Edit tour

Windows Analysis Report
4a9OE5cKJo.exe

Overview

General Information

Sample Name:	4a9OE5cKJo.exe
Original Sample Name:	84cc4306c04df6e4d2f0431f538e6612c2bf72ee57d0bac23ed3a19936b3ed73
Analysis ID:	1299135
MD5:	9652452e6863bfcb4fb2c1c20702ca7f
SHA1:	698dce4f4d06fafa486a0ac8c4d3913c249e429c
SHA256:	84cc4306c04df6e4d2f0431f538e6612c2bf72ee57d0bac23ed3a19936b3ed73
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	32
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to get notified if a device is plugged in / out

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

EXE planting / hijacking vulnerabilities found

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

DLL planting / hijacking vulnerabilities found

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Found evasive API chain checking for process token information

Installs a global mouse hook

Potential key logger detected (key state polling based)

Found large amount of non-executed APIs

Classification

Process Tree

System is w10x64

4a9OE5cKJo.exe (PID: 7064 cmdline: C:\Users\user\Desktop\4a9OE5cKJo.exe MD5: 9652452E6863BFCB4FB2C1C20702CA7F)

bReporter.exe (PID: 7080 cmdline: C:\Users\Public\Music\Picture\bReporter.exe --version MD5: BB63FD178AFFCCAAB180BCE1689157CE)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 6264 cmdline: C:\Windows\system32\WerFault.exe -u -p 7064 -s 916 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x65946:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x6609d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x658d6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x6602d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 4a9OE5cKJo.exe

Virustotal: Detection: 42%

Perma Link

Antivirus detection for dropped file

Source: C:\Users\Public\Music\Picture\libwim-15.dll

Avira: detection malicious, Label: TR/Rozena.rxfwi

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Music\Picture\libwim-15.dll

ReversingLabs: Detection: 25%

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

EXE: C:\Users\Public\Music\Picture\bReporter.exe

Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: wldp.DLL	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: WINMM.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: SspiCli.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: mscoree.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: amsi.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: C:\Users\Public\Music\Picture\libwim-15.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: WINMMBASE.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: WININET.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: xinput1_4.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: CRYPTSP.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: winnlsres.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: DEVOBJ.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: CRYPTBASE.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: DPAPI.DLL	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: HID.DLL	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

EXE: C:\Users\Public\Music\Picture\bReporter.exe

Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: wldp.DLL	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: WINMM.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: SspiCli.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: mscoree.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: amsi.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: C:\Users\Public\Music\Picture\libwim-15.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: WINMMBASE.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: WININET.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: xinput1_4.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: CRYPTSP.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: winnlsres.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: DEVOBJ.dll	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: CRYPTBASE.DLL	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	DLL: DPAPI.DLL	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	DLL: HID.DLL	Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 82.156.94.45:443 -> 192.168.2.4:49711 version: TLS 1.2

PE / OLE file has a valid certificate

Source: 4a9OE5cKJo.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 4a9OE5cKJo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to get notified if a device is plugged in / out

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CBFE20 SystemParametersInfoW,SystemParametersInfoW,MapVirtualKeyW,ToUnicode,ToUnicode,WideCharToMultiByte,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,RtlVerifyVersionInfo,SetProcessDPIAware,SetProcessDPIAware,CreateWindowExW,ShowWindow,RegisterDeviceNotificationW,PeekMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,

0_2_00007FF739CBFE20

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CBDDF0 GetVersionExA,SetProcessMitigationPolicy,RtlAdjustPrivilege,GetCurrentProcess,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,NtQueryInformationProcess,NtSetInformationProcess,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,FindClose,CoTaskMemFree,CreateProcessA,MessageBoxA,MessageBoxA,_invalid_parameter_noinfo_noreturn,		0_2_00007FF739CBDDF0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDD078 FindFirstFileExW,		0_2_00007FF739CDD078

Networking

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.234.23.52

Source: 4a9OE5cKJo.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: bReporter.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: bReporter.exe, 00000001.00000003.249836779.000000000014A000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000003.236724918.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: bReporter.exe, 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmp, bReporter.exe.0.dr	String found in binary or memory: http://gnu.org/licenses/gpl.html
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: bReporter.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: bReporter.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: bReporter.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: bReporter.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: bReporter.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: 4a9OE5cKJo.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: bReporter.exe, 00000001.00000002.616208785.00000000039A5000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/%
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/api/v1/nsquery
Source: bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/api/v1/nsqueryM
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/api/v1/nsquerye
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/ngs
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/ngsi
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52/s
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443.myqcloud.com
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquery
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquery0
Source: bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquery5
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquery6Z
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquery9
Source: bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsqueryCESS
Source: bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsquerytingsA
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsreport
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://62.234.23.52:443/api/v1/nsreportmyqcloud.com
Source: 4a9OE5cKJo.exe	String found in binary or memory: https://baidu.com/x/2/page
Source: bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/
Source: bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/odS
Source: bReporter.exe, 00000001.00000003.249836779.000000000014A000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000003.236724918.0000000000148000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.00000000000AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log
Source: bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log$
Source: bReporter.exe, 00000001.00000003.249836779.000000000014A000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000003.236724918.0000000000148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log(
Source: bReporter.exe, 00000001.00000002.615332470.00000000000AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.logI
Source: 4a9OE5cKJo.exe, 00000000.00000003.217000206.0000022549781000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.617358215.00007FFD3F22A000.00000002.00000001.01000000.00000005.sdmp, libwim-15.dll.0.dr	String found in binary or memory: https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.logMyAppRtlEnterCriticalSectionRtlLeaveCr
Source: bReporter.exe, 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmp, bReporter.exe.0.dr	String found in binary or memory: https://wimlib.net/forums/.
Source: bReporter.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown

DNS traffic detected: queries for: cdn-1319693778.cos.ap-beijing.myqcloud.com

Source: global traffic

HTTP traffic detected: GET /service.log HTTP/1.1User-Agent: MyAppHost: cdn-1319693778.cos.ap-beijing.myqcloud.comCache-Control: no-cache

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 82.156.94.45:443 -> 192.168.2.4:49711 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a DirectInput object (often for capturing keystrokes)

Source: 4a9OE5cKJo.exe

Binary or memory string: DirectInput8Create

Installs a raw input device (often for capturing keystrokes)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CC3520 GetPropW,EnableNonClientDpiScaling,DefWindowProcW,GetRawInputData,GetRawInputData,DefWindowProcW,

0_2_00007FF739CC3520

Installs a global mouse hook

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\dinput8.dll

Jump to behavior

Potential key logger detected (key state polling based)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CC31E0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_00007FF739CC31E0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown

Yara signature match

Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13

One or more processes crash

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7064 -s 916

Detected potential crypto function

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CBFE20	0_2_00007FF739CBFE20
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CBDDF0	0_2_00007FF739CBDDF0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CE1AD0	0_2_00007FF739CE1AD0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD197C	0_2_00007FF739CD197C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CCD140	0_2_00007FF739CCD140
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD8504	0_2_00007FF739CD8504
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD4C6C	0_2_00007FF739CD4C6C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC4C30	0_2_00007FF739CC4C30
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD2438	0_2_00007FF739CD2438
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDEB64	0_2_00007FF739CDEB64
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD5B34	0_2_00007FF739CD5B34
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CCEEF4	0_2_00007FF739CCEEF4
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CE36AC	0_2_00007FF739CE36AC
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDCE6C	0_2_00007FF739CDCE6C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC15A0	0_2_00007FF739CC15A0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD1DD4	0_2_00007FF739CD1DD4
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDBDC4	0_2_00007FF739CDBDC4
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDC55C	0_2_00007FF739CDC55C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CE00B4	0_2_00007FF739CE00B4
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC1080	0_2_00007FF739CC1080
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDD078	0_2_00007FF739CDD078
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDA054	0_2_00007FF739CDA054
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CD97BC	0_2_00007FF739CD97BC
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_00403C40	1_2_00403C40
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_00412050	1_2_00412050
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_00413DC0	1_2_00413DC0
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_0040F5B0	1_2_0040F5B0
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_00411B80	1_2_00411B80
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_004147B0	1_2_004147B0
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_0241592A	1_2_0241592A
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_02416182	1_2_02416182
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_0241660A	1_2_0241660A
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_02415D4A	1_2_02415D4A
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_02414D02	1_2_02414D02
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040A0716	1_2_040A0716
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040B502C	1_2_040B502C
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04099550	1_2_04099550
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04099D60	1_2_04099D60
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04099990	1_2_04099990
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040A0E02	1_2_040A0E02
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04092200	1_2_04092200
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_0409C248	1_2_0409C248
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040B52B0	1_2_040B52B0
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040986F0	1_2_040986F0
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04095720	1_2_04095720
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_04091F50	1_2_04091F50
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_040C07F0	1_2_040C07F0

