 c6 44 24 20 00 48 8d 54 24 20 e8 ac 00 00 00 48 8d 4c 24 20 e8 22 17 04 00 48 8b 8c 24 90 17 00 00 48 33 cc e8 d2 35 03 00 48 81 c4 a8 17 00 00 c3 cc cc cc cc cc cc cc cc cc cc 48 8b c4 48 89 58 10 89 48 08 57 48 83 ec 30 4c 8d 40 08 48 8d 50 e8 48 8d 0d 2a f3 09 00 e8 8d fa ff ff 48 8b 08 48 8b 79 28 48 85 ff 74 24 48 8b cf e8 e9 1d 04 00 48 8d 48 01 e8 90 2f 03 00 48 8b d7 48 8b c8 48 8b d8 e8 02 1d 04 00 48 8b c3 eb 0d Data Ascii: IHHHL$ HHL$ q@H(H`!5H+HDH3H$ApD$ HT$ HL$ "H$H35HHHXHWH0L@HPH*HHy(Ht$HHH/HHHH
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 45 28 41 8d 45 01 66 89 45 30 48 8d 05 99 b3 06 00 48 89 45 38 41 8d 45 02 66 89 45 40 48 8d 05 8a b3 06 00 48 89 45 48 41 8d 45 03 66 89 45 50 48 8d 05 7b b3 06 00 48 89 45 58 41 8d 45 04 66 89 45 60 48 8d 05 6c b3 06 00 48 89 45 68 41 8d 45 05 66 89 45 70 48 8d 05 5d b3 06 00 48 89 45 78 41 8d 45 06 66 89 85 80 00 00 00 48 8d 05 4b b3 06 00 48 89 85 88 00 00 00 41 8d 45 07 66 89 85 90 00 00 00 48 8d 05 36 b3 06 00 48 89 85 98 00 00 00 41 8d 45 08 66 89 85 a0 00 00 00 48 8d 05 21 b3 06 00 48 89 85 a8 00 00 00 41 8d 45 09 66 89 85 b0 00 00 00 48 8d 05 0c b3 06 00 48 89 85 b8 00 00 00 41 8d 45 0a 66 89 85 c0 00 00 00 48 8d 05 f7 b2 06 00 48 89 85 c8 00 00 00 41 8d 45 0b 66 89 85 d0 00 00 00 48 8d 05 e2 b2 06 00 48 89 85 d8 00 00 00 41 8d 45 0c 66 89 85 e0 Data Ascii: E(AEfE0HHE8AEfE@HHEHAEfEPH{HEXAEfE`HlHEhAEfEpH]HExAEfHKHAEfH6HAEfH!HAEfHHAEfHHAEfHHAEf
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 06 00 48 89 85 a8 03 00 00 b8 02 04 00 00 66 89 85 b0 03 00 00 48 8d 05 10 af 06 00 48 89 85 b8 03 00 00 b8 03 04 00 00 66 89 85 c0 03 00 00 48 8d 05 fe ae 06 00 48 89 85 c8 03 00 00 b8 04 04 00 00 66 89 85 d0 03 00 00 48 8d 05 ec ae 06 00 48 89 85 d8 03 00 00 b8 05 04 00 00 66 89 85 e0 03 00 00 48 8d 05 da ae 06 00 48 89 85 e8 03 00 00 b8 06 04 00 00 66 89 85 f0 03 00 00 48 8d 05 c8 ae 06 00 48 89 85 f8 03 00 00 b8 07 04 00 00 66 89 85 00 04 00 00 48 8d 05 b6 ae 06 00 48 89 85 08 04 00 00 b8 08 04 00 00 66 89 85 10 04 00 00 48 8d 05 a4 ae 06 00 48 89 85 18 04 00 00 b8 09 04 00 00 66 89 85 20 04 00 00 48 8d 05 92 ae 06 00 48 89 85 28 04 00 00 b8 0a 04 00 00 66 89 85 30 04 00 00 b8 0b 04 00 00 66 89 85 40 04 00 00 48 8d 0d b4 ae 06 00 48 8d 05 75 ae 06 00 Data Ascii: HfHHfHHfHHfHHfHHfHHfHHf HH(f0f@HHu
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 66 89 85 00 07 00 00 48 8d 05 4c ab 06 00 48 89 85 08 07 00 00 b8 3d 04 00 00 66 89 85 10 07 00 00 b8 3e 04 00 00 66 89 85 20 07 00 00 48 8d 05 2e ab 06 00 48 89 85 28 07 00 00 b8 3f 04 00 00 66 89 85 30 07 00 00 48 8d 05 1c ab 06 00 48 89 85 38 07 00 00 b8 40 04 00 00 66 89 85 40 07 00 00 48 8d 05 0a ab 06 00 48 89 85 48 07 00 00 b8 41 04 00 00 66 89 85 50 07 00 00 48 8d 05 f8 aa 06 00 48 89 85 58 07 00 00 b8 43 04 00 00 66 89 85 60 07 00 00 b8 44 04 00 00 66 89 85 70 07 00 00 b8 46 04 00 00 66 89 85 80 07 00 00 48 8d 05 d6 aa 06 00 48 89 85 88 07 00 00 b8 47 04 00 00 66 89 85 90 07 00 00 48 8d 05 c4 aa 06 00 48 89 85 98 07 00 00 b8 49 04 00 00 66 89 85 a0 07 00 00 48 8d 05 b2 aa 06 00 48 89 85 a8 07 00 00 b8 4a 04 00 00 66 89 85 b0 07 00 00 48 8d 05 a0 Data Ascii: fHLH=f>f H.H(?f0HH8@f@HHHAfPHHXCf`DfpFfHHGfHHIfHHJfH
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 00 48 8d 05 80 a7 06 00 48 89 85 88 0a 00 00 b8 0a 18 00 00 66 89 85 90 0a 00 00 48 8d 05 6e a7 06 00 48 89 85 98 0a 00 00 b8 0c 18 00 00 66 89 85 a0 0a 00 00 48 8d 05 5c a7 06 00 48 89 85 a8 0a 00 00 b8 01 1c 00 00 66 89 85 b0 0a 00 00 48 8d 05 4a a7 06 00 48 89 85 b8 0a 00 00 48 89 b5 88 09 00 00 48 89 8d a8 09 00 00 b8 09 1c 00 00 66 89 85 c0 0a 00 00 48 8d 05 2a a7 06 00 48 89 85 c8 0a 00 00 b8 0a 1c 00 00 66 89 85 d0 0a 00 00 48 8d 05 18 a7 06 00 48 89 85 d8 0a 00 00 b8 01 20 00 00 66 89 85 e0 0a 00 00 48 8d 05 06 a7 06 00 48 89 85 e8 0a 00 00 b8 09 20 00 00 66 89 85 f0 0a 00 00 48 8d 05 f4 a6 06 00 48 89 85 f8 0a 00 00 b8 0a 20 00 00 66 89 85 00 0b 00 00 48 8d 05 e2 a6 06 00 48 89 85 08 0b 00 00 b8 01 24 00 00 66 89 85 10 0b 00 00 48 8d 05 d0 a6 06 Data Ascii: HHfHnHfH\HfHJHHHfH*HfHH fHH fHH fHH$fH
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: cc cc 48 89 5c 24 08 57 48 83 ec 40 e8 d1 2a 00 00 48 83 64 24 30 00 41 b8 03 00 00 00 48 8b c8 c7 44 24 28 80 00 00 00 45 33 c9 44 89 44 24 20 ba 00 00 00 80 ff 15 b7 81 06 00 48 8b f8 48 8d 48 01 48 f7 c1 fe ff ff ff 75 2e ff 15 c9 81 06 00 8b d8 e8 8a 2a 00 00 4c 8b c8 48 8d 0d 68 9b 06 00 44 8b c3 48 8b d7 e8 c5 16 01 00 48 8d 0d 86 9b 06 00 e8 59 18 00 00 48 8b 5c 24 50 48 8b c7 48 83 c4 40 5f c3 cc cc cc cc cc cc cc cc cc cc cc 40 53 55 56 57 41 54 41 56 41 57 b8 c0 17 00 00 e8 7b 1a 03 00 48 2b e0 48 8b 05 09 c6 09 00 48 33 c4 48 89 84 24 b0 17 00 00 33 ff 41 8a e9 49 8b f0 4c 8b fa 4c 8b f1 4d 85 c0 0f 8e b3 00 00 00 41 bc 70 17 00 00 44 8b c6 4c 8d 4c 24 30 44 2b c7 48 8d 54 24 40 48 8b c6 49 8b ce 48 2b c7 49 3b c4 45 0f 4f c4 48 83 64 24 20 00 Data Ascii: H\$WH@Hd$0AHD$(E3DD$ HHHHu.LHhDHHYH\$PHH@_@SUVWATAVAW{H+HH3H$3AILLMApDLL$0D+HT$@HIH+I;EOHd$
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: e8 0b 1f 03 00 48 8b f0 48 85 c0 74 68 48 8d 0d 8c 90 0a 00 e8 67 fe 03 00 48 2b f3 48 8d 48 01 48 03 ce 48 81 f9 70 17 00 00 0f 83 2a 01 00 00 c6 44 0c 20 00 48 8d 54 24 20 48 8d 0d bf 9f 06 00 e8 8a 16 01 00 33 d2 48 8d 4c 24 20 ff 15 2d 7c 06 00 85 c0 75 1e ff 15 5b 7c 06 00 3d b7 00 00 00 74 11 48 8d 54 24 20 48 8d 0d c0 9f 06 00 e8 5b 11 01 00 4c 8b cb 4c 8d 05 21 90 0a 00 48 8d 15 6e 9f 06 00 48 8d 4c 24 20 e8 40 02 00 00 48 8d 54 24 20 48 8b cd e8 c3 00 00 00 8b d8 85 c0 0f 85 91 00 00 00 48 8d 15 42 9f 06 00 33 c9 41 ff c6 e8 88 00 04 00 48 8b d8 e8 90 13 00 00 84 c0 75 45 44 3b f7 0f 8c f6 fe ff ff ba 01 00 00 00 49 8b cf e8 46 0f 03 00 41 b9 01 00 00 00 45 33 c0 33 d2 48 8b cd ff 15 b2 7b 06 00 48 8b cd 89 05 ad d2 09 00 ff 15 b3 7b 06 00 48 8d Data Ascii: HHthHgH+HHHHp*D HT$ H3HL$ -\|u[\|=tHT$ H[LL!HnHL$ @HT$ HHB3AHuED;IFAE33H{H{H
2024-11-21 12:55:43 UTC	1378	IN	Data Raw: 40 01 00 00 4c 8d 68 01 48 8b 49 10 48 2b 0e 48 c1 f9 05 48 8b d1 48 d1 ea 48 8b c7 48 2b c2 48 3b c8 76 0e 48 89 7c 24 78 48 c7 c1 e0 ff ff ff eb 2f 48 8d 04 0a 4d 8b f5 49 3b c5 4c 0f 43 f0 4c 3b f7 0f 87 01 01 00 00 49 8b ce 48 c1 e1 05 49 8b fe 4c 89 74 24 78 48 81 f9 00 10 00 00 72 12 e8 a8 d4 ff ff 48 8b d8 4c 8b 8c 24 80 00 00 00 eb 1e 48 85 c9 74 12 e8 01 0a 03 00 48 8b d8 4c 8b 8c 24 80 00 00 00 eb 02 33 db 4c 89 74 24 78 48 89 9c 24 88 00 00 00 49 83 e7 e0 4d 8d 34 1f 4d 8d 7e 20 4c 89 7c 24 28 0f 57 c0 41 0f 11 06 49 83 66 10 00 49 83 66 18 00 41 b8 20 00 00 00 49 8b d1 49 8b ce e8 b2 27 03 00 48 8b 84 24 80 00 00 00 48 83 60 10 00 48 c7 40 18 0f 00 00 00 c6 00 00 4c 89 74 24 20 48 8b 56 08 48 8b 0e 4c 3b e2 75 05 4c 8b fb eb 1a 4c 8b ce 4c 8b Data Ascii: @LhHIH+HHHHH+H;vH\|$xH/HMI;LCL;IHILt$xHrHL$HtHL$3Lt$xH$IM4M~ L\|$(WAIfIfA II'H$H`H@Lt$ HVHL;uLLL

Target ID:	0
Start time:	07:55:38
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe" > cmdline.out 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:55:38
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:55:38
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe"
Imagebase:	0x400000
File size:	3'895'184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:57:21
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\download\OpenWebStart_windows-x64_1_10_1.exe"
Imagebase:	0x7ff7c1d50000
File size:	58'803'280 bytes
MD5 hash:	899985795B87D9F86877595A8C004D40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:57:29
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\jre\bin\java.exe
Wow64 process (32bit):	false
Commandline:	"c:\users\user\appdata\local\temp\E4JA75~1.TMP\jre\bin\java.exe" -version
Imagebase:	0x7ff650ef0000
File size:	315'784 bytes
MD5 hash:	990B10C495E3E60ED7AF4BA310AEDE57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:57:29
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0.1%
Signature Coverage:	16.1%
Total number of Nodes:	1573
Total number of Limit Nodes:	41

Executed Functions

Function 00007FFE126DCC3C Relevance: 126.4, APIs: 34, Strings: 38, Instructions: 378
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32 ref: 00007FFE126DCC99
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCCA4
_wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFE126DCCD4
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCCE2
GetVersionExA.KERNEL32 ref: 00007FFE126DCD06
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCD29
memset.VCRUNTIME140 ref: 00007FFE126DCD41
GetNativeSystemInfo.KERNELBASE ref: 00007FFE126DCD4B
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCD67
GetSystemDirectoryW.KERNEL32 ref: 00007FFE126DCD7C
wcsncat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCDA9
GetFileVersionInfoSizeW.VERSION ref: 00007FFE126DCDB6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DCDC5
GetFileVersionInfoW.VERSION ref: 00007FFE126DCDE0
VerQueryValueW.VERSION ref: 00007FFE126DCDFD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DCE1C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD00B
_wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFE126DD055
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD066
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD074
GetUserNameW.ADVAPI32 ref: 00007FFE126DD088
GetLastError.KERNEL32 ref: 00007FFE126DD092
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DD0A4
GetUserNameW.ADVAPI32 ref: 00007FFE126DD0BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DD0C7
GetUserDefaultLCID.KERNELBASE ref: 00007FFE126DD0FE
GetSystemDefaultLCID.KERNELBASE ref: 00007FFE126DD106
GetUserDefaultUILanguage.KERNEL32 ref: 00007FFE126DD10E
GetStdHandle.KERNEL32 ref: 00007FFE126DD1F8
GetFileType.KERNELBASE ref: 00007FFE126DD207
GetStdHandle.KERNEL32 ref: 00007FFE126DD223
GetFileType.KERNELBASE ref: 00007FFE126DD232
GetCurrentDirectoryW.KERNEL32 ref: 00007FFE126DD27B
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD28A

Strings

sun.awt.Win32GraphicsEnvironment, xrefs: 00007FFE126DCCC6
sun.awt.windows.WPrinterJob, xrefs: 00007FFE126DCCB8
little, xrefs: 00007FFE126DD034
Windows XP, xrefs: 00007FFE126DCE7F
Windows Server 2016, xrefs: 00007FFE126DCF98
Windows Server 2012, xrefs: 00007FFE126DCF1A
UnicodeLittle, xrefs: 00007FFE126DD255
\kernel32.dll, xrefs: 00007FFE126DCD9A
windows, xrefs: 00007FFE126DD026
amd64, xrefs: 00007FFE126DD018
\kernel32.dll, xrefs: 00007FFE126DCD57
sun.awt.windows.WToolkit, xrefs: 00007FFE126DCC81
Windows 9X (unknown), xrefs: 00007FFE126DCFB7, 00007FFE126DCFDD
Windows NT (unknown), xrefs: 00007FFE126DCE69
Windows NT, xrefs: 00007FFE126DCE47
MS950_HKSCS, xrefs: 00007FFE126DD1DE
Windows 11, xrefs: 00007FFE126DCF5C
USERNAME, xrefs: 00007FFE126DD047
%d.%d, xrefs: 00007FFE126DCFF1
Windows 2003, xrefs: 00007FFE126DCE8B
Windows 2000, xrefs: 00007FFE126DCE97
unknown, xrefs: 00007FFE126DD0D2
Windows Server 2008, xrefs: 00007FFE126DCF32
Windows Server 2008 R2, xrefs: 00007FFE126DCF26
C:\, xrefs: 00007FFE126DD0EC
Windows Vista, xrefs: 00007FFE126DCEEB
Windows 10, xrefs: 00007FFE126DCF63
Windows Me, xrefs: 00007FFE126DCFBE
Windows 98, xrefs: 00007FFE126DCFCB
Windows Server 2012 R2, xrefs: 00007FFE126DCF0E
Windows Server 2022, xrefs: 00007FFE126DCF81
Windows (unknown), xrefs: 00007FFE126DCE35
Windows Server 2019, xrefs: 00007FFE126DCF91
Windows 8, xrefs: 00007FFE126DCED3
JAVA2D_FONTPATH, xrefs: 00007FFE126DCCB1
Windows 95, xrefs: 00007FFE126DCFD4
Windows 8.1, xrefs: 00007FFE126DCEC7
Windows 7, xrefs: 00007FFE126DCEDF

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FileUser_wcsdup$DefaultInfoSystemVersion$DirectoryHandleNameType_strdup_wgetenvfreemalloc$CurrentErrorLanguageLastNativePathQuerySizeTempValuememsetstrlenwcslenwcsncat
String ID: %d.%d$C:\$JAVA2D_FONTPATH$MS950_HKSCS$USERNAME$UnicodeLittle$Windows (unknown)$Windows 10$Windows 11$Windows 2000$Windows 2003$Windows 7$Windows 8$Windows 8.1$Windows 95$Windows 98$Windows 9X (unknown)$Windows Me$Windows NT$Windows NT (unknown)$Windows Server 2008$Windows Server 2008 R2$Windows Server 2012$Windows Server 2012 R2$Windows Server 2016$Windows Server 2019$Windows Server 2022$Windows Vista$Windows XP$\kernel32.dll$\kernel32.dll$amd64$little$sun.awt.Win32GraphicsEnvironment$sun.awt.windows.WPrinterJob$sun.awt.windows.WToolkit$unknown$windows
API String ID: 891123638-1661956704
Opcode ID: 9c398fcc935609dbce609cd9f5f80340da3c0a283d7b0a50262574631a174619
Instruction ID: a10274522863ac0b00c958f00caadd99279b7204ac2eab12977b67267bdc4eaa
Opcode Fuzzy Hash: 9c398fcc935609dbce609cd9f5f80340da3c0a283d7b0a50262574631a174619
Instruction Fuzzy Hash: 40123A21E09F4B96EB54DB26EC501B923A4BF44774F9001B6D99E426F8EFBCE948C340

Function 00007FFE126D9EF0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 215
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D9F54
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9F62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9F73
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126D9F79
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D9F9F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9FA8
GetFileAttributesW.KERNELBASE ref: 00007FFE126D9FB1
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D9FD2
wcscat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA039
FindFirstFileW.KERNELBASE ref: 00007FFE126DA047
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA053
GetLastError.KERNEL32 ref: 00007FFE126DA05F

Strings

\, xrefs: 00007FFE126DA018
:, xrefs: 00007FFE126DA00A
, xrefs: 00007FFE126D9FDB
\, xrefs: 00007FFE126D9FFD
native memory allocation faiuled, xrefs: 00007FFE126D9F7F

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: free$Filewcslen$AttributesErrorFindFirstLast_errnomallocwcscatwcscpy
String ID: $:$\$\$native memory allocation faiuled
API String ID: 4052662375-713153650
Opcode ID: ed855e02f2fe8734bde0ba0484d8f9b8c797769fb0ca78ccc4f29b205f257b55
Instruction ID: c683a27c7ea7f1d8f916c7ab21de8a5b1ce5867a3313f2d89f4806d3843d186c
Opcode Fuzzy Hash: ed855e02f2fe8734bde0ba0484d8f9b8c797769fb0ca78ccc4f29b205f257b55
Instruction Fuzzy Hash: 1A815D21A09E8A82EA609B17AD5467D23A1BF45FE5F448075CE4E477F4EEBCE9498300

Function 00007FFE126DB5F8 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 217
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DB652
_wfullpath.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFE126DB66D
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB682
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB69D
wcschr.VCRUNTIME140 ref: 00007FFE126DB6C0
towupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB727
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126DB735
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB815
FindFirstFileW.KERNEL32 ref: 00007FFE126DB837

Strings

\\.\, xrefs: 00007FFE126DB693
\, xrefs: 00007FFE126DB881
\, xrefs: 00007FFE126DB6AB

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcslen$FileFindFirst_errno_wfullpathmalloctowupperwcschrwcsncmp
String ID: \$\$\\.\
API String ID: 3991119416-2666731034
Opcode ID: a0678ac8903d25bfdd32a361c964afc4d1675fb03d0e7d8513375d57d55c42b5
Instruction ID: 3912adb40ff236f80498d528283a145ee1f366903d4e0fe095c29cb4181d5e92
Opcode Fuzzy Hash: a0678ac8903d25bfdd32a361c964afc4d1675fb03d0e7d8513375d57d55c42b5
Instruction Fuzzy Hash: 4B817C16E08E4A87EA60DB179C5427962A0FF48BA4F454175DE9D472F8FFBCE885C310

Function 00007FFE126DD33C Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 139
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD384
GetLocaleInfoA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3A5
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3CE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3E2
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD401
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD416
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD429
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD448
GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD45D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD471
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD480
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD488
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4A7
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4BA
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD503

Part of subcall function 00007FFE126DD9DC: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126DDA19

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4D2
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4E5
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4F4

Strings

%*[a-z\-]%1[A-Z]%[a-z], xrefs: 00007FFE126DD3B2

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcpy$InfoLocale$malloc$strcmp$__stdio_common_vsscanfstrlen
String ID: %*[a-z\-]%1[A-Z]%[a-z]
API String ID: 2622327803-2148588631
Opcode ID: 089e7a8f9015e9749015a035bf1096b96c892262c542c8dce2caab59cbe0d08a
Instruction ID: dd9d874636c265d17038a563a9eeb80128a2f83321993502bbfd406851b626fb
Opcode Fuzzy Hash: 089e7a8f9015e9749015a035bf1096b96c892262c542c8dce2caab59cbe0d08a
Instruction Fuzzy Hash: 89512D22A09E4B86EB11EB17EC507B92761AF94BA8F4540B5C94D473F5EFBCE908C340

Function 00007FFE126DB198 Relevance: 21.2, APIs: 14, Instructions: 196
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDBCSLeadByte.KERNEL32 ref: 00007FFE126DB1EF
_fullpath.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFE126DB21E
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB23D
IsDBCSLeadByte.KERNEL32 ref: 00007FFE126DB250
strchr.VCRUNTIME140 ref: 00007FFE126DB270
isalpha.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB2A5
toupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB2BF
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB34E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126DB438

Part of subcall function 00007FFE126DB5B4: IsDBCSLeadByte.KERNEL32(?,?,?,00007FFE126DB312), ref: 00007FFE126DB5C9

FindFirstFileA.KERNELBASE ref: 00007FFE126DB396
FindClose.KERNELBASE ref: 00007FFE126DB3A8
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB3B3
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB3F7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126DB422

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strlen$ByteLead$Find_errno$CloseFileFirst_fullpathisalphastrchrtoupper
String ID:
API String ID: 2904132903-0
Opcode ID: d7e1368ad44b4902f8ee6e953f1652ae472480b331b051f971e4ed0e79c28c25
Instruction ID: 291710354e703cf93478c6acfd798bb3157b11056404943227e82b70ce360703
Opcode Fuzzy Hash: d7e1368ad44b4902f8ee6e953f1652ae472480b331b051f971e4ed0e79c28c25
Instruction Fuzzy Hash: 1A818312E0DE8E8AFB61DB369C543BD26D09F55BA4F4841B5DA8C067FDEEACE4058301

Function 00007FFE126DD548 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FFE126DD551
IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE126DD59F

Strings

i486 i386 i86, xrefs: 00007FFE126DD5D6
pentium+mmx pentium i486 i386 i86, xrefs: 00007FFE126DD5C6
i386 i86, xrefs: 00007FFE126DD5DF
ia64, xrefs: 00007FFE126DD573
amd64, xrefs: 00007FFE126DD56A
pentium_pro pentium i486 i386 i86, xrefs: 00007FFE126DD5AC
pentium_pro+mmx pentium_pro pentium+mmx pentium i486 i386 i86, xrefs: 00007FFE126DD5A5
pentium i486 i386 i86, xrefs: 00007FFE126DD5CD

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FeatureInfoPresentProcessorSystem
String ID: amd64$i386 i86$i486 i386 i86$ia64$pentium i486 i386 i86$pentium+mmx pentium i486 i386 i86$pentium_pro pentium i486 i386 i86$pentium_pro+mmx pentium_pro pentium+mmx pentium i486 i386 i86
API String ID: 2393058041-2509394267
Opcode ID: eb9c19c0394ab34ea820678b9c38ee099f312756abd7bee04057a3ee2c4ac043
Instruction ID: b4c927669f5fb69fdaf7dad7f52b1460f61f4c6304490b77799cc3fd099e74aa
Opcode Fuzzy Hash: eb9c19c0394ab34ea820678b9c38ee099f312756abd7bee04057a3ee2c4ac043
Instruction Fuzzy Hash: BF113062E0CD0F97FE64EB669C941782361BF60769F5005B1D48E821F8EFACE909D700

Function 00007FF650F1A6EC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF650F1A731

Part of subcall function 00007FF650F1A084: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1A098

Part of subcall function 00007FF650F0F060: HeapFree.KERNEL32(?,?,?,00007FF650F1685A,?,?,?,00007FF650F16897,?,?,00000000,00007FF650F16D5D,?,?,?,00007FF650F16C8F), ref: 00007FF650F0F076
Part of subcall function 00007FF650F0F060: GetLastError.KERNEL32(?,?,?,00007FF650F1685A,?,?,?,00007FF650F16897,?,?,00000000,00007FF650F16D5D,?,?,?,00007FF650F16C8F), ref: 00007FF650F0F080

Part of subcall function 00007FF650F0EFA0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF650F0EF7F,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F0EFA9
Part of subcall function 00007FF650F0EFA0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF650F0EF7F,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F0EFCE

Part of subcall function 00007FF650F02544: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0248F

_get_daylight.LIBCMT ref: 00007FF650F1A720

Part of subcall function 00007FF650F1A0E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1A0F8

_get_daylight.LIBCMT ref: 00007FF650F1A996
_get_daylight.LIBCMT ref: 00007FF650F1A9A7
_get_daylight.LIBCMT ref: 00007FF650F1A9B8
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF650F1ABF8), ref: 00007FF650F1A9DF

Strings

Eastern Standard Time, xrefs: 00007FF650F1AA85
Eastern Summer Time, xrefs: 00007FF650F1AA9D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: a2aa2af43e589fb11b19142b17765a6d4dc8dc0dca7420b7a2486b4b3a9a729b
Instruction ID: 97caf7531476f4d6056da6fd04923c31b9d2416f3c4ffdadaec0dfda3ea9060d
Opcode Fuzzy Hash: a2aa2af43e589fb11b19142b17765a6d4dc8dc0dca7420b7a2486b4b3a9a729b
Instruction Fuzzy Hash: D3D1BDA2A0C343A6E724EF26D8511B967A5FF88794F4C8035EE4DA7B86DF3CE4418750

Function 00007FF650EF691C Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650EF69B8: LoadLibraryA.KERNELBASE ref: 00007FF650EF6A6A

LoadLibraryA.KERNELBASE ref: 00007FF650EF6948
GetProcAddress.KERNEL32 ref: 00007FF650EF6969
GetProcAddress.KERNEL32 ref: 00007FF650EF697C

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

Strings

Error: can't find JNI interfaces in: %s, xrefs: 00007FF650EF6995
Error: loading: %s, xrefs: 00007FF650EF6956
JNI_CreateJavaVM, xrefs: 00007FF650EF695F
JNI_GetDefaultJavaVMInitArgs, xrefs: 00007FF650EF696F
JVM path is %s, xrefs: 00007FF650EF6934

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: AddressLibraryLoadProc$Message
String ID: Error: can't find JNI interfaces in: %s$Error: loading: %s$JNI_CreateJavaVM$JNI_GetDefaultJavaVMInitArgs$JVM path is %s
API String ID: 337255860-3810690643
Opcode ID: 4979bcb14dd9d88d69924ef3917fa4a7b9f1fbbd0c43ed51c724111fbc120128
Instruction ID: 752792bf938759d8a390910aa56a8c326d67c0a772e5727d48d06ad38e8dd70b
Opcode Fuzzy Hash: 4979bcb14dd9d88d69924ef3917fa4a7b9f1fbbd0c43ed51c724111fbc120128
Instruction Fuzzy Hash: 8A015B60A0DA53B2EA109F02F8412796365EF8A780F9C5031DD4EA77A5EF7CE5458300

Function 00007FF650F0D164 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650F0CD24: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0CD65
Part of subcall function 00007FF650F0CD24: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0CDE3
Part of subcall function 00007FF650F0CD24: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0CE34

CreateFileW.KERNELBASE ref: 00007FF650F0D26A
CreateFileW.KERNEL32 ref: 00007FF650F0D2BA
GetLastError.KERNEL32 ref: 00007FF650F0D2EA
GetFileType.KERNELBASE ref: 00007FF650F0D2FF
GetLastError.KERNEL32 ref: 00007FF650F0D309
CloseHandle.KERNEL32 ref: 00007FF650F0D33C
CloseHandle.KERNEL32 ref: 00007FF650F0D49F
CreateFileW.KERNEL32 ref: 00007FF650F0D4D4
GetLastError.KERNEL32 ref: 00007FF650F0D4E3

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ddcf69559423f9e8aef30e8fca8db06dd8d195fccc0f5274604b1d737d2e598b
Instruction ID: 631359bce2e4b0e6627a6177b0620090379584fb696cf9d7a029723f1ba20b61
Opcode Fuzzy Hash: ddcf69559423f9e8aef30e8fca8db06dd8d195fccc0f5274604b1d737d2e598b
Instruction Fuzzy Hash: 10C1C236B2CA4696EB10CF64D4A06AC3761FB49BA8B095235DE2FA77D4DF38D551C300

Function 00007FFE126DB91C Relevance: 13.6, APIs: 9, Instructions: 94fileCOMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB951
FindFirstFileW.KERNEL32 ref: 00007FFE126DB973
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DB97F

Part of subcall function 00007FFE126DB570: GetLastError.KERNEL32 ref: 00007FFE126DB574

FindFirstFileW.KERNELBASE ref: 00007FFE126DB98C
FindClose.KERNELBASE ref: 00007FFE126DB9A2
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB9AB
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DB9DA

Part of subcall function 00007FFE126DB4D8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB4F3
Part of subcall function 00007FFE126DB4D8: wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB522

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DBA38
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126DBA57

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcslen$Find$FileFirst$CloseErrorLast_errnofreemallocwcscpy
String ID:
API String ID: 764616015-0
Opcode ID: 58a18d7b498e5cabab497010c1b6d604c12faa6ad250a1d7dadbcb947c220dbc
Instruction ID: 43305db3557dd0688ae091640060013f42e4450aea8f1941bbfa5ba07a1dbbaf
Opcode Fuzzy Hash: 58a18d7b498e5cabab497010c1b6d604c12faa6ad250a1d7dadbcb947c220dbc
Instruction Fuzzy Hash: C8319211B19E4A86EA50DB17AC1427D6360EF88BB4F454170DD9E477F8EEBCE5058300

Function 00007FF650F1A968 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF650F1A996

Part of subcall function 00007FF650F1A0E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1A0F8

_get_daylight.LIBCMT ref: 00007FF650F1A9A7

Part of subcall function 00007FF650F1A084: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1A098

_get_daylight.LIBCMT ref: 00007FF650F1A9B8

Part of subcall function 00007FF650F1A0B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1A0C8

Part of subcall function 00007FF650F0F060: HeapFree.KERNEL32(?,?,?,00007FF650F1685A,?,?,?,00007FF650F16897,?,?,00000000,00007FF650F16D5D,?,?,?,00007FF650F16C8F), ref: 00007FF650F0F076
Part of subcall function 00007FF650F0F060: GetLastError.KERNEL32(?,?,?,00007FF650F1685A,?,?,?,00007FF650F16897,?,?,00000000,00007FF650F16D5D,?,?,?,00007FF650F16C8F), ref: 00007FF650F0F080

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF650F1ABF8), ref: 00007FF650F1A9DF

Strings

Eastern Standard Time, xrefs: 00007FF650F1AA85
Eastern Summer Time, xrefs: 00007FF650F1AA9D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: e0d7cefac507f6fa93dd5b66253c71826747cb55e649fe4c29d0000bfb1a440b
Instruction ID: 9050d751504a8c9bd4effc082cc221970f9d499822c5db1b71e177085c654e3b
Opcode Fuzzy Hash: e0d7cefac507f6fa93dd5b66253c71826747cb55e649fe4c29d0000bfb1a440b
Instruction Fuzzy Hash: 6F516C72A1C743A6E720EF21E9815A96764BF88794F4C4135EE4DE3B96DF3CE4408750

Function 00007FFE126D5B10 Relevance: 105.2, APIs: 3, Strings: 56, Instructions: 1907stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126DCC3C: GetTempPathW.KERNEL32 ref: 00007FFE126DCC99
Part of subcall function 00007FFE126DCC3C: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCCA4
Part of subcall function 00007FFE126DCC3C: _wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFE126DCCD4
Part of subcall function 00007FFE126DCC3C: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCCE2
Part of subcall function 00007FFE126DCC3C: GetVersionExA.KERNEL32 ref: 00007FFE126DCD06
Part of subcall function 00007FFE126DCC3C: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCD29
Part of subcall function 00007FFE126DCC3C: memset.VCRUNTIME140 ref: 00007FFE126DCD41
Part of subcall function 00007FFE126DCC3C: GetNativeSystemInfo.KERNELBASE ref: 00007FFE126DCD4B
Part of subcall function 00007FFE126DCC3C: strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCD67
Part of subcall function 00007FFE126DCC3C: GetSystemDirectoryW.KERNEL32 ref: 00007FFE126DCD7C
Part of subcall function 00007FFE126DCC3C: wcsncat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DCDA9
Part of subcall function 00007FFE126DCC3C: GetFileVersionInfoSizeW.VERSION ref: 00007FFE126DCDB6
Part of subcall function 00007FFE126DCC3C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DCDC5
Part of subcall function 00007FFE126DCC3C: GetFileVersionInfoW.VERSION ref: 00007FFE126DCDE0
Part of subcall function 00007FFE126DCC3C: VerQueryValueW.VERSION ref: 00007FFE126DCDFD

__swprintf_l.LIBCMT ref: 00007FFE126D60FE

Part of subcall function 00007FFE126DD2F8: wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD313

JVM_InitProperties.JVM ref: 00007FFE126D766C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D76FC

Strings

sun.java2d.fontpath, xrefs: 00007FFE126D7033
user.language, xrefs: 00007FFE126D65EF, 00007FFE126D7468, 00007FFE126D7734
sun.desktop, xrefs: 00007FFE126D73CD
getProperty, xrefs: 00007FFE126D5BD6
Temurin, xrefs: 00007FFE126D5F2A
sun.stderr.encoding, xrefs: 00007FFE126D6A7E
user.dir, xrefs: 00007FFE126D7329
user.timezone, xrefs: 00007FFE126D728B
file.encoding.pkg, xrefs: 00007FFE126D6B1C
line.separator, xrefs: 00007FFE126D6554
Java Platform API Specification, xrefs: 00007FFE126D5D50
sun.locale.formatasdefault, xrefs: 00007FFE126D7671
java.io.tmpdir, xrefs: 00007FFE126D70C9
java.class.version, xrefs: 00007FFE126D6106
sun.jnu.encoding, xrefs: 00007FFE126D6926
https://github.com/adoptium/adoptium-support/issues, xrefs: 00007FFE126D6066
user.country, xrefs: 00007FFE126D673E, 00007FFE126D7534, 00007FFE126D778C
os.version, xrefs: 00007FFE126D62E8
java.awt.graphicsenv, xrefs: 00007FFE126D6F8A
path.separator, xrefs: 00007FFE126D64B9
(Ljava/lang/Object;)Ljava/lang/Object;, xrefs: 00007FFE126D5B94
java.specification.name, xrefs: 00007FFE126D5D31
sun.cpu.endian, xrefs: 00007FFE126D6D04
Oracle Corporation, xrefs: 00007FFE126D5DEE
java.specification.maintenance.version, xrefs: 00007FFE126D5C93
user.variant, xrefs: 00007FFE126D67EA, 00007FFE126D759A, 00007FFE126D77BB
java.vendor.url, xrefs: 00007FFE126D5FA9
file.encoding, xrefs: 00007FFE126D6888, 00007FFE126D7600, 00007FFE126D77E3, 00007FFE126D784E
sun.os.patch.level, xrefs: 00007FFE126D6EEC
remove, xrefs: 00007FFE126D5BA1
true, xrefs: 00007FFE126D76F2
java.vendor.url.bug, xrefs: 00007FFE126D6047
user.home, xrefs: 00007FFE126D71F5
sun.arch.data.model, xrefs: 00007FFE126D6E4E
awt.toolkit, xrefs: 00007FFE126D61B0
user.script, xrefs: 00007FFE126D6695, 00007FFE126D74CE, 00007FFE126D775D
1.8, xrefs: 00007FFE126D5C14
java.specification.version, xrefs: 00007FFE126D5BF4
1.8.0_412, xrefs: 00007FFE126D5E8C
os.arch, xrefs: 00007FFE126D6383
sun.stdout.encoding, xrefs: 00007FFE126D69D2
java.specification.vendor, xrefs: 00007FFE126D5DCF
java.vendor, xrefs: 00007FFE126D5F0B
sun.cpu.isalist, xrefs: 00007FFE126D6C58
os.name, xrefs: 00007FFE126D624E
%d.%d, xrefs: 00007FFE126D60E8
put, xrefs: 00007FFE126D5B6C
https://adoptium.net/, xrefs: 00007FFE126D5FC8
sun.io, xrefs: 00007FFE126D6B3B
(Ljava/lang/String;)Ljava/lang/String;, xrefs: 00007FFE126D5BC9
sun.io.unicode.encoding, xrefs: 00007FFE126D6BBA
file.separator, xrefs: 00007FFE126D641E
java.awt.printerjob, xrefs: 00007FFE126D6DA2
java.version, xrefs: 00007FFE126D5E6D
(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;, xrefs: 00007FFE126D5B5F
user.name, xrefs: 00007FFE126D715F

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: InfoVersion$FileSystem_wcsdup$DirectoryInitNativePathPropertiesQuerySizeTempValue__swprintf_l_strdup_wgetenvmallocmemsetstrcmpstrlenwcslenwcsncat
String ID: %d.%d$(Ljava/lang/Object;)Ljava/lang/Object;$(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;$(Ljava/lang/String;)Ljava/lang/String;$1.8$1.8.0_412$Java Platform API Specification$Oracle Corporation$Temurin$awt.toolkit$file.encoding$file.encoding.pkg$file.separator$getProperty$https://adoptium.net/$https://github.com/adoptium/adoptium-support/issues$java.awt.graphicsenv$java.awt.printerjob$java.class.version$java.io.tmpdir$java.specification.maintenance.version$java.specification.name$java.specification.vendor$java.specification.version$java.vendor$java.vendor.url$java.vendor.url.bug$java.version$line.separator$os.arch$os.name$os.version$path.separator$put$remove$sun.arch.data.model$sun.cpu.endian$sun.cpu.isalist$sun.desktop$sun.io$sun.io.unicode.encoding$sun.java2d.fontpath$sun.jnu.encoding$sun.locale.formatasdefault$sun.os.patch.level$sun.stderr.encoding$sun.stdout.encoding$true$user.country$user.dir$user.home$user.language$user.name$user.script$user.timezone$user.variant
API String ID: 1782339531-3967455213
Opcode ID: 8a4a3cfb265e643f60b4fa1fd51cf6f0a6c3c80396f72e72750516d193d3e1d1
Instruction ID: 8cb939c07979a9594e797e569f2b54d2f5091ac1990b9bc86b2861db5d3a4244
Opcode Fuzzy Hash: 8a4a3cfb265e643f60b4fa1fd51cf6f0a6c3c80396f72e72750516d193d3e1d1
Instruction Fuzzy Hash: 4FF219B6206F4982DE899B179A943BD23A6BB49FD0F048026CF5E077A4DF3CD169C341

Function 00007FF650EF1D98 Relevance: 54.5, APIs: 12, Strings: 19, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF650EF6504: InitCommonControlsEx.COMCTL32 ref: 00007FF650EF6529

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1E6C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1E94
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1EAE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1EC1
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1ED4
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1EEE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F01
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F14
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F20
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F4E

Part of subcall function 00007FF650EF3CC8: sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF3D21

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F63
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1F84

Strings

javaw:%s, xrefs: 00007FF650EF1EE0
off, xrefs: 00007FF650EF1E78
Command line args:, xrefs: 00007FF650EF1F5C
javargs:%s, xrefs: 00007FF650EF1EA0
NEVER_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF650EF1F47
argv[%d] = %s, xrefs: 00007FF650EF1F77
fullversion:%s, xrefs: 00007FF650EF1EFA
-Dsun.java.launcher.diag=true, xrefs: 00007FF650EF1F97
Launcher state:, xrefs: 00007FF650EF1E65
ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE, xrefs: 00007FF650EF1F3E
launcher name:%s, xrefs: 00007FF650EF1ECD
-Dsun.java.launcher=SUN_STANDARD, xrefs: 00007FF650EF212F
DEFAULT_ERGONOMICS_POLICY, xrefs: 00007FF650EF1F35
ergo_policy:, xrefs: 00007FF650EF1F19
program name:%s, xrefs: 00007FF650EF1EBA
dotversion:%s, xrefs: 00007FF650EF1F0D
CLASSPATH, xrefs: 00007FF650EF20AE
debug:%s, xrefs: 00007FF650EF1E8D
%ld micro seconds to LoadJavaVM, xrefs: 00007FF650EF205E

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: wprintf$CommonControlsInitsprintf
String ID: debug:%s$dotversion:%s$ergo_policy:$fullversion:%s$javargs:%s$javaw:%s$launcher name:%s$program name:%s$%ld micro seconds to LoadJavaVM$-Dsun.java.launcher.diag=true$-Dsun.java.launcher=SUN_STANDARD$ALWAYS_ACT_AS_A_SERVER_CLASS_MACHINE$CLASSPATH$Command line args:$DEFAULT_ERGONOMICS_POLICY$Launcher state:$NEVER_ACT_AS_A_SERVER_CLASS_MACHINE$argv[%d] = %s$off
API String ID: 3782895439-2837184635
Opcode ID: 89c584f2efd9fa36dece4bc3508ef836efc780303e49f70769de8086073e36b9
Instruction ID: 2c1ea2daad8fd8b15e1a41bf9fba6f5b57744a0e9d481b3f6f5987327f9ff473
Opcode Fuzzy Hash: 89c584f2efd9fa36dece4bc3508ef836efc780303e49f70769de8086073e36b9
Instruction Fuzzy Hash: F9B17F62A0C697B5E710DB10FC412BA6765EF85384FAC0036EA4DE77A6DF2CE549CB00

Function 00007FF650EF21FC Relevance: 52.8, APIs: 8, Strings: 22, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF650EF55FC: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF650EF3745), ref: 00007FF650EF5610

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF228D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF229C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF22BE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF22CD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF22F0

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

Part of subcall function 00007FF650EF6548: fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF662E