Found potential string decryption / allocating functions

Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: String function: 00401650 appears 45 times
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: String function: 004023A0 appears 45 times
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: String function: 004024D0 appears 82 times

Contains functionality to call native functions

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CBDDF0 GetVersionExA,SetProcessMitigationPolicy,RtlAdjustPrivilege,GetCurrentProcess,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,NtQueryInformationProcess,NtSetInformationProcess,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,FindClose,CoTaskMemFree,CreateProcessA,MessageBoxA,MessageBoxA,_invalid_parameter_noinfo_noreturn,

0_2_00007FF739CBDDF0

Sample file is different than original file name gathered from version info

Source: 4a9OE5cKJo.exe	Binary or memory string: OriginalFilename vs 4a9OE5cKJo.exe
Source: 4a9OE5cKJo.exe, 00000000.00000000.216364679.00007FF739D89000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstalle.exe> vs 4a9OE5cKJo.exe
Source: 4a9OE5cKJo.exe, 00000000.00000003.217000206.00000225497C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibwim-15.dll4 vs 4a9OE5cKJo.exe
Source: 4a9OE5cKJo.exe	Binary or memory string: OriginalFilenameInstalle.exe> vs 4a9OE5cKJo.exe

Source: 4a9OE5cKJo.exe

Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

File read: C:\Users\user\Desktop\4a9OE5cKJo.exe

Jump to behavior

Source: 4a9OE5cKJo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4a9OE5cKJo.exe C:\Users\user\Desktop\4a9OE5cKJo.exe
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Process created: C:\Users\Public\Music\Picture\bReporter.exe C:\Users\Public\Music\Picture\bReporter.exe --version
Source: C:\Users\Public\Music\Picture\bReporter.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7064 -s 916
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Process created: C:\Users\Public\Music\Picture\bReporter.exe C:\Users\Public\Music\Picture\bReporter.exe --version	Jump to behavior

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

File created: C:\Users\Public\Music\Picture

Jump to behavior

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF6B.tmp

Jump to behavior

Source: classification engine

Classification label: mal72.winEXE@5/8@1/2

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CBFB90 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF739CBFB90

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7064
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_01

Source: bReporter.exe	String found in binary or memory: %ls --help %ls --version
Source: bReporter.exe	String found in binary or memory: %ls --help %ls --version
Source: bReporter.exe	String found in binary or memory: %ls --help %ls --version
Source: bReporter.exe	String found in binary or memory: %ls --help %ls --version

Source: C:\Users\Public\Music\Picture\bReporter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\Picture\bReporter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

PE file has a high image base, often used for DLLs

Source: 4a9OE5cKJo.exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: 4a9OE5cKJo.exe

Static file information: File size 1084632 > 1048576

PE / OLE file has a valid certificate

Source: 4a9OE5cKJo.exe

Static PE information: certificate valid

PE file contains a mix of data directories often seen in goodware

Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 4a9OE5cKJo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 4a9OE5cKJo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: 4a9OE5cKJo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

PE file contains a valid data directory to section mapping

Source: 4a9OE5cKJo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 4a9OE5cKJo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 4a9OE5cKJo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 4a9OE5cKJo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 4a9OE5cKJo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\Public\Music\Picture\bReporter.exe

Code function: 1_2_040982E1 push ebp; iretd

1_2_040982E2

PE file contains sections with non-standard names

Source: 4a9OE5cKJo.exe	Static PE information: section name: _RDATA
Source: bReporter.exe.0.dr	Static PE information: section name: /4
Source: bReporter.exe.0.dr	Static PE information: section name: .xdata
Source: libwim-15.dll.0.dr	Static PE information: section name: _RDATA

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CC0890 GetModuleHandleExW,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_00007FF739CC0890

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	File created: C:\Users\Public\Music\Picture\bReporter.exe			Jump to dropped file
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	File created: C:\Users\Public\Music\Picture\libwim-15.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

0_2_00007FF739CC0890

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain checking for process token information

Source: C:\Users\Public\Music\Picture\bReporter.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-24823

Found large amount of non-executed APIs

Source: C:\Users\Public\Music\Picture\bReporter.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CBDDF0 GetVersionExA,SetProcessMitigationPolicy,RtlAdjustPrivilege,GetCurrentProcess,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,NtQueryInformationProcess,NtSetInformationProcess,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,FindClose,CoTaskMemFree,CreateProcessA,MessageBoxA,MessageBoxA,_invalid_parameter_noinfo_noreturn,		0_2_00007FF739CBDDF0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CDD078 FindFirstFileExW,		0_2_00007FF739CDD078

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CCCB74 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF739CCCB74

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

0_2_00007FF739CC0890

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CDE2EC GetProcessHeap,

0_2_00007FF739CDE2EC

Enables debug privileges

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\Music\Picture\bReporter.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC6914 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	0_2_00007FF739CC6914
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC7128 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF739CC7128
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CCCB74 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF739CCCB74
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC6D60 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF739CC6D60
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: 0_2_00007FF739CC6F44 SetUnhandledExceptionFilter,	0_2_00007FF739CC6F44
Source: C:\Users\Public\Music\Picture\bReporter.exe	Code function: 1_2_00401190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,	1_2_00401190

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF739CE0B0C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: try_get_function,GetLocaleInfoW,	0_2_00007FF739CDAAF8
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: EnumSystemLocalesW,	0_2_00007FF739CE0A74
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: EnumSystemLocalesW,	0_2_00007FF739CE09A4
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF739CE0EB0
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF739CE0658
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: EnumSystemLocalesW,	0_2_00007FF739CDA654
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: GetLocaleInfoW,	0_2_00007FF739CE0D58
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF739CE108C
Source: C:\Users\user\Desktop\4a9OE5cKJo.exe	Code function: GetLocaleInfoW,	0_2_00007FF739CE0F60

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CDB430 cpuid

0_2_00007FF739CDB430

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

Code function: 0_2_00007FF739CDAB7C try_get_function,GetSystemTimeAsFileTime,

0_2_00007FF739CDAB7C

Source: C:\Users\user\Desktop\4a9OE5cKJo.exe

0_2_00007FF739CBDDF0

Source: C:\Users\Public\Music\Picture\bReporter.exe

Code function: 1_2_040AA8D0 GetUserNameA,

1_2_040AA8D0

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	2 DLL Search Order Hijacking	1 Process Injection	1 Masquerading	41 Input Capture	1 System Time Discovery	Remote Services	41 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	2 DLL Search Order Hijacking	1 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 DLL Search Order Hijacking	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
4a9OE5cKJo.exe	11%	ReversingLabs
4a9OE5cKJo.exe	42%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Music\Picture\libwim-15.dll	100%	Avira	TR/Rozena.rxfwi
C:\Users\Public\Music\Picture\bReporter.exe	0%	ReversingLabs
C:\Users\Public\Music\Picture\libwim-15.dll	25%	ReversingLabs	Win64.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://62.234.23.52:443.myqcloud.com	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsqueryCESS	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquerytingsA	0%	Avira URL Cloud	safe
https://62.234.23.52:443	0%	Avira URL Cloud	safe
https://62.234.23.52/api/v1/nsquerye	0%	Avira URL Cloud	safe
https://62.234.23.52/api/v1/nsquery	0%	Avira URL Cloud	safe
https://62.234.23.52/	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsreportmyqcloud.com	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquery6Z	0%	Avira URL Cloud	safe
https://62.234.23.52/ngs	0%	Avira URL Cloud	safe
https://62.234.23.52/api/v1/nsqueryM	0%	Avira URL Cloud	safe
https://62.234.23.52/ngsi	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquery5	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquery0	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquery9	0%	Avira URL Cloud	safe
https://62.234.23.52/%	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsreport	0%	Avira URL Cloud	safe
https://wimlib.net/forums/.	0%	Avira URL Cloud	safe
https://62.234.23.52:443/api/v1/nsquery	0%	Avira URL Cloud	safe
https://62.234.23.52/s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bj.file.myqcloud.com	82.156.94.45	true	false		high
cdn-1319693778.cos.ap-beijing.myqcloud.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://62.234.23.52/api/v1/nsquerye	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52:443	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52:443/api/v1/nsqueryCESS	bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://baidu.com/x/2/page	4a9OE5cKJo.exe	false		high
https://62.234.23.52:443.myqcloud.com	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://62.234.23.52/api/v1/nsquery	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52:443/api/v1/nsquerytingsA	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52:443/api/v1/nsquery6Z	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://62.234.23.52:443/api/v1/nsreportmyqcloud.com	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52/	bReporter.exe, 00000001.00000002.616208785.00000000039A5000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52/ngs	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52/api/v1/nsqueryM	bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52/ngsi	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.logI	bReporter.exe, 00000001.00000002.615332470.00000000000AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://62.234.23.52:443/api/v1/nsquery5	bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.logMyAppRtlEnterCriticalSectionRtlLeaveCr	4a9OE5cKJo.exe, 00000000.00000003.217000206.0000022549781000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.617358215.00007FFD3F22A000.00000002.00000001.01000000.00000005.sdmp, libwim-15.dll.0.dr	false		high
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log(	bReporter.exe, 00000001.00000003.249836779.000000000014A000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000003.236724918.0000000000148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://62.234.23.52:443/api/v1/nsquery0	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/service.log$	bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://62.234.23.52:443/api/v1/nsquery9	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://62.234.23.52/%	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/	bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://62.234.23.52:443/api/v1/nsreport	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gnu.org/licenses/gpl.html	bReporter.exe, 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmp, bReporter.exe.0.dr	false		high
https://wimlib.net/forums/.	bReporter.exe, 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmp, bReporter.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://62.234.23.52:443/api/v1/nsquery	bReporter.exe, 00000001.00000002.615332470.000000000012D000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp, bReporter.exe, 00000001.00000002.615332470.0000000000176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn-1319693778.cos.ap-beijing.myqcloud.com/odS	bReporter.exe, 00000001.00000002.615332470.00000000000CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://62.234.23.52/s	bReporter.exe, 00000001.00000002.616208785.0000000003986000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.234.23.52	unknown	China		45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
82.156.94.45	bj.file.myqcloud.com	China		12513	ECLIPSEGB	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1299135
Start date and time:	2023-08-29 07:49:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	4a9OE5cKJo.exe
Original Sample Name:	84cc4306c04df6e4d2f0431f538e6612c2bf72ee57d0bac23ed3a19936b3ed73
Detection:	MAL
Classification:	mal72.winEXE@5/8@1/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.9% (good quality ratio 10.4%) Quality average: 56.4% Quality standard deviation: 35.4%
HCA Information:	Successful, ratio: 58% Number of executed functions: 42 Number of non-executed functions: 153
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, kv601.prod.do.dsp.mp.microsoft.com, fs.microsoft.com, geo.prod.do.dsp.mp.microsoft.com, login.live.com, eudb.ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
82.156.94.45	1q3HnZAcnJ.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bj.file.myqcloud.com	1q3HnZAcnJ.exe	Get hash	malicious	Unknown	Browse	82.156.94.45
	word.exe	Get hash	malicious	Unknown	Browse	82.156.94.48
	182cv6Y090.dll	Get hash	malicious	Unknown	Browse	120.53.180.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	gHYcrExhwJ.elf	Get hash	malicious	Mirai	Browse	81.70.216.102
	Qz4IsYZanw.elf	Get hash	malicious	Mirai	Browse	188.131.185.106
	cgdDrNG7A1.elf	Get hash	malicious	Mirai	Browse	150.158.255.158
	xSoP4QsJLl.elf	Get hash	malicious	Mirai	Browse	175.26.73.199
	sora.arm.elf	Get hash	malicious	Mirai	Browse	150.158.191.49
	UGCjB3A6fH.elf	Get hash	malicious	Mirai	Browse	118.30.175.244
	kK2ah63zl1.elf	Get hash	malicious	Mirai	Browse	118.89.249.200
	R0a3TfNKXN.elf	Get hash	malicious	Mirai	Browse	150.158.255.152
	sora.arm.elf	Get hash	malicious	Mirai	Browse	152.140.56.220
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	121.51.1.19
	yourbiggestnightmare.arm7.elf	Get hash	malicious	Mirai	Browse	109.244.173.150
	sora.arm.elf	Get hash	malicious	Mirai	Browse	81.71.190.182
	t0OQ6isTUe.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	118.89.133.137
	d722wDMYzv.elf	Get hash	malicious	Mirai	Browse	94.191.53.147
	M6gGkxJFKz.exe	Get hash	malicious	CobaltStrike	Browse	81.69.249.203
	4E2rcYG9jo.elf	Get hash	malicious	Mirai	Browse	118.89.162.154
	jL1EOxRcVy.elf	Get hash	malicious	Mirai	Browse	94.191.99.66
	ciOC7M8KQB.elf	Get hash	malicious	Mirai	Browse	106.53.12.97
	sora.arm.elf	Get hash	malicious	Mirai	Browse	118.28.71.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	PDFViewer_44882564 (1).msi	Get hash	malicious	Unknown	Browse	82.156.94.45
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	82.156.94.45
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	82.156.94.45
	3 cahier Ile bleue 2023.xlsx	Get hash	malicious	Unknown	Browse	82.156.94.45
	Orden_de_compra_-_P06672_PDF.exe	Get hash	malicious	GuLoader	Browse	82.156.94.45
	download (17).vbs	Get hash	malicious	Unknown	Browse	82.156.94.45
	N94307_251628_2023-08-28_BC8976924pdf.exe	Get hash	malicious	GuLoader	Browse	82.156.94.45
	CC1eNsOCDq.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	OYGuDyAvhG.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	CC1eNsOCDq.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	cMBkG9Nme3.exe	Get hash	malicious	Unknown	Browse	82.156.94.45
	CVj3khKqLB.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	eB6bGbNNSH.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	CVj3khKqLB.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	cMBkG9Nme3.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	6srcaz6D6M.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	eB6bGbNNSH.exe	Get hash	malicious	Fabookie	Browse	82.156.94.45
	INV.PDF.exe	Get hash	malicious	DarkCloud	Browse	82.156.94.45
	mp3studios_6.exe	Get hash	malicious	Socelars	Browse	82.156.94.45

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_4a9OE5cKJo.exe_5d821032eba26e5e17f9a2465f70afed96fa7875_98ba9ed1_1833c5a4\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	TeX document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9469412203544003
Encrypted:	false
SSDEEP:	96:JWuFrQUoS6zD/4eLv9+L9nziSKpXIQcQ6c6k9UR8cEncw3qEob+HbHg/8BRTf3uM:R3oSsD/4gHU4TtPjwWh/u7sSS274ltp
MD5:	72CA86F99E68F9D87C63D1D4714E1EFB
SHA1:	76B4F766977B08ADF3D898B0BB4BEEB43AA79F16
SHA-256:	AC69FA08B8CBEFB1B21CEBA7536D3EDE187FEB92711BB61A5149F7CDDB27B4A0
SHA-512:	C2D193287E22AAE816A563CE2524A6A36286226E74F06354A4BAEB7801FBD6C5A3A58F153EA5B48DDCE1529C57E28410B67C1E5381202A20A9169489E50B9B02
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.7.7.6.1.8.4.7.7.9.9.6.2.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.7.7.6.1.8.4.8.3.3.0.8.8.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.8.f.6.f.8.7.-.f.2.d.0.-.4.d.7.b.-.b.e.b.d.-.d.5.1.d.5.e.a.e.d.a.3.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.4.e.a.5.b.e.-.c.d.d.7.-.4.b.5.a.-.a.9.f.5.-.a.0.2.d.e.1.b.1.0.4.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.4.a.9.O.E.5.c.K.J.o...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.n.s.t.a.l.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.9.8.-.0.0.0.1.-.0.0.2.6.-.3.3.3.0.-.c.4.b.e.3.c.d.a.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.3.9.3.6.3.e.1.b.a.7.c.b.7.f.f.a.5.e.8.5.f.0.2.8.1.7.b.4.0.f.0.0.0.0.0.4.0.8.!.0.0.0.0.6.9.8.d.c.e.4.f.4.d.0.6.f.a.f.a.4.8.6.a.0.a.c.8.c.4.d.3.9.1.3.c.2.4.9.e.4.2.9.c.!.4.a.9.O.E.5.c.K.J.o...e.x.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF6B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Aug 29 05:50:48 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	102900
Entropy (8bit):	1.526136299186455
Encrypted:	false
SSDEEP:	192:BfULcUv6Twfg0OcCgtW3inzm331uyNWr8bpPP2suD8sOCI3g6lB61E:016DngtW3izw3pWr81uICI3g6P4E
MD5:	7FF2E791DB846D8A69F4DAF7E99D60F9
SHA1:	C42AB63EB1CAD6DE9DE54B03CB1AED401A0C7933
SHA-256:	97B84D5DAAE447017B87AC439D03FD8AF6FEBCF03FB310093E97A2E8CFE25E78
SHA-512:	DFC933C4E971CF395DE69B96F1B866D2321C4107AD1514EF76CE93878CD8E0A2FE9FA43296F109677B766E19DAD2E0AFA7129DF6C575AC475F4A60E632157247
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......8..d............$...........D...,.......4...NF..........T.......8...........T............#..Dn..........p...........\....................................................................U...........B..............Lw................o.....T...........1..d.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0C3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10020
Entropy (8bit):	3.712686775800822
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiKCyy6YiiKQx/gmfamSik+pDN89begffSqm:RrlsNi3h6YaQx/gmfamSiKewf2
MD5:	1A918E2D53849FC0F550828CF211623B
SHA1:	CEF0981EB20D7A9EEA2F6F848253B32423E306B2
SHA-256:	E8E2C7C244100B3B2C11AAC54B1FB905E6866CA5378B2FCAA7C347E4D1AB85FE
SHA-512:	B77ADD675FD01F5013AE3C9C1369110E50CF7569E3592DE4F521CFE4689FEB036939574A4E8A65714251AE0717BEAE524FE26EF0C5857F65BE375FC5684F54E0
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.6.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC132.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4816
Entropy (8bit):	4.460118382819922
Encrypted:	false
SSDEEP:	48:cvIwSD8zsiEJgtBI9D7Wgc8sqYjQ/8fm8M4J1Ajeh7FXgyq8vbehCdAuJNu2d:uITfNpKgrsqYFJ1bgWTdN22d
MD5:	50348ED580DA9F0480767D0CC85FCFD6
SHA1:	A62CF50EC41BC3E9DF640E3410836A2B8D7F5E88
SHA-256:	67B6F20DC7C9E1796D2392B1262B8F4AEAD46C403781EBE4D046D48BF1E19208
SHA-512:	479FEE05A19A7C64F4DCC0F05A31300D4D92CE879625E4012CF42263D92E81D43118AD5B76EA5B15152E53C0E0CE62C28E8089F9D26B8A0DF2D7956253D53986
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2194021" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\Public\Music\Picture\bReporter.exe