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF24CD
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF24DF
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF2503

Strings

App's argc is %d, xrefs: 00007FF650EF24D6
([Ljava/lang/String;)V, xrefs: 00007FF650EF25D5
%s is '%s', xrefs: 00007FF650EF24C6
argv[%2d] = '%s', xrefs: 00007FF650EF24F9
JNI_FALSE, xrefs: 00007FF650EF22AC
()Ljava/lang/Class;, xrefs: 00007FF650EF256D
sun/misc/Version, xrefs: 00007FF650EF236D
JNI_TRUE, xrefs: 00007FF650EF22A5
JavaVM args: , xrefs: 00007FF650EF2286
ignoreUnrecognized is %s, , xrefs: 00007FF650EF22B7
version 0x%08lx, , xrefs: 00007FF650EF2295
Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit., xrefs: 00007FF650EF2722
%ld micro seconds to InitializeJVM, xrefs: 00007FF650EF24A3
Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF650EF23FA, 00007FF650EF2671, 00007FF650EF26CF, 00007FF650EF26F7
option[%2d] = '%s', xrefs: 00007FF650EF22E3
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF650EF23C8, 00007FF650EF2541, 00007FF650EF2683, 00007FF650EF268F
()V, xrefs: 00007FF650EF2398
println, xrefs: 00007FF650EF2387
print, xrefs: 00007FF650EF2391
getApplicationClass, xrefs: 00007FF650EF2574
nOptions is %ld, xrefs: 00007FF650EF22C6
main, xrefs: 00007FF650EF25DC

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: wprintf$FrequencyMessagePerformanceQueryfwprintf
String ID: argv[%2d] = '%s'$ option[%2d] = '%s'$%ld micro seconds to InitializeJVM$%s is '%s'$()Ljava/lang/Class;$()V$([Ljava/lang/String;)V$App's argc is %d$Error: A JNI error has occurred, please check your installation and try again$Error: Could not create the Java Virtual Machine.Error: A fatal exception has occurred. Program will exit.$Error: Could not detach main thread.Error: A JNI error has occurred, please check your installation and try again$JNI_FALSE$JNI_TRUE$JavaVM args: $getApplicationClass$ignoreUnrecognized is %s, $main$nOptions is %ld$print$println$sun/misc/Version$version 0x%08lx,
API String ID: 2415670359-324781675
Opcode ID: cce32aa90a10dc80924c661921a5c771649c0875adcb5d738d7c43e30f79d7ed
Instruction ID: 23a749d5c1ffe42447484088cc699e0eeaef58f83e608c79cf5a2d0521b5428c
Opcode Fuzzy Hash: cce32aa90a10dc80924c661921a5c771649c0875adcb5d738d7c43e30f79d7ed
Instruction Fuzzy Hash: B6F16162B09A57A5EB00DF25E8901B827A5FF85B94B6C4036DE0DE77A5DF3CE849C300

Function 00007FF650EF337C Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF650EF55FC: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF650EF3745), ref: 00007FF650EF5610

Part of subcall function 00007FF650F02E3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F02DA4

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF375C

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

Strings

IGNORE, xrefs: 00007FF650EF35C0
name: %s vmType: %s server_class: %s, xrefs: 00007FF650EF36CC
name: %s vmType: %s alias: %s, xrefs: 00007FF650EF36F0
Error: could not open `%s', xrefs: 00007FF650EF379D
Warning: Unknown VM type on line %d of `%s', xrefs: 00007FF650EF3667
Warning: Missing VM type on line %d of `%s', xrefs: 00007FF650EF3512
KNOWN, xrefs: 00007FF650EF3529
WARN, xrefs: 00007FF650EF35A8
Warning: No leading - on line %d of `%s', xrefs: 00007FF650EF343A
Warning: Missing server class VM on line %d of `%s', xrefs: 00007FF650EF3639
ERROR, xrefs: 00007FF650EF35DB
%ld micro seconds to parse jvm.cfg, xrefs: 00007FF650EF3755
ALIASED_TO, xrefs: 00007FF650EF3540
VM_IF_SERVER_CLASS, xrefs: 00007FF650EF36C5
IF_SERVER_CLASS, xrefs: 00007FF650EF35F6
VM_ALIASED_TO, xrefs: 00007FF650EF36E9
jvm.cfg[%d] = ->%s<-, xrefs: 00007FF650EF367F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: FrequencyMessagePerformanceQuery_invalid_parameter_noinfowprintf
String ID: name: %s vmType: %s alias: %s$ name: %s vmType: %s server_class: %s$%ld micro seconds to parse jvm.cfg$ALIASED_TO$ERROR$Error: could not open `%s'$IF_SERVER_CLASS$IGNORE$KNOWN$VM_ALIASED_TO$VM_IF_SERVER_CLASS$WARN$Warning: Missing VM type on line %d of `%s'$Warning: Missing server class VM on line %d of `%s'$Warning: No leading - on line %d of `%s'$Warning: Unknown VM type on line %d of `%s'$jvm.cfg[%d] = ->%s<-
API String ID: 2156942979-2085308502
Opcode ID: 7a2c901d771dae70618be6488f207fe584e5720cc52e658178476a5304b62df3
Instruction ID: 516ea5f7b5dd66b8bdf30788faa1ff7420b5d3357549d5005dd65011e1100ed4
Opcode Fuzzy Hash: 7a2c901d771dae70618be6488f207fe584e5720cc52e658178476a5304b62df3
Instruction Fuzzy Hash: 22C19FA5E0D697B1FA20EB25FC512B92364AF85B84FAC0135DD4EE7396DE3CE8058700

Function 00007FF650EF52D8 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 179
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF650EF5364
LoadLibraryA.KERNEL32 ref: 00007FF650EF53C3
LoadLibraryA.KERNEL32 ref: 00007FF650EF53EE
LoadLibraryA.KERNEL32 ref: 00007FF650EF5418
GetProcAddress.KERNEL32 ref: 00007FF650EF5438

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

Strings

preloadStop, xrefs: 00007FF650EF542E
\bin\verify.dll, xrefs: 00007FF650EF5332, 00007FF650EF53AD
J2D_D3D_PRELOAD, xrefs: 00007FF650EF54EE
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF650EF5349
false, xrefs: 00007FF650EF54D5, 00007FF650EF5502
J2D_D3D, xrefs: 00007FF650EF54C4
\bin\java.dll, xrefs: 00007FF650EF53D3
\bin\awt.dll, xrefs: 00007FF650EF53FD
true, xrefs: 00007FF650EF5539
preloadD3D, xrefs: 00007FF650EF5562

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: LibraryLoad$AddressProc$Message
String ID: Error: Path length exceeds maximum length (PATH_MAX)$J2D_D3D$J2D_D3D_PRELOAD$\bin\awt.dll$\bin\java.dll$\bin\verify.dll$false$preloadD3D$preloadStop$true
API String ID: 3101497455-3693045609
Opcode ID: 7288d46773ecea5e04005aa582f25d4d1fc0b4c8f2fc823b08e93934b78b1e3a
Instruction ID: b147102f348c0e53557eb146aff6af56f7c9e4832f0a25af58092631997f0c3e
Opcode Fuzzy Hash: 7288d46773ecea5e04005aa582f25d4d1fc0b4c8f2fc823b08e93934b78b1e3a
Instruction Fuzzy Hash: 49816E62A1D643B6EA14DB11F8912B963A5BF98B80F5C0139DE4EE33A5DF7CE509C700

Function 00007FF650EF58E0 Relevance: 30.2, APIs: 2, Strings: 18, Instructions: 205
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.LIBVCRUNTIME ref: 00007FF650EF5A63
strchr.LIBVCRUNTIME ref: 00007FF650EF5A73

Strings

-Dsun.java2d.d3d, xrefs: 00007FF650EF5B23
-J-d32, xrefs: 00007FF650EF5966
%s\jvm.dll, xrefs: 00007FF650EF5AA6
%s\bin\%s\jvm.dll, xrefs: 00007FF650EF5A85
Error: This Java instance does not support a %d-bit JVM.Please install the desired version., xrefs: 00007FF650EF5B84
-Dsun.java2d.noddraw, xrefs: 00007FF650EF5B0F
-Dsun.awt.warmup, xrefs: 00007FF650EF5AE9
%s%slib%s%s%sjvm.cfg, xrefs: 00007FF650EF59FB
Error: could not determine JVM type., xrefs: 00007FF650EF5BC7
-J-d64, xrefs: 00007FF650EF5940
Error: missing `%s' JVM at `%s'.Please install or use the JRE or JDK that contains these missing components., xrefs: 00007FF650EF5BE1
Error: no known VMs. (check for corrupt jvm.cfg file), xrefs: 00007FF650EF5BB2
amd64, xrefs: 00007FF650EF59EF
ERROR, xrefs: 00007FF650EF5A40
Error: Could not find Java SE Runtime Environment., xrefs: 00007FF650EF5B9B
-d32, xrefs: 00007FF650EF5979
-d64, xrefs: 00007FF650EF5953
-Dsun.java2d.opengl, xrefs: 00007FF650EF5B36

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: strchr
String ID: %s%slib%s%s%sjvm.cfg$%s\bin\%s\jvm.dll$%s\jvm.dll$-Dsun.awt.warmup$-Dsun.java2d.d3d$-Dsun.java2d.noddraw$-Dsun.java2d.opengl$-J-d32$-J-d64$-d32$-d64$ERROR$Error: Could not find Java SE Runtime Environment.$Error: This Java instance does not support a %d-bit JVM.Please install the desired version.$Error: could not determine JVM type.$Error: missing `%s' JVM at `%s'.Please install or use the JRE or JDK that contains these missing components.$Error: no known VMs. (check for corrupt jvm.cfg file)$amd64
API String ID: 2830005266-3502651862
Opcode ID: 4a1a7ab9ea26feb7e82c963e124ecda87a6748183017f93ca113a1837f9a255e
Instruction ID: 5d388703f29b8891a1a554dd0fb2f1a5f8204eada665fe4876efc7c82e27b98d
Opcode Fuzzy Hash: 4a1a7ab9ea26feb7e82c963e124ecda87a6748183017f93ca113a1837f9a255e
Instruction Fuzzy Hash: 10917162A0CA53B2FA14DB11F8912B92369AF95794F6C4032DE4EF7796DE3CE446C700

Function 00007FFE14639D38 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 115
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE14639D6D
jio_fprintf.JVM ref: 00007FFE14639D7D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14639D8F
JVM_RawMonitorEnter.JVM ref: 00007FFE14639DAE
JVM_RawMonitorExit.JVM ref: 00007FFE14639DE8
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14639E35
getErrorString.JAVA ref: 00007FFE14639E48
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE14639E57
jio_fprintf.JVM ref: 00007FFE14639E6D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14639EA9
getErrorString.JAVA ref: 00007FFE14639EBC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE14639ECB

Strings

jzentry was invalid, xrefs: 00007FFE14639D76
%s: %s, xrefs: 00007FFE14639E63

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: __acrt_iob_func$ErrorMonitorString_errnojio_fprintf$EnterExitstrcpy
String ID: %s: %s$jzentry was invalid
API String ID: 3069357152-2155475130
Opcode ID: b101bb934fca45f68e4f045c403b8e4990805114c187f88983fa97574556f816
Instruction ID: 1f8f17d49eb1e23d15984a70f3f3c179065943d3b30eb85d6dabc7069dadd9c3
Opcode Fuzzy Hash: b101bb934fca45f68e4f045c403b8e4990805114c187f88983fa97574556f816
Instruction Fuzzy Hash: 12419062B19E8142EE149B13D9817BA6351BF46FECF444075DE0D077A6DE3CE81DCA80

Function 00007FFE14639A68 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14639A9E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14639AAF
JVM_RawMonitorCreate.JVM ref: 00007FFE14639ABD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14639AD5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14639ADE
JVM_GetLastErrorString.JVM ref: 00007FFE14639B19
handleLseek.JAVA ref: 00007FFE14639B80
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14639BB9
CloseHandle.KERNEL32 ref: 00007FFE14639BC5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14639BFA
JVM_RawMonitorEnter.JVM ref: 00007FFE14639C0C
JVM_RawMonitorExit.JVM ref: 00007FFE14639C2A

Strings

zip file is empty, xrefs: 00007FFE14639B98

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: Monitor_strdup$free$CloseCreateEnterErrorExitHandleLastLseekStringcallochandle
String ID: zip file is empty
API String ID: 2341892333-4278478081
Opcode ID: c79d034b8b5be2d738046e979602391ff0ee75f5a6b1ad3e3cca559884143a4d
Instruction ID: 6508ae5d039b86c5181ed924048f0791a60975eac5ef2f8954d1096dc0bc357f
Opcode Fuzzy Hash: c79d034b8b5be2d738046e979602391ff0ee75f5a6b1ad3e3cca559884143a4d
Instruction Fuzzy Hash: 6951A621A09E9241FA659B27A8D037922A0AF4AB7CF0402B4DD5F427F5DF3CE41DCB80

Function 00007FFE1463A86C Relevance: 19.9, APIs: 4, Strings: 9, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE1463A028: memset.VCRUNTIME140 ref: 00007FFE1463A0A7
Part of subcall function 00007FFE1463A028: memcpy.VCRUNTIME140 ref: 00007FFE1463A16E
Part of subcall function 00007FFE1463A028: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A185

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463AA3F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463AA8D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463AAD7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463AB00

Part of subcall function 00007FFE1463A2C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463A383), ref: 00007FFE1463A2D6
Part of subcall function 00007FFE1463A2C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463A383), ref: 00007FFE1463A2E5
Part of subcall function 00007FFE1463A2C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A31A
Part of subcall function 00007FFE1463A2C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A335

Strings

M, xrefs: 00007FFE1463AC1A
invalid CEN header (bad compression method), xrefs: 00007FFE1463AD84
MANIFEST.MF, xrefs: 00007FFE1463AC5A
invalid END header (bad central directory offset), xrefs: 00007FFE1463AA81
META-INF/, xrefs: 00007FFE1463AC13
invalid CEN header (bad signature), xrefs: 00007FFE1463AD9C
invalid CEN header (encrypted entry), xrefs: 00007FFE1463AD90
invalid CEN header (bad header size), xrefs: 00007FFE1463AD78
invalid END header (bad central directory size), xrefs: 00007FFE1463AA25

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: free$malloc$callocmemcpymemset
String ID: M$MANIFEST.MF$META-INF/$invalid CEN header (bad compression method)$invalid CEN header (bad header size)$invalid CEN header (bad signature)$invalid CEN header (encrypted entry)$invalid END header (bad central directory offset)$invalid END header (bad central directory size)
API String ID: 2808508016-2383787489
Opcode ID: 78c3fd45124eb078c40ac8a8f0a2b8b6cb04664f9ac0899b9b8b5e2aaec187a5
Instruction ID: be11cf59fed749eb44b054e55cf116164884bd376ef4445b0cad2703cb86891b
Opcode Fuzzy Hash: 78c3fd45124eb078c40ac8a8f0a2b8b6cb04664f9ac0899b9b8b5e2aaec187a5
Instruction Fuzzy Hash: 38F17C63F09AE149E7108B3698942BC3FE1AB467ADB040272EEAE437D5DE3CD118D750

Function 00007FF650EF69B8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 92
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF650EF6A6A
LoadLibraryA.KERNELBASE ref: 00007FF650EF6B04

Strings

msvcp140.dll, xrefs: 00007FF650EF6A8D
\bin\, xrefs: 00007FF650EF6A0B, 00007FF650EF6A99
vcruntime140.dll, xrefs: 00007FF650EF69FF
CRT path is %s, xrefs: 00007FF650EF6A49
\bin\vcruntime140.dll, xrefs: 00007FF650EF6A33
Error: Path length exceeds maximum length (PATH_MAX), xrefs: 00007FF650EF6ABD
\bin\msvcp140.dll, xrefs: 00007FF650EF6ACD
Error: loading: %s, xrefs: 00007FF650EF6B14
PRT path is %s, xrefs: 00007FF650EF6AE3

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: LibraryLoad
String ID: CRT path is %s$Error: Path length exceeds maximum length (PATH_MAX)$Error: loading: %s$PRT path is %s$\bin\$\bin\msvcp140.dll$\bin\vcruntime140.dll$msvcp140.dll$vcruntime140.dll
API String ID: 1029625771-3119513514
Opcode ID: 01ff668b7556ced2fa6fbddc1395e19fbf20c6e6c0a74bb9eaff1fa0b69a20f8
Instruction ID: 2a2432be3862c34bb715db106312e6c9a5cc7a901b906592f8ed9024d446b027
Opcode Fuzzy Hash: 01ff668b7556ced2fa6fbddc1395e19fbf20c6e6c0a74bb9eaff1fa0b69a20f8
Instruction Fuzzy Hash: 00415E61A1C953B2EA50EB10F8521F963A4BF95344F9C4132D94EE73A6EF3CE609C710

Function 00007FFE1463A3BC Relevance: 15.3, APIs: 12, Instructions: 321COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00007FFE14639619,?,?,?,?,00007FFE1463203B), ref: 00007FFE1463A3E3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A560
memcpy.VCRUNTIME140(?,?,?,00007FFE1463203B), ref: 00007FFE1463A57F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A5A0

Part of subcall function 00007FFE1463AE18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463B04D,?,?,?,?,?,?,00000000,00007FFE1463A420,?,?,?,00007FFE1463203B), ref: 00007FFE1463AE52

memcpy.VCRUNTIME140(?,?,?,00007FFE1463203B), ref: 00007FFE1463A5D1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A7E4
memcpy.VCRUNTIME140(?,?,?,00007FFE1463203B), ref: 00007FFE1463A805
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A819
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A823
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A82D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463203B), ref: 00007FFE1463A836
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A84D

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: freemalloc$memcpy
String ID:
API String ID: 3519880569-0
Opcode ID: e82d6cd48b92b60d07b16079f469951bed993eb0783c6cfabc5ead75f9124269
Instruction ID: e87ad4b35f52d1e89a3f09646fc0557be5d63cd4fb0886a1367de01235a5bfac
Opcode Fuzzy Hash: e82d6cd48b92b60d07b16079f469951bed993eb0783c6cfabc5ead75f9124269
Instruction Fuzzy Hash: 9CD12862609AE007DA758B2668E523D3FE0E746782B04117ADFEF42B91DE3CD168D760

Function 00007FF650EF5450 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 99synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650F0A100: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0A12B

WaitForSingleObject.KERNEL32 ref: 00007FF650EF5579
GetExitCodeThread.KERNEL32 ref: 00007FF650EF5587
CloseHandle.KERNEL32 ref: 00007FF650EF5590

Part of subcall function 00007FF650F0A100: CreateThread.KERNELBASE ref: 00007FF650F0A16C
Part of subcall function 00007FF650F0A100: GetLastError.KERNEL32 ref: 00007FF650F0A17A
Part of subcall function 00007FF650F0A100: CloseHandle.KERNEL32 ref: 00007FF650F0A190
Part of subcall function 00007FF650F0A100: FreeLibrary.KERNEL32 ref: 00007FF650F0A19F

Strings

J2D_D3D_PRELOAD, xrefs: 00007FF650EF54EE
false, xrefs: 00007FF650EF54D5, 00007FF650EF5502
J2D_D3D, xrefs: 00007FF650EF54C4
true, xrefs: 00007FF650EF5539
preloadD3D, xrefs: 00007FF650EF5562

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CloseHandleThread$CodeCreateErrorExitFreeLastLibraryObjectSingleWait_invalid_parameter_noinfo
String ID: J2D_D3D$J2D_D3D_PRELOAD$false$preloadD3D$true
API String ID: 2847611408-3397395437
Opcode ID: 50e482a12a846dd847a3039098743e9302157542b0eb9f7c6de6cd063f07b22b
Instruction ID: 614bdc4574f567cbd42a101fe2b5a240445b4d60fa1312c2089016f9ea20cfe6
Opcode Fuzzy Hash: 50e482a12a846dd847a3039098743e9302157542b0eb9f7c6de6cd063f07b22b
Instruction Fuzzy Hash: 7F415971A1D753A6EA18DB11FC912B863A1AF98B90F5C0139DE0EE37A5DF3CE5458B00

Function 00007FF650EF1008 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF102A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1051
GetCommandLineA.KERNEL32 ref: 00007FF650EF1065

Strings

1.8, xrefs: 00007FF650EF10FD
_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF650EF1012
Windows original main args:, xrefs: 00007FF650EF1023
1.8.0_412-b08, xrefs: 00007FF650EF1118
wwwd_args[%d] = %s, xrefs: 00007FF650EF1043

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: wprintf$CommandLine
String ID: 1.8$1.8.0_412-b08$Windows original main args:$_JAVA_LAUNCHER_DEBUG$wwwd_args[%d] = %s
API String ID: 921100755-1496169136
Opcode ID: 570558dfcfd09c745ff65766fc1c7cc8351026277295affa8e5bca5b275ab6f1
Instruction ID: ba2e399612a6ad7d6e7ea002d511bf5990c09038d1ae0664283568123dd0af98
Opcode Fuzzy Hash: 570558dfcfd09c745ff65766fc1c7cc8351026277295affa8e5bca5b275ab6f1
Instruction Fuzzy Hash: 79319E65A0CA8BA1FB10DB51F8903B9B365EF85B84F6C4036DA4DA3766DF3CE0448B00

Function 00007FF650EFA7B4 Relevance: 13.6, APIs: 9, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF650EFA7C8

Part of subcall function 00007FF650EFACD0: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF650EFACF2

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF650EFA7DD
__scrt_release_startup_lock.LIBCMT ref: 00007FF650EFA84B
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF650EFA861
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF650EFA88D
__scrt_is_managed_app.LIBCMT ref: 00007FF650EFA8C2
__scrt_uninitialize_crt.LIBCMT ref: 00007FF650EFA8D9
__scrt_fastfail.LIBCMT ref: 00007FF650EFA910
__scrt_fastfail.LIBCMT ref: 00007FF650EFA91B

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 2690363330-0
Opcode ID: 391b7f3ad77ed67af486723d169d38384ba16e5104c024a8800a2c4e6e2a8fb2
Instruction ID: f409d506576aafe9d50e3c4b22ab1fe39d8a6164e4daeab9d85d9ec2fe257bcb
Opcode Fuzzy Hash: 391b7f3ad77ed67af486723d169d38384ba16e5104c024a8800a2c4e6e2a8fb2
Instruction Fuzzy Hash: BD3180A1E0C253A2FA14AB25F4263B92795AF84784F6C4035DA0EFB3D7DE6DE8458310

Function 00007FF650F0F09C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00007FF650F0F328,?,?,?,?,00007FF650F09F4E), ref: 00007FF650F0F218
GetProcAddress.KERNEL32(?,00007FF650F0F328,?,?,?,?,00007FF650F09F4E), ref: 00007FF650F0F224

Strings

ext-ms-, xrefs: 00007FF650F0F175
api-ms-, xrefs: 00007FF650F0F162

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 0534ce3b8b05da40400d399223f3a47e1dc0b1387e26064a143094e510062e07
Instruction ID: 05314bbd59a0a3e4fe2941b93fc63795601234deab89b86d03071c778f7a13a9
Opcode Fuzzy Hash: 0534ce3b8b05da40400d399223f3a47e1dc0b1387e26064a143094e510062e07
Instruction Fuzzy Hash: 7541DC72B1DA03B1FA26DB16EC216752291BF49BA0F0C4139DD0EE7B94DE3CE6498344

Function 00007FFE1320EEB0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FFE1320EEC8

Part of subcall function 00007FFE1320D0A0: std::locale::_Init.LIBCPMT ref: 00007FFE1320D0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FFE1320EF05
std::ios_base::failure::failure.LIBCPMT ref: 00007FFE1320EF57
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1320EF68

Strings

ios_base::failbit set, xrefs: 00007FFE1320EF2B
ios_base::eofbit set, xrefs: 00007FFE1320EF32
ios_base::badbit set, xrefs: 00007FFE1320EF1F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowstd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 792165947-1866435925
Opcode ID: 5a961f8f7a396de3a89a0a91937ff84da1abf775fff624eb7f976a44ec027974
Instruction ID: a85f7c06f63d359100ee26564078badf4322d87634d761d9382de213be55165d
Opcode Fuzzy Hash: 5a961f8f7a396de3a89a0a91937ff84da1abf775fff624eb7f976a44ec027974
Instruction Fuzzy Hash: 6921E362A18E469AEA14AB22D6513ED2760FBA47D0F444071D74D17BB5DF7CE498C340

Function 00007FF650F0DAFC Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0DF29

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 87f4c229a28051cc36f94f49d734fe51ff4aad4668add1027d000a943144d7b8
Instruction ID: 06b52c0321e8e224812cada30fe15e5459bc18352df3c7359c1b7cb161c3580e
Opcode Fuzzy Hash: 87f4c229a28051cc36f94f49d734fe51ff4aad4668add1027d000a943144d7b8
Instruction Fuzzy Hash: D1C1D52AA0CB87B2F7619B1494602BD7B94EB91B90F5D4131DE4FA7791DF7CE8458300

Function 00007FFE126D96A8 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

native memory allocation failed, xrefs: 00007FFE126D97A4
Bad pathname, xrefs: 00007FFE126D9824

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID:
String ID: Bad pathname$native memory allocation failed
API String ID: 0-1025850331
Opcode ID: 47a681c490351da526917e4cdc6f45a8f28748e6275e1edda54ee62f1d3e0ea8
Instruction ID: 522b53ddf7046432a7f0b1f1590a064353a90ad804aba43944cdc95517f86033
Opcode Fuzzy Hash: 47a681c490351da526917e4cdc6f45a8f28748e6275e1edda54ee62f1d3e0ea8
Instruction Fuzzy Hash: 66417F25B0AE8A82EE50DB179D547BA2392BF49FE4F448471CE4D077A5DF7CE1058710

Function 00007FFE126D9534 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D9591
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D95B4
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D95DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D95F5

Strings

native memory allocation failed, xrefs: 00007FFE126D95FD
Bad pathname, xrefs: 00007FFE126D966E

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcslen$freemalloc
String ID: Bad pathname$native memory allocation failed
API String ID: 2638336986-1025850331
Opcode ID: dff6fabb4baa71c3779531ac07e32636692aa6e25ed9ef3f942eb7955bb98a4d
Instruction ID: cc3c1041b600489cf043794732419a62b8ec940e217cf50ed1a73fc4e6215338
Opcode Fuzzy Hash: dff6fabb4baa71c3779531ac07e32636692aa6e25ed9ef3f942eb7955bb98a4d
Instruction Fuzzy Hash: AA316D25B09E9A86FE609B17AD643B91392AF89FE4F044071CE8E07BE5DE7DE1058740

Function 00007FFE126DC4CC Relevance: 9.1, APIs: 6, Instructions: 69pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC4E1
SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC505
GetFileSizeEx.KERNEL32(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC51E
GetStdHandle.KERNEL32(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC543
PeekNamedPipe.KERNEL32(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC581
GetLastError.KERNEL32(?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC58B

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$ErrorHandleLastNamedPeekPipePointerSizeType
String ID:
API String ID: 350669804-0
Opcode ID: 690146e6408ddfdfd0ae4f9a6ee95b96d101c32ddc6db26209460045d70f74fd
Instruction ID: a3c34f5d481c3f0d2c790cf72d91ce97c163e347528a25335a5773b3eb690889
Opcode Fuzzy Hash: 690146e6408ddfdfd0ae4f9a6ee95b96d101c32ddc6db26209460045d70f74fd
Instruction Fuzzy Hash: 1B216635B0CE4E83D7208F56A94013D63A1FB857B4F544271D69D82AE8DFBDD8558700

Function 00007FFE126DBB7C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

Stream Closed, xrefs: 00007FFE126DBCBB
java/lang/IndexOutOfBoundsException, xrefs: 00007FFE126DBCE7
Read error, xrefs: 00007FFE126DBCAA

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID:
String ID: Read error$Stream Closed$java/lang/IndexOutOfBoundsException
API String ID: 0-3079417902
Opcode ID: b919cdb7ea6a395969c2000858ea8e5deca12c23e36e7547955565b69c6b7afa
Instruction ID: 877439e2b27f70f86eb3f30ea9a23529f5881f8173ea8cdde32d5367ae52ed82
Opcode Fuzzy Hash: b919cdb7ea6a395969c2000858ea8e5deca12c23e36e7547955565b69c6b7afa
Instruction Fuzzy Hash: B341C351B09E4E82EA60AB27AD546BE2251BF45FF0F0085B1DD5D437F9EEBCE5468200

Function 00007FF650F0A100 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0A12B
CreateThread.KERNELBASE ref: 00007FF650F0A16C
GetLastError.KERNEL32 ref: 00007FF650F0A17A
CloseHandle.KERNEL32 ref: 00007FF650F0A190
FreeLibrary.KERNEL32 ref: 00007FF650F0A19F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 8d1782677999c9c424b1fb351f0c1c91f7eefa2521cd7a0470e8abf867f4703c
Instruction ID: e7a85c96e9e1287a87d0c2d0eede8a7d5300d4104131775543997fd5bb7f710a
Opcode Fuzzy Hash: 8d1782677999c9c424b1fb351f0c1c91f7eefa2521cd7a0470e8abf867f4703c
Instruction Fuzzy Hash: 23215E75A0EB43A6FE14DF65E420179B3A0AF88B90F4C4435DE4EA3755EE3CE5448A10

Function 00007FFE126D15DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

JVM_UnloadLibrary.JVM ref: 00007FFE126D16D5
__swprintf_l.LIBCMT ref: 00007FFE126D175F

Strings

java/lang/UnsatisfiedLinkError, xrefs: 00007FFE126D176C
unsupported JNI version 0x%08X required by %s, xrefs: 00007FFE126D174E

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: LibraryUnload__swprintf_l
String ID: java/lang/UnsatisfiedLinkError$unsupported JNI version 0x%08X required by %s
API String ID: 1224256548-3689090645
Opcode ID: 032bdd53c57f46e0c819e8f87d449a839100380cca9cc8544c82abfa7b3ce292
Instruction ID: e3fae1ba804bc020b96322ca22bb1f7aac60d21755dc6a53a36a2374f1db1ef2
Opcode Fuzzy Hash: 032bdd53c57f46e0c819e8f87d449a839100380cca9cc8544c82abfa7b3ce292
Instruction Fuzzy Hash: 76515F66608F8E82EB549B23AC203B95351BF89FE4F0850B2DD4E177B9DEBCD4498200

Function 00007FFE126DD5EC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DD5F7
GetConsoleCP.KERNELBASE ref: 00007FFE126DD605

Part of subcall function 00007FFE126D2270: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D22B4

Strings

cp%d, xrefs: 00007FFE126DD60B
ms%d, xrefs: 00007FFE126DD612

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Console__stdio_common_vsprintfmalloc
String ID: cp%d$ms%d
API String ID: 4201459119-683763357
Opcode ID: 8c7e5fa6d43404cb0ba7fbeb1b62cf528e26c1c3a2aad76867fc057f80b3f58c
Instruction ID: c6b406bf67d3fb1236a936f570c064fc4e564e50a6e62d0f2383d4567daa7c75
Opcode Fuzzy Hash: 8c7e5fa6d43404cb0ba7fbeb1b62cf528e26c1c3a2aad76867fc057f80b3f58c
Instruction Fuzzy Hash: FAE04891B05E4F96FE04975368541782351EF14B60F5450B4CD4D073F0DD6CBD898751

Function 00007FF650F14BF4 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF650F14CE4
_get_daylight.LIBCMT ref: 00007FF650F14CF5
_get_daylight.LIBCMT ref: 00007FF650F14D06
_isindst.LIBCMT ref: 00007FF650F14DD1

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 35bb38b4e3f3938f8b072f9e0d0e0bddb89ec7d928382a76bc937e4f81ea9c58
Instruction ID: 6bb435a4339fc5ae9c9ef5d670f54f0fcddf1f19324c6bc42b4f260a10c66169
Opcode Fuzzy Hash: 35bb38b4e3f3938f8b072f9e0d0e0bddb89ec7d928382a76bc937e4f81ea9c58
Instruction Fuzzy Hash: EE51B1B2F0C213AAEB14DB24E9556BC36A5BB84358F580235DE1EA3BD5DE38E4428700

Function 00007FFE14639520 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

JVM_RawMonitorEnter.JVM(?,?,?,00007FFE1463203B), ref: 00007FFE1463956D
JVM_RawMonitorExit.JVM(?,?,?,00007FFE1463203B), ref: 00007FFE146395CA
JVM_RawMonitorExit.JVM(?,?,?,?,00007FFE1463203B), ref: 00007FFE14639695
JVM_RawMonitorEnter.JVM(?,?,?,?,00007FFE1463203B), ref: 00007FFE146396A9

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: Monitor$EnterExit
String ID:
API String ID: 4213081209-0
Opcode ID: 835efab409f85f410f9f62c4ecfaebdec3510304ecba942962157adb7859af42
Instruction ID: f8b6a39851ce59016e8751675eb0494fe4bd76248ee00e0770d07dde07493728
Opcode Fuzzy Hash: 835efab409f85f410f9f62c4ecfaebdec3510304ecba942962157adb7859af42
Instruction Fuzzy Hash: 16412922E08DD145F7558A27998027A6BA1EF86BF8F095071DE0C077AADE39DC4D8B80

Function 00007FF650F0A72C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF650F0A75F
GetFileInformationByHandle.KERNELBASE ref: 00007FF650F0A7C1
GetLastError.KERNEL32 ref: 00007FF650F0A852
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000001,?,00000000,?,00007FF650F0A664), ref: 00007FF650F0A89E

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: dd97e74e6b0e0f1eda76761a9610a4370102fd70fa6b166e4367e24316d0d962
Instruction ID: 9232816a222f36749c26320749a2c5f8bf6290aed4bd5206b0a0c062ee735b6b
Opcode Fuzzy Hash: dd97e74e6b0e0f1eda76761a9610a4370102fd70fa6b166e4367e24316d0d962
Instruction Fuzzy Hash: 8B517C62E0D6429AFB10CF71D4603BD73E1BB48B98F188534DE0AA7789EF38D4428720

Function 00007FFE1320A240 Relevance: 6.1, APIs: 4, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

ctype.LIBCPMT ref: 00007FFE1320A309
std::_Facet_Register.LIBCPMT ref: 00007FFE1320A321
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1320A35C
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1320A36D

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: 7a11b1e22366df953c56bcdb6bf69edafa6fe217a70891a973f310d91d7d0277
Instruction ID: cc12bdc03c0157266367b9b8b98a1829e55534971194638b8aae2ac3d7e5f11f
Opcode Fuzzy Hash: 7a11b1e22366df953c56bcdb6bf69edafa6fe217a70891a973f310d91d7d0277
Instruction Fuzzy Hash: 27417122A08E4289FA11AB27E4401BD6361EBE47B0F6807B5DA5E276F5DF2CE446C300

Function 00007FF650F0A5D8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0A605
CreateFileW.KERNELBASE ref: 00007FF650F0A644
CloseHandle.KERNEL32 ref: 00007FF650F0A679

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8861900786a6d350923476f935a22c4e6ea3a05d3b4e33b9e1015929ed07bad5
Instruction ID: 553c40e8f8a46c44eb52ee9118f9562b4f33900f40d2ddc7c765c3fb511f9699
Opcode Fuzzy Hash: 8861900786a6d350923476f935a22c4e6ea3a05d3b4e33b9e1015929ed07bad5
Instruction Fuzzy Hash: BD418062E1C78393E6108B2095603697260FB947A4F189334EE9E93BD6EF7CE5E08710

Function 00007FFE1463A028 Relevance: 5.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE1463A0A7
memcpy.VCRUNTIME140 ref: 00007FFE1463A16E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A185
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1463A1B1

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: freemallocmemcpymemset
String ID:
API String ID: 603710549-0
Opcode ID: f03465c7582c2204226b11315512dd33ff84e5fdeac7ab5b9082aa910108fa75
Instruction ID: e8260cecf92970997a2993c9df68592caca4d134351af9a82169b3e907af5bfc
Opcode Fuzzy Hash: f03465c7582c2204226b11315512dd33ff84e5fdeac7ab5b9082aa910108fa75
Instruction Fuzzy Hash: 1751D462A18EC185EB218B22A8843AD7B90FB46BE8F440275EA9D077E5DF3CD5099740

Function 00007FFE1463AE18 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463B04D,?,?,?,?,?,?,00000000,00007FFE1463A420,?,?,?,00007FFE1463203B), ref: 00007FFE1463AE52
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463B04D,?,?,?,?,?,?,00000000,00007FFE1463A420,?,?,?,00007FFE1463203B), ref: 00007FFE1463AEB2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1463B04D,?,?,?,?,?,?,00000000,00007FFE1463A420,?,?,?,00007FFE1463203B), ref: 00007FFE1463AED9

Part of subcall function 00007FFE1463AEFC: handleRead.JAVA(?,?,?,00007FFE1463AFA3,?,?,?,00007FFE1463AE71,?,?,?,00007FFE1463B04D), ref: 00007FFE1463AF2C
Part of subcall function 00007FFE1463AEFC: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE1463AFA3,?,?,?,00007FFE1463AE71,?,?,?,00007FFE1463B04D), ref: 00007FFE1463AF44

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: Read_errnofreehandlemallocrealloc
String ID:
API String ID: 2016743971-0
Opcode ID: 16235bb4b5f2ef0e69102319eb5dc957244385377771cf3388e705c1836d7826
Instruction ID: 06565922dfc20457e92e209b60c524aec48a8cd97edfab8104c0aad2b305c293
Opcode Fuzzy Hash: 16235bb4b5f2ef0e69102319eb5dc957244385377771cf3388e705c1836d7826
Instruction Fuzzy Hash: 4F210522E14AE145EB548B2B588007C3AE0EB8AFE9B194271DE5D577A5DE3CD406A380

Function 00007FF650F0A038 Relevance: 4.5, APIs: 3, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650F11738: GetLastError.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F11747
Part of subcall function 00007FF650F11738: SetLastError.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F117E7

CloseHandle.KERNEL32(?,?,?,00007FF650F0A1E5,?,?,?,?,00007FF650F0A029), ref: 00007FF650F0A073
FreeLibraryAndExitThread.KERNELBASE(?,?,?,00007FF650F0A1E5,?,?,?,?,00007FF650F0A029), ref: 00007FF650F0A089
ExitThread.KERNEL32 ref: 00007FF650F0A092

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 576c661495019b550564d0a0eed6664c94331a18011bf5dedf684b0bed68b42e
Instruction ID: f8900c082135f108b7a52a9456f1c9267946b0010852c285e75515e91b274a60
Opcode Fuzzy Hash: 576c661495019b550564d0a0eed6664c94331a18011bf5dedf684b0bed68b42e
Instruction Fuzzy Hash: C0F01421A0DA8761FA155F20C06427C62A4AF40B78F1C0B35CE3E933E4DF79E8448250

Function 00007FF650F02A60 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF650F02A5C), ref: 00007FF650F02A71
TerminateProcess.KERNEL32(?,?,?,00007FF650F02A5C), ref: 00007FF650F02A7C
ExitProcess.KERNEL32 ref: 00007FF650F02A8B

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fa475533fdbe25f7c8a2a99f6e4d0b550e1c05fb8957c012fba4c7ac103fd5aa
Instruction ID: 747a5e9eca1e073e3dca7ec4d54a4cc874db845d51a3335aeff0320b11611359
Opcode Fuzzy Hash: fa475533fdbe25f7c8a2a99f6e4d0b550e1c05fb8957c012fba4c7ac103fd5aa
Instruction Fuzzy Hash: DDD092A0F0C603B2EAA82F7198A617C12156F98741F181838DC4BF7393DD3CF8098360

Function 0000026EA188991A Relevance: 4.3, Strings: 3, Instructions: 528COMMON

Download Yara Rule

Strings

should not reach here, xrefs: 0000026EA1889F9A, 0000026EA188A0E9
+Aif, xrefs: 0000026EA188A203
+Aif, xrefs: 0000026EA1889A20

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID: +Aif$+Aif$should not reach here
API String ID: 0-472377690
Opcode ID: 78216ed1a481af5f78f67b242c718a536b2bf1d38d2790505b91e695fdaf7e5a
Instruction ID: f552ddb3bb245b7aeb6dc412fbb8bb950b12acfc619ff880cb22d1e8e1aecd8c
Opcode Fuzzy Hash: 78216ed1a481af5f78f67b242c718a536b2bf1d38d2790505b91e695fdaf7e5a
Instruction Fuzzy Hash: 7C02DF7082CB884FDB55EF689885659BFF0FB9A340F05469EE488C7293D7349885CB93

Function 0000026EA18899EE Relevance: 4.3, Strings: 3, Instructions: 523COMMON

Download Yara Rule

Strings

should not reach here, xrefs: 0000026EA1889F9A, 0000026EA188A0E9
+Aif, xrefs: 0000026EA188A203
+Aif, xrefs: 0000026EA1889A20

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID: +Aif$+Aif$should not reach here
API String ID: 0-472377690
Opcode ID: c74ef86e3edec47f4ea04f4e50aef4fbbe76a98a61320ace73dc3862cd9ab2dc
Instruction ID: 20884241c207445f1b812cccfab76a01b2b5f82fc028e57d427cf305122c2ced
Opcode Fuzzy Hash: c74ef86e3edec47f4ea04f4e50aef4fbbe76a98a61320ace73dc3862cd9ab2dc
Instruction Fuzzy Hash: 2702DF7082CF888FDB55EF689885759BFE0FB99340F05469EE488C7292D7349885CB83

Function 00007FF650F13158 Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1312B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F196B8

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ad399a528632ccefeec01087826ad95117e0ed9142114db4a24372e653234b86
Instruction ID: 58c19f4e10cd66df264fb92487c9d9f5be4ac0a0984e93f7128d71f8b2336fae
Opcode Fuzzy Hash: ad399a528632ccefeec01087826ad95117e0ed9142114db4a24372e653234b86
Instruction Fuzzy Hash: B651CEB2E1C243A7EA248B29D5602B973A0EF56B50F180130DE9EE77D0CF2DE402C791

Function 00007FF650F0F8F0 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF650F0F969
GetFileType.KERNELBASE ref: 00007FF650F0F97F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 368ab012e90031e9b681492e052ae3b5f14a9a3314ad0890e5ef39e891803059
Instruction ID: 592372e2d3e9fff5eaf505223f0fcce3cf8370a1fc3e127fa44362a947547218
Opcode Fuzzy Hash: 368ab012e90031e9b681492e052ae3b5f14a9a3314ad0890e5ef39e891803059
Instruction Fuzzy Hash: E831B421A1CB43B1DB608B1598A12786650FB45BB0B6C132AEFAFA77E0CF38E555D340

Function 00007FFE126DCB44 Relevance: 3.1, APIs: 2, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FFE126DCBF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DCC05

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CreateFilefree
String ID:
API String ID: 1298414175-0
Opcode ID: 6f527aac095c3d8dfc4c5c78a198494300ee73bf4f9984f8158613252f94d683
Instruction ID: c29a174707325541e7ae08123cb5827cfe03371a909c5d67aa5d974ef18394d0
Opcode Fuzzy Hash: 6f527aac095c3d8dfc4c5c78a198494300ee73bf4f9984f8158613252f94d683
Instruction Fuzzy Hash: DB210B32F14B4947E7548A26FC517A96680A7C4BF4F485738EEBA87BD9CE7CD8044700

Function 00007FFE126D56B8 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FFE126DC662

Strings

close failed, xrefs: 00007FFE126DC66C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CloseHandle
String ID: close failed
API String ID: 2962429428-4025108754
Opcode ID: 808c3758b2db616dfa82520b6060d47331fef75801a850625a138bc25cb7b7d6
Instruction ID: 65cfc1829b2aae20cfa8c0f0b752ec44585ce9e20b291687526a1d15d85778bf
Opcode Fuzzy Hash: 808c3758b2db616dfa82520b6060d47331fef75801a850625a138bc25cb7b7d6
Instruction Fuzzy Hash: E7219D66608F8A81EA049F2399482B87765FB8AFF0B184375DE7D07BE9CF78D4518300

Function 00007FFE126D2660 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FFE126DC662

Strings

close failed, xrefs: 00007FFE126DC66C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CloseHandle
String ID: close failed
API String ID: 2962429428-4025108754
Opcode ID: 26ac8a6394c8d32a9dbc7dee0debfacc2ad9fa924ded00be098d7198dad1e48f
Instruction ID: 35667066ab707e67db4e2d364636a60d80512d01a2a3eb84b1aeeeda37213306
Opcode Fuzzy Hash: 26ac8a6394c8d32a9dbc7dee0debfacc2ad9fa924ded00be098d7198dad1e48f
Instruction Fuzzy Hash: 79218B66608F8A81EA049F2399482B86765FB8AFF0B184275DE7D07BE8CF78D4518300

Function 00007FFE126D2654 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FFE126DC662

Strings

close failed, xrefs: 00007FFE126DC66C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CloseHandle
String ID: close failed
API String ID: 2962429428-4025108754
Opcode ID: 1a26d26ab298a480aafc200953ab2fd1d00b487ebb84e7c1e3831b30d5aaf812
Instruction ID: bd50eae873dd630442559977cedb5843c1f8606fd227dea54b4e554c3ef2dde2
Opcode Fuzzy Hash: 1a26d26ab298a480aafc200953ab2fd1d00b487ebb84e7c1e3831b30d5aaf812
Instruction Fuzzy Hash: 0B215B66608F8A81EA049F2399482B96765EB8AFF0B194275DE7D07BE9CF78D4518300

Function 00007FF650F0A8D4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF650F0A7E9), ref: 00007FF650F0A907
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF650F0A7E9), ref: 00007FF650F0A91D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: fcae231cdd73b0debb8068d542d8f3b0d1c4c004e3c56d9c7fe606b50e2eb898
Instruction ID: 171dd1e42ae85e1f4ef2caaa9440bd819869bd85b6c9b1c1cc45ed590daddc43
Opcode Fuzzy Hash: fcae231cdd73b0debb8068d542d8f3b0d1c4c004e3c56d9c7fe606b50e2eb898
Instruction Fuzzy Hash: 38117072A0C65392EB548B15E42103AB7A0FB85761F640336FE9ED6AE8EF7CD054DB10

Function 00007FFE1463AEFC Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

handleRead.JAVA(?,?,?,00007FFE1463AFA3,?,?,?,00007FFE1463AE71,?,?,?,00007FFE1463B04D), ref: 00007FFE1463AF2C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE1463AFA3,?,?,?,00007FFE1463AE71,?,?,?,00007FFE1463B04D), ref: 00007FFE1463AF44

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: Read_errnohandle
String ID:
API String ID: 3594243491-0
Opcode ID: c8e89788166f6e74e539e673da474fce9018aad71b07dccc9732740ca6886b93
Instruction ID: 415f687faaa9caf1a6bcd72f45af722d5dd21a3307ad73c6929ef8ee44b1188a
Opcode Fuzzy Hash: c8e89788166f6e74e539e673da474fce9018aad71b07dccc9732740ca6886b93
Instruction Fuzzy Hash: 56F0F660F1CDC241EAA04637668003D51905F56BF8F2887B4F97D8ABF5DE3CD44A9740

Function 00007FF650F09FC8 Relevance: 3.0, APIs: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF650F09FD6
ExitThread.KERNEL32 ref: 00007FF650F09FDE

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 40497f098380b03f7054f704791e4846bef56c93343ce3931745d6b65bb82a65
Instruction ID: 2cf665746944039fb757e0d43c46292bfb4ee603e10eb1d9cf19197886f29968
Opcode Fuzzy Hash: 40497f098380b03f7054f704791e4846bef56c93343ce3931745d6b65bb82a65
Instruction Fuzzy Hash: 02F09061E0E64352EF14AB71D42957D22A0AF59B00F0C0834DD1EE33A2DF2CE4048310

Function 00007FFE132184A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132184B4

Part of subcall function 00007FFE1320B690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6B2
Part of subcall function 00007FFE1320B690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6D8
Part of subcall function 00007FFE1320B690: memmove.VCRUNTIME140(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6F0

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132184DE

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: setlocale$freemallocmemmove
String ID:
API String ID: 4085402405-0
Opcode ID: de0bc8ff20c1a892cccc3991225f6002f78959e2e2777f6cb1df57c22036f2db
Instruction ID: 5b46a62817f035b4d7d1101ea54f02d562e43789b7dfefbc8e6e6ef2a0739575
Opcode Fuzzy Hash: de0bc8ff20c1a892cccc3991225f6002f78959e2e2777f6cb1df57c22036f2db
Instruction Fuzzy Hash: 5EF0BB62704F426EEE199F53D5850F96351AFA8B90B4C8039CA0D47764FE3CD158C300

Function 00007FFE14639924 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14639970: CreateFileA.KERNELBASE ref: 00007FFE14639A35

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14639951

Strings

Zip file open error, xrefs: 00007FFE14639957

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: CreateFilefree
String ID: Zip file open error
API String ID: 1298414175-2061581709
Opcode ID: 204675e3895e6ce83d655423ec01342963e5e64d145706d27acd556ba9968046
Instruction ID: 68fb968e26df61764d39beeb5798691c0c5814be946896c5f98a237617ff8f90
Opcode Fuzzy Hash: 204675e3895e6ce83d655423ec01342963e5e64d145706d27acd556ba9968046
Instruction Fuzzy Hash: F1E06516B09F8641FFA55B12B6D167522949F45BECF0C5070DE8D02BA4DE3CD44D8B80

Function 00007FFE126DC6E0 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00007FFE126DC6FA
GetLastError.KERNEL32 ref: 00007FFE126DC704

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 3718ec1d38c06515d1bd92b8cba10d0ce7fc2cd8460585cb5e8bd4367b71e99e
Instruction ID: fb717feb82bb5da2ff64e737ef01b69fb581fb3cd92e36343a31076dbb9afb46
Opcode Fuzzy Hash: 3718ec1d38c06515d1bd92b8cba10d0ce7fc2cd8460585cb5e8bd4367b71e99e
Instruction Fuzzy Hash: B5E01221D1CC4E87E6608B6ADC1433922A0AB55774F641370E2BD815F8DFADDC168700

Function 00007FFE126D12FC Relevance: 2.6, APIs: 2, Instructions: 99COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1381
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1421

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea96da83128c42e822e135967a23310f02ecded808f1f65ec265dc073277ea71
Instruction ID: 01b4b6fde1e805be6c852bf2dff6f71f374a1dd08b8965108ed872e474142554
Opcode Fuzzy Hash: ea96da83128c42e822e135967a23310f02ecded808f1f65ec265dc073277ea71
Instruction Fuzzy Hash: 1131D225709E8986EF20DB13AD507BE6391BF89FE4F4840B1DE8D47BA5CEBCD0418600

Function 00007FF650F0C860 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,000000FF,00007FF650F0C811), ref: 00007FF650F0C8CE
GetLastError.KERNEL32(?,?,000000FF,00007FF650F0C811), ref: 00007FF650F0C8D8

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 92605ca156ea671335eff8a87ea7d6dfe6d0b4b6cab224b239a3edf995b83463
Instruction ID: cfa2f5f9ba6eaab7d201a6dcf4c69a8097aea3ca4577176d73f9b81ae5353192
Opcode Fuzzy Hash: 92605ca156ea671335eff8a87ea7d6dfe6d0b4b6cab224b239a3edf995b83463
Instruction Fuzzy Hash: 8421A161F0C68361FE949761E4A027D12C29F85BA8F0C8235DE2FE77D1CE7CE4498241

Function 00007FFE14639438 Relevance: 2.5, APIs: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1463945C

Part of subcall function 00007FFE14639520: JVM_RawMonitorEnter.JVM(?,?,?,00007FFE1463203B), ref: 00007FFE1463956D
Part of subcall function 00007FFE14639520: JVM_RawMonitorExit.JVM(?,?,?,00007FFE1463203B), ref: 00007FFE146395CA

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14639483

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: Monitorstrlen$EnterExit
String ID:
API String ID: 3007777551-0
Opcode ID: 8f90330bade888d47dce9b4d4b796aee260fbe15d3c76b8391629ea28e5c8aec
Instruction ID: ef20a6640382c7cd15cfd4bd3ecd6ec92ed07a75cce37567e31172b40d51f175
Opcode Fuzzy Hash: 8f90330bade888d47dce9b4d4b796aee260fbe15d3c76b8391629ea28e5c8aec
Instruction Fuzzy Hash: 51F09672708B8141D614CF53B580469A691FB89FD0B088074EF8C47B5ADE3CD4418B40

Function 00007FF650F0D9DC Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0DA62

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 589fbe9e6f8aa97ec2007ac5ed52086db8016a8d071c616c52e93fa5237ed098
Instruction ID: 0b871ad18b99da6b34c3a006202d5c2234aeff70bf898d379f0c412ce673915e
Opcode Fuzzy Hash: 589fbe9e6f8aa97ec2007ac5ed52086db8016a8d071c616c52e93fa5237ed098
Instruction Fuzzy Hash: 1831A126F1CA03A6F7116B5588613BD3690AF80BA4F494235ED2EA33D3DF7CE8428711

Function 00007FF650F02E3C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F02DA4

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1fb5cd5af31717fdc85b5cfa459b4d1dfb60c5c66ce73af9d29daba56db0e6c6
Instruction ID: a6593d6511b762d3cede0a9ac7dda8f40a25e18cc3d0cfc49270df90c08308d5
Opcode Fuzzy Hash: 1fb5cd5af31717fdc85b5cfa459b4d1dfb60c5c66ce73af9d29daba56db0e6c6
Instruction Fuzzy Hash: 5621C061E4D24361FAB69E26B8206BDA5C16F90790F5C1530ED5FE77C5DE3CF8828220

Function 00007FFE14639970 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00007FFE14639A35

Memory Dump Source

Source File: 00000009.00000002.2761468078.00007FFE14631000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000009.00000002.2761443673.00007FFE14630000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761493217.00007FFE1463D000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761518863.00007FFE14644000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2761546449.00007FFE14645000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe14630000_java.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 351d94d2e0ae0e73ba3424eceb3ebbe0a87dfec45fad6345a4680e5acc94a0ed
Instruction ID: d012431732c2384c718a668ff5332c8ee16b60d5403f66fd4508dce2aa6cd19d
Opcode Fuzzy Hash: 351d94d2e0ae0e73ba3424eceb3ebbe0a87dfec45fad6345a4680e5acc94a0ed
Instruction Fuzzy Hash: 1721EB73B14A8547F7548B06E8417A566D2E7D9BD8F0C9234DA4D8BB99CF3CD9098B00

Function 00007FF650F02991 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF650F029BF

Part of subcall function 00007FF650F02AB8: GetModuleHandleExW.KERNEL32 ref: 00007FF650F02ADD
Part of subcall function 00007FF650F02AB8: GetProcAddress.KERNEL32 ref: 00007FF650F02AF3
Part of subcall function 00007FF650F02AB8: FreeLibrary.KERNEL32 ref: 00007FF650F02B1A

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 0a2aac931313355aa1ea3384d5d7464a018c23d17eb13bebea55ad075bad7ca1
Instruction ID: 31be976524d472fa94988487f051d27ba35ca4fc930471b420ea8f50d55550cd
Opcode Fuzzy Hash: 0a2aac931313355aa1ea3384d5d7464a018c23d17eb13bebea55ad075bad7ca1
Instruction Fuzzy Hash: 58215C32B0C6839AEB648F64C8942AC33A0EB0471CF584635DA1EA7B95DF3CE585C750

Function 00007FF650F0C9E0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0CA03

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2524be057f76e80ad9628ae1df1375ae48cea90edfe4af3194bc063c39145db4
Instruction ID: e799beb3d7098928208a6f5af75b5ae422c8b8d183f9532855556b430d1008d1
Opcode Fuzzy Hash: 2524be057f76e80ad9628ae1df1375ae48cea90edfe4af3194bc063c39145db4
Instruction Fuzzy Hash: 24218032A1CA8796DB618F18D46036976A0EB84B98F584234EF5ED77D9DF3CD8018B40

Function 00007FF650F02F00 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F02E6C

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 807caad7f35c5830ed883684cc14c97941b3cbea4634de78d9ced0701cd52c4b
Instruction ID: 6a5e4e98dd385c88d3014c4de549eb017fc116b99fdd23caca22de4b2478cf75
Opcode Fuzzy Hash: 807caad7f35c5830ed883684cc14c97941b3cbea4634de78d9ced0701cd52c4b
Instruction Fuzzy Hash: FA118161E0C64361FEA19E51D4203BDA6A0AF95B80F5C4431EE4EEBB86DF2DF8018750

Function 00007FF650F11DA0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F11DCB

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bb6d7c00368c0dfff8df30a67875cb9e5cb27c1305f2d93c270a130b14179b95
Instruction ID: 948e07328eaca88101be970261eb01910f249fc70c7541957a803da708a52a45
Opcode Fuzzy Hash: bb6d7c00368c0dfff8df30a67875cb9e5cb27c1305f2d93c270a130b14179b95
Instruction Fuzzy Hash: C81188B2A1C643A2F7109B14E4501AAB2A5FB84740F4D0535EE9DE77A2DF3CF8518B40

Function 00007FFE126DD82C Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD8B9

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: _wcsdup
String ID:
API String ID: 3026052805-0
Opcode ID: a3cf7ed0798ec5daa0a4ce5ff54c5d0b888c3d46dcbca9ee90d2a4e5de09a7a4
Instruction ID: 182c973c3a88b9516f08935259dac155abddbe7f444bc55420c608e42e3443f8
Opcode Fuzzy Hash: a3cf7ed0798ec5daa0a4ce5ff54c5d0b888c3d46dcbca9ee90d2a4e5de09a7a4
Instruction Fuzzy Hash: 1B117062A18E4A86FB109B22FC653BA3360FF54B24F401575C65D826F8EF7CE4048704

Function 00007FFE126E834C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFE126E830D

Part of subcall function 00007FFE126E8700: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFE126E871A
Part of subcall function 00007FFE126E8700: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFE126E8786
Part of subcall function 00007FFE126E8700: RaiseException.KERNEL32 ref: 00007FFE126E879A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 773ff7ae73ebe9fc3e15ade4bafa8f4c8769c7bd0d086b0829db98bee486eb13
Instruction ID: 20226867d01e053583e95f39c2c1009b4949d218d574fef2a7529e80d3c35cfd
Opcode Fuzzy Hash: 773ff7ae73ebe9fc3e15ade4bafa8f4c8769c7bd0d086b0829db98bee486eb13
Instruction Fuzzy Hash: 3601DA6291CFC1C2E620CB19F84206AE764FBD9790F105325EFC852E68DFBCC6548B44

Function 00007FFE126E82CE Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__delayLoadHelper2.DELAYIMP ref: 00007FFE126E830D

Part of subcall function 00007FFE126E8700: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FFE126E871A
Part of subcall function 00007FFE126E8700: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFE126E8786
Part of subcall function 00007FFE126E8700: RaiseException.KERNEL32 ref: 00007FFE126E879A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2LoadRaiseRelease__delay
String ID:
API String ID: 1206973476-0
Opcode ID: 0817a665c9e013f36ccefa68424197515d9b0345c2caf64e751cb20553cd9298
Instruction ID: dd79d8ebd59f7f999588d20229e1e659d8bbf195e70f558db4a5465ab595b431
Opcode Fuzzy Hash: 0817a665c9e013f36ccefa68424197515d9b0345c2caf64e751cb20553cd9298
Instruction Fuzzy Hash: 8AF0A86291CFC1C2E620CB59F84206AE764F7D9790F209325EFC852E68DFACC6548B44

Function 00007FFE126DC698 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00007FFE126D25ED), ref: 00007FFE126DC6C3

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: be9dc7904426ec350247320533e370f92a5aca0f2d055046f810045ebce124f5
Instruction ID: 610f4cb27845a29d2de0c0fea2251d58498deae9c14be33d0638cb9cc62124e2
Opcode Fuzzy Hash: be9dc7904426ec350247320533e370f92a5aca0f2d055046f810045ebce124f5
Instruction Fuzzy Hash: F9E0C273F34A9485DF649736FE82F5922406B68774F902F20D83EE2EE0D92DC1458B00

Function 00007FFE13201000 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FFE1324D054

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 45b37ec2bb0f8a4a56d9e8288d7fee9759b84d915821fdc39ea959b37f96572b
Instruction ID: 8a7788de7757250f7c3a5161384eed9afc5e354db3ccb23a2b2ad169fe1f1e8d
Opcode Fuzzy Hash: 45b37ec2bb0f8a4a56d9e8288d7fee9759b84d915821fdc39ea959b37f96572b
Instruction Fuzzy Hash: FBE0C210F28C1BD8F604BB37E8926B40110AFF53A0FD026B1C80EA22B2DD0CA296CB00

Function 00007FFE126D9434 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 00007FFE126D943B

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1f7661fa2fe0b82afe26bf50e4266ff7514997d4385f128f8ea962d51b501674
Instruction ID: 637df6c5fab1f75051847365c15e71c54f68f14ec7419e7659accafbe28c50ec
Opcode Fuzzy Hash: 1f7661fa2fe0b82afe26bf50e4266ff7514997d4385f128f8ea962d51b501674
Instruction Fuzzy Hash: 7DA01108F2280283820C232A2C8202802A0AB8A232FE000A0C00AA23A0CC8C08EA0B00

Function 00007FF650F0EFE8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF650F1179A,?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001), ref: 00007FF650F0F03D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3753acb20c6cd571d5aafc18e5655534a2986022adabe8bfd768f240e50b3248
Instruction ID: fa1f14852d33ee706e53abb74cb59ea18fed4a8eac0db45513532fd51fd20dce
Opcode Fuzzy Hash: 3753acb20c6cd571d5aafc18e5655534a2986022adabe8bfd768f240e50b3248
Instruction Fuzzy Hash: 15F01D94F4D20771FE585B6299722B552955F89B40F4C4430CD0FE7BD2EE6CEA894220

Function 0000026EA189812B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d822f311f9cbbb73736d09bbd0aa89ed7385577088b8080321e18dd2645f79
Instruction ID: f614dff2c22110c0373ee57298356612fd2ea17e031a706d8190b1042411d703
Opcode Fuzzy Hash: 06d822f311f9cbbb73736d09bbd0aa89ed7385577088b8080321e18dd2645f79
Instruction Fuzzy Hash: 57217FB490DF894FD71A5B68A848350BFB0FB57311F06439BD448C71E3EA345898C366

Function 0000026EA188B92C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca9299cef13959714625736e0ce6c9abe6bfe75d19857d062d00b32f5d41ce0
Instruction ID: 34f1767ae6478c0d85adae1dd731aa25b9237b9d9216642d987fe2710388b649
Opcode Fuzzy Hash: 9ca9299cef13959714625736e0ce6c9abe6bfe75d19857d062d00b32f5d41ce0
Instruction Fuzzy Hash: 7221AFB090DF844FDB1E5B28A818350BFB0FB56311F46439BD048C71E3EA345899C356

Function 0000026EA189836C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a21bc223b55983a0a61b96b52dab173694346b9548258dcbc5bce4a19d22de
Instruction ID: e0c7eb6902460302cac2cf8e1ed71904da2e5a9cbcdcc1377368f43a12fb776d
Opcode Fuzzy Hash: 47a21bc223b55983a0a61b96b52dab173694346b9548258dcbc5bce4a19d22de
Instruction Fuzzy Hash: AE21ACB090CF894FDB0A4B28A848350BFB0FB56301F0643ABD048C72E3DB345898C396

Function 0000026EA1895D24 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81beea0dd9c87261c9f4052d8b1fa5f23d1dc35904537fa8500987d54036bdd
Instruction ID: 2519436c158e03589bce111bdc02782efbf9fcdaefa7744196fbdc6380f1c3c2
Opcode Fuzzy Hash: c81beea0dd9c87261c9f4052d8b1fa5f23d1dc35904537fa8500987d54036bdd
Instruction Fuzzy Hash: 8C11A0B091DF894FDB1A5B78A808354BFB0EB56301F0643ABE448C71E3EA385899C356

Function 0000026EA1897008 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da3491355b14c02e5e88455a9bfbc48050e903549586cc7be704808a8ed332c
Instruction ID: c1a6b38e0de9e4efdac4ad23cda4c69e26d99a1f70ab9103097032a56ddd9f7a
Opcode Fuzzy Hash: 7da3491355b14c02e5e88455a9bfbc48050e903549586cc7be704808a8ed332c
Instruction Fuzzy Hash: D61102B491CF884FDB1E5B68A808750BFB0FB56311F1643ABD448C71E3EA385898C796

Function 0000026EA189877A Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616b0ad300d58894364778187f3676bb9c075cec0e360cc8f41aea1b2a4b9fa6
Instruction ID: 89cda27bd6c8e9dfe050911d13aea159c7af87b255c03629e4283f8f716f2279
Opcode Fuzzy Hash: 616b0ad300d58894364778187f3676bb9c075cec0e360cc8f41aea1b2a4b9fa6
Instruction Fuzzy Hash: FF11C2B091CF895FDB1A0B68A848754BFB0FB56301F06439BD448C71E3EA385899C366

Non-executed Functions

Function 00007FFE126D8480 Relevance: 66.8, APIs: 29, Strings: 9, Instructions: 336registrytimeCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FFE126D84D3
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFE126D8548
RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D8586
RegQueryValueExA.ADVAPI32 ref: 00007FFE126D85C4
RegCloseKey.ADVAPI32 ref: 00007FFE126D862E
GetTimeZoneInformation.KERNEL32 ref: 00007FFE126D863F
RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D8671
RegQueryValueExA.ADVAPI32 ref: 00007FFE126D86B4
RegQueryValueExA.ADVAPI32 ref: 00007FFE126D86F0
RegCloseKey.ADVAPI32 ref: 00007FFE126D8724

Part of subcall function 00007FFE126D8258: GetProcAddress.KERNEL32(?,?,00000000,00007FFE126D84FD), ref: 00007FFE126D8285

RegCloseKey.ADVAPI32 ref: 00007FFE126D8776
RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D8799
RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D87C0
RegQueryInfoKeyA.ADVAPI32 ref: 00007FFE126D880D
RegEnumKeyExA.ADVAPI32 ref: 00007FFE126D8858
RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D8885
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D88D2
RegCloseKey.ADVAPI32 ref: 00007FFE126D8A17

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Time Zones, xrefs: 00007FFE126D87B6
DynamicDaylightTimeDisabled, xrefs: 00007FFE126D85BD, 00007FFE126D86AD
TimeZoneKeyName, xrefs: 00007FFE126D860C
TZI, xrefs: 00007FFE126D8904
System\CurrentControlSet\Control\TimeZoneInformation, xrefs: 00007FFE126D8578, 00007FFE126D8667
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones, xrefs: 00007FFE126D878F
,, xrefs: 00007FFE126D88F4
DisableAutoDaylightTimeSet, xrefs: 00007FFE126D86E9
MapID, xrefs: 00007FFE126D89CF

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Open$CloseQuery$Value$AddressEnumInfoInformationProcTimeVersionZonewcscmpwcstombs
String ID: ,$DisableAutoDaylightTimeSet$DynamicDaylightTimeDisabled$MapID$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones$SOFTWARE\Microsoft\Windows\CurrentVersion\Time Zones$System\CurrentControlSet\Control\TimeZoneInformation$TZI$TimeZoneKeyName
API String ID: 1007125062-3802396129
Opcode ID: 021506612136905d8a06103ce8b00fbada07760ddc2702a07b9d242f1711f302
Instruction ID: e81428e66fdae8d550372baceff8e9d7f8d102a4e156567580fb1d9ce568016c
Opcode Fuzzy Hash: 021506612136905d8a06103ce8b00fbada07760ddc2702a07b9d242f1711f302
Instruction Fuzzy Hash: 70F14836A08F4A86E760CF26EC446AE77A4FB84798F400175EA8D47AB8DF7CD545CB40

Function 00007FFE1A4653DC Relevance: 65.4, APIs: 15, Strings: 22, Instructions: 621COMMON

Download Yara Rule

APIs

JVM_GetMethodIxModifiers.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A465455
JVM_IsVMGeneratedMethodIx.JVM(?,?,?,?,?,?), ref: 00007FFE1A4654DE
JVM_GetMethodIxExceptionTableLength.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A4655A6
JVM_GetMethodIxLocalsCount.JVM(?,?,?,?,?,?), ref: 00007FFE1A4655CD
JVM_GetMethodIxArgsSize.JVM(?,?,?,?,?,?), ref: 00007FFE1A465683
JVM_GetMethodIxModifiers.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A4656C5
JVM_IsConstructorIx.JVM(?,?,?,?,?,?), ref: 00007FFE1A4656D7
JVM_GetMethodIxSignatureUTF.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A465714
JVM_GetMethodIxExceptionsCount.JVM(?,?,?,?,?,?), ref: 00007FFE1A4657C5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?), ref: 00007FFE1A4657D5
JVM_GetMethodIxExceptionIndexes.JVM(?,?,?,?,?,?), ref: 00007FFE1A4657F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?), ref: 00007FFE1A46582C

Strings

Fourth operand byte of invokeinterface must be zero, xrefs: 00007FFE1A466389
Illegal target of jump or branch, xrefs: 00007FFE1A466400
Code stops in the middle of instruction starting at offset %d, xrefs: 00007FFE1A465882
Must call initializers using invokespecial, xrefs: 00007FFE1A46634C
invokedynamic bytecode is not supported in this class file version, xrefs: 00007FFE1A4663D3
Illegal dimension argument, xrefs: 00007FFE1A466410
Bad type passed to newarray, xrefs: 00007FFE1A4663F0
Illegal creation of multi-dimensional array, xrefs: 00007FFE1A466430
Illegal local variable number, xrefs: 00007FFE1A46632C
Array with too many dimensions, xrefs: 00007FFE1A464F55, 00007FFE1A466420
Illegal call to internal method, xrefs: 00007FFE1A46635C
Illegal branch in tableswitch, xrefs: 00007FFE1A4663B3
Illegal use of nonvirtual function call, xrefs: 00007FFE1A46636C
Quick instructions shouldn't appear yet., xrefs: 00007FFE1A46633C
Illegal instruction found at offset %d, xrefs: 00007FFE1A465895
Illegal type, xrefs: 00007FFE1A4663E0
Illegal constant pool index, xrefs: 00007FFE1A465413
Non zero padding bytes in switch, xrefs: 00007FFE1A466396
Illegal default target in switch, xrefs: 00007FFE1A4663C3
Unsorted lookup switch, xrefs: 00007FFE1A4663A3
Inconsistent args_size for invokeinterface, xrefs: 00007FFE1A46637C
Empty code, xrefs: 00007FFE1A46586F

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Method$CountExceptionModifiers$ArgsConstructorExceptionsGeneratedIndexesLengthLocalsSignatureSizeTablefreemalloc
String ID: Array with too many dimensions$Bad type passed to newarray$Code stops in the middle of instruction starting at offset %d$Empty code$Fourth operand byte of invokeinterface must be zero$Illegal branch in tableswitch$Illegal call to internal method$Illegal constant pool index$Illegal creation of multi-dimensional array$Illegal default target in switch$Illegal dimension argument$Illegal instruction found at offset %d$Illegal local variable number$Illegal target of jump or branch$Illegal type$Illegal use of nonvirtual function call$Inconsistent args_size for invokeinterface$Must call initializers using invokespecial$Non zero padding bytes in switch$Quick instructions shouldn't appear yet.$Unsorted lookup switch$invokedynamic bytecode is not supported in this class file version
API String ID: 1151877785-1627078881
Opcode ID: 68a94c949df6c63681ecbc1736d54b9f216f4dbe11a711654383428075bc6d47
Instruction ID: bd924d44888b96de7921bd7c625bd637486b354ccbc6afd29fc89b854ff2659d
Opcode Fuzzy Hash: 68a94c949df6c63681ecbc1736d54b9f216f4dbe11a711654383428075bc6d47
Instruction Fuzzy Hash: F2320872B08A8246EB289B2A94542B963B1BF44FA4F1441F7DE7D43BB5DF3CE4618740

Function 00007FF650F0541C Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F05753
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F059B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F05C79
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F05F19
memcpy_s.LIBCPMT ref: 00007FF650F06126
memcpy_s.LIBCPMT ref: 00007FF650F061C2
memcpy_s.LIBCPMT ref: 00007FF650F0667A
memcpy_s.LIBCPMT ref: 00007FF650F066B5
memcpy_s.LIBCPMT ref: 00007FF650F067E1
memcpy_s.LIBCPMT ref: 00007FF650F06908
memcpy_s.LIBCPMT ref: 00007FF650F069B3
memcpy_s.LIBCPMT ref: 00007FF650F069FB
memcpy_s.LIBCPMT ref: 00007FF650F06A25
memcpy_s.LIBCPMT ref: 00007FF650F06AD6
memcpy_s.LIBCPMT ref: 00007FF650F06CD6
memcpy_s.LIBCPMT ref: 00007FF650F06D1B
memcpy_s.LIBCPMT ref: 00007FF650F06DD2
memcpy_s.LIBCPMT ref: 00007FF650F06EFF
memcpy_s.LIBCPMT ref: 00007FF650F065CA

Part of subcall function 00007FF650F08588: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F085BA

memcpy_s.LIBCPMT ref: 00007FF650F06645
memcpy_s.LIBCPMT ref: 00007FF650F070B9

Strings

, xrefs: 00007FF650F06FAC
, xrefs: 00007FF650F06E7F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: b3e61ec1c0bebdcd4ca5d1b03d1a92ab612b9a8304382151be96c94c201f6ec3
Instruction ID: 5c98dd0370086755c15b61dcdba3b073d9df739796fa60ace9bdb5036889d2ec
Opcode Fuzzy Hash: b3e61ec1c0bebdcd4ca5d1b03d1a92ab612b9a8304382151be96c94c201f6ec3
Instruction Fuzzy Hash: 3403A472A1C2839BE7758E25D9607FA3795FB44788F585135DE0AA7B84DF39EA00CB00

Function 00007FFE126DD644 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 115stringfileCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DD66F
GetLocaleInfoA.KERNEL32 ref: 00007FFE126DD692
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFE126DD6A5
strcpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD6F0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD716
MultiByteToWideChar.KERNEL32 ref: 00007FFE126DD747
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD773
IsValidCodePage.KERNEL32 ref: 00007FFE126DD782
GetWindowsDirectoryA.KERNEL32 ref: 00007FFE126DD798
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD7A9
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD7B6
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD7CF
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126DD7E0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126DD7EE
strcpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DD7FE

Strings

GBK, xrefs: 00007FFE126DD6E6, 00007FFE126DD769
\FONTS\SimSun18030.ttc, xrefs: 00007FFE126DD7A2, 00007FFE126DD7C3
MS950_HKSCS_XP, xrefs: 00007FFE126DD75D
MS950, xrefs: 00007FFE126DD70C
UTF-8, xrefs: 00007FFE126DD6FE
GB18030, xrefs: 00007FFE126DD6DD, 00007FFE126DD7F4

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcmpstrcpystrlen$ByteCharCodeDirectoryInfoLocaleMultiPageValidWideWindowsatoifclosefopenmallocstrcat
String ID: GB18030$GBK$MS950$MS950_HKSCS_XP$UTF-8$\FONTS\SimSun18030.ttc
API String ID: 2845657969-259244653
Opcode ID: d654ca017417d3e2398b60b9880c537f44fc8f6dea5e73cc364abc6681f433b4
Instruction ID: 14c401b7f806745cff47944ab4b88a835618e81a7245317d08e74a1a4476f878
Opcode Fuzzy Hash: d654ca017417d3e2398b60b9880c537f44fc8f6dea5e73cc364abc6681f433b4
Instruction Fuzzy Hash: BE515221E0DE4A82FA20DB17EC502B92361EF64BA0F5440B5D98D876F4EFEDE945C741

Function 00007FFE1323A39E Relevance: 34.3, APIs: 16, Strings: 3, Instructions: 1053COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FFE1323A549
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1323A55D

Strings

ios_base::failbit set, xrefs: 00007FFE1323A517, 00007FFE1323A72B, 00007FFE1323A77F, 00007FFE1323A92F, 00007FFE1323AB43, 00007FFE1323AD57, 00007FFE1323ADAB, 00007FFE1323AF5B, 00007FFE1323B16F, 00007FFE1323B383, 00007FFE1323B3D0, 00007FFE1323B3D1
ios_base::eofbit set, xrefs: 00007FFE1323A51E, 00007FFE1323A732, 00007FFE1323A936, 00007FFE1323AB4A, 00007FFE1323AD5E, 00007FFE1323AF62, 00007FFE1323B176, 00007FFE1323B38A
ios_base::badbit set, xrefs: 00007FFE1323A50C, 00007FFE1323A720, 00007FFE1323A924, 00007FFE1323AB38, 00007FFE1323AD4C, 00007FFE1323AF50, 00007FFE1323B164, 00007FFE1323B378

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: a54cee33b44168558c5cb967e45710e18166b4d6495f0e29b40998f8c5ba6aed
Instruction ID: 861721139bb9576479009e82548d70580d7dc5c654759790b053543287c587d4
Opcode Fuzzy Hash: a54cee33b44168558c5cb967e45710e18166b4d6495f0e29b40998f8c5ba6aed
Instruction Fuzzy Hash: 1CA27A62609F8585EB14DF1AE4902A9B760FBD9FA4F048136DA8D53BB5EF7CD44AC300

Function 00007FF650F17954 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF650F179A2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1800E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F18184
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F18442
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F18662
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F1889F
memcpy_s.LIBCPMT ref: 00007FF650F1897A
memcpy_s.LIBCPMT ref: 00007FF650F18A25
memcpy_s.LIBCPMT ref: 00007FF650F18AF4

Strings

1#INF, xrefs: 00007FF650F17ACB
1#IND, xrefs: 00007FF650F17A8F
1#SNAN, xrefs: 00007FF650F17AB2
1#QNAN, xrefs: 00007FF650F17ABB

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c44fc3645e5a50f8493876a8545964e1f3f00bd04bc6894b6d3713a5ede2e846
Instruction ID: 6ced4497718180dc964c27610a62dbc77806423d4de967667aa0e4f77eefe53f
Opcode Fuzzy Hash: c44fc3645e5a50f8493876a8545964e1f3f00bd04bc6894b6d3713a5ede2e846
Instruction Fuzzy Hash: E6B2C1B2A1C2939BE7658E64E6407FD37A1FB54388F585135DE0DA7B84DF38EA018B40

Function 00007FFE126D4FE8 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFE126D5012

Part of subcall function 00007FFE126D4BDC: FormatMessageW.KERNEL32(?,?,?,?,?,?,CreatePipe,00007FFE126D502F), ref: 00007FFE126D4C06

swprintf_s.PGOCR ref: 00007FFE126D5058

Part of subcall function 00007FFE126D4F94: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D4FD0

Part of subcall function 00007FFE126E8B8C: __report_securityfailure.LIBCMT ref: 00007FFE126E8B95

swprintf_s.PGOCR ref: 00007FFE126D506A
WideCharToMultiByte.KERNEL32 ref: 00007FFE126D50A4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D5174
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D51F2
VerifyFixClassname.VERIFY ref: 00007FFE126D522E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D5262
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D526B

Strings

Secondary error while OS message extraction, xrefs: 00007FFE126D50AA
CreatePipe, xrefs: 00007FFE126D5113
%s failed, error=%d, xrefs: 00007FFE126D505F
%s error=%d, %s, xrefs: 00007FFE126D504D

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freemallocswprintf_s$ByteCharClassnameErrorFormatLastMessageMultiVerifyWide__report_securityfailure__stdio_common_vswprintf
String ID: %s error=%d, %s$%s failed, error=%d$CreatePipe$Secondary error while OS message extraction
API String ID: 1318136-453967788
Opcode ID: f064ba1c8de9593d6d020e63d361c9106d9199b8034e5b774d65a6c2262569ca
Instruction ID: 1a15e91135902cfeb09187a3e03a202d033ecd198ae30e7f4172522cd0ced4fe
Opcode Fuzzy Hash: f064ba1c8de9593d6d020e63d361c9106d9199b8034e5b774d65a6c2262569ca
Instruction Fuzzy Hash: A9718025A08F8986EB24DB27EC503BA6391FF88BA4F444171DE8D43BA5DFBCD5458740

Function 00007FFE126D4C54 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 189processCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFE126D4CE5
GetStdHandle.KERNEL32 ref: 00007FFE126D4CF4
GetStdHandle.KERNEL32 ref: 00007FFE126D4D06
GetHandleInformation.KERNEL32 ref: 00007FFE126D4D28
SetHandleInformation.KERNEL32 ref: 00007FFE126D4D53
GetConsoleWindow.KERNEL32 ref: 00007FFE126D4E11
CreateProcessW.KERNEL32 ref: 00007FFE126D4E84
CloseHandle.KERNEL32 ref: 00007FFE126D4EA9
SetHandleInformation.KERNEL32 ref: 00007FFE126D4F0B

Strings

CreateProcess, xrefs: 00007FFE126D4E8E

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Handle$Information$CloseConsoleCreateProcessWindow
String ID: CreateProcess
API String ID: 202648973-963392458
Opcode ID: 198519749e018c4542805de7987c3811d16b76cd85573b09d1d31bc8a8ce33a8
Instruction ID: c3ce6f5ea4280afc3a1f2d509e87baaf91cb332b66429fe7e23d4f01c0f1c649
Opcode Fuzzy Hash: 198519749e018c4542805de7987c3811d16b76cd85573b09d1d31bc8a8ce33a8
Instruction Fuzzy Hash: E5817132A04F898AE7508F76DC402ED2761FB447B8F404275EE9D56AE8DFB8D845C740

Function 00007FFE13213410 Relevance: 16.7, APIs: 8, Strings: 1, Instructions: 984COMMON

Download Yara Rule

Strings

0123456789-+Ee, xrefs: 00007FFE13213575, 00007FFE132137BD, 00007FFE13213A52, 00007FFE13213C10, 00007FFE1321402A

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID:
String ID: 0123456789-+Ee
API String ID: 0-1347306980
Opcode ID: 2a5e06a1adac9b42b7c28ebf5c26845d02698c37de2a44bfbb92993eb66f60f2
Instruction ID: 5a7f7995f8d33baa65a388e9cce83c44f35c337846b5599d52528e1b3ba34bc9
Opcode Fuzzy Hash: 2a5e06a1adac9b42b7c28ebf5c26845d02698c37de2a44bfbb92993eb66f60f2
Instruction Fuzzy Hash: FC92B322B0DE818DEB14AB27C25027D2BA2AFA1BA4F5441B1DF5D277B6DF2DE455C300

Function 00007FFE132140E0 Relevance: 15.0, APIs: 7, Strings: 1, Instructions: 1022COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FFE1321455A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13214745
memchr.VCRUNTIME140 ref: 00007FFE13214834
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132148DB
memchr.VCRUNTIME140 ref: 00007FFE13214A24
memchr.VCRUNTIME140 ref: 00007FFE13214D3B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13214DD7

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FFE13214210, 00007FFE13214595, 00007FFE132147D2, 00007FFE132149C4, 00007FFE13214CD9

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: memchr$_invalid_parameter_noinfo_noreturn$localeconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 2141594249-3606100449
Opcode ID: 1b5687b207f4c3ef9572bd8424db7714914aef374c84d11e2037f835debd3264
Instruction ID: edbc71be7b204ecb25d2544d9fdbbe94f925cf89b7313ace2fe790e91f096eef
Opcode Fuzzy Hash: 1b5687b207f4c3ef9572bd8424db7714914aef374c84d11e2037f835debd3264
Instruction Fuzzy Hash: AFA2A122A0CE868DEB14AB27C25027D27B1ABE1BA4F5481B1DE5D377B6DF2DE455C300

Function 00007FF650EF878F Relevance: 14.5, Strings: 11, Instructions: 726COMMON

Download Yara Rule

Strings

R?, xrefs: 00007FF650EF8697
invalid distance code, xrefs: 00007FF650EF8FD4
invalid distance too far back, xrefs: 00007FF650EF9085
invalid bit length repeat, xrefs: 00007FF650EF8B24, 00007FF650EF8B30
invalid literal/lengths set, xrefs: 00007FF650EF8BBB
H?, xrefs: 00007FF650EF9103
invalid code lengths set, xrefs: 00007FF650EF889E
too many length or distance symbols, xrefs: 00007FF650EF88AA
invalid literal/length code, xrefs: 00007FF650EF8E1E
invalid code -- missing end-of-block, xrefs: 00007FF650EF8B5D
invalid distances set, xrefs: 00007FF650EF8C1D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: H?$R?$invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-1223343669
Opcode ID: edd6f6c09ab6b1ed7d4bb6f1af445cb1d79257c06667f10ce54f7715aa185b4f
Instruction ID: e4de38166e65193f30ab3c70912e269444e5dda8d1c027fc07b419c964e1d440
Opcode Fuzzy Hash: edd6f6c09ab6b1ed7d4bb6f1af445cb1d79257c06667f10ce54f7715aa185b4f
Instruction Fuzzy Hash: 1D52B172B046639BE718CE24E5406BC37AAF784748F284239DE5AE7788DF38D984C750

Function 00007FFE132332B8 Relevance: 11.2, APIs: 7, Instructions: 659COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1323356C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE132335D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13233653

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6e9f264266f81638ed93c892ea1a7bf8ecafffbcce5fe915574c902dbb99e0d2
Instruction ID: 25c5b9a20f91364b334abdf1f08b953988c623e477a7f18fc2973d4ce0ecba92
Opcode Fuzzy Hash: 6e9f264266f81638ed93c892ea1a7bf8ecafffbcce5fe915574c902dbb99e0d2
Instruction Fuzzy Hash: 0E52B362B08F9589FB11AB6AD4441BD6770FBA9BA8F044171DF4D23BA5EF38D645C300

Function 00007FF650EF6640 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,-00000008,00000000,00000000,00000105,00000000), ref: 00007FF650EF6677
FormatMessageA.KERNEL32 ref: 00007FF650EF66A2
MessageBoxA.USER32 ref: 00007FF650EF67A6
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF67F7
LocalFree.KERNEL32(?,?,00000000,-00000008,00000000,00000000,00000105,00000000), ref: 00007FF650EF6805

Strings

Java Virtual Machine Launcher, xrefs: 00007FF650EF679A

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Message$ErrorFormatFreeLastLocalfwprintf
String ID: Java Virtual Machine Launcher
API String ID: 3630131139-898708411
Opcode ID: 3aa54cff73404e75af5f7de182ef90a82b52d63296d06c8bbc32c58b32fc2909
Instruction ID: 4b3aa0c51187db7972bd3efb4549436fb7c9b491e2f95cf489f4f9aba95ac575
Opcode Fuzzy Hash: 3aa54cff73404e75af5f7de182ef90a82b52d63296d06c8bbc32c58b32fc2909
Instruction Fuzzy Hash: B351E362A0C653A6FB24DB61E8517BD26A4FB89B88F58453ADE4EA7781DF3CD0018310