Download File

Process:	C:\Users\user\Desktop\4a9OE5cKJo.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	152080
Entropy (8bit):	6.033340834736862
Encrypted:	false
SSDEEP:	3072:eNScv9gt7ElprSiZgmUs1qbrsErX71wLOp:eNSB7E3rwmXOsErXpwk
MD5:	BB63FD178AFFCCAAB180BCE1689157CE
SHA1:	5F9270D357E366622D4DA1589A31BEBDD2D01AE4
SHA-256:	3B510C14FF2ADF730F796EF534E0B1138EF430E0B1390F31D17A7820E4C4AB8E
SHA-512:	A54EE92E762C8D52382577DB6F6D0AB67705EEBD61C0C302761E35493E503E71DF4DD4E3533B523CE2B1DB079842C437DE634361636B751CF4A19AFEE768A55A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./....#.H....................@............................................... ..............................................P............... ...........:......................................(....................T..8............................text...(F.......H..................`.P`.data........`.......L..............@.P..rdata......p.......N..............@.`@/4..................................@.0..pdata....... ......................@.0@.xdata.......0......................@.0@.bss.........@........................`..idata.......P......................@.0..CRT....h....p......................@.@..tls................................@.@.................................................................................................................................................................................................................

C:\Users\Public\Music\Picture\libwim-15.dll

Download File

Process:	C:\Users\user\Desktop\4a9OE5cKJo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	281088
Entropy (8bit):	6.181911083064269
Encrypted:	false
SSDEEP:	3072:lY+s9O8ItYzq6s236F6t6Sr0yWYbBMSXK+BCOMJg0OSOrmUkoY46pveyzbCibH/R:bsJItUqn28N6dWYbOJ9EOohjy67K
MD5:	40F57EFDE162ABC926C6B0C9C9025E7E
SHA1:	FEDEBC1AB39CD9BB6895A7B3F8407FF4FE17AB94
SHA-256:	251CFA2A6DC4F9C9258F5AC6679AAC24CEB82CA6841A790E97458CCC17DDFE13
SHA-512:	C134DD93321AAC8D10F0FA40DEB279675AE91429EE583421A2E6BBBC1AC91179843865CB0837B439D2891BD9AE636EB9FB6FF07BC9DBE45CB76BD85849D1BA80
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../q.Q/q.Q/q.Qt..P%q.Qt..P=q.Qt..P.q.Q...P!q.Q...P%q.Q...Pcq.Qt..P.q.Qt..P"q.Q/q.Q.q.Q...P-q.Q...P.q.Q..AQ.q.Q/q)Q.q.Q...P.q.QRich/q.Q................PE..d...a..d.........." ...#......&.....d.........................................)...........`.........................................P.................).H....P).."............).T.......8.......................(.......@............................................text...p........................... ..`.rdata..:Q.......R..................@..@.data...<A%......2..................@....pdata..."...P)..$..................@..@_RDATA..\.....)......:..............@..@.rsrc...H.....)......<..............@..@.reloc..T.....)......@..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\service[1].log

Download File

Process:	C:\Users\Public\Music\Picture\bReporter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2836039
Entropy (8bit):	4.18810933759387
Encrypted:	false
SSDEEP:	12288:rif5ocg8XFiqhoHEqhFaS28NPUczWO3xhd58SyR5sLLs7yWQfcdkO3jM6EqelKMR:kGDzjItMXb+bL8AWruZ/SS9NmBEuXx
MD5:	563F073B851A36041C5433B18BD08501
SHA1:	BD39CB9339C3C20F97D2C51DE0FC24D6CDFE381F
SHA-256:	E7A4AEF1D59F611B7AB5D4B08F8B60943DB01E342CA0B1CE869A166B09CDCBB9
SHA-512:	DC284E11C91B21C58410AC19BADEEED63A2430E9848652FBF90BC6E28BE5E372654E74DED9DCF2C0289630F49C330E1E5BEC2F2E630511A9E9AF8E08269C1F73
Malicious:	false
Preview:	kick..blue..picture..egg..eye..blue..picture..egg..eye..judge..fall..yesterday..man..school..ocean..camera..wind..work..animal..land..rain..func..ghost..guest..sugar..music..usually..life..yearn..java..yesterday..blue..understand..night..oil..king..judge..yard..alone..room..hat..eye..eye..eye..eye..map..kick..voice..pizza..value..fire..ghost..hair..wind..ment..Kanthan..hit..beach..rabbit..land..green..fire..train..face..rest..hope..white..visitor..cloud..jump..cloud..cow..victory..quarter..joy..information..picture..joke..zebra..jacket..joke..offer..nature..top..east..yes..color..issue..while..yellow..question..talk..university..nature..jump..java..book..char..int..friend..oil..taste..day..yellow..boy..boy..unsigned..young..green..machine..order..head..high..array..energy..monkey..kiss..king..queen..kind..visitor..day..short..short..note..order..icon..school..test..person..question..room..key..keep..laugh..winter..one..meal..plant..map..red..easy..warn..test..victory..dog..university..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.366081624472304
Encrypted:	false
SSDEEP:	12288:9+00Th31T9p6HTSPW59Wvr+47Zb1VX11p/4dd/DYZ58yHlqr3wsU:I00Th31T9pyTSPvd7e
MD5:	B266D14CFA6BB1FFA23463AF29C055C3
SHA1:	9D33FAD8F2C0B42BF23347A54853DB60A3E44A2B
SHA-256:	6B35CED75971D2B918D27A568EACBD08D9FFD5B3DDA558C0A07E9B88ECE0BE09
SHA-512:	3F79BD437B38FB746AB3628D3A4C833FC199E78E1B95A8FA938E83A17503F8A37217122FF41326B8AA20614F05EC0D7E361D0CFD33BED67FAF364F58712B5E15
Malicious:	false
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.~H.<................................................................................................................................................................................................................................................................................................................................................WA.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.106702138127371
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4a9OE5cKJo.exe
File size:	1'084'632 bytes
MD5:	9652452e6863bfcb4fb2c1c20702ca7f
SHA1:	698dce4f4d06fafa486a0ac8c4d3913c249e429c
SHA256:	84cc4306c04df6e4d2f0431f538e6612c2bf72ee57d0bac23ed3a19936b3ed73
SHA512:	94c2e873e8c41ce73de756be3354db4bb1bbf615b4a331afa592332f5ef1f4b38d033840558ebc3f2551e7535238fdf71bede61df61a0e604a8ee75f4895a916
SSDEEP:	24576:trVMSqfnuFiD4GQg2JmTedvip7V+3bNmgKtoKm6v0G1a:trVxsnm3+SAsN/BJka
TLSH:	7D354B9432E3E4C7F513E83AC456F560E564F42CABE13D6F1B88EAA45B11DE00E1F692
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n...............g.......g.......g..t...{s......{s......{s.......g.......g..............Ot.......r.......r8.......P......r.....