Function 00007FF650EF79F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00000000,?,00007FF650EF763D,?,?,?,00007FF650EF79A3,?,?,?,00007FF650EF3CE4), ref: 00007FF650EF7A44
FindNextFileA.KERNEL32(?,00007FF650EF763D,?,?,?,00007FF650EF79A3,?,?,?,00007FF650EF3CE4), ref: 00007FF650EF7A8F
strchr.LIBVCRUNTIME ref: 00007FF650EF7AF1
FindClose.KERNEL32(?,00007FF650EF763D,?,?,?,00007FF650EF79A3,?,?,?,00007FF650EF3CE4), ref: 00007FF650EF7B8B

Strings

jar, xrefs: 00007FF650EF7AC5
JAR, xrefs: 00007FF650EF7AD5

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Find$File$CloseFirstNextstrchr
String ID: JAR$jar
API String ID: 872531559-1396542530
Opcode ID: f0573fde57629eec75e4fceecd91344edf1575764ec6e0d388a6346049599583
Instruction ID: 8946bf4e7319fba6c32fddd342598014e743f19066bfe9788272e6cb846c2ae8
Opcode Fuzzy Hash: f0573fde57629eec75e4fceecd91344edf1575764ec6e0d388a6346049599583
Instruction Fuzzy Hash: 8A51D032A0CA53A5EA14DF22F9901BD7354AB44B90F9D8434DE9E97392EE3CE106C700

Function 00007FFE126D9C34 Relevance: 10.6, APIs: 7, Instructions: 94fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FFE126D9C89
GetLastError.KERNEL32 ref: 00007FFE126D9CD0
FindFirstFileW.KERNEL32 ref: 00007FFE126D9CE6
wcsrchr.VCRUNTIME140 ref: 00007FFE126D9D1B
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D9D43
FindClose.KERNEL32 ref: 00007FFE126D9D73
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9D7C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastfreewcscmpwcsrchr
String ID:
API String ID: 1804246891-0
Opcode ID: 5d857f27a5163685866b547434ffcfa2b811344f5848cf3e8951be4bde255f61
Instruction ID: 1ba59bff8d9fa44085faa7f0efabcf560e739ee459498410431aca438db055e8
Opcode Fuzzy Hash: 5d857f27a5163685866b547434ffcfa2b811344f5848cf3e8951be4bde255f61
Instruction Fuzzy Hash: F5416621F09E498AEB20CB27D94027D63A1BB487F4F540270DE9E57BE8DFBCE9458600

Function 00007FF650F0ECB4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF650F0ED2D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF650F0ED45
RtlVirtualUnwind.KERNEL32 ref: 00007FF650F0ED80
IsDebuggerPresent.KERNEL32 ref: 00007FF650F0EDB9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF650F0EDC3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF650F0EDCE

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 02caacaf8abf0deac1f9656b03262357833ed45479890a23037d7611336d95cb
Instruction ID: fb9efdd405ac54225724a875db6b57edb966898cb87c942745dfbca6ad564c90
Opcode Fuzzy Hash: 02caacaf8abf0deac1f9656b03262357833ed45479890a23037d7611336d95cb
Instruction Fuzzy Hash: 8A31603661CB82A6EB64CF25E8402AE73A4FB88754F580136EE9D93B59DF3CD155CB00

Function 00007FFE126D9448 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FFE126D9480
CryptAcquireContextA.ADVAPI32 ref: 00007FFE126D94A4
CryptGenRandom.ADVAPI32 ref: 00007FFE126D94E6
CryptReleaseContext.ADVAPI32 ref: 00007FFE126D9512

Strings

J2SE, xrefs: 00007FFE126D9462, 00007FFE126D9498

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: J2SE
API String ID: 685801729-1696787763
Opcode ID: 28837a239f2bff6b3766a984ad2b0d8feece9e938f76cd695256cac5190819ba
Instruction ID: c0676fbe88a5a82ca909589a2eb411c79fefb41db95971156ebe72b118450bfb
Opcode Fuzzy Hash: 28837a239f2bff6b3766a984ad2b0d8feece9e938f76cd695256cac5190819ba
Instruction Fuzzy Hash: 95219076714B5582EB10CF13E954A6A67A1FB88FE4F444071CE4D43B64DE7CD509CB00

Function 00007FF650EF7F95 Relevance: 6.7, Strings: 5, Instructions: 421COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00007FF650EF7F12
unknown header flags set, xrefs: 00007FF650EF7FD8
R?, xrefs: 00007FF650EF8697
??, xrefs: 00007FF650EF849D
header crc mismatch, xrefs: 00007FF650EF843F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: ??$R?$header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-3224737733
Opcode ID: dc188b1ce2de7fa26f2ad8b6727475f3e53927dbebb6c655d38408b18cd24f43
Instruction ID: ed4e46e4979fccfb7a25c1a0c639759baf658127d1d92d89acee0046ef963fde
Opcode Fuzzy Hash: dc188b1ce2de7fa26f2ad8b6727475f3e53927dbebb6c655d38408b18cd24f43
Instruction Fuzzy Hash: 0C02AFB3A046629AEB25CF25D14427C37A5FB44B88F294539DE4DA7798DF38E980C740

Function 00007FFE126DA5A8 Relevance: 6.0, APIs: 4, Instructions: 44fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FFE126DA5D9
GetLastError.KERNEL32 ref: 00007FFE126DA5F3
FindFirstFileW.KERNEL32 ref: 00007FFE126DA606
FindClose.KERNEL32 ref: 00007FFE126DA626

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLast
String ID:
API String ID: 1980345056-0
Opcode ID: 9fe644bad4dc12992496b50de58b337e44fe6d33966a12247e26b73c644cc1ae
Instruction ID: 28d919be949843470e6136a7487beccb4df2912e5194031efab5aad72e10e18e
Opcode Fuzzy Hash: 9fe644bad4dc12992496b50de58b337e44fe6d33966a12247e26b73c644cc1ae
Instruction Fuzzy Hash: 60115125B0CE8986EB20DB66A88427E7351BF88BB0F5447B0D9AD437E5CFBCD8458740

Function 00007FFE1A46280C Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 472COMMON

Download Yara Rule

APIs

JVM_GetMethodIxExceptionTableLength.JVM(?,?,?,?,?,?,00000000,?,?,00000000,?,00000001,00007FFE1A464AE9), ref: 00007FFE1A462BBE

Strings

Multiple returns to single jsr, xrefs: 00007FFE1A462B51
Illegal return from subroutine, xrefs: 00007FFE1A462B61

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: ExceptionLengthMethodTable
String ID: Illegal return from subroutine$Multiple returns to single jsr
API String ID: 400656622-4078859611
Opcode ID: 65db3d556288adcf74e2a32041685ef858da5c736517a0827d3f850334309b05
Instruction ID: c05dedab48ede52cfb53350720e2b1003971ea8157d8107e6e7e9c482ab38bc9
Opcode Fuzzy Hash: 65db3d556288adcf74e2a32041685ef858da5c736517a0827d3f850334309b05
Instruction Fuzzy Hash: EA12AB72B08B919AEB248F56D4446BD37B1FB48FA8F1041B6DE5D47BA4DB38E452CB00

Function 00007FF650EF7E28 Relevance: 5.2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00007FF650EF7F12
incorrect header check, xrefs: 00007FF650EF7F7E
invalid window size, xrefs: 00007FF650EF7F75
??, xrefs: 00007FF650EF933B

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: ??$incorrect header check$invalid window size$unknown compression method
API String ID: 0-2304039700
Opcode ID: 5262b3f1c262a49862854fadb96fa6416d466344f4cb9e846b9aaaa866ec3d04
Instruction ID: 0245976c1d0cba086f40a65da439df1c03a70480b79094f8c02e44f87442e186
Opcode Fuzzy Hash: 5262b3f1c262a49862854fadb96fa6416d466344f4cb9e846b9aaaa866ec3d04
Instruction Fuzzy Hash: 90919272A182639BE764CF39D44467C36A9FB44B58F294139DE89A77C4DF38E940CB40

Function 00007FF650F13950 Relevance: 5.0, APIs: 3, Instructions: 461stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FF650F1398C

Part of subcall function 00007FF650F0EFA0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF650F0EF7F,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F0EFA9
Part of subcall function 00007FF650F0EFA0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF650F0EF7F,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F0EFCE

wcschr.LIBVCRUNTIME ref: 00007FF650F13CE8

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessorstrchrwcschr
String ID:
API String ID: 4050513513-0
Opcode ID: 91c26da0f45d737209db68c7a5483a167f55d11f77b43adf27cc8ed3c65646c8
Instruction ID: 1a575efb96416f7cc4675f10ee38b634e27a8c651b0390a5d9091970a18c54fe
Opcode Fuzzy Hash: 91c26da0f45d737209db68c7a5483a167f55d11f77b43adf27cc8ed3c65646c8
Instruction Fuzzy Hash: E602EEA1F0D747A1FE64AB11E4212B92694AF44BA0F4C4635DD6EF77D2EE3DE4018340

Function 00007FF650F07350 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF650F073B6
memcpy_s.LIBCPMT ref: 00007FF650F073E1

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: c4b254260b794a4fdcf68fbdf210bf02d875c904a59c5109986706b174881dba
Instruction ID: 595959b6b1422057b6c9d992e970d652dde77faa82f7743d5fc224dd73bbbe28
Opcode Fuzzy Hash: c4b254260b794a4fdcf68fbdf210bf02d875c904a59c5109986706b174881dba
Instruction Fuzzy Hash: 7FC1C372B1C78697E724CF19A25866AB7A1F784B84F489135DF4BA3B44DE3DE801CB40

Function 00007FFE126D9DAC Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetVolumePathNameW.KERNEL32 ref: 00007FFE126D9DF5
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FFE126D9E13
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9E41

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: DiskFreeNamePathSpaceVolumefree
String ID:
API String ID: 3740045719-0
Opcode ID: 0f67cf1237a74afbd49758cf6668c80eaadac0aa4104bef80a6524aaee190314
Instruction ID: 83ef636df3f385fa4b3909f26385c3117047c37636568b8157b2d1d66a28672b
Opcode Fuzzy Hash: 0f67cf1237a74afbd49758cf6668c80eaadac0aa4104bef80a6524aaee190314
Instruction Fuzzy Hash: 5E117521A0CE8982EA60CB33E8442AA6361FF88BA4F554175DACD037B8CF7CD9058740

Function 00007FF650F0FED4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF650F10216

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 284741088b524781262a6674b342e95cd5e7370ce7c2a291f9ce45d6c5b3487c
Instruction ID: 0ad87082c6f68c124952b8ce24f5dd5bf20d5ecf83ea20a993ddb5bccaf59180
Opcode Fuzzy Hash: 284741088b524781262a6674b342e95cd5e7370ce7c2a291f9ce45d6c5b3487c
Instruction Fuzzy Hash: 5AA144A2B0C7C796EB21CB25E4107AA7B91AB65B84F088132DE8DA7785DE7DD501C700

Function 00007FFE13232AE0 Relevance: 3.5, APIs: 2, Instructions: 497COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13230A80: std::_Locinfo::_Locinfo.LIBCPMT ref: 00007FFE13230B0A
Part of subcall function 00007FFE13230A80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13230B8D

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

_Gettnames.API-MS-WIN-CRT-TIME-L1-1-0(?,?,0000003F,00000000), ref: 00007FFE132331BB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000003F,00000000), ref: 00007FFE132331C7

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: GettnamesLocinfoLocinfo::__invalid_parameter_noinfo_noreturn_lock_localesfreestd::_
String ID:
API String ID: 2687532069-0
Opcode ID: 669bfab655bfa340165cac930cc5320ca9d16efe882350b10353a874cd6c0f73
Instruction ID: 7e860828917e92a82af623768898df5d1d32361550ff00aa621c249afcb35031
Opcode Fuzzy Hash: 669bfab655bfa340165cac930cc5320ca9d16efe882350b10353a874cd6c0f73
Instruction Fuzzy Hash: 4B323F21E09F1A88EB40BB13E8401B573A5AFE97A4B5845B6D90E673B5DE3CF581C380

Function 00007FF650F1C868 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF650F1CAB7
RaiseException.KERNEL32 ref: 00007FF650F1CAC8

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 0884517145abd17397860958173845fcd39d82d40d4cc49c055fbc14753fd1cb
Instruction ID: d69c97d97f890076a5b4109833b2bfcca51ae14a5e9fd69b4b701f9a199f6a5f
Opcode Fuzzy Hash: 0884517145abd17397860958173845fcd39d82d40d4cc49c055fbc14753fd1cb
Instruction Fuzzy Hash: C2B12AB3A08B8A8AE715CF29C8863687BA0F784B5CF198921DF5D937A4CF39D451C740

Function 00007FF650F10368 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

e+000, xrefs: 00007FF650F10475
gfff, xrefs: 00007FF650F104F2

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 7345b038b39b10582f44c610f2b89c3505016a56afdd04efb44f21c2e443a62e
Instruction ID: 809bf0a329c1203e990e30d8d4578df368654382286d591fb2d3fb189091506a
Opcode Fuzzy Hash: 7345b038b39b10582f44c610f2b89c3505016a56afdd04efb44f21c2e443a62e
Instruction Fuzzy Hash: 69515962B1C2C756E724CE35E8407697B91E744B94F4C8235CFA887BC5DEBDD4408700

Function 0000026EA1897240 Relevance: 2.3, Strings: 1, Instructions: 1006COMMON

Download Yara Rule

Strings

should not reach here, xrefs: 0000026EA1897B3E, 0000026EA1897C74

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID: should not reach here
API String ID: 0-515530660
Opcode ID: 6e7bc7898b7be98630effe73c66aab7aecacd6ac127a082dda8e834f1a882b05
Instruction ID: 4f789af678ca980ca77e52e67e5721fa0a9b47e3e35eefd9ced5031edf80acbc
Opcode Fuzzy Hash: 6e7bc7898b7be98630effe73c66aab7aecacd6ac127a082dda8e834f1a882b05
Instruction Fuzzy Hash: C572FE34428F0D8FEF68AFA8D889799B7E0FB14310F558699D494871D2E7359C81CF82

Function 00007FFE1322816C Relevance: 2.0, APIs: 1, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c37a8791c92a800a5254a4f4fa4a9051128f0941c607519f7520e2254ece187
Instruction ID: ce58d1bc6a79c38a27eaed873f75c19b57333559b9ca500e03dae3eab162e13b
Opcode Fuzzy Hash: 0c37a8791c92a800a5254a4f4fa4a9051128f0941c607519f7520e2254ece187
Instruction Fuzzy Hash: 47328522F18E9589EB209F6AE8441BD6770FBA4B58F454171EE8D23769EF7CD541C300

Function 00007FFE13228950 Relevance: 2.0, APIs: 1, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72af18d3878dc5f958364873e1181f861dcf7d3dff00c9b8ecb34c2b4cae1f10
Instruction ID: 9da0f4f963ef0133d4fd92b058f109798ec09c930a3c43452aa8e1dc338ceeab
Opcode Fuzzy Hash: 72af18d3878dc5f958364873e1181f861dcf7d3dff00c9b8ecb34c2b4cae1f10
Instruction Fuzzy Hash: A732A322F18E9589EB209F2AE8441BD67B0FBA4B98F454171EE4D23B79EF78D545C300

Function 00007FF650F15310 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfaba65afa451b203e9ec3540cae4af75cc50a6bcd11410df5a15e7a392510c
Instruction ID: ab99573903b62340c7f0a28e7e026e7e165208f1a75d1044321063f12a22cbf0
Opcode Fuzzy Hash: 5dfaba65afa451b203e9ec3540cae4af75cc50a6bcd11410df5a15e7a392510c
Instruction Fuzzy Hash: 5151D662B0C782A5FB209B72E8505AE7BA1EB44BD4F584135EE5DB7B95CE3CD101C700

Function 00007FFE1A462F24 Relevance: 1.5, APIs: 1, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea1a0b395c6870aa13248e4166ad45f10b5b0abee4621415056bbe1610f58cc
Instruction ID: 17f63cc1bb2baceb9ebd566dfa369ec4e2afccbe6628a19f79de73d5f4799f78
Opcode Fuzzy Hash: 0ea1a0b395c6870aa13248e4166ad45f10b5b0abee4621415056bbe1610f58cc
Instruction Fuzzy Hash: E2C1D172B08AD186DB60CF2694446BA7BA0FB84FE4F044176DEAD47B98DF39E451C700

Function 00007FF650F16FAC Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF650F16FB0

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0699566233b6e1bdcf0995a478f18ca5decb1328aecb9714f0da28c8ba0185eb
Instruction ID: 24dccf419dc8ac7eeb9c2053668131a66ab9ced5eb305277804d9c203f869d23
Opcode Fuzzy Hash: 0699566233b6e1bdcf0995a478f18ca5decb1328aecb9714f0da28c8ba0185eb
Instruction Fuzzy Hash: 02B09260E0BA47D2EA482B12AC8222422A47F48710F9C4039C80CA3320DE2CA0E94B11

Function 00007FFE126E6B90 Relevance: .7, Instructions: 746COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1cb703a96487e17e00789f2fd4a55bf56ca4b315406eecb35b489a78fb5542
Instruction ID: 00f6a8f5f8e1ce81752fd6880dc5adbcf6f22eaf8b1fe4dc424c232c5a857b99
Opcode Fuzzy Hash: ca1cb703a96487e17e00789f2fd4a55bf56ca4b315406eecb35b489a78fb5542
Instruction Fuzzy Hash: D2823E3291CA85CBD366CF29E45022AF3A1FBD9358F105365F6CE96A98DB7CD5818F00

Function 00007FFE126E7AB0 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024b602c66860695447a35b852b990a58af53fa896d843a93869d42fa03fe7d5
Instruction ID: e016c777187dcc231bdc203bd176c2eea733779756d20c48e21933f8523b37d8
Opcode Fuzzy Hash: 024b602c66860695447a35b852b990a58af53fa896d843a93869d42fa03fe7d5
Instruction Fuzzy Hash: EE12D23260CA419FD359CE2DE49062EB7E0E798760F008669F2DAC7A98D77CE941DF40

Function 00007FF650F00A60 Relevance: .4, Instructions: 351COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84938f344501b089dc9f30a1f4ec40152defb60fda01a30b9f4cfd654dea366a
Instruction ID: 5906b8576f4e29c76c02b6b53155d9c999924901a03d04e5f9a7f1d3031e18a5
Opcode Fuzzy Hash: 84938f344501b089dc9f30a1f4ec40152defb60fda01a30b9f4cfd654dea366a
Instruction Fuzzy Hash: 70E1AE72A0C643A6E7688A28C5647793791EB85B58F1C8235CE0EE73D5EF3DE881C710

Function 00007FF650F00E98 Relevance: .3, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9fe757705c1db86055028c8dd7645bc9c0c0e884b443dd1cb06d94dcc39ae3
Instruction ID: bc97c0b74cabd03aec852aa29e3c52532374e29bb210e644c87709402ee4af15
Opcode Fuzzy Hash: 6a9fe757705c1db86055028c8dd7645bc9c0c0e884b443dd1cb06d94dcc39ae3
Instruction Fuzzy Hash: 49D1BE32A0C683A6EB788B29856067D27A1FB45B48F1C4235CE4FA77D5DF39E885D340

Function 0000026EA18963A1 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2756257931.0000026EA1875000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026EA1875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_26ea1875000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13d39416565e04f69c62867a5f871261e8bd080f9af4ab4b5019e868d34b593
Instruction ID: ad88b36cb0d1bd061883dd29b9a342ca81c46e11399f36e64592b35243a6f736
Opcode Fuzzy Hash: d13d39416565e04f69c62867a5f871261e8bd080f9af4ab4b5019e868d34b593
Instruction Fuzzy Hash: 18A1E3344087988FEB2ADA98D8D47FC37E0EB19310F35456ED9A6CB1C3D62A9843C721

Function 00007FF650F04F10 Relevance: .3, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065d7ba2a5f6d14a853772fa0439540b8975fb29702ac884e0a731994ea79c20
Instruction ID: a0115492269da60d71e635cf4069c2fde3c597b68a85985e965157b4ffac0a98
Opcode Fuzzy Hash: 065d7ba2a5f6d14a853772fa0439540b8975fb29702ac884e0a731994ea79c20
Instruction Fuzzy Hash: 79911336B1C247D6FE684A2594203BB5690AF50B84F0C1639DE6FE77C5DEBCE5069B00

Function 00007FF650F00038 Relevance: .2, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56b2ed4b5e6e39f02683123c79e586b040c008349f621cabd1a211413cd7cde
Instruction ID: a056ec2a4a3050e3b3eca3972328d076d71038c7fc8a142d5200acdd7bba5d3e
Opcode Fuzzy Hash: f56b2ed4b5e6e39f02683123c79e586b040c008349f621cabd1a211413cd7cde
Instruction Fuzzy Hash: FAB18072A0C68796E7658F39C0A427D3BA0EB49B48F1C4135DE4EA7395EF39D840C751

Function 00007FF650F003D0 Relevance: .2, Instructions: 241COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fd7e6c199534787834c05189536a5a1a3b763f31309099cab7e3e57e8cb349
Instruction ID: 3a41574cba7ac9a9cfdc1b2db5028ab252443d5b2a648b2ed7a7d23aef1d7bc3
Opcode Fuzzy Hash: 04fd7e6c199534787834c05189536a5a1a3b763f31309099cab7e3e57e8cb349
Instruction Fuzzy Hash: 61B16C72A0CB8695E7658F29C46023D3BA1EB45F48F2C4235DE4EA7395EF3AD451CB04

Function 00007FF650EF9AA8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a402abbc886bb2f616769e10d17daf76db68ec42469fe97c5d4afe5f38be51
Instruction ID: 02d7f80133782342c41a0d31884b008b818657bbc3cf5837cb6581976e0af416
Opcode Fuzzy Hash: 47a402abbc886bb2f616769e10d17daf76db68ec42469fe97c5d4afe5f38be51
Instruction Fuzzy Hash: 3D815972B286B542EB06CB2AB8549B673DCFB587C8F555030DE8997744EE3DE901CB10

Function 00007FF650F109E8 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533c3ddc46cb4fc9a31a9bfb1bdeb0da96529f849742e5e29486b3beda572fcb
Instruction ID: 7cb39b4c0f729e3566a91ee1ed0a0bef79044887848d7a96338c014a10eb7c65
Opcode Fuzzy Hash: 533c3ddc46cb4fc9a31a9bfb1bdeb0da96529f849742e5e29486b3beda572fcb
Instruction Fuzzy Hash: 1481F3B2A0C78296E774CB29E48037A7A91FB857D4F584235DE9E97B99DF7CD4008B00

Function 00007FF650F0CAA4 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 857fae65ef777fb734bfd069f17d4ad6da85f22b5332f6cff373aa360f1d2413
Instruction ID: ebc9690633ab6e53f59821abe6dfc01cd3eec82b41cac594e1ff73dae257cd7f
Opcode Fuzzy Hash: 857fae65ef777fb734bfd069f17d4ad6da85f22b5332f6cff373aa360f1d2413
Instruction Fuzzy Hash: CB61C262F0C2C366FB688B28D46027976C1AB80768F5C8235DE1FE37D1DE6DE8418780

Function 00007FF650EFF294 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a345e8a9b3a0baf78c14d404585405c2c904bddc464f9727e591e467fc4a11
Instruction ID: 3162579e0d82b3ce41083b60b0c71e6be841dc01abba38b2040f3a61fdc8f9fd
Opcode Fuzzy Hash: 04a345e8a9b3a0baf78c14d404585405c2c904bddc464f9727e591e467fc4a11
Instruction Fuzzy Hash: 80516176A196A395E7248B29E04123D37A8EF45B58F3C4131CE8DA77A5CF3AE843C740

Function 00007FF650EFEA84 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d90b99c94436f5500418e8d1d64ff695af4dd9a972850ca9c92cd039d8929c6
Instruction ID: 3a6c0db9a310097baa9cd868d39181b9b5bb5991824c2dcb64668ce3c24ba4e6
Opcode Fuzzy Hash: 6d90b99c94436f5500418e8d1d64ff695af4dd9a972850ca9c92cd039d8929c6
Instruction Fuzzy Hash: 7A517076A18A6396E7348F29E04423977A4EB84B58F386131DE4DA7795CF3AF842C740

Function 00007FF650EFF498 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfa5e33ed8d62a9902ee46aeee8e1133693122a8725ae0f866d25151504457f
Instruction ID: c3a2685f13526c274771067c84b34ac491890beb81d06e2bc79b5a504dc5402a
Opcode Fuzzy Hash: ecfa5e33ed8d62a9902ee46aeee8e1133693122a8725ae0f866d25151504457f
Instruction Fuzzy Hash: 15517676A186A396E7248F29E04123937A5EF44B58F3D4131CE4DA77A4DF3AEC42C780

Function 00007FF650EFEC88 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd5d5e279daa781766ee679ea663ba857614290eea1c3132a4783aed0bd006b
Instruction ID: cd4416e6bab60355b67700e62c667b3f2116afc17e7f3f223df3b614484de469
Opcode Fuzzy Hash: 0fd5d5e279daa781766ee679ea663ba857614290eea1c3132a4783aed0bd006b
Instruction Fuzzy Hash: 4D51A436A1866296E7248F29E04423837A5EB45F58F3C6131DE4DA7BA4CF3AFC52C740

Function 00007FF650EFEE8C Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5f16adac66681e9595d87db647b9d52ad734f38038cb3cc9ea8ac92c3b4d1a
Instruction ID: 1f4b905047aaebdf273757324c012acd2eea1d60eb4cb3e152059f1bddf463d3
Opcode Fuzzy Hash: 4c5f16adac66681e9595d87db647b9d52ad734f38038cb3cc9ea8ac92c3b4d1a
Instruction Fuzzy Hash: 22514E77A18AA396E7248F29E05423827A4EB44B58F385131DE4DA77A5CF3AEC43C740

Function 00007FF650EFF090 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115c2fcc5df6ef421f4db4aaae0eef8ae9410e8380d057895dc6cd9b0dd752c2
Instruction ID: 0103a6a76f37999b884f3102f04cc4af875e038d061f2a4ebfda1d058d4bd4e7
Opcode Fuzzy Hash: 115c2fcc5df6ef421f4db4aaae0eef8ae9410e8380d057895dc6cd9b0dd752c2
Instruction Fuzzy Hash: B1516136A196A3D6E7248B29E04127937A5EF85B58F384131CE4DA77A5CF3AE843C740

Function 00007FF650F0BF24 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2e1655161aea02c74079f82344d78ed79ea5bc495a7f86a9970a897d49737dc8
Instruction ID: 016ef8e9590e40c1dbe8201b013fb5386074bc9174788f5b0aff482104a9ef25
Opcode Fuzzy Hash: 2e1655161aea02c74079f82344d78ed79ea5bc495a7f86a9970a897d49737dc8
Instruction Fuzzy Hash: 7741E37271CA5692EF04CF2AD925569B3A1BB48FD4B499036DE0EE7B58DE3CD046C300

Function 00007FF650F07998 Relevance: .1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abe10b1d5e930bfcc1ea5b182d5064abf55f12676c153dc8d1649a5ef6e0cf4
Instruction ID: e9e307f4f06d9f933ab6143e969ec1cf7c8c3ad0f49c53039bb7aa840d8a4011
Opcode Fuzzy Hash: 2abe10b1d5e930bfcc1ea5b182d5064abf55f12676c153dc8d1649a5ef6e0cf4
Instruction Fuzzy Hash: 17313522F1C303A5F6A95529877C67D7252AF82340E2C90B1DD0FA3BA9CD2DFA429611

Function 00007FF650F08810 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a210ff3abf15ad26ad393709d0c98705d12608672c9ddc0d7357cc2a41d21c51
Instruction ID: 6644bf059757e17d05642742b1b578bd1b0d804aa898557dc2e91a0961347399
Opcode Fuzzy Hash: a210ff3abf15ad26ad393709d0c98705d12608672c9ddc0d7357cc2a41d21c51
Instruction Fuzzy Hash: F4318162B0D74352FB289A66A42137E65D1AFC4B90F5C8238DE5EA77C6EE7CD5024300

Function 00007FF650F1C6B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e7e37fac7b7fca4e3c74bcae93601f5c610dbc7eb50b705feb5ef85dcbf5dc
Instruction ID: e9398d7134d64534f7e3dc4cbcbe57a61fdee5f39fb0f324cbc44290b86b7e49
Opcode Fuzzy Hash: 61e7e37fac7b7fca4e3c74bcae93601f5c610dbc7eb50b705feb5ef85dcbf5dc
Instruction Fuzzy Hash: 45F062B1B1C2969BDBA48F28A84266A77D0F7083D4F988139DA9DC3B14DA3CD0618F04

Function 00007FF650EFB204 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40486affbeb358e765684004c285b79b8057f977dcba3e0fdbe2d776e8a0f5af
Instruction ID: 345c3f8e61fe951800eae9c847003fb28370e3eef6b6ea9fc4912ec3d8a6c6b5
Opcode Fuzzy Hash: 40486affbeb358e765684004c285b79b8057f977dcba3e0fdbe2d776e8a0f5af
Instruction Fuzzy Hash: C5A0017194C813B0F6048B00E9540246224AB60300B590071C81DA22609E3DE5408611

Function 00007FF650EF2AD4 Relevance: 75.3, APIs: 2, Strings: 48, Instructions: 332COMMON

Download Yara Rule

Strings

-oss, xrefs: 00007FF650EF2DDC
-ms, xrefs: 00007FF650EF2DF3
-splash:, xrefs: 00007FF650EF2EAB
-Xverify:all, xrefs: 00007FF650EF2D19
-Xtm, xrefs: 00007FF650EF2CBF
Warning: %s option is no longer supported., xrefs: 00007FF650EF2F07
-Xdiag, xrefs: 00007FF650EF2C38
-checksource, xrefs: 00007FF650EF2E21
-noverify, xrefs: 00007FF650EF2D51
-jar, xrefs: 00007FF650EF2B56
-version, xrefs: 00007FF650EF2BBE
-jre-restrict-search, xrefs: 00007FF650EF2E94
-no-jre-restrict-search, xrefs: 00007FF650EF2E7D
-fullversion, xrefs: 00007FF650EF2C57
-Xrunhprof:cpu=old,file=%s, xrefs: 00007FF650EF2DAB
-ss, xrefs: 00007FF650EF2DC8
-classpath, xrefs: 00007FF650EF2B22
-XshowSettings:, xrefs: 00007FF650EF2C21
-X%s, xrefs: 00007FF650EF2F2D
-cs, xrefs: 00007FF650EF2E38
-help, xrefs: 00007FF650EF2B79
-tm, xrefs: 00007FF650EF2CAC
-Xverify:none, xrefs: 00007FF650EF2D64
-Xnoclassgc, xrefs: 00007FF650EF2CFD
-mx, xrefs: 00007FF650EF2E0A
-showversion, xrefs: 00007FF650EF2BD5
-verbosegc, xrefs: 00007FF650EF2C6E
-cp, xrefs: 00007FF650EF2B3F
-verify, xrefs: 00007FF650EF2D22
Error: %s requires jar file specification, xrefs: 00007FF650EF2F95
-Dsun.java.launcher.diag=true, xrefs: 00007FF650EF2C4B
-Xdebug, xrefs: 00007FF650EF2CDE
-verifyremote, xrefs: 00007FF650EF2D35
%s full version "%s", xrefs: 00007FF650EF2FB6
-verbose:gc, xrefs: 00007FF650EF2C81
-Xt, xrefs: 00007FF650EF2CA0
-Xverify:remote, xrefs: 00007FF650EF2D48
-debug, xrefs: 00007FF650EF2CCB
Error: %s requires class path specification, xrefs: 00007FF650EF2FE5
-XshowSettings, xrefs: 00007FF650EF2C0A
-Xfuture, xrefs: 00007FF650EF2D06
-noasyncgc, xrefs: 00007FF650EF2E4F
-Xrunhprof:cpu=old,file=java.prof, xrefs: 00007FF650EF2DB7
-prof, xrefs: 00007FF650EF2D77
-noclassgc, xrefs: 00007FF650EF2CEA
-version:, xrefs: 00007FF650EF2E66
-d32, xrefs: 00007FF650EF2ED2
-d64, xrefs: 00007FF650EF2EE9

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID:
String ID: %s full version "%s"$-Dsun.java.launcher.diag=true$-X%s$-Xdebug$-Xdiag$-Xfuture$-Xnoclassgc$-Xrunhprof:cpu=old,file=%s$-Xrunhprof:cpu=old,file=java.prof$-XshowSettings$-XshowSettings:$-Xt$-Xtm$-Xverify:all$-Xverify:none$-Xverify:remote$-checksource$-classpath$-cp$-cs$-d32$-d64$-debug$-fullversion$-help$-jar$-jre-restrict-search$-ms$-mx$-no-jre-restrict-search$-noasyncgc$-noclassgc$-noverify$-oss$-prof$-showversion$-splash:$-ss$-tm$-verbose:gc$-verbosegc$-verify$-verifyremote$-version$-version:$Error: %s requires class path specification$Error: %s requires jar file specification$Warning: %s option is no longer supported.
API String ID: 0-425787817
Opcode ID: 630067ed93981814bc1a982f4fc02fab53557c4d48f9df6f3110d670f7565dc9
Instruction ID: 67a172cbc5b9b4fdb35cffe098fa8072a295511e92ceda72975aa215879597c4
Opcode Fuzzy Hash: 630067ed93981814bc1a982f4fc02fab53557c4d48f9df6f3110d670f7565dc9
Instruction Fuzzy Hash: CFE129A1B1CA13B0FA14DB26FA911B867A96F45780FAD4036DD0EF7796EF2CE505C240

Function 00007FFE1A465420 Relevance: 59.8, APIs: 12, Strings: 22, Instructions: 285COMMON

Download Yara Rule

APIs

JVM_GetMethodIxModifiers.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A465455

Part of subcall function 00007FFE1A461000: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A461049
Part of subcall function 00007FFE1A461000: memset.VCRUNTIME140 ref: 00007FFE1A4610CA

JVM_IsVMGeneratedMethodIx.JVM(?,?,?,?,?,?), ref: 00007FFE1A4654DE
JVM_GetMethodIxExceptionTableLength.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A4655A6
JVM_GetMethodIxLocalsCount.JVM(?,?,?,?,?,?), ref: 00007FFE1A4655CD
JVM_GetMethodIxArgsSize.JVM(?,?,?,?,?,?), ref: 00007FFE1A465683
JVM_GetMethodIxModifiers.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A4656C5
JVM_IsConstructorIx.JVM(?,?,?,?,?,?), ref: 00007FFE1A4656D7
JVM_GetMethodIxSignatureUTF.JVM(?,?,?,?,?,?,?,?,?,?,00007FFE1A46613F), ref: 00007FFE1A465714
JVM_GetMethodIxExceptionsCount.JVM(?,?,?,?,?,?), ref: 00007FFE1A4657C5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?), ref: 00007FFE1A4657D5
JVM_GetMethodIxExceptionIndexes.JVM(?,?,?,?,?,?), ref: 00007FFE1A4657F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?), ref: 00007FFE1A46582C

Strings

Fourth operand byte of invokeinterface must be zero, xrefs: 00007FFE1A466389
Illegal target of jump or branch, xrefs: 00007FFE1A466400
Code stops in the middle of instruction starting at offset %d, xrefs: 00007FFE1A465882
Must call initializers using invokespecial, xrefs: 00007FFE1A46634C
invokedynamic bytecode is not supported in this class file version, xrefs: 00007FFE1A4663D3
Inconsistent access bits., xrefs: 00007FFE1A46585F
Illegal dimension argument, xrefs: 00007FFE1A466410
Bad type passed to newarray, xrefs: 00007FFE1A4663F0
Illegal creation of multi-dimensional array, xrefs: 00007FFE1A466430
<, xrefs: 00007FFE1A465C9E
Array with too many dimensions, xrefs: 00007FFE1A464F55, 00007FFE1A466420
Illegal call to internal method, xrefs: 00007FFE1A46635C
Illegal branch in tableswitch, xrefs: 00007FFE1A4663B3
Illegal use of nonvirtual function call, xrefs: 00007FFE1A46636C
Illegal instruction found at offset %d, xrefs: 00007FFE1A465895
Illegal type, xrefs: 00007FFE1A4663E0
<init>, xrefs: 00007FFE1A465C40
Non zero padding bytes in switch, xrefs: 00007FFE1A466396
Illegal default target in switch, xrefs: 00007FFE1A4663C3
Unsorted lookup switch, xrefs: 00007FFE1A4663A3
Inconsistent args_size for invokeinterface, xrefs: 00007FFE1A46637C
Empty code, xrefs: 00007FFE1A46586F

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Method$CountExceptionModifiersmalloc$ArgsConstructorExceptionsGeneratedIndexesLengthLocalsSignatureSizeTablefreememset
String ID: <$<init>$Array with too many dimensions$Bad type passed to newarray$Code stops in the middle of instruction starting at offset %d$Empty code$Fourth operand byte of invokeinterface must be zero$Illegal branch in tableswitch$Illegal call to internal method$Illegal creation of multi-dimensional array$Illegal default target in switch$Illegal dimension argument$Illegal instruction found at offset %d$Illegal target of jump or branch$Illegal type$Illegal use of nonvirtual function call$Inconsistent access bits.$Inconsistent args_size for invokeinterface$Must call initializers using invokespecial$Non zero padding bytes in switch$Unsorted lookup switch$invokedynamic bytecode is not supported in this class file version
API String ID: 2230652408-720543662
Opcode ID: dd64cc774ee1517bf2f87a22a618c0e1a06e2835f8e7bcf968826ae9030afd8c
Instruction ID: cb93bc1df1ecd7b9260ac1741b612a815084beb0e1aa94e2fc7922a6e88138db
Opcode Fuzzy Hash: dd64cc774ee1517bf2f87a22a618c0e1a06e2835f8e7bcf968826ae9030afd8c
Instruction Fuzzy Hash: D8B1D772B08B8246EB249F2694546BE77A1FB44FE4F0441B6DE6E47BA5DF3CD0218700

Function 00007FF650EF5BFC Relevance: 42.3, APIs: 11, Strings: 13, Instructions: 266stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF650EF5C48

Part of subcall function 00007FF650F0DF98: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0DFB5

GetCommandLineA.KERNEL32 ref: 00007FF650EF5CB9
strchr.LIBVCRUNTIME ref: 00007FF650EF5D0A
strchr.LIBVCRUNTIME ref: 00007FF650EF5D1B
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF5ECC
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF5EDD
CreateProcessA.KERNEL32 ref: 00007FF650EF5F67
WaitForSingleObject.KERNEL32 ref: 00007FF650EF5FC1
GetExitCodeProcess.KERNEL32 ref: 00007FF650EF5FD5
CloseHandle.KERNEL32 ref: 00007FF650EF5FF6
CloseHandle.KERNEL32 ref: 00007FF650EF6001

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

Strings

Error: CreateProcess(%s, ...) failed:, xrefs: 00007FF650EF5FA3
-classpath, xrefs: 00007FF650EF5D9A
Error: Unable to resolve %s, xrefs: 00007FF650EF6014
%s\bin\%s.exe, xrefs: 00007FF650EF5CA7
ExecJRE: new: %s, xrefs: 00007FF650EF5C74
-cp, xrefs: 00007FF650EF5DAD
Error: WaitForSingleObject() failed., xrefs: 00007FF650EF5FE1
ReExec Command: %s (%s), xrefs: 00007FF650EF5EC5
ExecJRE: old: %s, xrefs: 00007FF650EF5C65
ReExec Args: %s, xrefs: 00007FF650EF5ED6
-jre-restrict-search, xrefs: 00007FF650EF5DD9
-no-jre-restrict-search, xrefs: 00007FF650EF5DEC
-version:, xrefs: 00007FF650EF5DC6

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CloseHandleProcessstrchrwprintf$CodeCommandCreateExitFileLineMessageModuleNameObjectSingleWait_invalid_parameter_noinfo
String ID: %s\bin\%s.exe$-classpath$-cp$-jre-restrict-search$-no-jre-restrict-search$-version:$Error: CreateProcess(%s, ...) failed:$Error: Unable to resolve %s$Error: WaitForSingleObject() failed.$ExecJRE: new: %s$ExecJRE: old: %s$ReExec Args: %s$ReExec Command: %s (%s)
API String ID: 3132247948-2302492997
Opcode ID: c6e7af5aa5e2742d91f5a7c425163152edb45020e29c0c0f1edf492294748966
Instruction ID: 0dea28af05974a6dccab68ef5d3893e1ede0fdd4921e8fb16fb79eeb73385702
Opcode Fuzzy Hash: c6e7af5aa5e2742d91f5a7c425163152edb45020e29c0c0f1edf492294748966
Instruction Fuzzy Hash: A3B18E62B0C65761FA00EB22F8512BD6355AF85B80F9C4431DE4EE7796EE7CE505C740

Function 00007FFE126D8A4C Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 136stringfileCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8A80
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8A8F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D8A9B
strcpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8AB6
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8AC5
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8AD4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8AE5
_cwprintf_s_l.LIBCMT ref: 00007FFE126D8AF8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D8B00
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D8B0B
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8B20
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8BB0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8BC5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8BFD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D8C0F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8C1D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D8C28
_cwprintf_s_l.LIBCMT ref: 00007FFE126D8C3B

Strings

tzmappings: Illegal format at line %d., xrefs: 00007FFE126D8C31
#, xrefs: 00007FFE126D8B36
can't open %s., xrefs: 00007FFE126D8AEE
\lib\tzmappings, xrefs: 00007FFE126D8A85, 00007FFE126D8ABB

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: __acrt_iob_func_cwprintf_s_lfclosefreestrcmpstrlen$_strdupfgetsfopenmallocstrcatstrcpy
String ID: #$\lib\tzmappings$can't open %s.$tzmappings: Illegal format at line %d.
API String ID: 1564758537-1007732828
Opcode ID: 1ebea417da70cec1098b9c17aad2549d596375980d995c4a74d398b48c148276
Instruction ID: 2a18f55310ec902de3b61dbecd76dbd85d678152fd6fbd3755abfa1ba79b7c99
Opcode Fuzzy Hash: 1ebea417da70cec1098b9c17aad2549d596375980d995c4a74d398b48c148276
Instruction Fuzzy Hash: A7518551B0DF4E82FA21DB17AC582796390AF95BE4F0844B1DD8E473F5EEECE8468200

Function 00007FFE1A461240 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 346COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE1A46129D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4612E4

Part of subcall function 00007FFE1A461CD8: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1A46132A), ref: 00007FFE1A461CEB
Part of subcall function 00007FFE1A461CD8: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1A46132A), ref: 00007FFE1A461D02

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A461357

Part of subcall function 00007FFE1A462198: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A46222D
Part of subcall function 00007FFE1A462198: JVM_FindClassFromClass.JVM(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A462268

Part of subcall function 00007FFE1A462198: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A4622C6

Part of subcall function 00007FFE1A461914: JVM_GetClassNameUTF.JVM(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461943
Part of subcall function 00007FFE1A461914: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A4619CC
Part of subcall function 00007FFE1A461914: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A41
Part of subcall function 00007FFE1A461914: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A4A
Part of subcall function 00007FFE1A461914: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A60

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A461486
JVM_GetClassFieldsCount.JVM ref: 00007FFE1A461522
JVM_GetClassMethodsCount.JVM ref: 00007FFE1A461563
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A46164E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A46168F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4616A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4616B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4616D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4616EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4616FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A461711

Strings

java/io/Serializable, xrefs: 00007FFE1A4613D6
java/lang/String, xrefs: 00007FFE1A461397
java/lang/Cloneable, xrefs: 00007FFE1A4613C1
Inconsistent access bits., xrefs: 00007FFE1A461782
java/lang/Throwable, xrefs: 00007FFE1A4613AC
java/lang/Object, xrefs: 00007FFE1A46138B