File Icon


Icon Hash:	c0d4d5afab636949

Static PE Info

General

Entrypoint:	0x140046aa4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64D9D3CA [Mon Aug 14 07:12:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	17f1c6a7e23412a1437c57618bb9a6ad

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	8/24/2021 2:00:00 AM 8/30/2023 1:59:59 AM
Subject Chain	CN=\u6f33\u5dde\u5927\u76db\u8f6f\u4ef6\u6709\u9650\u516c\u53f8, O=\u6f33\u5dde\u5927\u76db\u8f6f\u4ef6\u6709\u9650\u516c\u53f8, L=\u6f33\u5dde\u5e02, S=\u798f\u5efa\u7701, C=CN
Version:	3
Thumbprint MD5:	A41028D4292D0CBC86D5E8A47172E987
Thumbprint SHA-1:	0E1E3A020F05ECDCA98CFB4410A7755645059DF3
Thumbprint SHA-256:	93C99C42C6E76151B128605E542748121434D430CEE40B7AD7459DE5EA8CEE6F
Serial:	0782044CA401E93EDD4C5B52B1CDF68B

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2C78B8BE78h
dec eax
add esp, 28h
jmp 00007F2C78B8B7EFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F2C78B8B982h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F2C78B8B985h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F2C78B8B97Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F2C78B8B992h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [000BC581h]
jne 00007F2C78B8B982h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F2C78B8B973h
ret
dec eax
ror ecx, 10h
jmp 00007F2C78B8BF63h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1004dc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10d000	0x18b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x109000	0x28f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x107c00	0x10d8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10f000	0xc64	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfc2a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xfc300	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfc160	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x68000	0x4f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x66ae4	0x66c00	False	0.2889009276155718	data	6.140154330547015	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x68000	0x9958e	0x99600	False	0.5697919850244498	data	7.2097235661698775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x102000	0x650c	0x2200	False	0.22047334558823528	data	3.408757123703961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x109000	0x28f8	0x2a00	False	0.4760044642857143	data	5.542765320264992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x10c000	0x15c	0x200	False	0.404296875	data	3.3446944364441142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x10d000	0x18b8	0x1a00	False	0.8192608173076923	data	7.249844587471112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10f000	0xc64	0xe00	False	0.45005580357142855	data	5.177955843960203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x10d130	0x139a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9489836588282184
RT_GROUP_ICON	0x10e4d0	0x14	data	Chinese	China	1.05
RT_VERSION	0x10e4e8	0x24c	data	Chinese	China	0.5034013605442177
RT_MANIFEST	0x10e738	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetACP, VerSetConditionMask, FreeLibrary, GetModuleHandleExW, LoadLibraryA, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, QueryPerformanceCounter, QueryPerformanceFrequency, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetThreadExecutionState, SetEndOfFile, HeapSize, ReadConsoleW, ReadFile, FlushFileBuffers, CreateFileW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExW, HeapReAlloc, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, GetFileType, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleCP, HeapAlloc, HeapFree, WriteFile, GetStdHandle, GetModuleFileNameW, ExitProcess, RtlUnwind, LoadLibraryExW, SetLastError, RtlUnwindEx, RaiseException, RtlPcToFileHeader, TerminateProcess, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateEventW, InitializeCriticalSectionAndSpinCount, CloseHandle, GetCPInfo, GetStringTypeW, LCMapStringEx, WriteConsoleW, DecodePointer, EncodePointer, InitializeCriticalSectionEx, GetVersionExA, SetProcessMitigationPolicy, CreateProcessA, GetCurrentProcess, GetLastError, FindNextFileW, FindFirstFileW, FindClose, CreateFileA, CreateDirectoryA
USER32.dll	GetRawInputDeviceInfoA, GetRawInputDeviceList, RegisterRawInputDevices, GetRawInputData, MessageBoxA, MonitorFromWindow, LoadImageW, DestroyIcon, LoadCursorW, GetWindowLongW, PtInRect, SetRect, ClipCursor, WindowFromPoint, ScreenToClient, ClientToScreen, GetCursorPos, SetCursor, SetCursorPos, AdjustWindowRectEx, GetClientRect, RemovePropW, GetPropW, ReleaseCapture, SetCapture, GetKeyState, SetWindowLongW, SetWindowPos, RegisterClassExW, UnregisterClassW, DefWindowProcW, GetMessageTime, TrackMouseEvent, EnumDisplayMonitors, GetMonitorInfoW, EnumDisplayDevicesW, EnumDisplaySettingsW, ChangeDisplaySettingsExW, SystemParametersInfoW, MapVirtualKeyW, ToUnicode, ShowWindow, DestroyWindow, CreateWindowExW, UnregisterDeviceNotification, RegisterDeviceNotificationW, PeekMessageW, DispatchMessageW, TranslateMessage
GDI32.dll	CreateRectRgn, SetDeviceGammaRamp, GetDeviceCaps, DeleteDC, CreateDCW, DeleteObject
SHELL32.dll	DragFinish, DragQueryPoint, DragQueryFileW, SHGetKnownFolderPath
ole32.dll	CoTaskMemFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 07:50:43.703758955 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:43.703819990 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:43.703910112 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:43.816907883 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:43.816960096 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:49.753334999 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:49.753671885 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:49.754780054 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:49.754935026 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:50.029666901 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:50.029731989 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.030628920 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.030734062 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:50.032989979 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:50.075486898 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.867793083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.867862940 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.868160009 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:50.868189096 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:50.868267059 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.480875969 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.480909109 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.480993986 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481117964 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481157064 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481218100 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481236935 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481254101 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481261969 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481297016 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481313944 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481522083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481600046 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:51.481611967 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:51.481662035 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.094657898 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.094691038 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.094907045 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.094924927 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.094980001 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.095022917 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.095068932 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.095091105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.095159054 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.136672020 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.136820078 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.136955976 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.136995077 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137054920 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.137087107 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137134075 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137147903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.137233019 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137449980 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.137501001 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.137545109 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137559891 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.137583017 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.137624979 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.708362103 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708394051 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708468914 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708575964 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.708651066 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708690882 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.708710909 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.708872080 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708923101 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708947897 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.708967924 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.708995104 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.709012032 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.709413052 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.709460020 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.709513903 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.709542036 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.709563971 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.709599972 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.750700951 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.750771999 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.750905991 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.750977039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751035929 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751071930 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751090050 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751369953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751419067 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751482964 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751504898 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751527071 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751559019 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751559973 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751589060 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751632929 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751656055 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.751668930 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.751720905 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752181053 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752226114 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752264977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752281904 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752314091 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752347946 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752407074 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752490044 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752510071 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752563000 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752690077 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752767086 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:52.752783060 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:52.752844095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.322531939 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.322575092 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.322691917 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.322962999 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.322962999 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323031902 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323154926 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323246002 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323331118 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323354006 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323373079 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323442936 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323523045 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323534012 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323564053 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323622942 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323685884 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323703051 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323751926 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323781013 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323796988 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.323867083 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323941946 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.323956966 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324064016 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324140072 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324228048 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324259996 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324276924 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324336052 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324381113 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324383974 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324418068 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324484110 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324569941 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324584007 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324659109 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.324865103 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324934006 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.324990988 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.325006962 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.325058937 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.325098991 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.325345039 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.325414896 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.325473070 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.325489044 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.325556993 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.325597048 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.365750074 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.365848064 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.365947962 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.366010904 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.366049051 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.366070986 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.366756916 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.366823912 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.366888046 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.366904974 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.366930962 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.366962910 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.367019892 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.367082119 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.369461060 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.369528055 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.369604111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.369621038 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.369646072 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.369673967 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370002985 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370065928 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370194912 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370218039 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370256901 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370373964 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370390892 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370543957 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370695114 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370760918 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370794058 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370810986 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.370836973 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370861053 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.370949984 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.371045113 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.371059895 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.371115923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.371436119 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.371536016 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.371565104 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.371582031 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.371604919 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.371638060 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372015953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372077942 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372123003 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372138977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372164011 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372199059 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372271061 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372373104 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372394085 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372440100 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372443914 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372478008 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372515917 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372546911 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.372558117 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.372606039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.937954903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.937988997 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938100100 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938294888 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938355923 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938400984 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938441992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938477993 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938499928 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938530922 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.938534975 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938595057 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938664913 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.938955069 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939003944 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939053059 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939071894 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939116955 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939163923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939443111 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939524889 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939563990 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939582109 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939641953 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939687014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939699888 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939760923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.939939022 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.939996004 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940042019 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.940057039 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940126896 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940155983 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.940175056 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940231085 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.940278053 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.940377951 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940490961 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.940505981 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.940576077 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941016912 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941075087 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941123009 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941138029 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941205978 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941473007 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941523075 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941576958 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941591024 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.941629887 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941682100 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.941988945 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942051888 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942117929 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942137003 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942223072 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942492962 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942564964 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942612886 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942626953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942679882 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942733049 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942734957 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942765951 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942846060 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942904949 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.942922115 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.942946911 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.943017960 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.943083048 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:53.943099022 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:53.943169117 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.207272053 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.207308054 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.207516909 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.207895994 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.207895994 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.207963943 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208005905 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208029032 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208344936 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.208386898 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208463907 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208672047 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.208690882 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208717108 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208760977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.208791018 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208940029 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.208950043 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.208970070 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209011078 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209065914 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209084988 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209155083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209217072 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209227085 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209228039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209319115 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209357977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209357977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209384918 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209408998 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209470034 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209486008 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209572077 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209598064 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209685087 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209711075 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209723949 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209786892 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209830999 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209831953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209861994 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.209942102 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.209955931 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210031033 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210042953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210069895 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210150957 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210166931 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210210085 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210246086 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210254908 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210285902 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210340977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210419893 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210448027 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210463047 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210505962 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210539103 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210588932 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210602999 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210642099 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210686922 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210686922 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210714102 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210799932 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210809946 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210869074 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210897923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.210912943 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.210956097 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211023092 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211035013 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211057901 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211092949 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211107969 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211177111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211204052 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211297035 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211312056 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211352110 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211375952 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211390972 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211412907 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211486101 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211503029 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211551905 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211579084 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211595058 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211608887 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211633921 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211662054 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211740017 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211755037 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211779118 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211817980 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211822033 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211846113 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.211906910 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.211988926 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212007999 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212023020 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212044954 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212122917 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212140083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212184906 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212212086 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212225914 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212254047 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212284088 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212363958 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212390900 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212431908 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212476015 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212491989 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212532043 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212563992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212574959 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212589025 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212620020 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212657928 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212673903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212721109 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212749004 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212764025 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212779045 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212800980 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212853909 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212923050 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.212937117 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.212979078 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213005066 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213018894 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213048935 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213073969 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213148117 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213160992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213186026 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213227034 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213228941 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213258982 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213354111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213397980 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213423014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213438988 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213471889 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213500977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213571072 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213587046 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213620901 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213645935 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213660955 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213681936 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213752031 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213768005 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213807106 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213814020 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.213849068 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.213908911 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214001894 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214014053 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214118004 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214184046 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214199066 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214257956 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214303017 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214309931 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214333057 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214395046 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214430094 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214467049 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214513063 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214641094 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214672089 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214699030 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214782953 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214833021 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214850903 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.214869022 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214891911 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.214965105 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215003014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215014935 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215039015 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215090036 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215092897 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215115070 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215162039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215223074 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215243101 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215291023 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215343952 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215358019 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215401888 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215425014 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215429068 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215451956 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215528011 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215531111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215553045 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215635061 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215686083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215729952 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215789080 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215805054 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215846062 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215864897 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215881109 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.215897083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.215955019 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216028929 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216038942 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216057062 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216090918 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216108084 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216154099 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216166973 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216203928 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216209888 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216250896 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216262102 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216294050 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216305971 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216378927 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216423035 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216464996 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216517925 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216532946 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216573000 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216593981 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216614962 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216628075 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216659069 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216689110 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216756105 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216768980 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216794014 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.216837883 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.216892958 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.232933998 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.232959032 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.233172894 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.235639095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.235654116 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.235682964 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.235950947 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.235964060 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.236093998 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.246933937 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.248636007 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793270111 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793363094 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793598890 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793668032 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793710947 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793731928 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793757915 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793772936 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793802977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.793803930 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793858051 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.793894053 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794038057 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794089079 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794142008 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794161081 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794188023 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794225931 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794483900 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794533014 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794583082 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794601917 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794632912 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794647932 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794881105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.794980049 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.794984102 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.795018911 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.795069933 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.795108080 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820265055 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820338964 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820436001 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820487022 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820514917 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820563078 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820617914 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820638895 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820679903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.820760012 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820859909 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.820991993 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821063042 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821120977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.821137905 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821270943 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.821445942 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821515083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821693897 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.821712971 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821784019 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.821923971 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.821991920 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822063923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822078943 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822129965 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822170973 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822388887 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822459936 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822520971 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822535992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822575092 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822628021 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822851896 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822926044 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.822977066 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.822993994 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823061943 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823096991 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823296070 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823391914 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823411942 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823481083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823517084 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823576927 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823800087 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823865891 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.823915958 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.823934078 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824023962 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824074984 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824284077 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824341059 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824408054 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824423075 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824472904 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824520111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824686050 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824747086 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824812889 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824829102 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:55.824882030 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:55.824923992 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.445523024 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.445554972 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.445662975 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.445816994 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.445816994 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.445879936 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.445924997 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.445949078 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.445969105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446001053 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446007967 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446017981 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446033955 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446080923 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446105003 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446525097 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446574926 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446634054 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446651936 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446676970 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446738958 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446755886 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446770906 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446825027 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446892977 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446907997 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446930885 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.446937084 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.446990967 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447006941 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.447027922 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447050095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.447087049 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.447092056 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447118044 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447165966 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447258949 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:56.447277069 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:56.447330952 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024044037 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024077892 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024245977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024326086 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024393082 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024461985 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024468899 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024538040 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024538040 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024566889 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024571896 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024630070 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024667025 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024800062 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024846077 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024883986 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024910927 