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: free$Classmalloc$Countcallocstrcmp$FieldsFindFromMethodsNamememsetstrcpystrlen
String ID: Inconsistent access bits.$java/io/Serializable$java/lang/Cloneable$java/lang/Object$java/lang/String$java/lang/Throwable
API String ID: 2890842302-2077067311
Opcode ID: ee192f53cec13a11f4a6d4060ab77da1602e8d47f2e678b8d6a72e2d3309fad2
Instruction ID: 848735784ebc88b81caae4d532d8ac3721bb889d4b946375705654ff2951c39c
Opcode Fuzzy Hash: ee192f53cec13a11f4a6d4060ab77da1602e8d47f2e678b8d6a72e2d3309fad2
Instruction Fuzzy Hash: 53E16B76B09F8182EA18DB27A5542BDA3A1FB48F95F0440B6DE6E47765DF3CE0258700

Function 00007FF650EF3E28 Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF650EF3F7C
GetCurrentProcessId.KERNEL32 ref: 00007FF650EF3FBF
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF3FEB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF3FFA
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF4011

Strings

%s%d, xrefs: 00007FF650EF3FCB
-classpath, xrefs: 00007FF650EF3E7E
-help, xrefs: 00007FF650EF3ECC
TRACER_MARKER: NativeMemoryTracking: got value %s, xrefs: 00007FF650EF400A
TRACER_MARKER: NativeMemoryTracking: env var is %s, xrefs: 00007FF650EF3FE4
-cp, xrefs: 00007FF650EF3E67
-XX:NativeMemoryTracking=, xrefs: 00007FF650EF3F28, 00007FF650EF3F3F
TRACER_MARKER: NativeMemoryTracking: putenv arg %s, xrefs: 00007FF650EF3FF3
-, xrefs: 00007FF650EF3E95
-jar, xrefs: 00007FF650EF3EFA
-version, xrefs: 00007FF650EF3E9E
-, xrefs: 00007FF650EF3E5D
-fullversion, xrefs: 00007FF650EF3EB5
%s%d=%s, xrefs: 00007FF650EF3F88

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: wprintf$CurrentProcess
String ID: %s%d$%s%d=%s$-$-$-XX:NativeMemoryTracking=$-classpath$-cp$-fullversion$-help$-jar$-version$TRACER_MARKER: NativeMemoryTracking: env var is %s$TRACER_MARKER: NativeMemoryTracking: got value %s$TRACER_MARKER: NativeMemoryTracking: putenv arg %s
API String ID: 2490283382-3922024441
Opcode ID: 62bc8bd266c98468d5ab7d0392c70bdd916b676a80479e67a3e8a8e33a779de8
Instruction ID: ff531e86e229618aa0620304f59fd1012641d28f0736b1742a06c2cd02de0cd5
Opcode Fuzzy Hash: 62bc8bd266c98468d5ab7d0392c70bdd916b676a80479e67a3e8a8e33a779de8
Instruction Fuzzy Hash: B2513BA1E1C66370FA14AF22FC111B96398AF45BD0F9C4032DE4EE7796EE2CE5068701

Function 00007FFE1A4CA2A4 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4CA331
DName::operator+=.LIBVCRUNTIME ref: 00007FFE1A4CA552

Part of subcall function 00007FFE1A4C5634: DName::doPchar.LIBVCRUNTIME ref: 00007FFE1A4C566B

DName::operator+=.LIBVCRUNTIME ref: 00007FFE1A4CA55F
DName::operator+=.LIBCMT ref: 00007FFE1A4CA573

Strings

void, xrefs: 00007FFE1A4CA3D2
`template-parameter, xrefs: 00007FFE1A4CA485, 00007FFE1A4CA4BC
..., xrefs: 00007FFE1A4CA569

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: Name::operator+=$Name::doPcharReplicator::operator[]
String ID: ...$`template-parameter$void
API String ID: 1221187619-2152273162
Opcode ID: 278fcfa71d38e529015f3f785dc64d8e2510ef2d39a074e72a021b6f3f917e60
Instruction ID: 454991eefe7f32c62d9596d491503b9660b302fd79618cd3992dd74425a761fd
Opcode Fuzzy Hash: 278fcfa71d38e529015f3f785dc64d8e2510ef2d39a074e72a021b6f3f917e60
Instruction Fuzzy Hash: 7C915B61B09F8285FB20CB66E4541B827A2AB54FA8F9441F3DA4D07A7DDF3DE465C340

Function 00007FFE126DA89C Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 69COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FFE126DA8C6
_wcsupr.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA90D
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA920
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA934
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA948
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA95C
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA976
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA990

Strings

\, xrefs: 00007FFE126DA8E4
., xrefs: 00007FFE126DA8F0
NUL, xrefs: 00007FFE126DA952
\, xrefs: 00007FFE126DA8D8
\, xrefs: 00007FFE126DA8FC
COM, xrefs: 00007FFE126DA96C
AUX, xrefs: 00007FFE126DA93E
CON, xrefs: 00007FFE126DA916
LPT, xrefs: 00007FFE126DA986
PRN, xrefs: 00007FFE126DA92A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcscmp$wcsncmp$FullNamePath_wcsupr
String ID: .$AUX$COM$CON$LPT$NUL$PRN$\$\$\
API String ID: 1899337560-4164704460
Opcode ID: 0fcca0e6e7574243ed5458b32ccb83ce3a861a68ff9e94daf8b0dc975036c8f4
Instruction ID: 6a6101686bd4b1702c69e28252d20fb29bebae252c99cdcc0af5fdcd270017df
Opcode Fuzzy Hash: 0fcca0e6e7574243ed5458b32ccb83ce3a861a68ff9e94daf8b0dc975036c8f4
Instruction Fuzzy Hash: 2E312F11E2CE4A82EB20DB16AC5477D33A1BF84B64F454176D58E4A6F8EFACD944C701

Function 00007FFE126DFC0C Relevance: 30.1, APIs: 6, Strings: 14, Instructions: 128stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFCD7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFCEE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD05
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD18
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD37
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD4A

Strings

(Ljava/lang/String;)Ljava/lang/String;, xrefs: 00007FFE126DFC7A
getProperty, xrefs: 00007FFE126DFC73
ISO8859-1, xrefs: 00007FFE126DFCE4
([BLjava/lang/String;)V, xrefs: 00007FFE126DFDF5
getBytes, xrefs: 00007FFE126DFDD3
ISO8859_1, xrefs: 00007FFE126DFCFB
utf-16le, xrefs: 00007FFE126DFD40
ISO646-US, xrefs: 00007FFE126DFD0E
(Ljava/lang/String;)[B, xrefs: 00007FFE126DFDCC
8859_1, xrefs: 00007FFE126DFCCD
java/lang/System, xrefs: 00007FFE126DFC81
sun.jnu.encoding, xrefs: 00007FFE126DFC4E
Cp1252, xrefs: 00007FFE126DFD2D
<init>, xrefs: 00007FFE126DFDFC

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcmp
String ID: (Ljava/lang/String;)Ljava/lang/String;$(Ljava/lang/String;)[B$([BLjava/lang/String;)V$8859_1$<init>$Cp1252$ISO646-US$ISO8859-1$ISO8859_1$getBytes$getProperty$java/lang/System$sun.jnu.encoding$utf-16le
API String ID: 1004003707-625667711
Opcode ID: 8b829989d238815ddcb900ec99d6caba93fd8951d460cd093b548b172270a074
Instruction ID: 79a35ccad3c8de2bafbab5c61176aed04a1903381ec3c59a0acd8fbef057d8a7
Opcode Fuzzy Hash: 8b829989d238815ddcb900ec99d6caba93fd8951d460cd093b548b172270a074
Instruction Fuzzy Hash: EF512E21A09F4A86EA40DB27EC502B923A1AF58BE4F4850B1CD4D073F8EFBCE4498301

Function 00007FFE1A4C26F0 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A4C2739

Part of subcall function 00007FFE1A4C360C: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE1A4C3641
Part of subcall function 00007FFE1A4C360C: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A4C364F
Part of subcall function 00007FFE1A4C360C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A4C3674

IsInExceptionSpec.LIBVCRUNTIME ref: 00007FFE1A4C2803
Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A4C280F
pair.LIBVCRUNTIME ref: 00007FFE1A4C2870
TypeMatchHelper.LIBVCRUNTIME ref: 00007FFE1A4C294B
CatchIt.LIBVCRUNTIME ref: 00007FFE1A4C29C6
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A4C2A38
IsInExceptionSpec.LIBVCRUNTIME ref: 00007FFE1A4C2A70
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE1A4C2A8A
__FrameHandler3::UnwindNestedFrames.LIBVCRUNTIME ref: 00007FFE1A4C2AC2
FindHandlerForForeignException.LIBVCRUNTIME ref: 00007FFE1A4C2AFB

Part of subcall function 00007FFE1A4C4B10: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4C214E), ref: 00007FFE1A4C4B1E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C2B0C
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4C2B3C
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C2B4C

Strings

csm, xrefs: 00007FFE1A4C282D
csm, xrefs: 00007FFE1A4C2753
csm, xrefs: 00007FFE1A4C27B8

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: Frame$Exception$Handler3::Unwind$BlockCatchEstablisherHandlerSpec$ExecutionFindForeignFramesHelperIs_bad_exception_allowedMatchNestedSearchStateThrowTypeabortpairstd::bad_alloc::bad_allocterminate
String ID: csm$csm$csm
API String ID: 936637562-393685449
Opcode ID: d76b670b27c887d5cc407461949c7751ad277912157a421ba399b99f10bf9e07
Instruction ID: fcf53f281bc890aa2c82d05cc1ccad56081487d3e2e49fdbd641d5b1e569cf1a
Opcode Fuzzy Hash: d76b670b27c887d5cc407461949c7751ad277912157a421ba399b99f10bf9e07
Instruction Fuzzy Hash: CAD15062B08A418AEB21DF6690403BD27A4FB45BA8F5001B6DE4D57BAADF78E461C740

Function 00007FFE1A4CB1F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4CB24A
UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FFE1A4CB26B
Replicator::operator+=.LIBVCRUNTIME ref: 00007FFE1A4CB491

Strings

generic-type-, xrefs: 00007FFE1A4CB304
template-parameter-, xrefs: 00007FFE1A4CB2C8

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: Decorator::getNameReplicator::operator+=Replicator::operator[]Template
String ID: generic-type-$template-parameter-
API String ID: 2508803971-13229604
Opcode ID: fc5fc02a2b2a7f523d34ceeea66521749eadb68659c43c2de903e21b4837528a
Instruction ID: 2d637c5f38a75ac8797e37429cb996e3f056b2b334b90998bdaa0571be847b52
Opcode Fuzzy Hash: fc5fc02a2b2a7f523d34ceeea66521749eadb68659c43c2de903e21b4837528a
Instruction Fuzzy Hash: FD816B22B08F8698FB108B66D4502BC27A1AB54FA4B8440F3DA4D57BB9DF3DE526D344

Function 00007FFE126DA69C Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 139fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE126DA6F0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA708
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA72B
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA740
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA75A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA7EC
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA820
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA83E
GetLastError.KERNEL32 ref: 00007FFE126DA857
CloseHandle.KERNEL32 ref: 00007FFE126DA862
SetLastError.KERNEL32 ref: 00007FFE126DA86E

Strings

native memory allocation failed, xrefs: 00007FFE126DA766, 00007FFE126DA7FA, 00007FFE126DA848
?, xrefs: 00007FFE126DA798
U, xrefs: 00007FFE126DA7AE
C, xrefs: 00007FFE126DA7BC
N, xrefs: 00007FFE126DA7B5

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Handle$ErrorFinalLastNamePathfreemalloc$CloseCreateFilereallocwcscpy
String ID: ?$C$N$U$native memory allocation failed
API String ID: 3603261646-3023969977
Opcode ID: bce179ca66eacd076be166ce990ff18af90b8acc7fd75fc4efc9127be1e88962
Instruction ID: 0d77e455acfc7171b8265ac89f003fff24e670775996edd8a61cb5b7c7858d8d
Opcode Fuzzy Hash: bce179ca66eacd076be166ce990ff18af90b8acc7fd75fc4efc9127be1e88962
Instruction Fuzzy Hash: 1D516125E0DA0A82EB619B23AC1867D62A1AF44BB4F058575CD5E473F4DFBCED4A8340

Function 00007FF650EF6294 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF650EF62EB
RegOpenKeyExA.ADVAPI32 ref: 00007FF650EF639A
RegCloseKey.ADVAPI32 ref: 00007FF650EF6341

Part of subcall function 00007FF650EF6548: MessageBoxA.USER32 ref: 00007FF650EF65EA

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF641A
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF6432
RegCloseKey.ADVAPI32 ref: 00007FF650EF643E
RegCloseKey.ADVAPI32 ref: 00007FF650EF6449

Part of subcall function 00007FF650EF6478: RegQueryValueExA.ADVAPI32 ref: 00007FF650EF64AC
Part of subcall function 00007FF650EF6478: RegQueryValueExA.ADVAPI32 ref: 00007FF650EF64DE

Strings

JavaHome, xrefs: 00007FF650EF63BF
Warning: Can't read MicroVersion, xrefs: 00007FF650EF6413
Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required., xrefs: 00007FF650EF636F
MicroVersion, xrefs: 00007FF650EF6403
CurrentVersion, xrefs: 00007FF650EF631D
Failed reading value of registry key:%s\%s\JavaHome, xrefs: 00007FF650EF63DD
Error: opening registry key '%s', xrefs: 00007FF650EF62FA, 00007FF650EF63AC
Error: Failed reading value of registry key:%s\CurrentVersion, xrefs: 00007FF650EF6330
Version major.minor.micro = %s.%s, xrefs: 00007FF650EF642B
Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF650EF62D1

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Close$OpenQueryValuewprintf$Message
String ID: CurrentVersion$Error: Failed reading value of registry key:%s\CurrentVersion$Error: Registry key '%s'\CurrentVersion'has value '%s', but '%s' is required.$Error: opening registry key '%s'$Failed reading value of registry key:%s\%s\JavaHome$JavaHome$MicroVersion$Software\JavaSoft\Java Runtime Environment$Version major.minor.micro = %s.%s$Warning: Can't read MicroVersion
API String ID: 1004157669-1407590046
Opcode ID: 982a3118ff34b0e86d83a062d57c7d4589a5df67d8fab02e18a514213ee1ce42
Instruction ID: e6aab5b1a6fb58fcf816606a0d86c92f649560bcbfaf762f8273871b4bbb06d9
Opcode Fuzzy Hash: 982a3118ff34b0e86d83a062d57c7d4589a5df67d8fab02e18a514213ee1ce42
Instruction Fuzzy Hash: 02513D61A1CA53B2EA109B11F8515B96364FF86784F984032ED4EEBBA9CE3CD609C710

Function 00007FFE126DC2E0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 108stringwindowCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC314
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC32F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC33D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC34A
FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC36F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC419
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC460

Strings

Secondary error while OS message extraction, xrefs: 00007FFE126DC43D
Out of memory, xrefs: 00007FFE126DC325

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWidefreemallocstrlenstrncpy
String ID: Out of memory$Secondary error while OS message extraction
API String ID: 595988575-1389271946
Opcode ID: 3274905c2528511d2360679a3376066b548832f42a20692193a6f0ddbc06cc48
Instruction ID: 4b78f0c0ec3f2ac2b7984a163da46d747f7b5280ed7b0b880803cb5c075889ce
Opcode Fuzzy Hash: 3274905c2528511d2360679a3376066b548832f42a20692193a6f0ddbc06cc48
Instruction Fuzzy Hash: E4415B61B18F8A82EB10DB13AD4407D66A5EF84BE0B448579DE4E47BA8EFBCE4558310

Function 00007FFE1322FBE0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FC2E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FC82
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FCD2
_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1322FD76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FD93
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FDC9
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1322FDF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FE11
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FE3A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1322FE72

Part of subcall function 00007FFE1320B690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6B2
Part of subcall function 00007FFE1320B690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6D8
Part of subcall function 00007FFE1320B690: memmove.VCRUNTIME140(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6F0

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE1322FD24

Part of subcall function 00007FFE13236410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13236419
Part of subcall function 00007FFE13236410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFE1324CAF9,?,?,00000000,00007FFE1320C4D0), ref: 00007FFE1323642A

Part of subcall function 00007FFE132074A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074B8
Part of subcall function 00007FFE132074A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C0
Part of subcall function 00007FFE132074A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C9
Part of subcall function 00007FFE132074A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE1322FEAE

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

Strings

:AM:am:PM:pm, xrefs: 00007FFE1322FE68
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FFE1322FE1C
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFE1322FD9E

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: calloc$free$Concurrency::cancel_current_task$ExceptionGetdaysGetmonthsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_func_lock_localesmallocmemmovestd::bad_alloc::bad_alloc
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 3718130286-35662545
Opcode ID: 4984866773faa2ba8b097bb784f106a27c12d0944b280fa2bc18804908d0bf42
Instruction ID: dfa1eb1e41e0ed9df2902c16d65a3de096d55bbc78889f79934f4668b6e93fbe
Opcode Fuzzy Hash: 4984866773faa2ba8b097bb784f106a27c12d0944b280fa2bc18804908d0bf42
Instruction Fuzzy Hash: 58B1E762B09F8559EB21AF22A8046A877A1FBA5BF0F1842B0DE5D177B5DF3CE445C340

Function 00007FFE1A4C42CA Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C42E7

Part of subcall function 00007FFE1A4C47B0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4C2B51), ref: 00007FFE1A4C4825
Part of subcall function 00007FFE1A4C47B0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4C2B51), ref: 00007FFE1A4C4857

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4C4367
FindSITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A4C439B
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A4C43C3
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A4C43CA

Strings

Bad read pointer - no RTTI data!, xrefs: 00007FFE1A4C44C8
Bad dynamic_cast!, xrefs: 00007FFE1A4C4432
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE1A4C44A5
Access violation - no RTTI data!, xrefs: 00007FFE1A4C42CA, 00007FFE1A4C44EB

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: FindInstanceTargetType$ExceptionFileHeader$RaiseThrow
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 3612141105-928371585
Opcode ID: 9cb7c45a22ad7d1bde4ffead68d9dde7fb12edb2095f4aa00e7992c7fd4aeba8
Instruction ID: bbfdfffed5d46abd981936f899dd15475ace8e70fe06927ea694eda532e519c1
Opcode Fuzzy Hash: 9cb7c45a22ad7d1bde4ffead68d9dde7fb12edb2095f4aa00e7992c7fd4aeba8
Instruction Fuzzy Hash: 26518162719E4692EB20DB52E5446B96360FB84FA4F9041B3DA8D4377AEF3CE525C300

Function 00007FFE126E042C Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 79stringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E044F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0470
GetModuleFileNameA.KERNEL32(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E048B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04A6
strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04BB
strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04CB
strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04F6
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0504
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0514
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0533
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E053C

Strings

kernel, xrefs: 00007FFE126E04EF, 00007FFE126E0509
jvm, xrefs: 00007FFE126E0448

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strrchr$Modulefreestrlen$FileHandleNamemallocsetlocalestrcmp
String ID: jvm$kernel
API String ID: 1434356256-989517181
Opcode ID: ba9b24277e1b969f9f747e478fd2d47a7aff536cd3065a15fc241ee5ccbf2062
Instruction ID: fe0c57de549a90fe307a44284400ecdca3e009311733e64a8314ae53300f532a
Opcode Fuzzy Hash: ba9b24277e1b969f9f747e478fd2d47a7aff536cd3065a15fc241ee5ccbf2062
Instruction Fuzzy Hash: 25316F20E1AE4385FF15DB27EE552782391AF94BA4F4840B4D94E467F9EFBCE8458300

Function 00007FFE1A466BC4 Relevance: 24.2, APIs: 16, Instructions: 235COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1A466BEC
__scrt_initialize_crt.LIBCMT ref: 00007FFE1A466C31
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1A466C52
_RTC_Initialize.LIBCMT ref: 00007FFE1A466C80
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FFE1A466C8A
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1A466CA6
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1A466CD1
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FFE1A466CF0
__scrt_fastfail.LIBCMT ref: 00007FFE1A466D26
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1A466D68
_RTC_Initialize.LIBCMT ref: 00007FFE1A466D87
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1A466D9A
__scrt_uninitialize_crt.LIBCMT ref: 00007FFE1A466DA4
__scrt_fastfail.LIBCMT ref: 00007FFE1A466DB7

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 627783611-0
Opcode ID: 8f28604852fa52fc3accc1823e7bd47af9b4f3aab69c4052e404c3f1f7baedd7
Instruction ID: b42a23a727e4a7bd17d3a53440e562ec2c090c559f7386cf30a7eadfeb59f77d
Opcode Fuzzy Hash: 8f28604852fa52fc3accc1823e7bd47af9b4f3aab69c4052e404c3f1f7baedd7
Instruction Fuzzy Hash: 19919261F0CE4786FA589B579841279A6B0AF85FA0F0440F7EA2D477B6EF3CE4658700

Function 00007FFE126DDA28 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 121stringCOMMON

Download Yara Rule

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDA5A
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDA6E
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDA7F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDA98
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDABF
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB1C
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB34
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB53
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB69
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFE126D911A), ref: 00007FFE126DDB7B

Strings

412, xrefs: 00007FFE126DDB12
b08, xrefs: 00007FFE126DDA87, 00007FFE126DDAB4, 00007FFE126DDAC9

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: atoi$isdigitstrlen$memsetstrncpy
String ID: 412$b08
API String ID: 3579253740-1187039387
Opcode ID: d075a0693ee53cb6e0c1122a54f01503a988f30df69bbfeb6a1d15240f3427d6
Instruction ID: 848bd35b6ee2359d0ca37258db6766bbc77de781149a2ddcadf7596695a9887d
Opcode Fuzzy Hash: d075a0693ee53cb6e0c1122a54f01503a988f30df69bbfeb6a1d15240f3427d6
Instruction Fuzzy Hash: B741E562A0CD564AE710DF27AC540BA7BA0FB997A4B4901B5DA9F832F5EEBCD444C700

Function 00007FFE126E8E0C Relevance: 22.7, APIs: 15, Instructions: 235COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE126E8E34
__scrt_initialize_crt.LIBCMT ref: 00007FFE126E8E79
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE126E8E9A
_RTC_Initialize.LIBCMT ref: 00007FFE126E8EC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE126E8EEE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE126E8F19
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FFE126E8F38
__scrt_fastfail.LIBCMT ref: 00007FFE126E8F6E
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE126E8FB0
_RTC_Initialize.LIBCMT ref: 00007FFE126E8FCF
__scrt_release_startup_lock.LIBCMT ref: 00007FFE126E8FE2
__scrt_uninitialize_crt.LIBCMT ref: 00007FFE126E8FEC
__scrt_fastfail.LIBCMT ref: 00007FFE126E8FFF

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 4294476110-0
Opcode ID: e3755101f75a8c61ba68b93988ed189906dee15a0090e16fad0165e48df8729f
Instruction ID: 96742046239177c0f319918ef54cf3bd228c48f0e38722bb514be9d74dd4af6a
Opcode Fuzzy Hash: e3755101f75a8c61ba68b93988ed189906dee15a0090e16fad0165e48df8729f
Instruction Fuzzy Hash: CA91B061E1DE438AFB64EB67AC412B92290AF857B0F4444B5EA0D477F6DEFCE8458700

Function 00007FFE13207850 Relevance: 22.7, APIs: 15, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13207FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13207622), ref: 00007FFE13208025
Part of subcall function 00007FFE13207FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13207622), ref: 00007FFE132080A5

_WStoflt.LIBCPMT ref: 00007FFE132078D4
_FXp_setw.LIBCPMT ref: 00007FFE132078EE
_FXp_setw.LIBCPMT ref: 00007FFE13207901
_FXp_setn.LIBCPMT ref: 00007FFE13207945
_FXp_setn.LIBCPMT ref: 00007FFE132079CC
_FXp_mulx.LIBCPMT ref: 00007FFE132079F2
_FXp_setn.LIBCPMT ref: 00007FFE13207A05
_FXp_addx.LIBCPMT ref: 00007FFE13207957

Part of subcall function 00007FFE13203970: _FXp_addh.LIBCPMT ref: 00007FFE132039B1

_FXp_mulx.LIBCPMT ref: 00007FFE13207932

Part of subcall function 00007FFE13203CD0: _FXp_mulh.LIBCPMT ref: 00007FFE13203D2C

_WStoxflt.LIBCPMT ref: 00007FFE13207993
_FXp_setw.LIBCPMT ref: 00007FFE132079AE
_FXp_setw.LIBCPMT ref: 00007FFE132079C1
_FXp_setn.LIBCPMT ref: 00007FFE1320790C

Part of subcall function 00007FFE13203DD4: _FXp_setw.LIBCPMT ref: 00007FFE13203E0D
Part of subcall function 00007FFE13203DD4: _FXp_mulh.LIBCPMT ref: 00007FFE13203E1F
Part of subcall function 00007FFE13203DD4: _FXp_addh.LIBCPMT ref: 00007FFE13203E38

_FXp_addx.LIBCPMT ref: 00007FFE13207A17
_FDscale.LIBCPMT ref: 00007FFE13207A3B

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addhXp_addxXp_mulhXp_mulxiswctype$DscaleStofltStoxflt
String ID:
API String ID: 1993114911-0
Opcode ID: 93daba1b2ca0e0d8915cb4de3bf39f6ce065bf3dbf861f4ba4fb38182f6be529
Instruction ID: a315c390b2d4966c21f2bd2abf7c2c1dcd9ac29d8ae1af6bd54ee27faf269af1
Opcode Fuzzy Hash: 93daba1b2ca0e0d8915cb4de3bf39f6ce065bf3dbf861f4ba4fb38182f6be529
Instruction Fuzzy Hash: EE618322F089469EE711FEA7D4806FD2721ABA4768F504675DE0D73BA5DE38E94EC300

Function 00007FFE13205AF0 Relevance: 22.7, APIs: 15, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1320670C: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13205B42), ref: 00007FFE13206732
Part of subcall function 00007FFE1320670C: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13205B42), ref: 00007FFE1320679C

_Stoflt.LIBCPMT ref: 00007FFE13205B7B
_Xp_setw.LIBCPMT ref: 00007FFE13205B96
_Xp_setw.LIBCPMT ref: 00007FFE13205BAA
_Xp_setn.LIBCPMT ref: 00007FFE13205BF1
_Xp_setn.LIBCPMT ref: 00007FFE13205C82
_Xp_mulx.LIBCPMT ref: 00007FFE13205CA9
_Xp_setn.LIBCPMT ref: 00007FFE13205CBD
_Xp_addx.LIBCPMT ref: 00007FFE13205C04

Part of subcall function 00007FFE132054BC: _Xp_addh.LIBCPMT ref: 00007FFE132054FE

_Xp_mulx.LIBCPMT ref: 00007FFE13205BDE

Part of subcall function 00007FFE13205718: _Xp_mulh.LIBCPMT ref: 00007FFE13205776

_Stoxflt.LIBCPMT ref: 00007FFE13205C47
_Xp_setw.LIBCPMT ref: 00007FFE13205C62
_Xp_setw.LIBCPMT ref: 00007FFE13205C76
_Xp_setn.LIBCPMT ref: 00007FFE13205BB6

Part of subcall function 00007FFE13205820: _Xp_setw.LIBCPMT ref: 00007FFE13205832

_Xp_addx.LIBCPMT ref: 00007FFE13205CD1
_Dscale.LIBCPMT ref: 00007FFE13205CF9

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulx$DscaleStofltStoxfltXp_addhXp_mulhisspaceisxdigit
String ID:
API String ID: 1561094175-0
Opcode ID: 26f20ec9df820aa32de266d0aeb6ef9945677f21c9edbebf0351e67feff02a77
Instruction ID: 655374ab2754ae7e6b553e955ed6aca2378dade9101060aef9e4cfdf788c935a
Opcode Fuzzy Hash: 26f20ec9df820aa32de266d0aeb6ef9945677f21c9edbebf0351e67feff02a77
Instruction Fuzzy Hash: FA61C522B1CE46CAE711FE52E4806AE6760FBE4764F600172EE4E276A5DE3CD54DCB00

Function 00007FFE126D38C4 Relevance: 21.2, APIs: 14, Instructions: 204COMMON

Download Yara Rule

APIs

wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3A26
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AB7
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AD3
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AFB
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B12
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B1D
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B34
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B5E
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B75
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B80
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B97
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BBE
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BD6
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BE1

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcscat_s$wcslen$_wcsdup
String ID:
API String ID: 1851556896-0
Opcode ID: 04186553b314d44ae307e7e8756c3af07c6a736935d1ca56604aa05a1955220b
Instruction ID: 55a559c01ccc7f7adfe23f3b2814a9cf1adcbfb468a787512d5483081025baa9
Opcode Fuzzy Hash: 04186553b314d44ae307e7e8756c3af07c6a736935d1ca56604aa05a1955220b
Instruction Fuzzy Hash: DA918232728E8586E721CF26E8546FE6361FB84B54F404176EA8D47AA8EF7CD615CB00

Function 00007FFE13206380 Relevance: 21.2, APIs: 14, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1320670C: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13205B42), ref: 00007FFE13206732
Part of subcall function 00007FFE1320670C: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13205B42), ref: 00007FFE1320679C

_Stoflt.LIBCPMT ref: 00007FFE1320640B
_Xp_setw.LIBCPMT ref: 00007FFE13206426
_Xp_setw.LIBCPMT ref: 00007FFE1320643A
_Xp_setn.LIBCPMT ref: 00007FFE13206481
_Xp_setn.LIBCPMT ref: 00007FFE13206512
_Xp_mulx.LIBCPMT ref: 00007FFE13206539
_Xp_setn.LIBCPMT ref: 00007FFE1320654D
_Xp_addx.LIBCPMT ref: 00007FFE13206494

Part of subcall function 00007FFE1320483C: _Xp_addh.LIBCPMT ref: 00007FFE1320487E

_Xp_mulx.LIBCPMT ref: 00007FFE1320646E

Part of subcall function 00007FFE13204BA0: _Xp_mulh.LIBCPMT ref: 00007FFE13204BFE

_Stoxflt.LIBCPMT ref: 00007FFE132064D7
_Xp_setw.LIBCPMT ref: 00007FFE132064F2
_Xp_setw.LIBCPMT ref: 00007FFE13206506
_Xp_setn.LIBCPMT ref: 00007FFE13206446

Part of subcall function 00007FFE13204CA8: _Xp_setw.LIBCPMT ref: 00007FFE13204CBA

_Xp_addx.LIBCPMT ref: 00007FFE13206561

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulx$StofltStoxfltXp_addhXp_mulhisspaceisxdigit
String ID:
API String ID: 3077680349-0
Opcode ID: 68dfcd458d3605dce68000bdeb4d798d5053b9c95eebfd4242a2a1a3d2f218f3
Instruction ID: bfa804e48ce8ed15cf96b4efe200cc4a78fcecb55f1cd59f72fc10e0e76a07a7
Opcode Fuzzy Hash: 68dfcd458d3605dce68000bdeb4d798d5053b9c95eebfd4242a2a1a3d2f218f3
Instruction Fuzzy Hash: 8B61A522B18D428AE621FE63E4405AE6720FBE5774F604572EA4D736A9DE3CE54DCB00

Function 00007FFE126D3A5C Relevance: 19.6, APIs: 13, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126D3790: wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000001,00007FFE126D3AA1), ref: 00007FFE126D3839

Part of subcall function 00007FFE126D38C4: wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3A26

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AB7
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AD3
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3AFB
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B12
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B1D
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B34
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B5E
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B75
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B80
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3B97
wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BBE
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BD6
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D3BE1

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcscat_s$wcslen$_wcsdupwcscpy
String ID:
API String ID: 3436322422-0
Opcode ID: 6b2e08468c9344467c80d96ec20497130c152e344c07f9b501dcda7d557295de
Instruction ID: d97d7ab9a6d3f604df4e047bfb02141530c30379b144e9a8bd1d4a3b15b295ca
Opcode Fuzzy Hash: 6b2e08468c9344467c80d96ec20497130c152e344c07f9b501dcda7d557295de
Instruction Fuzzy Hash: A2414C22738E819AD761DF25EC546EE7361FB88B54F800136E54E46AA8EF7CCA08C740

Function 00007FF650EF6B50 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 125registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF650EF6BB6
RegEnumKeyA.ADVAPI32 ref: 00007FF650EF6BDD
RegEnumKeyA.ADVAPI32 ref: 00007FF650EF6C3A
RegOpenKeyExA.ADVAPI32 ref: 00007FF650EF6C66
RegCloseKey.ADVAPI32 ref: 00007FF650EF6C84
RegQueryValueExA.ADVAPI32 ref: 00007FF650EF6CB5
RegCloseKey.ADVAPI32 ref: 00007FF650EF6CC9
RegCloseKey.ADVAPI32 ref: 00007FF650EF6CEB
RegCloseKey.ADVAPI32 ref: 00007FF650EF6D33

Part of subcall function 00007FF650EF707C: strchr.LIBVCRUNTIME ref: 00007FF650EF70AF
Part of subcall function 00007FF650EF707C: strchr.LIBVCRUNTIME ref: 00007FF650EF70C6
Part of subcall function 00007FF650EF707C: strchr.LIBVCRUNTIME ref: 00007FF650EF70F0
Part of subcall function 00007FF650EF707C: strchr.LIBVCRUNTIME ref: 00007FF650EF711E

Strings

JavaHome, xrefs: 00007FF650EF6C9E
Software\JavaSoft\Java Runtime Environment, xrefs: 00007FF650EF6BAF

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Closestrchr$EnumOpen$QueryValue
String ID: JavaHome$Software\JavaSoft\Java Runtime Environment
API String ID: 3111475890-2531112370
Opcode ID: ec557db9036887e609cd1ea9896eab7b7eab56d925e7879669a822ec39487fdf
Instruction ID: a3a20a148ffd67fc9b9e7f3ebb2c84a64fbd272a06dba40d081e4d52ad56884e
Opcode Fuzzy Hash: ec557db9036887e609cd1ea9896eab7b7eab56d925e7879669a822ec39487fdf
Instruction Fuzzy Hash: 0A518031B1DA53A2EB50DB12F85067AA3A8FF89B84F580031ED8DA3B54DF3CE5058700

Function 00007FFE126DF478 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126DC2E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC314
Part of subcall function 00007FFE126DC2E0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC32F
Part of subcall function 00007FFE126DC2E0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE126DBE0B), ref: 00007FFE126DC33D

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DF4C3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DF4FA
__swprintf_l.LIBCMT ref: 00007FFE126DF528
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DF542
_snwprintf_s_l.LIBCMT ref: 00007FFE126DF581

Strings

no further information, xrefs: 00007FFE126DF600
(Ljava/lang/String;)Ljava/lang/String;, xrefs: 00007FFE126DF561
concat, xrefs: 00007FFE126DF56D
java/lang/OutOfMemoryError, xrefs: 00007FFE126DF50B
(Ljava/lang/String;)V, xrefs: 00007FFE126DF5C3
(%s), xrefs: 00007FFE126DF51A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: mallocstrlen$__swprintf_l_snwprintf_s_lfreestrncpy
String ID: (%s)$(Ljava/lang/String;)Ljava/lang/String;$(Ljava/lang/String;)V$concat$java/lang/OutOfMemoryError$no further information
API String ID: 3069144682-332957391
Opcode ID: 0082caa8189ba136a63e4ef439e0726990b27fc9ea287f73e2953c8e0a02edb9
Instruction ID: 2efb4258c3c4fbd8b9dd5678e2955e6e4be914602d5dc677c33e7b0552d050b4
Opcode Fuzzy Hash: 0082caa8189ba136a63e4ef439e0726990b27fc9ea287f73e2953c8e0a02edb9
Instruction Fuzzy Hash: 8C411C65A09F8A82EE55DF27AC106B96390AF99FE4F485071DD4E077B5EEBCE409C300

Function 00007FFE13209320 Relevance: 18.2, APIs: 12, Instructions: 231COMMON

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE13209363
__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE13209388
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE132093C8
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE1320946B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE132094D2
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE1320950E
MultiByteToWideChar.KERNEL32 ref: 00007FFE13209538
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1320959B
MultiByteToWideChar.KERNEL32 ref: 00007FFE132095D7
__crtCompareStringEx.LIBCPMT ref: 00007FFE132095F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE13209614
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE1320705B), ref: 00007FFE1320962F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ByteCharMultiWide$__strncntfreemalloc$CompareInfoString__crt
String ID:
API String ID: 1548350897-0
Opcode ID: 86e6458747dd585bbaca4ee4a0804712e124df9f5143478126bb692e17416477
Instruction ID: c4f88ba0a0f81aaa3c88eba02a1dd457545dbf1d4a8155f00ee799a266d8d79e
Opcode Fuzzy Hash: 86e6458747dd585bbaca4ee4a0804712e124df9f5143478126bb692e17416477
Instruction Fuzzy Hash: 0891A572B08B814EEB316B6294503BD6691AFE57B4F484271D95E267F4DF3CE548C300

Function 00007FFE1321C2B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE132074A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074B8
Part of subcall function 00007FFE132074A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C0
Part of subcall function 00007FFE132074A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C9
Part of subcall function 00007FFE132074A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074E5

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1321C2F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1321C312
_Maklocstr.LIBCPMT ref: 00007FFE1321C32E
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1321C337
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1321C354
_Maklocstr.LIBCPMT ref: 00007FFE1321C370
_Maklocstr.LIBCPMT ref: 00007FFE1321C385

Part of subcall function 00007FFE1320B690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6B2
Part of subcall function 00007FFE1320B690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6D8
Part of subcall function 00007FFE1320B690: memmove.VCRUNTIME140(?,?,?,00007FFE132184D4), ref: 00007FFE1320B6F0

Strings

:AM:am:PM:pm, xrefs: 00007FFE1321C37E
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FFE1321C35F
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFE1321C31D

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Maklocstrfree$GetdaysGetmonths___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemmove
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 269533641-35662545
Opcode ID: 0820c1a4a04c52d0eb239fbab98a74cf88671c412056eb74643d8d24ad950682
Instruction ID: d16fd65501032ae7215ed07f5a98c7eaaa4617163dc75e8dc7bb3c84b4a65e25
Opcode Fuzzy Hash: 0820c1a4a04c52d0eb239fbab98a74cf88671c412056eb74643d8d24ad950682
Instruction Fuzzy Hash: AA218466A08F4185EB00EF22D5442A877A0FBE9B94F444275DA4D53766EF3CE585C380

Function 00007FFE13244890 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FFE13244A8C
_CxxThrowException.VCRUNTIME140 ref: 00007FFE13244A9D
std::ios_base::failure::failure.LIBCPMT ref: 00007FFE13244ADE
_CxxThrowException.VCRUNTIME140 ref: 00007FFE13244AEF

Strings

ios_base::failbit set, xrefs: 00007FFE13244A60, 00007FFE13244AB2, 00007FFE13244B35
ios_base::eofbit set, xrefs: 00007FFE13244A67, 00007FFE13244AB9, 00007FFE13244B3C
ios_base::badbit set, xrefs: 00007FFE13244A55, 00007FFE13244AA7, 00007FFE13244B00, 00007FFE13244B2A, 00007FFE13244B80

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 5079871919eeef31b104849c91ea34eddbb498ae389773a60f034b0124e3a6ee
Instruction ID: 5a6914d845fd213890a8421702ffa590dd89dfd84595edc3af829afb94aa263f
Opcode Fuzzy Hash: 5079871919eeef31b104849c91ea34eddbb498ae389773a60f034b0124e3a6ee
Instruction Fuzzy Hash: AC91BE72A08E46C9EF14AB0AD4913B92761FBE4BA4F544175CA4E637B4EF3DE945C300

Function 00007FFE1A4648CC Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 182COMMON

Download Yara Rule

APIs

JVM_GetMethodIxMaxStack.JVM(?,?,?,?,?,?,?,?,?,00000000,00000001,00007FFE1A4657B2), ref: 00007FFE1A4648FC

Strings

Stack size too large, xrefs: 00007FFE1A464B96
Register %d contains wrong type, xrefs: 00007FFE1A464B56
Cannot load return address from register %d, xrefs: 00007FFE1A464B66
Cannot return normally, xrefs: 00007FFE1A464B86
Accessing value from uninitialized register %d, xrefs: 00007FFE1A464B26
Register pair %d/%d contains wrong type, xrefs: 00007FFE1A464B36
Constructor must call super() or this(), xrefs: 00007FFE1A464B76
Accessing value from uninitialized register pair %d/%d, xrefs: 00007FFE1A464B46

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: MethodStack
String ID: Accessing value from uninitialized register %d$Accessing value from uninitialized register pair %d/%d$Cannot load return address from register %d$Cannot return normally$Constructor must call super() or this()$Register %d contains wrong type$Register pair %d/%d contains wrong type$Stack size too large
API String ID: 1191498196-1725939121
Opcode ID: 74852251196557d771e779f56e56dd284c2b7ecbcf954671d12c858596342df2
Instruction ID: 57cdaaa13aa12e317442592e0a1ebb752801130ff2b360641150d7b6c7727dff
Opcode Fuzzy Hash: 74852251196557d771e779f56e56dd284c2b7ecbcf954671d12c858596342df2
Instruction Fuzzy Hash: 62719631B18A4296EE648E27D2546B92372FB44F61F1451F3DE2D47AB6DF7CE8A4C200

Function 00007FFE1321A300 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 165fileCOMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FFE1321A318

Part of subcall function 00007FFE1320D0A0: std::locale::_Init.LIBCPMT ref: 00007FFE1320D0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FFE1321A356
std::ios_base::failure::failure.LIBCPMT ref: 00007FFE1321A3A8
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321A3B9
fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321A492
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321A51E

Strings

ios_base::failbit set, xrefs: 00007FFE1321A37C
ios_base::eofbit set, xrefs: 00007FFE1321A383
ios_base::badbit set, xrefs: 00007FFE1321A370

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowfputwcfwritestd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 247381371-1866435925
Opcode ID: 35a38cbc79ebcab4b9ad5f99447ef1bcd6ff45df82ca40ad9567068bb31a2069
Instruction ID: 31221dd9f9091fe19462a490b1f529fea62615508d1a6b086ba2c8a8cefde063
Opcode Fuzzy Hash: 35a38cbc79ebcab4b9ad5f99447ef1bcd6ff45df82ca40ad9567068bb31a2069
Instruction Fuzzy Hash: B771BF72A08E8299EB10DF26D1403ED33A0FBA4B98F844072EB4D67B66DF39D555C300

Function 00007FFE132068B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE132068F7
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE1320698F
memchr.VCRUNTIME140(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE132069A1
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE132069D6
memchr.VCRUNTIME140(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE132069E4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00007FFE132062F5), ref: 00007FFE13206A4C

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FFE13206998, 00007FFE132069AB
0, xrefs: 00007FFE1320692E
0, xrefs: 00007FFE1320693E

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: memchrtolower$_errnoisspace
String ID: 0$0$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3508154992-2432849056
Opcode ID: 52be6e07b037d6f09550230747a39371e924b433e1c7da1dee62df230f17126e
Instruction ID: 4109592e399a319611f8d653e6b3f1e82a20e468aa3b2fbdcb27df6a61345f45
Opcode Fuzzy Hash: 52be6e07b037d6f09550230747a39371e924b433e1c7da1dee62df230f17126e
Instruction Fuzzy Hash: D351C412A0DBC64DE735BB22A85037D6A90EBE5774F2840B0D9CD627B5DE3CA94AC700

Function 00007FFE13206AA0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206ADC
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206B76
memchr.VCRUNTIME140(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206B88
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206BBB
memchr.VCRUNTIME140(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206BC9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE13206675), ref: 00007FFE13206C27