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.024940014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024966955 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.024997950 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025043964 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025074005 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025089979 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025115013 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025131941 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025156021 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025199890 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025233030 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025248051 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025289059 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025305986 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025353909 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025402069 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025441885 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025456905 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025480032 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025506020 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.025885105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025957108 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.025984049 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.026000977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.026029110 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.026052952 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060513973 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060575962 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060626984 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060664892 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060697079 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060723066 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060733080 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060760975 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060808897 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060810089 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060833931 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060849905 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.060875893 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060906887 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.060976028 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061019897 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061055899 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061073065 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061096907 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061117887 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061175108 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061218977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061258078 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061273098 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061300039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061328888 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061402082 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061450958 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061502934 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061517954 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061561108 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061583042 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061604977 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061650991 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061697006 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061713934 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061754942 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061772108 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061808109 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061850071 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061901093 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061925888 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.061949968 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.061971903 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062001944 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062083006 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062092066 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062114954 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062161922 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062182903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062206030 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062222004 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062247992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062266111 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062299013 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062313080 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062335014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062355042 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062398911 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062447071 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062474012 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062489033 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062517881 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062535048 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062598944 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062643051 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062675953 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062690973 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062719107 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062738895 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062799931 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062841892 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062887907 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062902927 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.062933922 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.062956095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063003063 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063047886 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063095093 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063116074 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063142061 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063165903 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063204050 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063247919 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063275099 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063288927 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063327074 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063345909 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063401937 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063447952 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063492060 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063515902 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063553095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063580036 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063623905 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063688993 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063709974 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063724995 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063757896 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063775063 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063802958 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063848972 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063877106 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063893080 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.063915968 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.063939095 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064001083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064043999 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064075947 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064101934 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064131021 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064152002 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064207077 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064249992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064280033 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064296961 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064320087 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064336061 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064402103 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064448118 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064474106 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064488888 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064513922 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064532995 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064599991 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064646006 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064687967 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064702988 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064728022 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064752102 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064800978 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064842939 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064871073 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064887047 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.064913034 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064929008 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.064986944 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065035105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065058947 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065073967 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065097094 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065114021 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065181017 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065253973 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065263987 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065284014 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065315008 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065340996 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065365076 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065408945 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065431118 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065444946 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065474033 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065490961 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065557957 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065604925 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065628052 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065643072 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065666914 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065684080 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065756083 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065802097 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065820932 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065835953 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065867901 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065886021 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.065948963 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.065994978 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066035986 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066051960 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066077948 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066098928 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066144943 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066185951 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066210032 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066224098 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066261053 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066287041 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066339970 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066386938 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066416979 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066436052 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066461086 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066504002 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066523075 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066569090 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066606045 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066623926 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066648006 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066670895 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.066701889 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.066776037 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.258358002 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.258404970 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.258435011 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.258454084 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.258529902 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.258542061 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.258608103 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.258666039 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.266211033 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.267230988 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638385057 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638442993 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638556957 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638578892 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638647079 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638695002 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638695002 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638755083 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638792992 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638835907 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638880014 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638900042 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.638926029 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.638963938 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639024019 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639069080 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639125109 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639149904 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639173985 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639195919 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639633894 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639729023 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639735937 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639775991 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.639822006 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.639848948 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.678750038 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.678788900 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.678869009 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.678970098 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.678997993 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679023981 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679044962 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679056883 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679068089 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679106951 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679128885 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679145098 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679157019 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679203033 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679250956 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679375887 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679397106 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679480076 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679503918 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679519892 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679553032 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679558039 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679572105 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679626942 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679641962 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679651976 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679711103 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679732084 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679744005 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679761887 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679827929 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679828882 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679843903 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679877043 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679878950 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:50:57.679920912 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.679949999 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.684385061 CEST	49711	443	192.168.2.4	82.156.94.45
Aug 29, 2023 07:50:57.684412956 CEST	443	49711	82.156.94.45	192.168.2.4
Aug 29, 2023 07:51:07.780611038 CEST	49724	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:07.780704975 CEST	443	49724	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:07.780852079 CEST	49724	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:07.781404972 CEST	49724	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:07.781471968 CEST	443	49724	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:09.557363987 CEST	443	49724	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:09.559283018 CEST	49727	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:09.559376001 CEST	443	49727	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:09.559648991 CEST	49727	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:09.563011885 CEST	49727	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:09.563067913 CEST	443	49727	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:10.325037003 CEST	443	49727	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:10.326011896 CEST	49731	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:10.326072931 CEST	443	49731	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:10.326183081 CEST	49731	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:10.327033997 CEST	49731	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:10.327068090 CEST	443	49731	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:11.143271923 CEST	443	49731	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:11.144601107 CEST	49735	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:11.144684076 CEST	443	49735	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:11.144906044 CEST	49735	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:11.145828009 CEST	49735	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:11.145863056 CEST	443	49735	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:12.795191050 CEST	443	49735	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:12.801986933 CEST	49742	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:12.802072048 CEST	443	49742	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:12.802200079 CEST	49742	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:12.802761078 CEST	49742	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:12.802798033 CEST	443	49742	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:14.609020948 CEST	443	49742	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:14.614959002 CEST	49744	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:14.615016937 CEST	443	49744	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:14.615149021 CEST	49744	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:14.615782976 CEST	49744	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:14.615813017 CEST	443	49744	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:15.267016888 CEST	443	49744	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:15.269587994 CEST	49746	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:15.269635916 CEST	443	49746	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:15.269717932 CEST	49746	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:15.270744085 CEST	49746	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:15.270764112 CEST	443	49746	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:16.890672922 CEST	443	49746	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:17.090100050 CEST	49747	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:17.090161085 CEST	443	49747	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:17.090297937 CEST	49747	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:17.091034889 CEST	49747	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:17.091062069 CEST	443	49747	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:47.779284954 CEST	49747	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:47.789115906 CEST	49748	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:47.789196968 CEST	443	49748	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:47.789319038 CEST	49748	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:47.789973974 CEST	49748	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:47.790011883 CEST	443	49748	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:49.423861980 CEST	443	49748	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:49.425548077 CEST	49749	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:49.425633907 CEST	443	49749	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:49.425772905 CEST	49749	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:49.426848888 CEST	49749	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:49.426891088 CEST	443	49749	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.084083080 CEST	443	49749	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.085536957 CEST	49750	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.085599899 CEST	443	49750	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.085716963 CEST	49750	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.086558104 CEST	49750	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.086592913 CEST	443	49750	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.697455883 CEST	443	49750	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.699140072 CEST	49751	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.699225903 CEST	443	49751	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:50.699428082 CEST	49751	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.701245070 CEST	49751	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:50.701287985 CEST	443	49751	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:51.469214916 CEST	443	49751	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:51.478832960 CEST	49752	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:51.478924990 CEST	443	49752	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:51.479132891 CEST	49752	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:51.481070995 CEST	49752	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:51.481116056 CEST	443	49752	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:53.253026962 CEST	443	49752	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:53.281753063 CEST	49753	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:53.281831026 CEST	443	49753	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:53.281944990 CEST	49753	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:53.282540083 CEST	49753	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:53.282583952 CEST	443	49753	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:54.048676014 CEST	443	49753	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:54.511867046 CEST	49754	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:54.511928082 CEST	443	49754	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:54.512013912 CEST	49754	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:54.512588978 CEST	49754	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:54.512609959 CEST	443	49754	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:56.310822964 CEST	443	49754	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:56.313158989 CEST	49755	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:56.313211918 CEST	443	49755	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:56.313344002 CEST	49755	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:56.314194918 CEST	49755	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:56.314224005 CEST	443	49755	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.074943066 CEST	443	49755	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.080899000 CEST	49756	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.080982924 CEST	443	49756	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.081118107 CEST	49756	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.081609964 CEST	49756	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.081648111 CEST	443	49756	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.699897051 CEST	443	49756	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.700937033 CEST	49757	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.701015949 CEST	443	49757	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:57.701122046 CEST	49757	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.701816082 CEST	49757	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:57.701845884 CEST	443	49757	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.309679031 CEST	443	49757	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.311578989 CEST	49758	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.311674118 CEST	443	49758	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.311908007 CEST	49758	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.313653946 CEST	49758	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.313699961 CEST	443	49758	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.935720921 CEST	443	49758	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.937601089 CEST	49759	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.937680006 CEST	443	49759	62.234.23.52	192.168.2.4