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FFE13206B7F, 00007FFE13206B92
0, xrefs: 00007FFE13206B23
0, xrefs: 00007FFE13206B13

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: memchrtolower$_errnoisspace
String ID: 0$0$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3508154992-2432849056
Opcode ID: 43815465dc66ac9b27d3f1ae7d633b0096f14b933a58eda5914f7ac150fdf0fb
Instruction ID: f4479edfd1e38f125e1198c5597af48623681599e49e67717b14d51bc60a241e
Opcode Fuzzy Hash: 43815465dc66ac9b27d3f1ae7d633b0096f14b933a58eda5914f7ac150fdf0fb
Instruction Fuzzy Hash: 5B51F852A0DF824EEB35BF26A5543BD6690EBE4774F6845B0C99D326B0DE3CE54AC300

Function 00007FFE1A4C4CC4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,00007FFE1A4C4F0B,?,?,00000000,00007FFE1A4C4CB4,?,?,?,?,00007FFE1A4C49CD), ref: 00007FFE1A4C4E1E

Strings

api-ms-, xrefs: 00007FFE1A4C4D89
ext-ms-, xrefs: 00007FFE1A4C4D9D

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: AddressProc
String ID: api-ms-$ext-ms-
API String ID: 190572456-537541572
Opcode ID: 28046739eb48f761849722ebe00dd8e64e8efb5e3179ccf37f38bb3829bf9516
Instruction ID: 67070c5efa0a2b582b33257bf70239aad6bea29427e9d0591ec91a5c7df3f0fe
Opcode Fuzzy Hash: 28046739eb48f761849722ebe00dd8e64e8efb5e3179ccf37f38bb3829bf9516
Instruction Fuzzy Hash: AD41CF21B09E4281FB15AB1799082B56391BF18FF0F8945F7DD1D8B7A9EE3CE4688300

Function 00007FFE13225A20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13225A60

Part of subcall function 00007FFE132074A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074B8
Part of subcall function 00007FFE132074A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C0
Part of subcall function 00007FFE132074A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C9
Part of subcall function 00007FFE132074A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074E5

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE13225AE7
_Maklocstr.LIBCPMT ref: 00007FFE13225B26
_Maklocstr.LIBCPMT ref: 00007FFE13225B40
_Getvals.LIBCPMT ref: 00007FFE13225C3A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE13225C41

Part of subcall function 00007FFE13236410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13236419
Part of subcall function 00007FFE13236410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFE1324CAF9,?,?,00000000,00007FFE1320C4D0), ref: 00007FFE1323642A

Strings

,, xrefs: 00007FFE13225B8F
true, xrefs: 00007FFE13225B39
false, xrefs: 00007FFE13225B1F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Maklocstr$Concurrency::cancel_current_taskExceptionGetvalsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: ,$false$true
API String ID: 2135902765-760133229
Opcode ID: 67ee8f4e636e21bca307c7727e2474fd631be0ead37d0a99a3418088d2fddda1
Instruction ID: 2fc1a00d14b2c7b43ae6b85c5b32d2cec9d36ed6bbf3325443bb74f81c0e156d
Opcode Fuzzy Hash: 67ee8f4e636e21bca307c7727e2474fd631be0ead37d0a99a3418088d2fddda1
Instruction Fuzzy Hash: 2451A222508FC196E621DB21F4002AAB7A4FBD4760F509262EBDE13769EF3CD185C700

Function 00007FFE1A4610F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4641E8: JVM_GetMethodIxNameUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464233
Part of subcall function 00007FFE1A4641E8: jio_snprintf.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A46428B
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642F2
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642FA
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464302

jio_vsnprintf.JVM(?,?,?,00007FFE1A461791), ref: 00007FFE1A46112D
longjmp.VCRUNTIME140(?,?,?,00007FFE1A461791), ref: 00007FFE1A461142
longjmp.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1A461791), ref: 00007FFE1A461166
jio_vsnprintf.JVM(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A461791), ref: 00007FFE1A4611A9
longjmp.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4611BE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4611F2
jio_fprintf.JVM(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A461202

Strings

0, xrefs: 00007FFE1A461214
Warning! An old version of jvm is used. This is not supported., xrefs: 00007FFE1A4611FB

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Releaselongjmp$jio_vsnprintf$MethodName__acrt_iob_funcjio_fprintfjio_snprintf
String ID: 0$Warning! An old version of jvm is used. This is not supported.
API String ID: 3549641724-3931950699
Opcode ID: d6a3c54afba130119dfc3fda5e609ed61d8e42cecbec127a8d11aca8c3a23a0a
Instruction ID: eabc8113cc784ef79694f84232ed53ec89b49b523a714d603cbbbee00701ed04
Opcode Fuzzy Hash: d6a3c54afba130119dfc3fda5e609ed61d8e42cecbec127a8d11aca8c3a23a0a
Instruction Fuzzy Hash: F931C531B08B8182EB04DB66E4443FA6771FB54B94F1404B6EAAC477AADF7CD6618780

Function 00007FFE1A4641E8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

JVM_GetMethodIxNameUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464233
jio_snprintf.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A46428B
jio_snprintf.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642C4
JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642F2
JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642FA
JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464302

Strings

(class: %s, field: %s) , xrefs: 00007FFE1A4642AE
(class: %s, method: %s signature: %s) , xrefs: 00007FFE1A464270
(class: %s) , xrefs: 00007FFE1A4642DA

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Release$jio_snprintf$MethodName
String ID: (class: %s) $(class: %s, field: %s) $(class: %s, method: %s signature: %s)
API String ID: 3284335260-151965855
Opcode ID: d7d682e46237ecdd32f061afec4269624f2dcc048d55d89b90da7df0779a996f
Instruction ID: 04d0cfc7f540011a5677f13aa883a59d952bb79e7be1213816ceddb6866b5268
Opcode Fuzzy Hash: d7d682e46237ecdd32f061afec4269624f2dcc048d55d89b90da7df0779a996f
Instruction Fuzzy Hash: DC31A125B09E8685EA18DB63A9441F9A370FB44FE4F1840B3DD6C47B6ACF3CD5228740

Function 00007FFE126D1E5C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126D1EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126D1ED9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126D1EEE
JVM_FindLibraryEntry.JVM(?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126D1F11
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126D1F1C

Strings

JNI_OnLoad, xrefs: 00007FFE126D1E8A
_JNI_OnUnload@8, xrefs: 00007FFE126D1E9B
_JNI_OnLoad@8, xrefs: 00007FFE126D1E79
JNI_OnUnload, xrefs: 00007FFE126D1EAC

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strlen$EntryFindLibraryfreemalloc
String ID: JNI_OnLoad$JNI_OnUnload$_JNI_OnLoad@8$_JNI_OnUnload@8
API String ID: 1455729729-366470588
Opcode ID: 460e35dd825ba0726d4a5ee97bace300b981cb30dd378b5d35f1f8e1ebd87569
Instruction ID: 9c9a2ae2e3a0da3af1339ef5802241a1b816143dfe3e3738822c4acd39ed83a4
Opcode Fuzzy Hash: 460e35dd825ba0726d4a5ee97bace300b981cb30dd378b5d35f1f8e1ebd87569
Instruction Fuzzy Hash: F6216D21B19F5986EB00DB13AC481AD73A6BF84BE0B4540B5DE9C077B1DFF9E9568340

Function 00007FF650F0E184 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0E1C7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0E5B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0E850

Strings

p, xrefs: 00007FF650F0E279
f, xrefs: 00007FF650F0E2E9
:, xrefs: 00007FF650F0E380
-, xrefs: 00007FF650F0E25D
p, xrefs: 00007FF650F0E2F1

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 8765d1a40496d380c4ebc8d5faee5c71b13af073b131ae4c475bcb1fed81b6d0
Instruction ID: 470e038400c2dd22c90885cfed7cb789c762af19adada01020c0e4cebe2e4691
Opcode Fuzzy Hash: 8765d1a40496d380c4ebc8d5faee5c71b13af073b131ae4c475bcb1fed81b6d0
Instruction Fuzzy Hash: BB12B162E1D243A6FB249E14E5646B9B691FB90754F8C8135EE9BE77C4DF3CE4808B00

Function 00007FFE1A464324 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 319COMMON

Download Yara Rule

APIs

JVM_GetCPFieldSignatureUTF.JVM(?,00000000,?,?,00000000,?,?,00007FFE1A464AB9,?,?,?,?,?,?,?,?), ref: 00007FFE1A4644EF
JVM_GetCPMethodSignatureUTF.JVM(?,00000000,?,?,00000000,?,?,00007FFE1A464AB9,?,?,?,?,?,?,?,?), ref: 00007FFE1A464592

Strings

java/lang/invoke/MethodType, xrefs: 00007FFE1A46444E
Internal error #3, xrefs: 00007FFE1A4647AF
java/lang/invoke/MethodHandle, xrefs: 00007FFE1A464455
Internal error #4, xrefs: 00007FFE1A4647D2
Illegal signature %s, xrefs: 00007FFE1A4647C2
java/lang/Class, xrefs: 00007FFE1A464482

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Signature$FieldMethod
String ID: Illegal signature %s$Internal error #3$Internal error #4$java/lang/Class$java/lang/invoke/MethodHandle$java/lang/invoke/MethodType
API String ID: 1369918702-871449873
Opcode ID: 4e48a1c59eecb2fde3f800cbf0d8626e9a5d3633f7160c534d4e38a06ef09196
Instruction ID: fe5a90c2784a52964667a8fbc23c06828ffa3549cc7553b177a0a0c563abd30e
Opcode Fuzzy Hash: 4e48a1c59eecb2fde3f800cbf0d8626e9a5d3633f7160c534d4e38a06ef09196
Instruction Fuzzy Hash: A0D1A265B0DE4289FF648A27D5402F926B2AB05FA5F5940F3CA2E436B3DF7CA561C301

Function 00007FFE1321B890 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FFE1321B8A8

Part of subcall function 00007FFE1320D0A0: std::locale::_Init.LIBCPMT ref: 00007FFE1320D0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FFE1321B8E6
std::ios_base::failure::failure.LIBCPMT ref: 00007FFE1321B938
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321B949
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321B982

Strings

ios_base::failbit set, xrefs: 00007FFE1321B90C
ios_base::eofbit set, xrefs: 00007FFE1321B913
ios_base::badbit set, xrefs: 00007FFE1321B900, 00007FFE1321B950

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowsetvbufstd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 692481045-1866435925
Opcode ID: fd2f3828b474fe88a08b624c1155f3347718e21b58a1bf8b771f14d77974cb8c
Instruction ID: d155e9c5d4b6f43c5b2272fe796df9e62687f4edeec213eeefef47fd8daf97f5
Opcode Fuzzy Hash: fd2f3828b474fe88a08b624c1155f3347718e21b58a1bf8b771f14d77974cb8c
Instruction Fuzzy Hash: 8E41BD32604F458AEB549F26D1413A933B0FBA4B98F504171CB4C5B769EF3CD594C780

Function 00007FF650EF27A8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 75COMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF2880
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF2893

Part of subcall function 00007FF650EF55FC: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF650EF3745), ref: 00007FF650EF5610

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF650EF2885
%ld micro seconds to load main class, xrefs: 00007FF650EF2879
----%s----, xrefs: 00007FF650EF288C
Error: A JNI error has occurred, please check your installation and try again, xrefs: 00007FF650EF289D
checkAndLoadMain, xrefs: 00007FF650EF27F7
(ZILjava/lang/String;)Ljava/lang/Class;, xrefs: 00007FF650EF27F0

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: wprintf$FrequencyPerformanceQuery
String ID: %ld micro seconds to load main class$(ZILjava/lang/String;)Ljava/lang/Class;$----%s----$Error: A JNI error has occurred, please check your installation and try again$_JAVA_LAUNCHER_DEBUG$checkAndLoadMain
API String ID: 55271498-1016856437
Opcode ID: e8a2913bac3ef7ff39d8ebda9fda6eea542540f2972fb7e065ff3bd7cfd524bf
Instruction ID: d61903651c235f5f063129e184bd50a56fccc6260d1fffb42ef54a2968ca1edb
Opcode Fuzzy Hash: e8a2913bac3ef7ff39d8ebda9fda6eea542540f2972fb7e065ff3bd7cfd524bf
Instruction Fuzzy Hash: C2217E65A0DAA7A1EE14EF62F8101A96398AF44FC4F5C4435EE4DA7796EF3CE102C700

Function 00007FFE126D992C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126DA89C: GetFullPathNameW.KERNEL32 ref: 00007FFE126DA8C6
Part of subcall function 00007FFE126DA89C: _wcsupr.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA90D
Part of subcall function 00007FFE126DA89C: wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA920
Part of subcall function 00007FFE126DA89C: wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA934
Part of subcall function 00007FFE126DA89C: wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA948
Part of subcall function 00007FFE126DA89C: wcscmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA95C
Part of subcall function 00007FFE126DA89C: wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA976
Part of subcall function 00007FFE126DA89C: wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DA990

CreateFileW.KERNEL32 ref: 00007FFE126D9986
GetLastError.KERNEL32 ref: 00007FFE126D9995
GetFileAttributesW.KERNEL32 ref: 00007FFE126D99AC
SetLastError.KERNEL32 ref: 00007FFE126D99B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D99D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D99EC
CloseHandle.KERNEL32 ref: 00007FFE126D99F5

Strings

Could not open file, xrefs: 00007FFE126D99BF

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcscmp$ErrorFileLastfreewcsncmp$AttributesCloseCreateFullHandleNamePath_wcsupr
String ID: Could not open file
API String ID: 1413038513-690550925
Opcode ID: 94392906d872f9a2f03cfccf3a25be0c44d0f6145bc8ea8f8853d3ec6ef4c8d4
Instruction ID: eae4d438ff03a677a72bd51d00ef8ab9f28c7059175dc0ca8fd4b911e9471519
Opcode Fuzzy Hash: 94392906d872f9a2f03cfccf3a25be0c44d0f6145bc8ea8f8853d3ec6ef4c8d4
Instruction Fuzzy Hash: 19113321A1DF4A83FA149B23AC5437D6351AF85BB4F184670D9AE4BBF5CFACE8458700

Function 00007FFE126D1CC4 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D1CEE
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D1CFD
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D1D45
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1D6B
strcpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D1DA1
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D1DB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1DF8

Strings

NULL filename for native library, xrefs: 00007FFE126D1D0A
.dll, xrefs: 00007FFE126D1CF3

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strlen$freemallocstrcpy
String ID: .dll$NULL filename for native library
API String ID: 1163677172-513714883
Opcode ID: f296d030f55bc0136553607a10350cac8745981e6157a93b7fe8ff32a3620587
Instruction ID: af944f2091befa6e27a647a350e54df0dae37fb958898f6feeece1c790d3b0d1
Opcode Fuzzy Hash: f296d030f55bc0136553607a10350cac8745981e6157a93b7fe8ff32a3620587
Instruction Fuzzy Hash: A3318B10B09E5A86EE18EB276C511B96691AF85FE0F0844F1DD8E0B7F6EEFCE0418204

Function 00007FFE132443D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FFE132445AE
_CxxThrowException.VCRUNTIME140 ref: 00007FFE132445BF
std::ios_base::failure::failure.LIBCPMT ref: 00007FFE13244600
_CxxThrowException.VCRUNTIME140 ref: 00007FFE13244611

Strings

ios_base::failbit set, xrefs: 00007FFE13244582, 00007FFE132445D4
ios_base::eofbit set, xrefs: 00007FFE13244589, 00007FFE132445DB
ios_base::badbit set, xrefs: 00007FFE13244577, 00007FFE132445C9

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 7650bd997bf7dffc81ca24ad573e1d6ea6f87f8d0221c566a3e0038d77b00579
Instruction ID: d0b89813b202916403fd42bb786307eca1112c7a9afbc50222686ce933ed848e
Opcode Fuzzy Hash: 7650bd997bf7dffc81ca24ad573e1d6ea6f87f8d0221c566a3e0038d77b00579
Instruction Fuzzy Hash: 3F717B72A08E46C9EF14EB1AD4913B827A0FBE0BA4F544176DA1E637B4DF2CE945C300

Function 00007FFE13225878 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE132074A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074B8
Part of subcall function 00007FFE132074A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C0
Part of subcall function 00007FFE132074A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C9
Part of subcall function 00007FFE132074A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074E5

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132258CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE13225903
_Getvals.LIBCPMT ref: 00007FFE1322593C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE13225A16

Part of subcall function 00007FFE13236410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13236419
Part of subcall function 00007FFE13236410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FFE1324CAF9,?,?,00000000,00007FFE1320C4D0), ref: 00007FFE1323642A

Strings

$+xv, xrefs: 00007FFE13225995, 00007FFE1322599E
$+xv, xrefs: 00007FFE132259F0
+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FFE1322598B, 00007FFE132259A8

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionGetvalsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 801482897-3573081731
Opcode ID: 08f4393cbb9286a77c8465830587d0892ef895849c8ce4b697314d7c6ad679fd
Instruction ID: c7fcee36ec6382f7de876b4dcf91fc21169d50e63294e5c9d96910f4e73c5cf3
Opcode Fuzzy Hash: 08f4393cbb9286a77c8465830587d0892ef895849c8ce4b697314d7c6ad679fd
Instruction Fuzzy Hash: 32510632A04F818AE734DF22A84057D7BA4FBA5BB0B245371CE9A537A4DF38E545C740

Function 00007FFE1A4C4690 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE1A4C46E5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4C4722
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A4C4757
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE1A4C4774
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4C4780
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4C4789

Strings

, xrefs: 00007FFE1A4C4708

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-3916222277
Opcode ID: 0ab38cecf78bff6f6954968786a459b80e7fd719337a2e73ef23b46534179fa2
Instruction ID: 76aa354de960626ac935b5b25b209f4a839ad770302b6346c1d547e8c393ed88
Opcode Fuzzy Hash: 0ab38cecf78bff6f6954968786a459b80e7fd719337a2e73ef23b46534179fa2
Instruction Fuzzy Hash: 6131AF26B1AF5184EB01CF26A90857963A0FB09FF4B9945B6DE6D433A9EE3CD416C300

Function 00007FFE126E02F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126E042C: GetModuleHandleA.KERNEL32(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E044F
Part of subcall function 00007FFE126E042C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0470
Part of subcall function 00007FFE126E042C: GetModuleFileNameA.KERNEL32(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E048B
Part of subcall function 00007FFE126E042C: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04A6
Part of subcall function 00007FFE126E042C: strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04BB
Part of subcall function 00007FFE126E042C: strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04CB
Part of subcall function 00007FFE126E042C: strrchr.VCRUNTIME140(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04DE
Part of subcall function 00007FFE126E042C: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E04F6
Part of subcall function 00007FFE126E042C: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0504
Part of subcall function 00007FFE126E042C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0514
Part of subcall function 00007FFE126E042C: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0533
Part of subcall function 00007FFE126E042C: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126E0246,?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E053C

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,00007FFE126DEC4F,?,?,00000000,00000000,00000000,00007FFE126D1DEE), ref: 00007FFE126E032B
mbstowcs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,00000000,00007FFE126DEC4F,?,?,00000000,00000000,00000000,00007FFE126D1DEE), ref: 00007FFE126E0338
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FFE126DEC4F,?,?,00000000,00000000,00000000,00007FFE126D1DEE), ref: 00007FFE126E0355
mbstowcs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,00000000,00007FFE126DEC4F,?,?,00000000,00000000,00000000,00007FFE126D1DEE), ref: 00007FFE126E0367
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FFE126DEC4F,?,?,00000000,00000000,00000000,00007FFE126D1DEE), ref: 00007FFE126E040A

Part of subcall function 00007FFE126DFC0C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFCD7
Part of subcall function 00007FFE126DFC0C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFCEE
Part of subcall function 00007FFE126DFC0C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD05
Part of subcall function 00007FFE126DFC0C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFD18

Strings

([C)V, xrefs: 00007FFE126E03C5
<init>, xrefs: 00007FFE126E03CC

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcmp$freestrlenstrrchr$Modulembstowcs$FileHandleNamecallocmallocsetlocale
String ID: ([C)V$<init>
API String ID: 3386562350-1011113392
Opcode ID: cbd15d54e1d0de6ced8842f3d21024f4ca9217755f51456d442fd93502e34fa5
Instruction ID: 3c2cec297499540a05566776086d9440adec733976f3c47880f01ffad866955f
Opcode Fuzzy Hash: cbd15d54e1d0de6ced8842f3d21024f4ca9217755f51456d442fd93502e34fa5
Instruction Fuzzy Hash: B3318A20A09E46C2EA44DB23AE542BD63A0AF49FF0F484175DE6D57BE5DFBCE4568300

Function 00007FFE126D82A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55registrytimeCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFE126D82ED
RegQueryValueExA.ADVAPI32 ref: 00007FFE126D832B
RegCloseKey.ADVAPI32 ref: 00007FFE126D833F
GetTimeZoneInformation.KERNEL32 ref: 00007FFE126D834E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D836B

Strings

System\CurrentControlSet\Control\TimeZoneInformation, xrefs: 00007FFE126D82D1
ActiveTimeBias, xrefs: 00007FFE126D830F

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CloseInformationOpenQueryTimeValueZone_strdup
String ID: ActiveTimeBias$System\CurrentControlSet\Control\TimeZoneInformation
API String ID: 2644126436-196929136
Opcode ID: 8d80930dddcd682e09ca9938ed849d16cf2e2d5464def2040c0ea5a1946fd7d3
Instruction ID: f0705404db5942dcb87d8b4e7477edff056ff21daf5a606b8164d25a08f097a1
Opcode Fuzzy Hash: 8d80930dddcd682e09ca9938ed849d16cf2e2d5464def2040c0ea5a1946fd7d3
Instruction Fuzzy Hash: 70213032628F85D6DB10CF26F8442AE73A4FB88764F415275EA9D43AA8DF7CD545CB00

Function 00007FFE1321C3B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE132074A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074B8
Part of subcall function 00007FFE132074A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C0
Part of subcall function 00007FFE132074A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074C9
Part of subcall function 00007FFE132074A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132074E5

_W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1321C3EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1321C40B
_W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1321C42B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1321C448

Part of subcall function 00007FFE1320B710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B739
Part of subcall function 00007FFE1320B710: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B768
Part of subcall function 00007FFE1320B710: memmove.VCRUNTIME140(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B77F

Strings

:AM:am:PM:pm, xrefs: 00007FFE1321C464
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFE1321C416
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FFE1321C453

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: free$GetdaysGetmonths___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemmove
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2607222871-3743323925
Opcode ID: 29a469ce97e9e63c9afcb1297cf3119d81ee8217b80f69d292bc9982e8b506e4
Instruction ID: 742b08d07c45be81f31ae4245ab4410be81d1aae8d2c7ce0fb6f867d8b12c2af
Opcode Fuzzy Hash: 29a469ce97e9e63c9afcb1297cf3119d81ee8217b80f69d292bc9982e8b506e4
Instruction Fuzzy Hash: C1217462908F4186EB20EF22E4542797370FBA4BA4F404274E74E63765EF7CE584C740

Function 00007FFE126D35D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFE126D35EB
GetProcAddress.KERNEL32 ref: 00007FFE126D35FB
GetModuleHandleA.KERNEL32 ref: 00007FFE126D360F
GetProcAddress.KERNEL32 ref: 00007FFE126D361F

Strings

GetLocaleInfoEx, xrefs: 00007FFE126D35F4
GetCalendarInfoEx, xrefs: 00007FFE126D3618
kernel32.dll, xrefs: 00007FFE126D35E4, 00007FFE126D3601

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetCalendarInfoEx$GetLocaleInfoEx$kernel32.dll
API String ID: 1646373207-1175232696
Opcode ID: dbba40188e7282fcc206741e4d6f733cf3fc66cb6b4dca80cdf3a46779755540
Instruction ID: 59464d3614711edc88fcb33167061713ffaccb067af2c7728609f96a96f298cd
Opcode Fuzzy Hash: dbba40188e7282fcc206741e4d6f733cf3fc66cb6b4dca80cdf3a46779755540
Instruction Fuzzy Hash: 75018464E09E8B86EB50CB23EC643B423A0BF58765F5401B5C46D063F4EFEC6998C614

Function 00007FFE1A4C2378 Relevance: 12.1, APIs: 8, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C2430
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C244E
__AdjustPointer.LIBCMT ref: 00007FFE1A4C248F
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C249C
__AdjustPointer.LIBCMT ref: 00007FFE1A4C24D7
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C24EC
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C2531
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C2538

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: terminate$AdjustPointer
String ID:
API String ID: 1364991670-0
Opcode ID: 9169a32f2c73a49571e9184a56cfbdfada7bc206d54ce01189ba9b97926fdaa3
Instruction ID: b44fd74239b42ad4aaa5fa0d14305335bda15865eddd1b5bfec0166023113dca
Opcode Fuzzy Hash: 9169a32f2c73a49571e9184a56cfbdfada7bc206d54ce01189ba9b97926fdaa3
Instruction Fuzzy Hash: 4051D021B0AE4286EB65EB57945463A6390AF04FA4FD580F7CA4E067BDDFBCE4618304

Function 00007FF650EF15E8 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650EF7968: strchr.LIBVCRUNTIME ref: 00007FF650EF797F

sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF1677
sprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF16D1

Strings

;, xrefs: 00007FF650EF161C
CLASSPATH, xrefs: 00007FF650EF1615
Error: Could not determine application home., xrefs: 00007FF650EF1699
-Djava.class.path=, xrefs: 00007FF650EF1715
-Denv.class.path=%s, xrefs: 00007FF650EF166A
-Dapplication.home=%s, xrefs: 00007FF650EF16C7

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: sprintf$strchr
String ID: -Dapplication.home=%s$-Denv.class.path=%s$-Djava.class.path=$;$CLASSPATH$Error: Could not determine application home.
API String ID: 1221780243-1246759518
Opcode ID: f0ca934c3f11b5318106385c95f5b099d18e9464230de4d0d56cc709eca2f312
Instruction ID: 0ef1cfc11770c48ec5af64c462db201f7fc2c4d3bc13203056187630e0a9d5d6
Opcode Fuzzy Hash: f0ca934c3f11b5318106385c95f5b099d18e9464230de4d0d56cc709eca2f312
Instruction Fuzzy Hash: E3418F21A2D65761EA64FB12F9611F95395AF89780F9D0031EE4EE7397EE3CE1068B00

Function 00007FFE1321922C Relevance: 12.1, APIs: 8, Instructions: 104threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFE13219259
GetCurrentThreadId.KERNEL32 ref: 00007FFE13219274
GetCurrentThreadId.KERNEL32 ref: 00007FFE1321928A
xtime_get.LIBCPMT ref: 00007FFE132192C6
GetCurrentThreadId.KERNEL32 ref: 00007FFE132192E1
_Xtime_diff_to_millis2.LIBCPMT ref: 00007FFE132192FC
GetCurrentThreadId.KERNEL32 ref: 00007FFE13219316
GetCurrentThreadId.KERNEL32 ref: 00007FFE1321936F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: CurrentThread$Xtime_diff_to_millis2xtime_get
String ID:
API String ID: 3218647749-0
Opcode ID: 6f3bf3e151121cb8b9efbec79e646c9e8da7cfbfd622af188c552a0e09985615
Instruction ID: 71c7dfdf186da5911bd870801947593f8d7ee9109d6625a193d751b38dca3e9c
Opcode Fuzzy Hash: 6f3bf3e151121cb8b9efbec79e646c9e8da7cfbfd622af188c552a0e09985615
Instruction Fuzzy Hash: 32413C32A08E428EEB60AF17E54027973A0FBA5B64F5040B1DA4E636F1DF3DE985C741

Function 00007FF650EF7394 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 103stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FF650EF73DD
strchr.LIBVCRUNTIME ref: 00007FF650EF740F
strchr.LIBVCRUNTIME ref: 00007FF650EF746C
strchr.LIBVCRUNTIME ref: 00007FF650EF7480
strchr.LIBVCRUNTIME ref: 00007FF650EF74B9
strchr.LIBVCRUNTIME ref: 00007FF650EF74CE

Strings

&+*, xrefs: 00007FF650EF744E
.-_, xrefs: 00007FF650EF7465, 00007FF650EF7479, 00007FF650EF74B2, 00007FF650EF74C7

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: strchr
String ID: &+*$.-_
API String ID: 2830005266-274609856
Opcode ID: fefd3919b469cbbbc754b2919de210f6e197afd1e5fce94115548d9581c91fab
Instruction ID: 3c52078705ee4923d536b2530f05fc87a694992b116f1f4c08f3823d13a5a47e
Opcode Fuzzy Hash: fefd3919b469cbbbc754b2919de210f6e197afd1e5fce94115548d9581c91fab
Instruction Fuzzy Hash: C141A010B0E6A764FE659B11BA203B91A99AF45B80F6C4074DE9DE77C6EE7CF8018710

Function 00007FFE126DC778 Relevance: 12.1, APIs: 8, Instructions: 92pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC79F
GetNumberOfConsoleInputEvents.KERNEL32(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC7BA
PeekNamedPipe.KERNEL32(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC7DF
GetLastError.KERNEL32(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC7E9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC827
PeekConsoleInputA.KERNEL32(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC852
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,00000000,00007FFE126DC55B,?,?,?,?,?,00007FFE126D24AD), ref: 00007FFE126DC898

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ConsoleInputPeekfree$ErrorEventsHandleLastNamedNumberPipemalloc
String ID:
API String ID: 2128092148-0
Opcode ID: 037eb206a22b9eccc1bacbf17b1cd1a2fe5c72425feb9d68699db8bbe89f73fe
Instruction ID: c8fb016a1cf3c79169226de2d29960ea811c7dd405b840b1123c8ec2a2927d52
Opcode Fuzzy Hash: 037eb206a22b9eccc1bacbf17b1cd1a2fe5c72425feb9d68699db8bbe89f73fe
Instruction Fuzzy Hash: 4B316221E48A4A8BEB10CF2BAC945396691FF847B4F544279DA5E436F4DEBCD8468B00

Function 00007FFE126DDC18 Relevance: 12.0, APIs: 8, Instructions: 46stringlibraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FFE126DDC46
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDC5C
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDC69
LoadLibraryA.KERNEL32 ref: 00007FFE126DDC73
GetWindowsDirectoryA.KERNEL32 ref: 00007FFE126DDC8B
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDCA1
strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDCAE
LoadLibraryA.KERNEL32 ref: 00007FFE126DDCB8

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcat$DirectoryLibraryLoad$SystemWindows
String ID:
API String ID: 2238065251-0
Opcode ID: d59b01e3f508392ccfa83d675326aa62b26bda73e4f11aeefca0b2d87ed88e34
Instruction ID: 0928a2a2bef46a7b66f0954ec0db2280fd8e0de770be3102da67366484cdc4eb
Opcode Fuzzy Hash: d59b01e3f508392ccfa83d675326aa62b26bda73e4f11aeefca0b2d87ed88e34
Instruction Fuzzy Hash: 43112E22618D4682EA21EB13EC502FA6370FF9C794F840175DA9D866F9EFACD604C700

Function 00007FFE126D7BA4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 299stringCOMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 00007FFE126D7DC9
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D7E3C

Strings

%s.format, xrefs: 00007FFE126D7EE6
%s.display, xrefs: 00007FFE126D7DB8

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: __swprintf_lstrcmp
String ID: %s.display$%s.format
API String ID: 4285305246-1189948043
Opcode ID: 5493930c41b7e01e36c56ca0a672234c0b5dcf8c5c9a5ed92e44d1896150fc43
Instruction ID: 30a1dec3d7287df93c9e45e6bef631b10180adc6d0783cbdb9bc8742ecac38d0
Opcode Fuzzy Hash: 5493930c41b7e01e36c56ca0a672234c0b5dcf8c5c9a5ed92e44d1896150fc43
Instruction Fuzzy Hash: D7B13066706F8982DE559F23E8283A963A1FB49FD4F489036DE4E077A8DE7CD449C301

Function 00007FFE1A461D34 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

JVM_GetMethodIxExceptionTableEntry.JVM ref: 00007FFE1A461DF6
JVM_GetCPClassNameUTF.JVM ref: 00007FFE1A461EC6

Strings

Stack size too large, xrefs: 00007FFE1A461F63
catch_type not a subclass of Throwable, xrefs: 00007FFE1A461F73
Illegal exception table range, xrefs: 00007FFE1A461F53
Illegal exception table handler, xrefs: 00007FFE1A461F80

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: ClassEntryExceptionMethodNameTable
String ID: Illegal exception table handler$Illegal exception table range$Stack size too large$catch_type not a subclass of Throwable
API String ID: 2764993686-3737619947
Opcode ID: 082fa6ec13affb624f93eccab37c4caa853017e609c0e7f74e666763f7dff133
Instruction ID: 26c2d0ccda7ac11719ec8e9fe392825393c6d4d99330ffa1378d87d22ae804e3
Opcode Fuzzy Hash: 082fa6ec13affb624f93eccab37c4caa853017e609c0e7f74e666763f7dff133
Instruction Fuzzy Hash: 8B519D32B09B4186EB58DB1B91846B973B0FB48F90F5040B2EE6D87B65CF7DE4618B00

Function 00007FFE1A464D84 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 142COMMON

Download Yara Rule

Strings

Illegal instruction found at offset %d, xrefs: 00007FFE1A465895
Code stops in the middle of instruction starting at offset %d, xrefs: 00007FFE1A465882
Illegal constant pool index, xrefs: 00007FFE1A465413
Illegal type in constant pool, xrefs: 00007FFE1A465406
Array with too many dimensions, xrefs: 00007FFE1A464F55

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: longjmp$jio_vsnprintf$__acrt_iob_funcjio_fprintf
String ID: Array with too many dimensions$Code stops in the middle of instruction starting at offset %d$Illegal constant pool index$Illegal instruction found at offset %d$Illegal type in constant pool
API String ID: 3794060502-1811465325
Opcode ID: cd3babd626374e01ab28e2e38cd4b548cc8859ef828e5cd9070a49ac103c80b5
Instruction ID: 528fe02136baf18a2339de8eed51a0d596787dff3158ef48c388f6693606fb1e
Opcode Fuzzy Hash: cd3babd626374e01ab28e2e38cd4b548cc8859ef828e5cd9070a49ac103c80b5
Instruction Fuzzy Hash: 8941FB72F0C94246EEB59A27D55437915A2EF09FA4F0500F7DE2D077A7CD2CE5208244

Function 00007FFE13212328 Relevance: 10.6, APIs: 7, Instructions: 117COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212418
memset.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212426
memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212438
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE1321246C
memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212476
memset.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212484
memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE13212A30,?,?,00000000,00007FFE13215826), ref: 00007FFE13212494

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: memmove$memset$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3802980928-0
Opcode ID: ab1676f4613d5929e73ddd5a5e1497729e0513e29030f9efa34d5d2f2fe8c048
Instruction ID: 79016b4f17c1152f513a028e6c2e37bcc29ec49b227c2367bc616550293d9373
Opcode Fuzzy Hash: ab1676f4613d5929e73ddd5a5e1497729e0513e29030f9efa34d5d2f2fe8c048
Instruction Fuzzy Hash: A241CD62708F8199EE14EB17E6441AA6362FB95BF0F440631EA6D17BEADF7CE041C304

Function 00007FFE126DAF5C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32 ref: 00007FFE126DAFB3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DAFC5
RegQueryValueExA.ADVAPI32 ref: 00007FFE126DAFF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DB001
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DB04C

Strings

native memory allocation failed, xrefs: 00007FFE126DB06C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: QueryValuefree$malloc
String ID: native memory allocation failed
API String ID: 556778661-1955051095
Opcode ID: e4be5b02ce675524da0c4db494a4f6936e1dfbe5e3b9e58c82446520c2109936
Instruction ID: 3bb3ad450d77983667b6ee72633e89cfb7c3d9f76981037e838e9acc0a7022f4
Opcode Fuzzy Hash: e4be5b02ce675524da0c4db494a4f6936e1dfbe5e3b9e58c82446520c2109936
Instruction Fuzzy Hash: 62316F22618F8986EB50CB27A814A6E63A0FB88FD4F444071EE8D07BA8EF7CD4058700

Function 00007FFE126D4698 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStrings.KERNEL32(?,?,?,?,00000000,00007FFE126D464D), ref: 00007FFE126D46E6
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,00000000,00007FFE126D464D), ref: 00007FFE126D4751
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,00000000,00007FFE126D464D), ref: 00007FFE126D4776

Strings

GetEnvironmentStrings failed, xrefs: 00007FFE126D46F4
([B)V, xrefs: 00007FFE126D46C3
<init>, xrefs: 00007FFE126D46CA

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID: ([B)V$<init>$GetEnvironmentStrings failed
API String ID: 3328510275-3866858519
Opcode ID: 4c1e1b926d410351de5e2d41a5460d1b23328acae78044c0eda99562865a5a2a
Instruction ID: aa3837d3a7b335da3a5cf3ad6669711cc753c01a8337d1aa5fd32dc63ae6a20f
Opcode Fuzzy Hash: 4c1e1b926d410351de5e2d41a5460d1b23328acae78044c0eda99562865a5a2a
Instruction Fuzzy Hash: BD216225A09F9A82EA558F17AC502B967A0FF46FE4F094071DD8E077A5DE7DD4068700

Function 00007FF650F115C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF650F115CF
FlsGetValue.KERNEL32 ref: 00007FF650F115E4
FlsSetValue.KERNEL32 ref: 00007FF650F11605
FlsSetValue.KERNEL32 ref: 00007FF650F11632
FlsSetValue.KERNEL32 ref: 00007FF650F11643
FlsSetValue.KERNEL32 ref: 00007FF650F11654
SetLastError.KERNEL32 ref: 00007FF650F1166F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fa3af5a8c53bf98c9d1f855d28cff95dfa1d0452699b13867a641d19253d6035
Instruction ID: f407f415da1b9ccf6883ac705384701db9a6bb86d60f92acc9ef63f1e015209b
Opcode Fuzzy Hash: fa3af5a8c53bf98c9d1f855d28cff95dfa1d0452699b13867a641d19253d6035
Instruction Fuzzy Hash: 7A215864F0C24372FA68A721EA6217A61526F84BB0F0C4734ED3EE7BC6DE2DF8454640

Function 00007FFE126D4998 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D49D0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D49DE
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D49FE
CreateFileW.KERNEL32 ref: 00007FFE126D4A40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D4A4C

Strings

CreateFileW, xrefs: 00007FFE126D4A58

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CreateFilefreemallocwcscpywcslen
String ID: CreateFileW
API String ID: 3008143036-2716854569
Opcode ID: 6fe7d81cdaf26b7c3bb343cf7791e6f9047ece41dac53a9efc5beba60aed4a44
Instruction ID: 3080621d19cb2ccbd2e164db776344b3c2f98d549adee83a1043bc1a2ad10fa2
Opcode Fuzzy Hash: 6fe7d81cdaf26b7c3bb343cf7791e6f9047ece41dac53a9efc5beba60aed4a44
Instruction Fuzzy Hash: 55213E65A08F9A82EA10DB17AD142696351EB85FF0F584274DE6E07BE8DF7CD9058700

Function 00007FF650F1BFEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF650F1C01D
GetLastError.KERNEL32 ref: 00007FF650F1C029
CloseHandle.KERNEL32 ref: 00007FF650F1C041
CreateFileW.KERNEL32 ref: 00007FF650F1C06C
WriteConsoleW.KERNEL32 ref: 00007FF650F1C08B

Strings

CONOUT$, xrefs: 00007FF650F1C04D

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 61a37418cc8ff3c0a35a55f0ebc28da284ef7b3f7b31195f586089eb32653b48
Instruction ID: 27e13ef59885c25c45b21f27682e60e6207bf14b6b88f4761ddda78c570254c5
Opcode Fuzzy Hash: 61a37418cc8ff3c0a35a55f0ebc28da284ef7b3f7b31195f586089eb32653b48
Instruction Fuzzy Hash: 05114961A1CA8396E7508B56E854329A3A4BB98FE4F084234EE5DE7794DF7CD9088740

Function 00007FFE126DB4D8 Relevance: 10.5, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB4F3
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB522
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB534
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB54A
wcscat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB556

Strings

\\?\, xrefs: 00007FFE126DB540
\\?\UNC, xrefs: 00007FFE126DB52A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: wcscpy$mallocwcscat
String ID: \\?\$\\?\UNC
API String ID: 3324911227-2523517826
Opcode ID: d1ae37bff6f0936244fced8d55b8f8950587e1f97014a930006262e1592aeaa2
Instruction ID: 2ecfcac47783e0d31fb7f8ead0ecb3986502e93b38b58c011085d1c5bafbbe7d
Opcode Fuzzy Hash: d1ae37bff6f0936244fced8d55b8f8950587e1f97014a930006262e1592aeaa2
Instruction Fuzzy Hash: 20113011E08A4A82EF14DF52A94453863A1AF48BE5B048079CA5D077A8EFFCE4858300

Function 00007FFE126D9E70 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE126D9EC6
GetProcAddress.KERNEL32 ref: 00007FFE126D9EDC

Strings

java/io/File, xrefs: 00007FFE126D9E79
path, xrefs: 00007FFE126D9E95
Ljava/lang/String;, xrefs: 00007FFE126D9E8E
GetFinalPathNameByHandleW, xrefs: 00007FFE126D9ED5

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetFinalPathNameByHandleW$Ljava/lang/String;$java/io/File$path
API String ID: 1646373207-3239406034
Opcode ID: 9f6132240895230a1dd55f3a07e32bde63dc5438ce216729a8d86962c25d6eb4
Instruction ID: 1783b56fbda9e6e84834e481c71e31dffcf4cb623da3f3ff88a0dd732030f5dd
Opcode Fuzzy Hash: 9f6132240895230a1dd55f3a07e32bde63dc5438ce216729a8d86962c25d6eb4
Instruction Fuzzy Hash: 4301E460A19E4B82EE00CB63AC546A923A1FF48BA4F0810B6C94D473F8EEBDE444C750

Function 00007FFE1320FAD0 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1320FB89

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 37ef44d73613fa637cd5931db9e282469f942bc8d6bbf53949da0148d4e9ee1e
Instruction ID: 48b2f8fcb105544f3e607ff584ad0d8d55c037ec69205812bcbaca8f055b511d
Opcode Fuzzy Hash: 37ef44d73613fa637cd5931db9e282469f942bc8d6bbf53949da0148d4e9ee1e
Instruction Fuzzy Hash: 1E817C72605E41DCEB50DF26D4907AC33A1FBA8BA8F545272EA5E57BA8DF38D548C300

Function 00007FFE126D18FC Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1972
VerifyFixClassname.VERIFY ref: 00007FFE126D19E4
JVM_DefineClassWithSource.JVM ref: 00007FFE126D1A2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1A4C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1A64
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1A6D

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: free$ClassClassnameDefineSourceVerifyWithmalloc
String ID:
API String ID: 1506554187-0
Opcode ID: 5ecb2c1e4bff8d010fcb51adb53c8a2faca3d63e9a22c30ee6569d3b7872c0fd
Instruction ID: 40d46ab27ffa41d5baf1b55a9693f8545f48d362a7b4c959efbb59b489f346a8
Opcode Fuzzy Hash: 5ecb2c1e4bff8d010fcb51adb53c8a2faca3d63e9a22c30ee6569d3b7872c0fd
Instruction Fuzzy Hash: 8E416312B09E8D86FE659B13AC1077A5291BF89FE4F4840B1DD8D177E4DFBCE5068610

Function 00007FFE13202A7C Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

_Xp_setw.LIBCPMT ref: 00007FFE13202AE3
_Xp_movx.LIBCPMT ref: 00007FFE13202AF3

Part of subcall function 00007FFE13204990: memmove.VCRUNTIME140(?,?,00000004,00007FFE13202AF8), ref: 00007FFE132049A6

Part of subcall function 00007FFE13204920: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FFE13202B08), ref: 00007FFE13204951

_Xp_mulx.LIBCPMT ref: 00007FFE13202B23
_Xp_movx.LIBCPMT ref: 00007FFE13202B36
_Xp_mulx.LIBCPMT ref: 00007FFE13202B51
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13202BAF

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemmove
String ID:
API String ID: 1646541708-0
Opcode ID: fbe8a88868b665d4309cbe054d2a8286b12580c86b6c0d59b7eba0ca7af31215
Instruction ID: 32e2dd90620ae628c3327158db122e313b2ae6c0cc55ff16ee655de5125656fe
Opcode Fuzzy Hash: fbe8a88868b665d4309cbe054d2a8286b12580c86b6c0d59b7eba0ca7af31215
Instruction Fuzzy Hash: AC418D22B08E028DF311BF6794512BD63A0AFE6764F6142B2DA4D376B5DF3CA54AC600

Function 00007FFE132041E8 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

_Xp_setw.LIBCPMT ref: 00007FFE1320424F
_Xp_movx.LIBCPMT ref: 00007FFE1320425F

Part of subcall function 00007FFE13204990: memmove.VCRUNTIME140(?,?,00000004,00007FFE13202AF8), ref: 00007FFE132049A6

Part of subcall function 00007FFE13204920: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FFE13202B08), ref: 00007FFE13204951

_Xp_mulx.LIBCPMT ref: 00007FFE1320428F
_Xp_movx.LIBCPMT ref: 00007FFE132042A2
_Xp_mulx.LIBCPMT ref: 00007FFE132042BD
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1320431B

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemmove
String ID:
API String ID: 1646541708-0
Opcode ID: 45cdee77e7545dfb4ac0ef30fcf84e3151481f7f1e52e181642e42e439e35c8f
Instruction ID: 592b6d27ef6060516509da2763c1d3478324791096b61e695f9c09b6f6a4d78b
Opcode Fuzzy Hash: 45cdee77e7545dfb4ac0ef30fcf84e3151481f7f1e52e181642e42e439e35c8f
Instruction Fuzzy Hash: F8416E22F08E018DF711BB67A4512BD6360AFE5764FA182B1DE4D376B5DF38A54ACA00

Function 00007FFE13203284 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

_FXp_setw.LIBCPMT ref: 00007FFE132032E3
_FXp_movx.LIBCPMT ref: 00007FFE132032F3

Part of subcall function 00007FFE13203AC8: memmove.VCRUNTIME140(?,00000004,00000004,00007FFE132032F8), ref: 00007FFE13203ADE

Part of subcall function 00007FFE13203A50: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FFE13203308), ref: 00007FFE13203A84

_FXp_mulx.LIBCPMT ref: 00007FFE13203325
_FXp_movx.LIBCPMT ref: 00007FFE1320333A
_FXp_mulx.LIBCPMT ref: 00007FFE13203358
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE132033B3

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemmove
String ID:
API String ID: 1646541708-0
Opcode ID: 46f50b73c82e49e8af2879a4f3962c67271bb0fc27e978c102ab5c68021049db
Instruction ID: 3e68a279be37e8b485d3f82fa0e9003e82cc178ce6f7d9d3240dc4b3a1bf9f36
Opcode Fuzzy Hash: 46f50b73c82e49e8af2879a4f3962c67271bb0fc27e978c102ab5c68021049db
Instruction Fuzzy Hash: ED419322A18E459AE211BB2BA4421BF6250BFE4760F584271EB4D376B5DF3CE64DC740

Function 00007FF650F11738 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F11747
FlsSetValue.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F1177D
FlsSetValue.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F117AA
FlsSetValue.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F117BB
FlsSetValue.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F117CC
SetLastError.KERNEL32(?,?,00000000,00007FF650F09C91,?,?,?,?,00007FF650F0E0B6,?,?,00000001,00007FF650F0C4B4), ref: 00007FF650F117E7

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8ac39f0b551b0f7bed7eff1c7116ff4f110f6babe48a270f6df1b9dd0efa0caa
Instruction ID: 735302f7802048d75511545db20fa34c567b28154db23aeb23d26ac6bca8e440
Opcode Fuzzy Hash: 8ac39f0b551b0f7bed7eff1c7116ff4f110f6babe48a270f6df1b9dd0efa0caa
Instruction Fuzzy Hash: 76116D68E0D24372FA54A735E96253A51926F44BB0F1C0734EC3EE7BD6EE2CF8454240

Function 00007FFE126E0134 Relevance: 9.1, APIs: 6, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E0160
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E0181
strcat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E0195
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E01A2
strcat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E01B7
strcat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126D1F0B,?,?,?,?,?,?,?,00007FFE126D1670), ref: 00007FFE126E01C2

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcat$strcpystrncpystrrchr
String ID:
API String ID: 1954989411-0
Opcode ID: 59d2e3c5ac19230995e6413e25fe1ade81acf1b0e246e018d3759074151466fb
Instruction ID: 745e490eb852187ca0c8dc652227901d0089c4b12e680e8b78e32f3702292e06
Opcode Fuzzy Hash: 59d2e3c5ac19230995e6413e25fe1ade81acf1b0e246e018d3759074151466fb
Instruction Fuzzy Hash: 00117050B19F4285EE04DB139E542B96761AF96FE0F4841B1DE4D1FBEADEBCE0428301

Function 00007FFE13201950 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201959
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1320196B
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1320197A
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132019E0
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132019EE
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13201A01

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: __pctype_func$___lc_codepage_func___lc_locale_name_func_wcsdupcalloc
String ID:
API String ID: 490008815-0
Opcode ID: c26570a5175e310c7c67cec82136f633dba3ba5588f44644c2c5e5ceca30bf29
Instruction ID: f86158eda005a5225c703ae494ba451735add31986e76d16e9e5ae97fee9d8de
Opcode Fuzzy Hash: c26570a5175e310c7c67cec82136f633dba3ba5588f44644c2c5e5ceca30bf29
Instruction Fuzzy Hash: D2212A66D08F8586E7019F39C5052B83360FBB9B58F15A360DE8926262EF39F2D9C340

Function 00007FFE126D3D78 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D3D8D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D3E1C
_cwprintf_s_l.LIBCMT ref: 00007FFE126D3E4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D3E68

Strings

null, xrefs: 00007FFE126D3DD5

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: __acrt_iob_func_cwprintf_s_lfreemalloc
String ID: null
API String ID: 1022940937-634125391
Opcode ID: 9260c71d98dbc860299550fee1d13d8d2299e56c4b155bc3a667898ba57cccdb
Instruction ID: c0a2d57cebcde9ffc8c6fd140dd41f12d822d54c99d14258182b507f7985e0aa
Opcode Fuzzy Hash: 9260c71d98dbc860299550fee1d13d8d2299e56c4b155bc3a667898ba57cccdb
Instruction Fuzzy Hash: 8821AD62609F8586EA148B17AD441BAA761EF99FE0F088071DE8D07BA9EE7CD0418B00

Function 00007FFE126D3D44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D3D59
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D3E1C
_cwprintf_s_l.LIBCMT ref: 00007FFE126D3E4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D3E68

Strings

null, xrefs: 00007FFE126D3DD5

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: __acrt_iob_func_cwprintf_s_lfreemalloc
String ID: null
API String ID: 1022940937-634125391
Opcode ID: 04bd31623f9e20d0a01fe80a07af40b596c1c5ce2a76416bfcde26bc44966345
Instruction ID: 7ce79a235780e47ef49ea36016072dcffc738ef0e7382b6e8cef9af7e5f61c9c
Opcode Fuzzy Hash: 04bd31623f9e20d0a01fe80a07af40b596c1c5ce2a76416bfcde26bc44966345
Instruction Fuzzy Hash: BA21BF62709F8586EA14CB17ED4417AA761EF99FE0F088071DF8D07BA9EE7CD0418B00

Function 00007FFE1320C0E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FFE1320C0FE
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1320C10F
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215DA0
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215DB2
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215E3B

Strings

bad locale name, xrefs: 00007FFE1320C0F2

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: setlocale$ExceptionThrowstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1847144839-1405518554
Opcode ID: 69bcb2bf6b235ff80315e2b808b356e45497ea8affdba11730961c61ec674efe
Instruction ID: a2a1d1e14887b00b7c718beefd1e75dad39e834008b9f4f0f79e5c855c848760
Opcode Fuzzy Hash: 69bcb2bf6b235ff80315e2b808b356e45497ea8affdba11730961c61ec674efe
Instruction Fuzzy Hash: 54210762E0CF42CDEA30BB1799440BA6251AFF0BA0F5C40F1D94D676B6EE2CE585C340

Function 00007FFE1A4C440F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C442C

Part of subcall function 00007FFE1A4C47B0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4C2B51), ref: 00007FFE1A4C4825
Part of subcall function 00007FFE1A4C47B0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4C2B51), ref: 00007FFE1A4C4857

_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C444F
RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4C447F
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C44C2
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C44E5
_CxxThrowException.LIBVCRUNTIME ref: 00007FFE1A4C4508

Strings

Bad dynamic_cast!, xrefs: 00007FFE1A4C4432
Access violation - no RTTI data!, xrefs: 00007FFE1A4C440F

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: Exception$Throw$FileHeader$Raise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 2819531018-3176238549
Opcode ID: 90cb39e335b400c16a10e85bcf0cced7481b2ddd4c165254aafbaafa962d782f
Instruction ID: e425fed1047d002b3e78acbb8bda8495f9eafd7d03a5742dffb57626765220d4
Opcode Fuzzy Hash: 90cb39e335b400c16a10e85bcf0cced7481b2ddd4c165254aafbaafa962d782f
Instruction Fuzzy Hash: 0C014C61B2AE4691EF00DB16E5451786360EF80FA4FD050F2D64E066BEEF6CE568C304

Function 00007FFE1320F8C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FFE1320F917
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1320F928

Strings

ios_base::failbit set, xrefs: 00007FFE1320F8EB
ios_base::eofbit set, xrefs: 00007FFE1320F8F2
ios_base::badbit set, xrefs: 00007FFE1320F8E0

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 76c8ab17d0850bfdcf0f794a817e6ee97031519e73788a0652dc125c2d8a2d96
Instruction ID: 17fe99878b7f03180b99762561308cba9ea8f03b7f5968b6b348c87423b55571
Opcode Fuzzy Hash: 76c8ab17d0850bfdcf0f794a817e6ee97031519e73788a0652dc125c2d8a2d96
Instruction Fuzzy Hash: 7601F762B189069EEE14E706D4415FD2361EFE0358FA40070C21D67674EF7CE10EC340

Function 00007FFE126DEF80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FFE126DEF49), ref: 00007FFE126DEF99

Part of subcall function 00007FFE126DF77C: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000000,00000000,00007FFE126DEFE6,?,?,?,00007FFE126DEF49), ref: 00007FFE126DF7B2

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FFE126DEF49), ref: 00007FFE126DEFCB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DEF49), ref: 00007FFE126DEFE9

Strings

%s: is NULL, xrefs: 00007FFE126DEFA2
%s: %s, xrefs: 00007FFE126DEFD4

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintffree
String ID: %s: %s$%s: is NULL
API String ID: 3720189618-2688301646
Opcode ID: 137e260fc552ecb51fbe70a088bd5ce2063345ef78910dd6a1fb0398613b4e15
Instruction ID: bb7dc4b4f8915366510aeed62939d1912e86ae63bffe382b45a001c241649733
Opcode Fuzzy Hash: 137e260fc552ecb51fbe70a088bd5ce2063345ef78910dd6a1fb0398613b4e15
Instruction Fuzzy Hash: D8F0A951E09F4A82EE08D75BFC855B822509F0ABE0F0440B4ED4D077E6EEACE5448300

Function 00007FF650EF602C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF650EF604F
GetProcAddress.KERNEL32 ref: 00007FF650EF6068

Strings

JVM_FindClassFromBootLoader, xrefs: 00007FF650EF605E, 00007FF650EF607A
jvm.dll, xrefs: 00007FF650EF6048
Error: loading: %s, xrefs: 00007FF650EF6081

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Error: loading: %s$JVM_FindClassFromBootLoader$jvm.dll
API String ID: 1646373207-1240634009
Opcode ID: 5803d9571d36c904f13919965812908100f48aa1b336726ff321a8c2e6fe5837
Instruction ID: 250bf0c14fcb943c2c7fd355a2809f9c88e121eb2009bd70b6d080966aaddbf2
Opcode Fuzzy Hash: 5803d9571d36c904f13919965812908100f48aa1b336726ff321a8c2e6fe5837
Instruction Fuzzy Hash: 75F03CA0A1EA43B2EE54CB25FC551346265AF497C4BAC4435CD0DE7364EE6CE5898300

Function 00007FF650F02AB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF650F02ADD
GetProcAddress.KERNEL32 ref: 00007FF650F02AF3
FreeLibrary.KERNEL32 ref: 00007FF650F02B1A

Strings

mscoree.dll, xrefs: 00007FF650F02AD4
CorExitProcess, xrefs: 00007FF650F02AEC

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 65c1f1bd96f8f687bd1b9d6e00296851f643bf00bf6a932f220a1bbe62acf52d
Instruction ID: 96d1bc342e2d6677b03265ebd02b54dc2ea570ee233aa560bb9569faf466d14b
Opcode Fuzzy Hash: 65c1f1bd96f8f687bd1b9d6e00296851f643bf00bf6a932f220a1bbe62acf52d
Instruction Fuzzy Hash: 31F06DA1B1DA07A1FB108F24E8653396320AF887A5F980635DE6E973F4CF6CE1488710

Function 00007FFE1321A9B0 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

fgetwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321AA6F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: fgetwc
String ID:
API String ID: 2948136663-0
Opcode ID: 7b092b86c2f800b45fcf13971108f149f52e97cd8681566c45f30ae54ea6449e
Instruction ID: 839813e9ff7e3223de589d87460d4299199de1307199a6d9e73e3cdb72055eac
Opcode Fuzzy Hash: 7b092b86c2f800b45fcf13971108f149f52e97cd8681566c45f30ae54ea6449e
Instruction Fuzzy Hash: 52813E72604F85CDEB509F2AC5903AC33A1FBA8BA8F505272EA5E577A9DF38D544C310

Function 00007FFE1A461914 Relevance: 7.6, APIs: 5, Instructions: 136stringCOMMON

Download Yara Rule

APIs

JVM_GetClassNameUTF.JVM(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461943
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A4619CC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A41
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A4A
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A461A60

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: ClassNamemallocstrcmpstrcpystrlen
String ID:
API String ID: 2986649934-0
Opcode ID: 7dd38abdaf8c4ca1cdf08ee94cf0a75ee206544b9cb2624f89444c92db5a87a0
Instruction ID: 3e94435b189c92d52f862a948a0d494adcee416d968ea2693d816a006164e792
Opcode Fuzzy Hash: 7dd38abdaf8c4ca1cdf08ee94cf0a75ee206544b9cb2624f89444c92db5a87a0
Instruction Fuzzy Hash: AE419E62B08B8282EA48DF2B98145B977B0FB85FD4B4441BADE6D477A5DF3CE521C300

Function 00007FFE126DBE80 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FFE126D26FD), ref: 00007FFE126DBF10

Strings

Write error, xrefs: 00007FFE126DBFD9
Stream Closed, xrefs: 00007FFE126DBFEA
java/lang/IndexOutOfBoundsException, xrefs: 00007FFE126DC011

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: malloc
String ID: Stream Closed$Write error$java/lang/IndexOutOfBoundsException
API String ID: 2803490479-3284941142
Opcode ID: ea24218f7d7fb715913f21d7cbbf0eb4fcf7877a939b311e33933810462b0089
Instruction ID: 8e32dd6dbeab8ea1372239340771949cc7c1bcb85cc9c8ad41dd0a61ba13638f
Opcode Fuzzy Hash: ea24218f7d7fb715913f21d7cbbf0eb4fcf7877a939b311e33933810462b0089
Instruction Fuzzy Hash: 5C41E122B09F8E86FA20AB279D547BD5251AF45FF0F4481B1DE9D037F9EEACE4458200

Function 00007FFE126DC908 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC95E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC9EB
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC9FF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCA43

Strings

native memory allocation failed, xrefs: 00007FFE126DC9CC, 00007FFE126DCA6A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: malloc$wcscpywcslen
String ID: native memory allocation failed
API String ID: 365105309-1955051095
Opcode ID: 0312693981bff92a31e3c3b07e780c0b96b05620e26bc2e78e65e5c739919215
Instruction ID: d40c75f859598bee8fc4fe9fbeb691b52d7edd50248fb42da879af8bb3a7f989
Opcode Fuzzy Hash: 0312693981bff92a31e3c3b07e780c0b96b05620e26bc2e78e65e5c739919215
Instruction Fuzzy Hash: E2416011A09F4E82EE64DB57995037863A1BF49BE0F0480B5CE8D477E9EFACE4468301

Function 00007FFE126DA39C Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFE126DA3EA
SetFileAttributesW.KERNEL32 ref: 00007FFE126DA444

Part of subcall function 00007FFE126DA69C: CreateFileW.KERNEL32 ref: 00007FFE126DA6F0
Part of subcall function 00007FFE126DA69C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA708
Part of subcall function 00007FFE126DA69C: GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA72B
Part of subcall function 00007FFE126DA69C: realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA740
Part of subcall function 00007FFE126DA69C: GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA75A
Part of subcall function 00007FFE126DA69C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA7EC
Part of subcall function 00007FFE126DA69C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA83E
Part of subcall function 00007FFE126DA69C: GetLastError.KERNEL32 ref: 00007FFE126DA857
Part of subcall function 00007FFE126DA69C: CloseHandle.KERNEL32 ref: 00007FFE126DA862

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA413
GetFileAttributesW.KERNEL32 ref: 00007FFE126DA41F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA457

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$AttributesHandlefree$FinalNamePathmalloc$CloseCreateErrorLastrealloc
String ID:
API String ID: 727762310-0
Opcode ID: 2c69e8724eaabf4ecc91385c2ae641e51d1c68c099f8020962e365cba21b48ba
Instruction ID: 3c6be7460f9c389bee8ba4596051baf35782f36c9c5ab818f0bde9b3c7e7970b
Opcode Fuzzy Hash: 2c69e8724eaabf4ecc91385c2ae641e51d1c68c099f8020962e365cba21b48ba
Instruction Fuzzy Hash: 03218421A0CE8A47EA248B276C4817D5691AF85BB0F1845B0DD9E57BF5DEBCFC068300

Function 00007FFE126DD8E8 Relevance: 7.6, APIs: 6, Instructions: 61stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD913

Part of subcall function 00007FFE126DD33C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD384
Part of subcall function 00007FFE126DD33C: GetLocaleInfoA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3A5
Part of subcall function 00007FFE126DD33C: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3CE
Part of subcall function 00007FFE126DD33C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD3E2
Part of subcall function 00007FFE126DD33C: GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD401
Part of subcall function 00007FFE126DD33C: GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD416
Part of subcall function 00007FFE126DD33C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD429
Part of subcall function 00007FFE126DD33C: GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD448
Part of subcall function 00007FFE126DD33C: GetLocaleInfoA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD45D
Part of subcall function 00007FFE126DD33C: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD471
Part of subcall function 00007FFE126DD33C: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD480
Part of subcall function 00007FFE126DD33C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD488
Part of subcall function 00007FFE126DD33C: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFE126DD4A7

strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD95E
strcat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD97C
strcat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD987
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD99A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE126D2BF3), ref: 00007FFE126DD9AB

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: InfoLocalemalloc$strcpy$freestrcat$strcmpstrlen
String ID:
API String ID: 2739658529-0
Opcode ID: fafe6f6dc6b41defcf0920e378b2a3affc54bee16cbfefa93a652a4469037ead
Instruction ID: 3d8bb8d69e26578c4787ae204ad47041503fa9899e45e2e9330139d916557e77
Opcode Fuzzy Hash: fafe6f6dc6b41defcf0920e378b2a3affc54bee16cbfefa93a652a4469037ead
Instruction Fuzzy Hash: D6218622A18E4986EB00EB17E8401AA7361FF94BE4F451171E9CD077A9CFADE445C740

Function 00007FF650F1C4AC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF650F1C4D4
_set_statfp.LIBCMT ref: 00007FF650F1C4EF
_set_statfp.LIBCMT ref: 00007FF650F1C50B
_set_statfp.LIBCMT ref: 00007FF650F1C547

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction ID: 8bd72a8781e0d7cf5c499c67bdcc1eb53d400459a482c6df395d09f6e598325e
Opcode Fuzzy Hash: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction Fuzzy Hash: F0114FB2E5CA4731F6642129E45637921426F6837CF4C6634ED6EA77DA8E2CFC414184

Function 00007FF650F11800 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF650F0EC43,?,?,00000000,00007FF650F0EEDE,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F1181F
FlsSetValue.KERNEL32(?,?,?,00007FF650F0EC43,?,?,00000000,00007FF650F0EEDE,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F1183E
FlsSetValue.KERNEL32(?,?,?,00007FF650F0EC43,?,?,00000000,00007FF650F0EEDE,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F11866
FlsSetValue.KERNEL32(?,?,?,00007FF650F0EC43,?,?,00000000,00007FF650F0EEDE,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F11877
FlsSetValue.KERNEL32(?,?,?,00007FF650F0EC43,?,?,00000000,00007FF650F0EEDE,?,?,?,?,00000000,00007FF650F0EE6A), ref: 00007FF650F11888

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 61d0e72b13839dc878842927c43137bc2eb843a329077fbdc39997bec07a2bed
Instruction ID: b82897dc360430f01fa32f3a5fb54f4531803e01b7b1b61fe2ab99223c15e024
Opcode Fuzzy Hash: 61d0e72b13839dc878842927c43137bc2eb843a329077fbdc39997bec07a2bed
Instruction Fuzzy Hash: DB116A64E1D24372FB58A725E96217A61526F84BB0F0C8734EC3EB7BD6DE2CF9458200

Function 00007FFE126DC168 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126DC9AB,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC1BA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DC9AB,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC1C5
_wgetcwd.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,00007FFE126DC9AB,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC1E3
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126DC9AB,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC1F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DC9AB,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DC203

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freewcslen$_wgetcwd
String ID:
API String ID: 923213787-0
Opcode ID: aa0464c90f3e983b1f60bec6950778578707bfc53fcf9162172e608c55a23621
Instruction ID: 86233950a769dd6335ee323e96d49167498e914d487858dc3dd235b5e862dcfc
Opcode Fuzzy Hash: aa0464c90f3e983b1f60bec6950778578707bfc53fcf9162172e608c55a23621
Instruction Fuzzy Hash: 2811E960E0DE1F87FF1497676D9807822E1EF54BB4B1440B6D98A422F8EEBCA8459300

Function 00007FF650F11694 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF650F116A5
FlsSetValue.KERNEL32 ref: 00007FF650F116C4
FlsSetValue.KERNEL32 ref: 00007FF650F116EC
FlsSetValue.KERNEL32 ref: 00007FF650F116FD
FlsSetValue.KERNEL32 ref: 00007FF650F1170E

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e3dfbcb81da656c65acc40646fb78d23dae7e3f2844057a05d2138b29bdfc71d
Instruction ID: 64b7d3aed435cfc223fe9c86b2fc7f5a9ae48be6b3eb4b55ab0c88962222199a
Opcode Fuzzy Hash: e3dfbcb81da656c65acc40646fb78d23dae7e3f2844057a05d2138b29bdfc71d
Instruction Fuzzy Hash: FB1139A8E1C20771FA68A725982257A11826F417B0F0C0734DD3EFBBD3DD2CF9454250

Function 00007FFE126DCA9C Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCAC7
_wfullpath.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCADE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCB02
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCB16
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69,?,?,?,?,?,?,?,00007FFE126DC24E), ref: 00007FFE126DCB1F

Part of subcall function 00007FFE126DB4D8: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB4F3
Part of subcall function 00007FFE126DB4D8: wcscpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00007FFE126DCAF3,?,?,00007FFE126DC9C4,?,?,?,00007FFE126DCB69), ref: 00007FFE126DB522

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: malloc$wcscpy$_wfullpathfree
String ID:
API String ID: 4287730431-0
Opcode ID: 1f351ce89198a921438b20c0bcfe65f6eaddff88d54222bb2faa8f92a88cfd20
Instruction ID: 6a090bcc5dc120e761ed6a7da28f292eb63bd36c19f7a6bab2c007f42c5e3f32
Opcode Fuzzy Hash: 1f351ce89198a921438b20c0bcfe65f6eaddff88d54222bb2faa8f92a88cfd20
Instruction Fuzzy Hash: DD116D21B09F4A86EE14CF47BC8807DA3A1AF89FE0B484475DE4D077A8EEBCE4458310

Function 00007FFE126DA47C Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFE126DA4AA
SetFileAttributesW.KERNEL32 ref: 00007FFE126DA4F8

Part of subcall function 00007FFE126DA69C: CreateFileW.KERNEL32 ref: 00007FFE126DA6F0
Part of subcall function 00007FFE126DA69C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA708
Part of subcall function 00007FFE126DA69C: GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA72B
Part of subcall function 00007FFE126DA69C: realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA740
Part of subcall function 00007FFE126DA69C: GetFinalPathNameByHandleW.KERNEL32 ref: 00007FFE126DA75A
Part of subcall function 00007FFE126DA69C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA7EC
Part of subcall function 00007FFE126DA69C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA83E
Part of subcall function 00007FFE126DA69C: GetLastError.KERNEL32 ref: 00007FFE126DA857
Part of subcall function 00007FFE126DA69C: CloseHandle.KERNEL32 ref: 00007FFE126DA862

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA4D1
GetFileAttributesW.KERNEL32 ref: 00007FFE126DA4DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA50A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$AttributesHandlefree$FinalNamePathmalloc$CloseCreateErrorLastrealloc
String ID:
API String ID: 727762310-0
Opcode ID: 340c7df960c3a66594e2588c63a9f1a021c75f5462a35558b2e4c2fef1416bb4
Instruction ID: e58c7376c766a0b0b1377babc89b5258447e237ddd2ca39264975142d72f2c6b
Opcode Fuzzy Hash: 340c7df960c3a66594e2588c63a9f1a021c75f5462a35558b2e4c2fef1416bb4
Instruction Fuzzy Hash: B7118E20E0CE4A46FE158B27AC5417D1290AF89FB8B1945B0DC9E4B7E4DFACEC068344

Function 00007FFE126DA524 Relevance: 7.5, APIs: 5, Instructions: 36fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE126DA556
GetFileInformationByHandle.KERNEL32 ref: 00007FFE126DA56F
GetLastError.KERNEL32 ref: 00007FFE126DA577
CloseHandle.KERNEL32 ref: 00007FFE126DA582
SetLastError.KERNEL32 ref: 00007FFE126DA58E

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ErrorFileHandleLast$CloseCreateInformation
String ID:
API String ID: 1345328482-0
Opcode ID: 9419c6b087e5bc2dc43a46c5340d794c4d9e390771c94c97e00b5f24aea42f77
Instruction ID: 66798d6619b853974293e6a1cd3afe91acbb0f5bb8caf80da0be9724d0d57845
Opcode Fuzzy Hash: 9419c6b087e5bc2dc43a46c5340d794c4d9e390771c94c97e00b5f24aea42f77
Instruction Fuzzy Hash: DC012C61B18B4583EB408B22AE4832D66A1BB88FF0F148670DA69877E0DFBCDC458740

Function 00007FFE126D9A00 Relevance: 7.5, APIs: 5, Instructions: 32fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32 ref: 00007FFE126D9A2B
GetFileAttributesW.KERNEL32 ref: 00007FFE126D9A34
RemoveDirectoryW.KERNEL32 ref: 00007FFE126D9A46
DeleteFileW.KERNEL32 ref: 00007FFE126D9A4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9A5C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemovefree
String ID:
API String ID: 3695524800-0
Opcode ID: 005ba064419c6215ff25736680f353d971abbd21b4cd664acee0394fc8500b74
Instruction ID: f788a9a84af3a63d205b7957927a38938fa8431c6cf8ba0572ebcdd46ce97c40
Opcode Fuzzy Hash: 005ba064419c6215ff25736680f353d971abbd21b4cd664acee0394fc8500b74
Instruction Fuzzy Hash: 67F06211A0DE4A86FA449767AD9427D1252AF45BE0F684170D89D166F4CE6CA8498200

Function 00007FF650F13160 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F13409

Part of subcall function 00007FF650F0DF98: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F0DFB5

Strings

UTF-8, xrefs: 00007FF650F1338C
ccs, xrefs: 00007FF650F13355
UTF-16LEUNICODE, xrefs: 00007FF650F133AD

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 97c63da7abe943ef41316946fa82da65032d02f3cd2c372a942e5c47127534fc
Instruction ID: 48e3dd823cc9983ad3c5fea8f5ce8af7b51a8ae78e7bf5f9525717b70fd8af1e
Opcode Fuzzy Hash: 97c63da7abe943ef41316946fa82da65032d02f3cd2c372a942e5c47127534fc
Instruction Fuzzy Hash: 2A819EB2E0C243A9F7754A29C65427C2B909F12B48F5D9035CE1EF77D9CE2EE8419706

Function 00007FFE1A462198 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A46222D
JVM_FindClassFromClass.JVM(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A462268

Part of subcall function 00007FFE1A463444: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE1A461A32,?,?,?,00000000,?,?,?,00007FFE1A461EDC), ref: 00007FFE1A46348D

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FFE1A46351A,?,?,?,?,?,?,?,00007FFE1A461A32), ref: 00007FFE1A4622C6

Part of subcall function 00007FFE1A4610F0: jio_vsnprintf.JVM(?,?,?,00007FFE1A461791), ref: 00007FFE1A46112D
Part of subcall function 00007FFE1A4610F0: longjmp.VCRUNTIME140(?,?,?,00007FFE1A461791), ref: 00007FFE1A461142
Part of subcall function 00007FFE1A4610F0: longjmp.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1A461791), ref: 00007FFE1A461166
Part of subcall function 00007FFE1A4610F0: jio_vsnprintf.JVM(?,?,?,?,?,?,?,?,?,?,?,00007FFE1A461791), ref: 00007FFE1A4611A9
Part of subcall function 00007FFE1A4610F0: longjmp.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4611BE
Part of subcall function 00007FFE1A4610F0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4611F2
Part of subcall function 00007FFE1A4610F0: jio_fprintf.JVM(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A461202

Strings

Cannot find class %s, xrefs: 00007FFE1A46230E

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: longjmp$Classjio_vsnprintf$FindFrom__acrt_iob_funccallocjio_fprintfmallocstrcmp
String ID: Cannot find class %s
API String ID: 2513069671-1593868937
Opcode ID: da6f6b59f8c57973b4d1b675e1bf952e249d5491f84bb2134d54b1318ce4185f
Instruction ID: bcbf838d16865be675af067797f24f27ad8b1e57ac3336ab8043060d3180fb95
Opcode Fuzzy Hash: da6f6b59f8c57973b4d1b675e1bf952e249d5491f84bb2134d54b1318ce4185f
Instruction Fuzzy Hash: 24418062B08B9186EA48DB2795502B877B1EB44FD0F4540B6DE6D477A5EF3CE562C300

Function 00007FF650EFDDDE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650EFC180: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF650EFC184

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF650EFDE06
RaiseException.KERNEL32 ref: 00007FF650EFDE2F
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF650EFDE90

Strings

csm, xrefs: 00007FF650EFDE63

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 5c108b4e9d1c7f63eab6d6260eebb8b5f8476ca490b38e5ae59f32b827b95f0b
Instruction ID: e7e1f8689a09f20d29894b920195f1a097c326a2c936239de5c146a42728e668
Opcode Fuzzy Hash: 5c108b4e9d1c7f63eab6d6260eebb8b5f8476ca490b38e5ae59f32b827b95f0b
Instruction Fuzzy Hash: 03213C36A0965292E731DF11F14026EB765FB98BA5F280221DF9D97795CF3CE882CB01

Function 00007FFE126DABC8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DABF6
RegEnumKeyExA.ADVAPI32 ref: 00007FFE126DAC3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DAC84

Strings

native memory allocation failed, xrefs: 00007FFE126DAC06

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Enumfreemalloc
String ID: native memory allocation failed
API String ID: 2465150619-1955051095
Opcode ID: 73f9ea48ed4f07e6fb2288c5d295e6601d652c48d2bae71f3f5e5d19e0476014
Instruction ID: 5251e1ab67cc01bd65f559d54bb521438ed73d616b510bf2a57b9676ba42c61a
Opcode Fuzzy Hash: 73f9ea48ed4f07e6fb2288c5d295e6601d652c48d2bae71f3f5e5d19e0476014
Instruction Fuzzy Hash: D3213A32A08B84C7D7508F26A84016AB7A4FB88FD4F494575EE8E43B68DF7CE4158B00

Function 00007FFE126DACA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DACD6
RegEnumValueA.ADVAPI32 ref: 00007FFE126DAD1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DAD64

Strings

native memory allocation failed, xrefs: 00007FFE126DACE6

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: EnumValuefreemalloc
String ID: native memory allocation failed
API String ID: 371016532-1955051095
Opcode ID: 35e4bb2ce3d3108203bd329be17fa7541e3f541c18972b38f00f92797a01317c
Instruction ID: c9767250037d84f115efcddeebac71a204fc59238a79575d549893b40b6d38f7
Opcode Fuzzy Hash: 35e4bb2ce3d3108203bd329be17fa7541e3f541c18972b38f00f92797a01317c
Instruction Fuzzy Hash: 48213A32A18B8486DB508F16A84016AB7A4FB88FD4F494175EE8E43BA8DF7CE4158B00

Function 00007FFE13208884 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00007FFE132088D3
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE132088E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE13208935

Strings

csm, xrefs: 00007FFE132088A3

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: DecodePointerfreeterminate
String ID: csm
API String ID: 1319892530-1018135373
Opcode ID: 6134b3d9ee8e42ecd0a282cc438d3bc65ec7692e143b46020cd19bf630b9a02f
Instruction ID: e44dbb1390561558bf9c46e35614a04da64654af3051d924e0ecd61e281b0143
Opcode Fuzzy Hash: 6134b3d9ee8e42ecd0a282cc438d3bc65ec7692e143b46020cd19bf630b9a02f
Instruction Fuzzy Hash: 8111936290AE4989EF61AB26C09427D3760EFA5F79F144271CA9D273F0DF6CD489C201

Function 00007FFE126D20EC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FFE126D210D
SetConsoleMode.KERNEL32 ref: 00007FFE126D2152

Strings

GetConsoleMode failed, xrefs: 00007FFE126D2117
SetConsoleMode failed, xrefs: 00007FFE126D215C

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ConsoleMode
String ID: GetConsoleMode failed$SetConsoleMode failed
API String ID: 4145635619-875437736
Opcode ID: 245e7091aeeb790ed147d483cda7ecacd3f8deec8fd14d37e9796516690d08a4
Instruction ID: 61ab06f8cd31e3ccf09a35c0b7411520320af5a4b9e474923d6d318b9fdfcc9b
Opcode Fuzzy Hash: 245e7091aeeb790ed147d483cda7ecacd3f8deec8fd14d37e9796516690d08a4
Instruction Fuzzy Hash: 56018825A08E4692FA10CB17EC8017D2710EF857B4F5481B1DB5D077F9CEACD5468700

Function 00007FF650EF7968 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FF650EF797F
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF79D6

Strings

_JAVA_LAUNCHER_DEBUG, xrefs: 00007FF650EF79B8
Expanded wildcards: before: "%s" after : "%s", xrefs: 00007FF650EF79CC

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: strchrwprintf
String ID: Expanded wildcards: before: "%s" after : "%s"$_JAVA_LAUNCHER_DEBUG
API String ID: 4031544228-730970534
Opcode ID: 2de6fc1e13d9ea1403281f85efbbb49db924ecc64ca6d11c8fcca59d7219976a
Instruction ID: e69c6cc688b24f3c7e6f5da5d1815a4efdc36a65b3fbe2eb847e6f9034fd2f16
Opcode Fuzzy Hash: 2de6fc1e13d9ea1403281f85efbbb49db924ecc64ca6d11c8fcca59d7219976a
Instruction Fuzzy Hash: F5F0AF10F1D66360FD14AB12BA911B953589F85BC0F6C9032ED8EABB8BDE7CE4438700

Function 00007FFE126D2BC4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 00007FFE126D2BDD
GetUserDefaultUILanguage.KERNEL32 ref: 00007FFE126D2BE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D2C11

Strings

memory allocation error, xrefs: 00007FFE126D2C19

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: DefaultUser$Languagefree
String ID: memory allocation error
API String ID: 3796525728-4231843585
Opcode ID: b63df859bba28096fff233e4bf17cafca4d77c07dc7f0d99065ebaf4434eb2b5
Instruction ID: fa531935d671a25a8161521d630d3b76a219d139c7c876732d484d4100ab8e9c
Opcode Fuzzy Hash: b63df859bba28096fff233e4bf17cafca4d77c07dc7f0d99065ebaf4434eb2b5
Instruction Fuzzy Hash: B9F0A421A0DE8AC2EA94EB53BC4407D6260AF48BF0F4440B5EA8E077E5DEACE8448700

Function 00007FFE1A4C21B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4C4B10: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4C214E), ref: 00007FFE1A4C4B1E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4C21D8

Strings

MOC, xrefs: 00007FFE1A4C21BF
csm, xrefs: 00007FFE1A4C21C7
RCC, xrefs: 00007FFE1A4C21B7

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 2032ee78bb98908be33bc98ec57f0184f02416d3a6a2d9d4ef717c693c7c64ad
Instruction ID: 72ccde8d458b82b54615b53637f32d6e4a89ba296dddc30967655290d0d1f803
Opcode Fuzzy Hash: 2032ee78bb98908be33bc98ec57f0184f02416d3a6a2d9d4ef717c693c7c64ad
Instruction Fuzzy Hash: BDE03035B18902CAE7542B5291492783264FF84F26FC154F2C60C0336BDFBC69A09B12

Function 00007FFE126DF734 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

_snwprintf_s_l.LIBCMT ref: 00007FFE126DF76A

Strings

NULL, xrefs: 00007FFE126DF740
toString, xrefs: 00007FFE126DF763
()Ljava/lang/String;, xrefs: 00007FFE126DF752

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: _snwprintf_s_l
String ID: ()Ljava/lang/String;$NULL$toString
API String ID: 3077465164-3168986423
Opcode ID: 2354e526947038daaee0da75ec0ebd5e42243e7980dd8bab4296eed4bb857661
Instruction ID: 592bacbf5fd0323ee252d473ba7b35619b3c6b7c304feda373e8a9b1d20114ba
Opcode Fuzzy Hash: 2354e526947038daaee0da75ec0ebd5e42243e7980dd8bab4296eed4bb857661
Instruction Fuzzy Hash: C9E012A6E09F8BC2EE04DB1AED411A52361FF95794F9081B6DD4C067B5EF7C9215C700

Function 00007FFE1A4CC170 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFE1A4CC179

Part of subcall function 00007FFE1A4CB850: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A4CB910
Part of subcall function 00007FFE1A4CB850: RtlUnwindEx.KERNEL32 ref: 00007FFE1A4CB95F

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4CC191

Strings

f, xrefs: 00007FFE1A4CC17E
csm, xrefs: 00007FFE1A4CC184

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwindterminate
String ID: csm$f
API String ID: 2215565074-629598281
Opcode ID: 5b1df027ad24a3acdf7e3c873366a75012bb79f642449c1b4f57e05d3fd8023e
Instruction ID: 0ba561cd6977de575d698f6d99d51cc604d1d97ca5265f409c22f5f595702104
Opcode Fuzzy Hash: 5b1df027ad24a3acdf7e3c873366a75012bb79f642449c1b4f57e05d3fd8023e
Instruction Fuzzy Hash: 7BD0A725F08A4785FF3817B3504523C16945F14F74F84C0F6CA4E062ADDE1E9DF98A16

Function 00007FFE1321E970 Relevance: 6.3, APIs: 4, Instructions: 318stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1321EA14
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1321EA27
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1321EA3C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1321EDA2

Part of subcall function 00007FFE1322F5E4: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FFE1321EBCA), ref: 00007FFE1322F642

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: strcspn$_invalid_parameter_noinfo_noreturnlocaleconvmemmove
String ID:
API String ID: 1669350605-0
Opcode ID: 97cef294c8234e24996934a69e811e08a35bd6dc2cc65fa79cb0f422811af0d6
Instruction ID: 9f18dbee24abd9b2ec83abfb02ec270d54586d978edff4e46af6742b6856146d
Opcode Fuzzy Hash: 97cef294c8234e24996934a69e811e08a35bd6dc2cc65fa79cb0f422811af0d6
Instruction Fuzzy Hash: 8AE19D26B18E8289EB10AF66C9442FC63B1BBA4B64F554171DE4D277A5EF38D54AC300

Function 00007FF650F121CC Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF650F1224B
WriteFile.KERNEL32 ref: 00007FF650F12513
WriteFile.KERNEL32 ref: 00007FF650F12559
GetLastError.KERNEL32 ref: 00007FF650F1260F

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: cc25c0b09400f26902325b928d6d8e38fbee5c8f15c3e185cd2a70761d70bf57
Instruction ID: 1c2437ad012723d2d882719237a23811972a943ea6eec6b657c22983292fa5f8
Opcode Fuzzy Hash: cc25c0b09400f26902325b928d6d8e38fbee5c8f15c3e185cd2a70761d70bf57
Instruction Fuzzy Hash: DDD1E5B2B0C68299E751CFA9D4406AC37B5FB44798B184236CE5DE7B99DE38D426C700

Function 00007FF650F12B8C Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00007FF650F17591,00000000), ref: 00007FF650F12CA8
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00007FF650F17591,00000000), ref: 00007FF650F12D33

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f5cf4ef510a3bc6452a774c41b707bfca2ffc660f09da2340c963cf567714be8
Instruction ID: 728a042254722ff84bac72e628390ef5c53bd238059e7b74f3819bef94e964ae
Opcode Fuzzy Hash: f5cf4ef510a3bc6452a774c41b707bfca2ffc660f09da2340c963cf567714be8
Instruction Fuzzy Hash: 8E919FB2E0C653A5F7A48FA5D4902BD3BA0BB54B98F184139DE0EB7B94DE38D452C700

Function 00007FFE126DE884 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126E0220: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E027E
Part of subcall function 00007FFE126E0220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E0291
Part of subcall function 00007FFE126E0220: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,?,00007FFE126DE8AB,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126E02A8

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126DE9E9

Part of subcall function 00007FFE126DF9B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00007FFE126DE925,?,?,?,?,?,00007FFE126D1629), ref: 00007FFE126DFA18

Strings

java/lang/OutOfMemoryError, xrefs: 00007FFE126DEA45
()[B, xrefs: 00007FFE126DE97C
getBytes, xrefs: 00007FFE126DE983

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: malloc$wcstombs
String ID: ()[B$getBytes$java/lang/OutOfMemoryError
API String ID: 3345184589-156493007
Opcode ID: 7f04db63f83230a4ceac44f7080afb79188ed73854faedd16c7ac00253df0b60
Instruction ID: 6e0daaa082085a6d42c0cf5fff358b4740b073b1d2cb733332ac5e44762c6b60
Opcode Fuzzy Hash: 7f04db63f83230a4ceac44f7080afb79188ed73854faedd16c7ac00253df0b60
Instruction Fuzzy Hash: B2514A21A08F4E82EE549F27AC642B96391BF45FE4F0890B5DE8E177E5DEBCE4058301

Function 00007FFE126D1A9C Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VerifyFixClassname.VERIFY ref: 00007FFE126D1B4D
JVM_DefineClassWithSource.JVM ref: 00007FFE126D1BA4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1BC1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D1BD9

Part of subcall function 00007FFE126D1F60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,00007FFE126D1A07), ref: 00007FFE126D1FAF

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: free$ClassClassnameDefineSourceVerifyWithmalloc
String ID:
API String ID: 1506554187-0
Opcode ID: 46f3096761b298ec19053bdf7f0c44fcb86edf2fced3a295a0d6aeecce56eee6
Instruction ID: 8b0cbac48d2e91c7b336a13567e9e8e30614082178d7e1b37f2f76088ccd495a
Opcode Fuzzy Hash: 46f3096761b298ec19053bdf7f0c44fcb86edf2fced3a295a0d6aeecce56eee6
Instruction Fuzzy Hash: D1318411709E8986EE65DB17AC103BA9291BF89BE4F4440B1DD8D07BE5FEBCD5028600

Function 00007FFE13201B60 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201B7D
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201B87
islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13201BC4
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201BEC

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func__pctype_funcislower
String ID:
API String ID: 2234106055-0
Opcode ID: 07b5da062168d5669a39c56d43f65f3b717084410d52d1df7f7576f4b81ce3ea
Instruction ID: 7c5fb431e17f87fddd87487a7c6aab7ee9af7bdde198bd752ebac554d9a2cefb
Opcode Fuzzy Hash: 07b5da062168d5669a39c56d43f65f3b717084410d52d1df7f7576f4b81ce3ea
Instruction Fuzzy Hash: 7E310C66A0CF418AF7116B17A45037D6651FBE07A1F2400B5EA89177A8EF3CF449C700

Function 00007FFE126D7938 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D7971
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126D7983

Strings

name too long, xrefs: 00007FFE126D79B8
.dll, xrefs: 00007FFE126D7976

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strlen
String ID: .dll$name too long
API String ID: 39653677-1882486534
Opcode ID: bd1b65766f39df255d1be5848e88eef7c9af28de6fb4b63cfa115996eef40333
Instruction ID: ffbd7b06c770bbb150f12b814c5dd3051af8f31c2c01c5768bc20c29a5207255
Opcode Fuzzy Hash: bd1b65766f39df255d1be5848e88eef7c9af28de6fb4b63cfa115996eef40333
Instruction Fuzzy Hash: CE312422714E8A85EA15DB27EC503BA6351FF88BA4F441071DE4E473A5DE7CD145C700

Function 00007FFE13201A20 Relevance: 6.1, APIs: 4, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201A37
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201A41
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13201A77
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13201A9F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func__pctype_funcisupper
String ID:
API String ID: 3857474680-0
Opcode ID: 697f0993e0c5f1d24f9c767484efc03f421657d87d9f7281fdc3a14322cfee9f
Instruction ID: 66b69275edcfa347e57c7eb47909f308b198b13cfd8b4497a5c9ebd465d715a1
Opcode Fuzzy Hash: 697f0993e0c5f1d24f9c767484efc03f421657d87d9f7281fdc3a14322cfee9f
Instruction Fuzzy Hash: 1831D866A0CB828AF7115B17945037D6A51EBF0BA1F2840B5EE89277A5DE3CF588C710

Function 00007FFE1321DB78 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

numpunct.LIBCPMT ref: 00007FFE1321DC41
std::_Facet_Register.LIBCPMT ref: 00007FFE1321DC59
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321DC94
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321DCA5

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesnumpunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 448217422-0
Opcode ID: 3c1d6b78a54c44f3109820ffb5f30ff00c321022ebf7eabf3ec7dc4569d6136e
Instruction ID: f9c4b918d1043b1d2732cb6a16a0a1fa67cd91290dafb1565bf7f732abd82c41
Opcode Fuzzy Hash: 3c1d6b78a54c44f3109820ffb5f30ff00c321022ebf7eabf3ec7dc4569d6136e
Instruction Fuzzy Hash: B5315322A09F46C9EA11BB17E5400B96761FBE4BB0F580AB1D65E277FADF6CE441C700

Function 00007FFE13219BAC Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

ctype.LIBCPMT ref: 00007FFE13219C75
std::_Facet_Register.LIBCPMT ref: 00007FFE13219C8D
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13219CC8
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1321AD6E), ref: 00007FFE13219CD9

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: f00470ad906fe360da248e588a27599a9484419fa2c40968de4492c9eddb5e12
Instruction ID: 993fa96674b2c0ebfb0204ee852b6e520884136e00a11d5a2b1bfb5953c61ca3
Opcode Fuzzy Hash: f00470ad906fe360da248e588a27599a9484419fa2c40968de4492c9eddb5e12
Instruction Fuzzy Hash: 1E314321B0CE0689EB11AB17E5400B967A1EBE97B0F6806B5D69E276F6DF3CF441C740

Function 00007FFE13230384 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

moneypunct.LIBCPMT ref: 00007FFE1323044D
std::_Facet_Register.LIBCPMT ref: 00007FFE13230465
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE132304A0
_CxxThrowException.VCRUNTIME140 ref: 00007FFE132304B1

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 969cec1644bb856d1eac6f1a35742c42c096f944a53fd65e4cc6a2f1d40e8599
Instruction ID: 0e19fb09fd72edf7656ba9bf288a019c5d339b64de1cdbf3896b01f66b74885d
Opcode Fuzzy Hash: 969cec1644bb856d1eac6f1a35742c42c096f944a53fd65e4cc6a2f1d40e8599
Instruction Fuzzy Hash: 39316321A0DF4689EB11AB27E4400B9A361FBE87B0F5846B1DB5E276F5DF2CE546C300

Function 00007FFE1321CBD4 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

messages.LIBCPMT ref: 00007FFE1321CC9D
std::_Facet_Register.LIBCPMT ref: 00007FFE1321CCB5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321CCF0
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321CD01

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 0625cce8056e1fbeafd34c4cc32d65403063833f55f3c25b616fc9f327735a8f
Instruction ID: e8c1cefb972667c8fe47ba68c2d17084775361904bcf1b59731a80f23e3efcfd
Opcode Fuzzy Hash: 0625cce8056e1fbeafd34c4cc32d65403063833f55f3c25b616fc9f327735a8f
Instruction Fuzzy Hash: B2315326A0DF1689EE10AB17E5400B96361EBE4FB0F580671DA5E277F6DE3CE841C740

Function 00007FFE13219A78 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

codecvt.LIBCPMT ref: 00007FFE13219B41
std::_Facet_Register.LIBCPMT ref: 00007FFE13219B59
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13219B94
_CxxThrowException.VCRUNTIME140 ref: 00007FFE13219BA5

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localescodecvtstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3627902316-0
Opcode ID: 9b1c32e4d03cbda99e153f31f72f21e24241e85f2033266064f8f55f5d5db2b3
Instruction ID: a1a93231f7796a9e7e69ff8f08f317aaebd071519de6b48d65716090ef878581
Opcode Fuzzy Hash: 9b1c32e4d03cbda99e153f31f72f21e24241e85f2033266064f8f55f5d5db2b3
Instruction Fuzzy Hash: 26315221A08E4289EB10FB17E5400B96761EBE47B0F6806B5D65E276F6DF2CF545C340

Function 00007FFE13230250 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

messages.LIBCPMT ref: 00007FFE13230319
std::_Facet_Register.LIBCPMT ref: 00007FFE13230331
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1323036C
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1323037D

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: aee45d2215da4ce7b0f3772c3ce5b61431520466d490ceabc17ed64f9b1dc149
Instruction ID: 4569933bfc4c70f8f1252865174a024aa3efa64b747acbd9be6f397fd9dbefd1
Opcode Fuzzy Hash: aee45d2215da4ce7b0f3772c3ce5b61431520466d490ceabc17ed64f9b1dc149
Instruction Fuzzy Hash: 33315722A0DF0689EB11BB17E4400B9A761FBE87B0F584672D65E276F5DF2CE441C700

Function 00007FFE1321DA44 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

messages.LIBCPMT ref: 00007FFE1321DB0D
std::_Facet_Register.LIBCPMT ref: 00007FFE1321DB25
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321DB60
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321DB71

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: d5d33d89c34cbe04dcd739ab9c1e0f669668da78f4d51707938014589a4dc942
Instruction ID: d6ae494e727f897e73bed308fe12beb9ecceb53dabad7298572bf3ca48d49bc8
Opcode Fuzzy Hash: d5d33d89c34cbe04dcd739ab9c1e0f669668da78f4d51707938014589a4dc942
Instruction Fuzzy Hash: 03315022A0CF46C9EA11FB1BE5400B96361EBE47B0F5806B1DA6E276F6DF2CE445C740

Function 00007FFE1321CAA0 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

messages.LIBCPMT ref: 00007FFE1321CB69
std::_Facet_Register.LIBCPMT ref: 00007FFE1321CB81
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321CBBC
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321CBCD

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: f3470c7af5e1219ea517dc311023a40c6ff5171f338326e24b56031dd2e8a965
Instruction ID: 65da58adfac767857fb761fdbc9030761b374100030cf66805d6af087bada218
Opcode Fuzzy Hash: f3470c7af5e1219ea517dc311023a40c6ff5171f338326e24b56031dd2e8a965
Instruction Fuzzy Hash: B231A325A49F1689EE10BB17E5400BA6361FBE4BB0F1806B1DA5E677FADF2CE541C340

Function 00007FFE1321B2C8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

ctype.LIBCPMT ref: 00007FFE1321B391
std::_Facet_Register.LIBCPMT ref: 00007FFE1321B3A9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321B3E4
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1321BA5E), ref: 00007FFE1321B3F5

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: 8a0be3e0796e4bd00e343c49d07b79d543f220f19bcd707963a39a8b0941f0ab
Instruction ID: 5fa1f5fbe8030af3a392a13b2adae0599207e7f6646e750d9252682b14239008
Opcode Fuzzy Hash: 8a0be3e0796e4bd00e343c49d07b79d543f220f19bcd707963a39a8b0941f0ab
Instruction Fuzzy Hash: 01316221A08E0289EB11BB27E5400B96361EFE47B0F6806B6D66E277F6DF6CE451C700

Function 00007FFE1321D30C Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

moneypunct.LIBCPMT ref: 00007FFE1321D3D5
std::_Facet_Register.LIBCPMT ref: 00007FFE1321D3ED
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321D428
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321D439

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 4a1d74a696e101f9418e4c1aea131a48374db2b4b2725ffa4bef69a5475c1a62
Instruction ID: a27d4c573e994b12be21db884722888e9cbe7cc876fd9576e0f98b2bea9f40c2
Opcode Fuzzy Hash: 4a1d74a696e101f9418e4c1aea131a48374db2b4b2725ffa4bef69a5475c1a62
Instruction Fuzzy Hash: AB314231A08F06C9EB15BB27E5400B97761EBE4BB0F5806B2DA5E276F6DE2CE441C740

Function 00007FFE1321B194 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

codecvt.LIBCPMT ref: 00007FFE1321B25D
std::_Facet_Register.LIBCPMT ref: 00007FFE1321B275
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321B2B0
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321B2C1

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localescodecvtstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3627902316-0
Opcode ID: 145bbbc3bc158e60b2dcae730ae36a5f341c077dba051ea11f4e148b8dfc7de4
Instruction ID: 30b4b22fd82017c61d0cd8ea7f8a1e8fb87e552fd9daea77d1e29965e03c0ca1
Opcode Fuzzy Hash: 145bbbc3bc158e60b2dcae730ae36a5f341c077dba051ea11f4e148b8dfc7de4
Instruction Fuzzy Hash: D4317721A08E0289EB15BB17E5400B9A3B1EBE47B0F2806B5D65E277F6DF3CE445C740

Function 00007FFE1321D1D8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

moneypunct.LIBCPMT ref: 00007FFE1321D2A1
std::_Facet_Register.LIBCPMT ref: 00007FFE1321D2B9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321D2F4
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321D305

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 38913df2d96a4eec83f92b864a390790dea28e991f3c948397feb914cf3f0946
Instruction ID: f58f0a1757b9d74c19511b73e75397dff3981da3a07a3c4087f04de2aae93407
Opcode Fuzzy Hash: 38913df2d96a4eec83f92b864a390790dea28e991f3c948397feb914cf3f0946
Instruction Fuzzy Hash: 8C316421A09F06C9EB10BB57E5400B9A361EBE4BB0F580672DA6D276F7DF2CE441C700

Function 00007FFE1321D0A4 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

messages.LIBCPMT ref: 00007FFE1321D16D
std::_Facet_Register.LIBCPMT ref: 00007FFE1321D185
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1321D1C0
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1321D1D1

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: a7b608efc1aee6970888407e30e28b4b43bd13f8e6f74a85ee7bf5bf6733577e
Instruction ID: 54915c504fcc2f6d63955b340f70137a4a070f943cc8a410a3c8ef1003a46fc3
Opcode Fuzzy Hash: a7b608efc1aee6970888407e30e28b4b43bd13f8e6f74a85ee7bf5bf6733577e
Instruction Fuzzy Hash: CD315322A09F46C9EB51BB17E5400B96361EBE4BB0F580672DA5E277F6DE2CE441C740

Function 00007FFE13207380 Relevance: 6.1, APIs: 4, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE132073C7
memmove.VCRUNTIME140 ref: 00007FFE132073EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE132073F8

Part of subcall function 00007FFE132099D0: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFE132071EE), ref: 00007FFE132099FA

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1320746B

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: ___lc_locale_name_funcfreemallocmemmovewcsnlen
String ID:
API String ID: 2626247968-0
Opcode ID: f30811991d692bedc0c7a1c88b05bcfd0119dbfede1abc1abae9bd436faa4321
Instruction ID: a4b1457a6e20e9325a18e90b6e0517b33ff19d490a87f6d4f567d78643287c82
Opcode Fuzzy Hash: f30811991d692bedc0c7a1c88b05bcfd0119dbfede1abc1abae9bd436faa4321
Instruction Fuzzy Hash: 2921E561709F9289E620AB1B640042A9AA0BBA5FF4F544671DEAD277F4DF3CD546C304

Function 00007FFE126E003C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126E006C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126E0083
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126E0103

Strings

java/lang/OutOfMemoryError, xrefs: 00007FFE126E0094

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freemallocstrlen
String ID: java/lang/OutOfMemoryError
API String ID: 1697819315-1651901855
Opcode ID: 061e2e778f8a44c2183a0b4321cc0617913c75eb1fc85178ce4e72fe9c8d472e
Instruction ID: 2c2199be049663ddd2f7ef903374d306073ce6cedbd0f706b5d1bf88d8c784e4
Opcode Fuzzy Hash: 061e2e778f8a44c2183a0b4321cc0617913c75eb1fc85178ce4e72fe9c8d472e
Instruction Fuzzy Hash: 7B21E211B19F9585EA60DB27A8102B923A1FF48BE4F854071DE8E573E5DEBCE442CB40

Function 00007FFE126DFE78 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFEA8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DFEBF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DFF2E

Strings

java/lang/OutOfMemoryError, xrefs: 00007FFE126DFED0

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freemallocstrlen
String ID: java/lang/OutOfMemoryError
API String ID: 1697819315-1651901855
Opcode ID: 6d3a7c07fce36e751c2b5ff0c3b141176c8d0f6e740044af7fe13b8a78dcc8c2
Instruction ID: 8e669feb159a6b72a28af6b25e884c638761075c2e210741bb1fd1f507c09aaa
Opcode Fuzzy Hash: 6d3a7c07fce36e751c2b5ff0c3b141176c8d0f6e740044af7fe13b8a78dcc8c2
Instruction Fuzzy Hash: 2A21F512B19F9A86EA20DB27E8103B96390EF48BE4F850471DE8D877E6DEBCD541C740

Function 00007FFE126DFF60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DFF90
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DFFA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126E0009

Strings

java/lang/OutOfMemoryError, xrefs: 00007FFE126DFFB8

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: freemallocstrlen
String ID: java/lang/OutOfMemoryError
API String ID: 1697819315-1651901855
Opcode ID: 47fe18a6da2c4c21355f5924eb59e4ba49ca4aeb3de2a35473978fcbea717be8
Instruction ID: 8d9c967a9c393d6a373c33e7a2cda51948c1684b28e6c10d97e6a662aa32c91d
Opcode Fuzzy Hash: 47fe18a6da2c4c21355f5924eb59e4ba49ca4aeb3de2a35473978fcbea717be8
Instruction Fuzzy Hash: 48212416B19F9986EA20DB13E9502B92390FF88FE4F854471DE8E877A5DE7CD442C700

Function 00007FFE126D9B60 Relevance: 6.1, APIs: 4, Instructions: 51filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE126D9BAD
GetFileTime.KERNEL32 ref: 00007FFE126D9BC9
CloseHandle.KERNEL32 ref: 00007FFE126D9C10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126D9C19

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$CloseCreateHandleTimefree
String ID:
API String ID: 3089823238-0
Opcode ID: 29a2633ef5610b1aa93f30ae6559819f8befeb47585f1c7519e96d51d30acf36
Instruction ID: 70e438fd9579d1caac78cd7e0259ab320f4155070971ff9625526f9b759d1300
Opcode Fuzzy Hash: 29a2633ef5610b1aa93f30ae6559819f8befeb47585f1c7519e96d51d30acf36
Instruction Fuzzy Hash: 1F116031B18B4587EA10CF2BA94456A77A1FB89BE0F084235EA6D47BE8DF3CD4018B00

Function 00007FFE126DA2C8 Relevance: 6.0, APIs: 4, Instructions: 50filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE126DA320
SetFileTime.KERNEL32 ref: 00007FFE126DA35C
CloseHandle.KERNEL32 ref: 00007FFE126DA372
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126DA37B

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: File$CloseCreateHandleTimefree
String ID:
API String ID: 3089823238-0
Opcode ID: 230860e046f8271c1c427473fcf68141e4cf0e3fe1dad07d9e30f01b2c6a43f0
Instruction ID: b5d4332e449dffac58c47e9a14c9262334692a770d0f5f25096115bb7496f1e1
Opcode Fuzzy Hash: 230860e046f8271c1c427473fcf68141e4cf0e3fe1dad07d9e30f01b2c6a43f0
Instruction Fuzzy Hash: 6111B231B1CB4583EB10CB22A94422A62A1FBC5BE0F040231EEAC47FE8CF7CD4528B40

Function 00007FFE126E9180 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE126E91AC
GetCurrentThreadId.KERNEL32 ref: 00007FFE126E91BA
GetCurrentProcessId.KERNEL32 ref: 00007FFE126E91C6
QueryPerformanceCounter.KERNEL32 ref: 00007FFE126E91D6

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2562e941b5578923e3abb4e5eb8aad6ceab3aaf28c0da42c8b44b0b5f22ccacb
Instruction ID: 416674458568f6cbd9ba7753f3e23979dc6de4e28a7bb5f9eb3ec53fe744df4f
Opcode Fuzzy Hash: 2562e941b5578923e3abb4e5eb8aad6ceab3aaf28c0da42c8b44b0b5f22ccacb
Instruction Fuzzy Hash: DD112A22A04F458AEF10DF62EC952A833A4FB5D768F041A35EA6D477A4DF7CD9A48340

Function 00007FFE1324D954 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1324D980
GetCurrentThreadId.KERNEL32 ref: 00007FFE1324D98E
GetCurrentProcessId.KERNEL32 ref: 00007FFE1324D99A
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1324D9AA

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 76dfa9f6affd35542d897482e00a8f8d8a31374749d9766d0099c6e1fca2c63d
Instruction ID: 94675a9077c4b2df092c2ee39f69a215dd8a169b9e189ff79eacd8dda339ff98
Opcode Fuzzy Hash: 76dfa9f6affd35542d897482e00a8f8d8a31374749d9766d0099c6e1fca2c63d
Instruction Fuzzy Hash: 60117332605F018AEB10DF61E8452A533A4F76DB68F441A71EB5D437A4EF3CD198C340

Function 00007FFE126D21E8 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFE126D21FE
GetStdHandle.KERNEL32 ref: 00007FFE126D2220
GetFileType.KERNEL32 ref: 00007FFE126D223D
GetFileType.KERNEL32 ref: 00007FFE126D224F

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 75e34c8015e663071655d22415b78ae955094a6c6286ef370dab2248a3099306
Instruction ID: 7734f710f6c652a737200b57a620f024051537512dcaf4fb25de5c081a38b746
Opcode Fuzzy Hash: 75e34c8015e663071655d22415b78ae955094a6c6286ef370dab2248a3099306
Instruction Fuzzy Hash: 1A01C920D09E4A92EE659B77BDD41742265AF96734F6007B4E87D427F5CEBC6C8A8200

Function 00007FFE13222B10 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13222F3F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13222F82

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FFE13222BB9, 00007FFE13222D8F

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3668304517-2799312399
Opcode ID: f900907ded2f50d54d52aa96b2e03f19fce0c69ff2b6659e1f2decb36258605d
Instruction ID: 35f9ad39f16890d31b76f30b4d9113817445f7968fde308b0a93b0d33075b728
Opcode Fuzzy Hash: f900907ded2f50d54d52aa96b2e03f19fce0c69ff2b6659e1f2decb36258605d
Instruction Fuzzy Hash: 44D1D922B08F828DEB60EF67E9402BD2761ABE67A4F404171DE4E277A5DE3DE545C340

Function 00007FFE1322D3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1322D5F4

Strings

0123456789-, xrefs: 00007FFE1322D474
%.0Lf, xrefs: 00007FFE1322D46D

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %.0Lf$0123456789-
API String ID: 3668304517-3094241602
Opcode ID: c075ca733a5e2985d7409c734a112bdb889e844c53dbfec16932d9e1d86b165b
Instruction ID: e936f9343bf2513f23e38ec91a6673c66cfa66e086f5d69d4cec557bb2ce891e
Opcode Fuzzy Hash: c075ca733a5e2985d7409c734a112bdb889e844c53dbfec16932d9e1d86b165b
Instruction Fuzzy Hash: 29819C32B08F8589EB10DF66E5402AC6371FBA4BA8F404172DE5D27BA9EF38E555C340

Function 00007FFE13235430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

swprintf_s.PGOCR ref: 00007FFE132354D4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13235621

Strings

%.0Lf, xrefs: 00007FFE132354C4

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnswprintf_s
String ID: %.0Lf
API String ID: 296878162-1402515088
Opcode ID: 989814ed0aab853247327d7537572a65def7191e538b3b40b3089a5dc173ab06
Instruction ID: 23c9e1ed58c172933c8c8e3c387b98604ebdb352d8a112af1ea50418285ab594
Opcode Fuzzy Hash: 989814ed0aab853247327d7537572a65def7191e538b3b40b3089a5dc173ab06
Instruction Fuzzy Hash: CA518162B19F8589EB01DB66D8402ED6360FBD9BA4F504272EE5D277A5EF3CD146C300

Function 00007FF650F1A608 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF650F14E30: _invalid_parameter_noinfo.LIBCMT ref: 00007FF650F14E63

_get_daylight.LIBCMT ref: 00007FF650F1A720
_get_daylight.LIBCMT ref: 00007FF650F1A731

Strings

?, xrefs: 00007FF650F1A6B1

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: d444604473f95c875a5fddf699602ca75a12cb7bf88859a24604a67b707a5eec
Instruction ID: 5b72e993afef1f315e3f8c192bc3cafadaaacff9b57ccaf21d61fe123bbb9afa
Opcode Fuzzy Hash: d444604473f95c875a5fddf699602ca75a12cb7bf88859a24604a67b707a5eec
Instruction Fuzzy Hash: 3E4106A2A1C38366FB259B25E41137A6760EB80BA4F1C4235EF5D97BD5DE3CD581CB00

Function 00007FF650F12864 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF650F1297B
GetLastError.KERNEL32 ref: 00007FF650F1299D

Strings

U, xrefs: 00007FF650F12927

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ab790628d61e4e69ab0ff3f33b1bc1b7585c2f5d3b1d8cf6258706f25a5cb499
Instruction ID: e5a173bf5080118caeda0c433db1a7bd6a41d54ba575802b44d12fbc4403e7b2
Opcode Fuzzy Hash: ab790628d61e4e69ab0ff3f33b1bc1b7585c2f5d3b1d8cf6258706f25a5cb499
Instruction Fuzzy Hash: 0441B262B1CA86A1DB608F65E8443AA67A0FB88794F884031EE4DD7798DF3CD455C740

Function 00007FFE13206290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE132062CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1320632C

Strings

+, xrefs: 00007FFE13206316

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: _errnoisspace
String ID: +
API String ID: 607103254-2126386893
Opcode ID: ceb648361af4a40464abd6bb96d21510e563132ef184305b88ba731e0678b504
Instruction ID: 1b51f2840fc374600cb62c97120bfa1ed0afbb1ca037b51e14fa92f9dce639fe
Opcode Fuzzy Hash: ceb648361af4a40464abd6bb96d21510e563132ef184305b88ba731e0678b504
Instruction Fuzzy Hash: 9021F721F08A5649FA34AB27985027C6AD1EBE4FF0F694075DE4D937A0EE3CD885C300

Function 00007FF650EF6548 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32 ref: 00007FF650EF65EA
fwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF650EF662E

Strings

Java Virtual Machine Launcher, xrefs: 00007FF650EF65DE

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Messagefwprintf
String ID: Java Virtual Machine Launcher
API String ID: 1438246221-898708411
Opcode ID: d74164845ff09ab43074489056e5f39c87cf7e4ac9f58b970354facdd68cfc20
Instruction ID: 2f95a23238d6d33df7e6065ec55c2bf4541557065285cfd8ec1256bf4efbfb10
Opcode Fuzzy Hash: d74164845ff09ab43074489056e5f39c87cf7e4ac9f58b970354facdd68cfc20
Instruction Fuzzy Hash: A321C472A0C75761E7109B61F8523BA6655EF84BC4F584239EE8DA7795CF3CD1058700

Function 00007FF650F144B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF650F144F0
GetCurrentDirectoryW.KERNEL32 ref: 00007FF650F14542

Strings

:, xrefs: 00007FF650F14506

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 09a0d36e2db1263690a753a365a396695f788e073ffa6f4c02def69ab853d975
Instruction ID: 19393a2e05f7a6987879a1326bb4c77fc34dbb997de8cf3cf48895c0936e9e68
Opcode Fuzzy Hash: 09a0d36e2db1263690a753a365a396695f788e073ffa6f4c02def69ab853d975
Instruction Fuzzy Hash: 7721CEA2A0C28392FB249B11D45427E73A6FBC4B84F8D4135DE8DA7784DF7CE9458B40

Function 00007FFE1320AC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13235920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE1323592F

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FFE1320ACBC
_CxxThrowException.VCRUNTIME140 ref: 00007FFE1320ACCD

Part of subcall function 00007FFE13215E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215DA0
Part of subcall function 00007FFE13215E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215DB2
Part of subcall function 00007FFE13215E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FFE13215E3B

Strings

bad locale name, xrefs: 00007FFE1320ACB0

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: setlocale$ExceptionThrow_lock_localesstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1683849403-1405518554
Opcode ID: 7c9bcb853565743618b71d0b67f6afb15cda60452226c720ad76d4234984937c
Instruction ID: b3360d3d03bdea900347bc2bb98746d40fbaae41c1035d8490ddc1208dfcad2b
Opcode Fuzzy Hash: 7c9bcb853565743618b71d0b67f6afb15cda60452226c720ad76d4234984937c
Instruction Fuzzy Hash: 01118233605F8189D7509F39A44005D77B5EBA8BA4B684275CA6C933AAEF34D955C340

Function 00007FFE126D4B34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,00000000,00007FFE126D4D86), ref: 00007FFE126D4B71

Part of subcall function 00007FFE126D4FE8: GetLastError.KERNEL32 ref: 00007FFE126D5012
Part of subcall function 00007FFE126D4FE8: swprintf_s.PGOCR ref: 00007FFE126D5058
Part of subcall function 00007FFE126D4FE8: WideCharToMultiByte.KERNEL32 ref: 00007FFE126D50A4

SetHandleInformation.KERNEL32(?,?,00000000,00007FFE126D4D86), ref: 00007FFE126D4BBB

Strings

CreatePipe, xrefs: 00007FFE126D4B7B

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ByteCharCreateErrorHandleInformationLastMultiPipeWideswprintf_s
String ID: CreatePipe
API String ID: 1211380366-2719314638
Opcode ID: f403dfc028bc6c97708f2d45837e2fd86d0be58d967332c5ce2f65f06594340b
Instruction ID: 6b57b78e2ffaf21ec16581c62532b507f09e6a97e657cdc5429e75bc322c3ed6
Opcode Fuzzy Hash: f403dfc028bc6c97708f2d45837e2fd86d0be58d967332c5ce2f65f06594340b
Instruction Fuzzy Hash: 9F11C236714F8982D710CF1BE8806696360F759FE0B405671DEAD837E4CEBDC4518700

Function 00007FF650F19E6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF650F19E9C
GetDriveTypeW.KERNEL32 ref: 00007FF650F19EDC

Strings

:, xrefs: 00007FF650F19EC5

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: a641d2d88e2b5cef80ca72adedec8aac067f83c7b3f3c309b76748071ed08f7a
Instruction ID: bd81cf3bd0b6e46a98ec3aa414ffe592f234b960aa1e0df89b9fb80c3c580fe1
Opcode Fuzzy Hash: a641d2d88e2b5cef80ca72adedec8aac067f83c7b3f3c309b76748071ed08f7a
Instruction Fuzzy Hash: 02017CA291C203A6F720EF60D46227E63A0EF44704F881035D94DE7791DF3CE5448B24

Function 00007FFE126DC100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 00007FFE126DC133
_wgetdcwd.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFE126DC148

Strings

:, xrefs: 00007FFE126DC118

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: DriveType_wgetdcwd
String ID: :
API String ID: 3524837991-336475711
Opcode ID: 9018718e6fd28528436b01ddbb0bbd61f30bdf6f43fd94c8b6389c011f953575
Instruction ID: 233b4d38d10cc49d21c9a589f0117af4cd2dc309ad2f0d4a6e93f212badbebc6
Opcode Fuzzy Hash: 9018718e6fd28528436b01ddbb0bbd61f30bdf6f43fd94c8b6389c011f953575
Instruction Fuzzy Hash: 7AF09062A28A09C6EB24CB22AC5507A73A1EF99364F400575D98D867B8DE7CD1458B08

Function 00007FFE126D2180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FFE126D2198

Part of subcall function 00007FFE126D2270: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE126D22B4

Strings

cp%d, xrefs: 00007FFE126D219E
ms%d, xrefs: 00007FFE126D21A5

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: Console__stdio_common_vsprintf
String ID: cp%d$ms%d
API String ID: 1488660647-683763357
Opcode ID: 7634e0db5f1f5c6b943e65b7b977657847cd93790f443323b0e9582193ee05e6
Instruction ID: 9196bf724aeada2e639209f715b6802ac94c42fffa8de60828332d5d72d2f7be
Opcode Fuzzy Hash: 7634e0db5f1f5c6b943e65b7b977657847cd93790f443323b0e9582193ee05e6
Instruction Fuzzy Hash: 48F08962B18E4A96EF10D723EC510B93351FF58754F905071D55D076B5DE6CEA45CF00

Function 00007FFE126D4AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22threadCOMMON

Download Yara Rule

APIs

JVM_GetThreadInterruptEvent.JVM ref: 00007FFE126D4AF5
WaitForMultipleObjects.KERNEL32 ref: 00007FFE126D4B0E

Part of subcall function 00007FFE126D4FE8: GetLastError.KERNEL32 ref: 00007FFE126D5012
Part of subcall function 00007FFE126D4FE8: swprintf_s.PGOCR ref: 00007FFE126D5058
Part of subcall function 00007FFE126D4FE8: WideCharToMultiByte.KERNEL32 ref: 00007FFE126D50A4

Strings

WaitForMultipleObjects, xrefs: 00007FFE126D4B19

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: ByteCharErrorEventInterruptLastMultiMultipleObjectsThreadWaitWideswprintf_s
String ID: WaitForMultipleObjects
API String ID: 2634532880-3113178308
Opcode ID: 8f50ad69bb90e3bbfaf4b8a4be1918caeeb4496f998a500ac724a8f4b784156d
Instruction ID: 59a6c240dfe1e69bf864fa87cc9a7ee0e8f82ddd1e5b860daa7e90eb3d4084e0
Opcode Fuzzy Hash: 8f50ad69bb90e3bbfaf4b8a4be1918caeeb4496f998a500ac724a8f4b784156d
Instruction Fuzzy Hash: F4E0A022A08E4A82DB209B16F8814AD7320FB557E4F504670EADC07AF5DF6CD5558B00

Function 00007FF650EFC610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF650EFC639
TlsSetValue.KERNEL32(?,?,?,00007FF650EFC291,?,?,?,?,00007FF650EFBF5C,?,?,?,?,00007FF650EFACF7), ref: 00007FF650EFC650

Strings

FlsSetValue, xrefs: 00007FF650EFC61D, 00007FF650EFC626

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 1262942b39d5c4b26ce0fbef8dd54b9f761f1885c10cfbeee1b4a2f8d288a19e
Instruction ID: beb52c84dbd954ad6050884ddd7d1ad652167d5dbc5dbe410ff7f76a48541a4f
Opcode Fuzzy Hash: 1262942b39d5c4b26ce0fbef8dd54b9f761f1885c10cfbeee1b4a2f8d288a19e
Instruction Fuzzy Hash: 27E06DA1A1C683B1FA144B51FD025B86261EF48B80F6C5032DD1DE7354CE3CE884C640

Function 00007FFE126D8258 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126DDC18: GetSystemDirectoryA.KERNEL32 ref: 00007FFE126DDC46
Part of subcall function 00007FFE126DDC18: strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDC5C
Part of subcall function 00007FFE126DDC18: strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDC69
Part of subcall function 00007FFE126DDC18: LoadLibraryA.KERNEL32 ref: 00007FFE126DDC73
Part of subcall function 00007FFE126DDC18: GetWindowsDirectoryA.KERNEL32 ref: 00007FFE126DDC8B
Part of subcall function 00007FFE126DDC18: strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDCA1
Part of subcall function 00007FFE126DDC18: strcat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126DDCAE
Part of subcall function 00007FFE126DDC18: LoadLibraryA.KERNEL32 ref: 00007FFE126DDCB8

GetProcAddress.KERNEL32(?,?,00000000,00007FFE126D84FD), ref: 00007FFE126D8285

Strings

GetDynamicTimeZoneInformation, xrefs: 00007FFE126D827B
Kernel32.dll, xrefs: 00007FFE126D826A

Memory Dump Source

Source File: 00000009.00000002.2761043165.00007FFE126D1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000009.00000002.2760948110.00007FFE126D0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761079778.00007FFE126EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761123171.00007FFE126F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2761165273.00007FFE126F9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe126d0000_java.jbxd

Similarity

API ID: strcat$DirectoryLibraryLoad$AddressProcSystemWindows
String ID: GetDynamicTimeZoneInformation$Kernel32.dll
API String ID: 434409499-4090116584
Opcode ID: 8bf11ae48bed2b6a70aaf6e838938b860db6a4ed4df3d6d76ddf5bd2b58a4649
Instruction ID: 67904e4b24f5bd5b8f84bb3645d0ffb9caafb0d9436b9d1d86deda79b801eefe
Opcode Fuzzy Hash: 8bf11ae48bed2b6a70aaf6e838938b860db6a4ed4df3d6d76ddf5bd2b58a4649
Instruction Fuzzy Hash: EAE04F11B19E4592EA44DB67BD841386260AF4C7A0F844074EA5D433E9EEACD9858310

Function 00007FFE1320D400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE1320D40D

Part of subcall function 00007FFE1320B710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B739
Part of subcall function 00007FFE1320B710: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B768
Part of subcall function 00007FFE1320B710: memmove.VCRUNTIME140(?,?,00000000,00007FFE1321C445), ref: 00007FFE1320B77F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1320D42A

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FFE1320D435

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: free$Getdaysmallocmemmove
String ID: :Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2126063425-3283725177
Opcode ID: 35240cb5f5100ad4a6dbdd5295e329d3b5d0df92d6cb6440ee87cb48881eb460
Instruction ID: 67084aca20cb080dc8df0975df32599964e115a5b2169d026e8769b76e314a94
Opcode Fuzzy Hash: 35240cb5f5100ad4a6dbdd5295e329d3b5d0df92d6cb6440ee87cb48881eb460
Instruction Fuzzy Hash: D2E06521715F4296DA14AB03F5443686360EF98BA0F440174DA0D13BA4EF3CE5E4C700

Function 00007FF650F1CE64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FF650F1CE6D

Part of subcall function 00007FF650EFBD30: __except_validate_context_record.LIBVCRUNTIME ref: 00007FF650EFBD5B
Part of subcall function 00007FF650EFBD30: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF650EFBDF0
Part of subcall function 00007FF650EFBD30: RtlUnwindEx.KERNEL32 ref: 00007FF650EFBE3F

Strings

csm, xrefs: 00007FF650F1CE78
f, xrefs: 00007FF650F1CE72

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 3112662972-629598281
Opcode ID: 5e28e35d85e163fea58098feb44f8df4754b1da2d6a6a340214a428e7e3e9941
Instruction ID: 305cda61798cd7d7a84878457b162e330035e243dc3960ec8e42491088957cac
Opcode Fuzzy Hash: 5e28e35d85e163fea58098feb44f8df4754b1da2d6a6a340214a428e7e3e9941
Instruction Fuzzy Hash: 5FD05E99D0D14B61FB3D26F2904537826909F1830CE1C8830CF189B78A5E3EF8944283

Function 00007FFE1A461148 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4641E8: JVM_GetMethodIxNameUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464233
Part of subcall function 00007FFE1A4641E8: jio_snprintf.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A46428B
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642F2
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A4642FA
Part of subcall function 00007FFE1A4641E8: JVM_ReleaseUTF.JVM(?,?,?,?,?,00007FFE1A461156,?,?,?,00007FFE1A4610EF), ref: 00007FFE1A464302

longjmp.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE1A461791), ref: 00007FFE1A461166

Strings

0, xrefs: 00007FFE1A461214
Warning! An old version of jvm is used. This is not supported., xrefs: 00007FFE1A4611FB

Memory Dump Source

Source File: 00000009.00000002.2761754705.00007FFE1A461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE1A460000, based on PE: true

Associated: 00000009.00000002.2761574879.00007FFE1A460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761798459.00007FFE1A468000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761910308.00007FFE1A46C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2761947874.00007FFE1A46D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a460000_java.jbxd

Similarity

API ID: Release$MethodNamejio_snprintflongjmp
String ID: 0$Warning! An old version of jvm is used. This is not supported.
API String ID: 4050543598-3931950699
Opcode ID: 213e7d44760841a8deddf00db6f1b33a9b884b7694c0e88d8aad006dc81ea796
Instruction ID: 716db3de41a62e70ed369fceab749fb62b4b96f363462ac85af6933e26e9c909
Opcode Fuzzy Hash: 213e7d44760841a8deddf00db6f1b33a9b884b7694c0e88d8aad006dc81ea796
Instruction Fuzzy Hash: EFC08C1471868982EB04B6B2904E3F916209B28B04F1800B1CA6C0B28BDD6AD26A43A1

Function 00007FF650EF707C Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strchr.LIBVCRUNTIME ref: 00007FF650EF70AF
strchr.LIBVCRUNTIME ref: 00007FF650EF70C6
strchr.LIBVCRUNTIME ref: 00007FF650EF70F0
strchr.LIBVCRUNTIME ref: 00007FF650EF711E

Memory Dump Source

Source File: 00000009.00000002.2760674085.00007FF650EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF650EF0000, based on PE: true

Associated: 00000009.00000002.2760635636.00007FF650EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760730941.00007FF650F1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760777741.00007FF650F2F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F32000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F35000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.2760817594.00007FF650F39000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff650ef0000_java.jbxd

Similarity

API ID: strchr
String ID:
API String ID: 2830005266-0
Opcode ID: f3389ab4bb7d7b348c842ef9816668ad7502dc52e1c6fec8506c504c21b4b2f3
Instruction ID: 7b0b4c244d9397bd6d427e600b970a29ac7d3210f87991351b582597201cd477
Opcode Fuzzy Hash: f3389ab4bb7d7b348c842ef9816668ad7502dc52e1c6fec8506c504c21b4b2f3
Instruction Fuzzy Hash: 16319301B0F3A365FA29AA16775027E56895F85BC0F6C8074DD8DA77CADE3DF8098311

Function 00007FFE1A4C4B2C Relevance: 5.1, APIs: 4, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A4C49A1,?,?,?,?,00007FFE1A4CC1CA,?,?,?,?,?), ref: 00007FFE1A4C4B4B
SetLastError.KERNEL32(?,?,?,00007FFE1A4C49A1,?,?,?,?,00007FFE1A4CC1CA,?,?,?,?,?), ref: 00007FFE1A4C4BE0

Memory Dump Source

Source File: 00000009.00000002.2762009821.00007FFE1A4C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000009.00000002.2761977419.00007FFE1A4C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762044738.00007FFE1A4CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762107966.00007FFE1A4D1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2762140216.00007FFE1A4D2000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe1a4c0000_java.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fcfe9833dd76a316f190f28222a65531f483fd64bfdee3458903b8af21480ea4
Instruction ID: 8619aaffc3d37c6b007f253ddd71b87d9e95e2845b5aa1010c73bd5c2f1a3ff0
Opcode Fuzzy Hash: fcfe9833dd76a316f190f28222a65531f483fd64bfdee3458903b8af21480ea4
Instruction Fuzzy Hash: 3B214D20B09F4241FB509B27A9482342291AF48FF5F8447F6D96E477FFEF2CA8618200

Function 00007FFE132309C0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE132309DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE132309E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE132309F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE132309FB

Memory Dump Source

Source File: 00000009.00000002.2761241543.00007FFE13201000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000009.00000002.2761219537.00007FFE13200000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761282766.00007FFE13252000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761322152.00007FFE1328F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761345634.00007FFE13290000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761368352.00007FFE13291000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13293000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2761389405.00007FFE13299000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe13200000_java.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 21e29c9922f19bdda75fb578db1eebbd38709f35706a816a21095b56aee0f4f3
Instruction ID: 901c5e76fa5e2fc2757fb9c2c08c52b56e85838d9a6ce1489b44ea88cd5e1696
Opcode Fuzzy Hash: 21e29c9922f19bdda75fb578db1eebbd38709f35706a816a21095b56aee0f4f3
Instruction Fuzzy Hash: AEF0EC21718F029ADB44AB17E9981A82360FBE8FA0B1441B1DA4D53B70EF2CE9A5C700

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\MessagesDefault

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_0_1mu2pq3.utf8

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_10_1mu2pq3_wnegrj.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_11_1mu2pq3.txt

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_12_1mu2pq3_1l2apw7.ico

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_13_1mu2pq3_x7nby6.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_14_1mu2pq3_vd2dea.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_15_1mu2pq3_un9apv.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_16_1mu2pq3_1xth8wx.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_17_1mu2pq3_259ij1.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_18_1mu2pq3_1w6mnzb.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_18_1mu2pq3_1w6mnzb@2x.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_1_1mu2pq3.utf8

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_2_1mu2pq3.utf8

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_3_1mu2pq3.utf8

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_4_1mu2pq3_1qcjq5g.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_5_1mu2pq3_14adzqr.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_6_1mu2pq3_1bf9cql.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_7_1mu2pq3_njuzm5.png

C:\Users\user\AppData\Local\Temp\e4jA753.tmp_dir1732193841\i4j_extf_8_1mu2pq3_1reef1z.png

Windows Analysis Report
https://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exe