Aug 29, 2023 07:51:58.937840939 CEST	49759	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.940198898 CEST	49759	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:51:58.940239906 CEST	443	49759	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:03.873739958 CEST	443	49759	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:03.886096001 CEST	49760	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:03.886187077 CEST	443	49760	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:03.886425972 CEST	49760	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:03.887919903 CEST	49760	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:03.887954950 CEST	443	49760	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:05.673120975 CEST	443	49760	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:05.674871922 CEST	49761	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:05.674956083 CEST	443	49761	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:05.675065041 CEST	49761	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:05.676918983 CEST	49761	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:05.676953077 CEST	443	49761	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:06.434659958 CEST	443	49761	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:06.436674118 CEST	49762	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:06.436758041 CEST	443	49762	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:06.436908960 CEST	49762	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:06.438065052 CEST	49762	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:06.438102007 CEST	443	49762	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:07.050853968 CEST	443	49762	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:07.052944899 CEST	49763	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:07.053025961 CEST	443	49763	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:07.053231955 CEST	49763	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:07.053848982 CEST	49763	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:07.053884029 CEST	443	49763	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:08.693804979 CEST	443	49763	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:08.700485945 CEST	49764	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:08.700577021 CEST	443	49764	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:08.700750113 CEST	49764	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:08.701425076 CEST	49764	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:08.701457977 CEST	443	49764	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:39.784143925 CEST	49764	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:39.792416096 CEST	49765	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:39.792496920 CEST	443	49765	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:39.792606115 CEST	49765	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:39.793127060 CEST	49765	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:39.793163061 CEST	443	49765	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:40.431651115 CEST	443	49765	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:40.433481932 CEST	49766	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:40.433562994 CEST	443	49766	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:40.433712006 CEST	49766	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:40.435125113 CEST	49766	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:40.435167074 CEST	443	49766	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:41.247127056 CEST	443	49766	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:41.249191046 CEST	49767	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:41.249272108 CEST	443	49767	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:41.249382019 CEST	49767	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:41.250333071 CEST	49767	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:41.250375986 CEST	443	49767	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:44.897180080 CEST	443	49767	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:44.898174047 CEST	49768	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:44.898233891 CEST	443	49768	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:44.898363113 CEST	49768	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:44.898971081 CEST	49768	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:44.898999929 CEST	443	49768	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:46.684840918 CEST	443	49768	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:46.930185080 CEST	49769	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:46.930268049 CEST	443	49769	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:46.930365086 CEST	49769	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:46.932146072 CEST	49769	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:46.932183981 CEST	443	49769	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:47.563849926 CEST	443	49769	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:47.933258057 CEST	49770	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:47.933345079 CEST	443	49770	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:47.933479071 CEST	49770	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:47.935015917 CEST	49770	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:47.935056925 CEST	443	49770	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:48.567730904 CEST	443	49770	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:48.568667889 CEST	49771	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:48.568746090 CEST	443	49771	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:48.568845034 CEST	49771	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:48.569582939 CEST	49771	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:48.569638968 CEST	443	49771	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.218854904 CEST	443	49771	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.220626116 CEST	49772	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.220705032 CEST	443	49772	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.220834970 CEST	49772	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.221939087 CEST	49772	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.221973896 CEST	443	49772	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.831943035 CEST	443	49772	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.842221022 CEST	49773	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.842325926 CEST	443	49773	62.234.23.52	192.168.2.4
Aug 29, 2023 07:52:52.842432022 CEST	49773	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.843157053 CEST	49773	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:52:52.843194962 CEST	443	49773	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:08.940999985 CEST	443	49773	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:08.942881107 CEST	49774	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:08.942939997 CEST	443	49774	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:08.943114996 CEST	49774	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:08.944811106 CEST	49774	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:08.944847107 CEST	443	49774	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:10.598288059 CEST	443	49774	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:10.600080013 CEST	49775	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:10.600161076 CEST	443	49775	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:10.600368023 CEST	49775	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:10.601867914 CEST	49775	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:10.601907969 CEST	443	49775	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:14.269973040 CEST	443	49775	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:14.271229982 CEST	49776	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:14.271330118 CEST	443	49776	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:14.271522999 CEST	49776	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:14.272088051 CEST	49776	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:14.272130013 CEST	443	49776	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:22.256206036 CEST	443	49776	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:22.261394024 CEST	49782	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:22.261462927 CEST	443	49782	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:22.261560917 CEST	49782	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:22.261924982 CEST	49782	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:22.261959076 CEST	443	49782	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.055329084 CEST	443	49782	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.057063103 CEST	49785	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.057142019 CEST	443	49785	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.057329893 CEST	49785	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.058806896 CEST	49785	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.058845043 CEST	443	49785	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.688352108 CEST	443	49785	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.689708948 CEST	49786	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.689785004 CEST	443	49786	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:26.689893961 CEST	49786	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.690491915 CEST	49786	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:26.690531015 CEST	443	49786	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:27.445518017 CEST	443	49786	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:27.446561098 CEST	49787	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:27.446671963 CEST	443	49787	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:27.446826935 CEST	49787	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:27.447693110 CEST	49787	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:27.447738886 CEST	443	49787	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:28.200570107 CEST	443	49787	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:28.213669062 CEST	49788	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:28.213732958 CEST	443	49788	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:28.213943958 CEST	49788	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:28.225840092 CEST	49788	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:28.225886106 CEST	443	49788	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:31.906831026 CEST	443	49788	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:31.907881975 CEST	49789	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:31.907977104 CEST	443	49789	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:31.908088923 CEST	49789	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:31.908942938 CEST	49789	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:31.908988953 CEST	443	49789	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:32.716227055 CEST	443	49789	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:32.717930079 CEST	49790	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:32.718035936 CEST	443	49790	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:32.718205929 CEST	49790	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:32.719750881 CEST	49790	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:32.719820976 CEST	443	49790	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:34.542557001 CEST	443	49790	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:34.543350935 CEST	49791	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:34.543426037 CEST	443	49791	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:34.543560982 CEST	49791	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:34.544085026 CEST	49791	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:34.544117928 CEST	443	49791	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.187314987 CEST	443	49791	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.196500063 CEST	49792	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.196580887 CEST	443	49792	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.196702003 CEST	49792	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.197346926 CEST	49792	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.197388887 CEST	443	49792	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.967447996 CEST	443	49792	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.968410015 CEST	49793	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.968485117 CEST	443	49793	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:36.968601942 CEST	49793	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.969326973 CEST	49793	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:36.969369888 CEST	443	49793	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:37.774517059 CEST	443	49793	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:37.775574923 CEST	49794	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:37.775656939 CEST	443	49794	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:37.775759935 CEST	49794	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:37.776427031 CEST	49794	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:37.776463032 CEST	443	49794	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:38.385168076 CEST	443	49794	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:38.387615919 CEST	49795	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:38.387685061 CEST	443	49795	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:38.387861013 CEST	49795	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:38.390305042 CEST	49795	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:38.390341997 CEST	443	49795	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:39.156330109 CEST	443	49795	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:39.160626888 CEST	49796	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:39.160672903 CEST	443	49796	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:39.160751104 CEST	49796	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:39.161396027 CEST	49796	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:39.161412954 CEST	443	49796	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:40.941440105 CEST	443	49796	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:40.942826033 CEST	49797	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:40.942943096 CEST	443	49797	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:40.943079948 CEST	49797	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:40.943809032 CEST	49797	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:40.943846941 CEST	443	49797	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:42.745280027 CEST	443	49797	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:42.747117043 CEST	49798	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:42.747193098 CEST	443	49798	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:42.747376919 CEST	49798	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:42.749295950 CEST	49798	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:42.749327898 CEST	443	49798	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:43.371747017 CEST	443	49798	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:43.373517036 CEST	49799	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:43.373590946 CEST	443	49799	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:43.373918056 CEST	49799	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:43.375072002 CEST	49799	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:43.375116110 CEST	443	49799	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:43.994606972 CEST	443	49799	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:44.000861883 CEST	49800	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.000937939 CEST	443	49800	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:44.001096964 CEST	49800	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.001852989 CEST	49800	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.001889944 CEST	443	49800	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:44.617557049 CEST	443	49800	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:44.618555069 CEST	49801	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.618628025 CEST	443	49801	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:44.618726969 CEST	49801	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.619362116 CEST	49801	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:44.619406939 CEST	443	49801	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:45.233511925 CEST	443	49801	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:45.235851049 CEST	49802	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:45.235929966 CEST	443	49802	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:45.236066103 CEST	49802	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:45.237278938 CEST	49802	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:45.237313032 CEST	443	49802	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.039180040 CEST	443	49802	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.040106058 CEST	49803	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.040179968 CEST	443	49803	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.040290117 CEST	49803	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.041167021 CEST	49803	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.041213989 CEST	443	49803	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.813147068 CEST	443	49803	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.820635080 CEST	49804	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.820715904 CEST	443	49804	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:46.820810080 CEST	49804	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.822074890 CEST	49804	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:46.822115898 CEST	443	49804	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:48.585138083 CEST	443	49804	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:48.585937023 CEST	49805	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:48.585980892 CEST	443	49805	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:48.586062908 CEST	49805	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:48.587035894 CEST	49805	443	192.168.2.4	62.234.23.52
Aug 29, 2023 07:53:48.587055922 CEST	443	49805	62.234.23.52	192.168.2.4
Aug 29, 2023 07:53:49.343580008 CEST	443	49805	62.234.23.52	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2023 07:50:43.385919094 CEST	60316	53	192.168.2.4	8.8.8.8
Aug 29, 2023 07:50:43.685619116 CEST	53	60316	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2023 07:50:43.385919094 CEST	192.168.2.4	8.8.8.8	0xcb4b	Standard query (0)	cdn-1319693778.cos.ap-beijing.myqcloud.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	cdn-1319693778.cos.ap-beijing.myqcloud.com	bj.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	bj.file.myqcloud.com		82.156.94.45	A (IP address)	IN (0x0001)	false
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	bj.file.myqcloud.com		82.156.94.47	A (IP address)	IN (0x0001)	false
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	bj.file.myqcloud.com		82.156.94.48	A (IP address)	IN (0x0001)	false
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	bj.file.myqcloud.com		82.156.94.13	A (IP address)	IN (0x0001)	false
Aug 29, 2023 07:50:43.685619116 CEST	8.8.8.8	192.168.2.4	0xcb4b	No error (0)	bj.file.myqcloud.com		82.156.94.17	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn-1319693778.cos.ap-beijing.myqcloud.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49711	82.156.94.45	443	C:\Users\Public\Music\Picture\bReporter.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-29 05:50:50 UTC	0	OUT	GET /service.log HTTP/1.1 User-Agent: MyApp Host: cdn-1319693778.cos.ap-beijing.myqcloud.com Cache-Control: no-cache
2023-08-29 05:50:50 UTC	0	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 2836039 Connection: close Accept-Ranges: bytes Date: Tue, 29 Aug 2023 05:50:50 GMT ETag: "563f073b851a36041c5433b18bd08501" Last-Modified: Sun, 13 Aug 2023 15:17:13 GMT Server: tencent-cos x-cos-hash-crc64ecma: 7122124251954580654 x-cos-request-id: NjRlZDg3M2FfNTQ0ZTQ0MGJfMjNlNjVfMTcxYWVm
2023-08-29 05:50:50 UTC	0	IN	Data Raw: 6b 69 63 6b 0d 0a 62 6c 75 65 0d 0a 70 69 63 74 75 72 65 0d 0a 65 67 67 0d 0a 65 79 65 0d 0a 62 6c 75 65 0d 0a 70 69 63 74 75 72 65 0d 0a 65 67 67 0d 0a 65 79 65 0d 0a 6a 75 64 67 65 0d 0a 66 61 6c 6c 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 6d 61 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 6f 63 65 61 6e 0d 0a 63 61 6d 65 72 61 0d 0a 77 69 6e 64 0d 0a 77 6f 72 6b 0d 0a 61 6e 69 6d 61 6c 0d 0a 6c 61 6e 64 0d 0a 72 61 69 6e 0d 0a 66 75 6e 63 0d 0a 67 68 6f 73 74 0d 0a 67 75 65 73 74 0d 0a 73 75 67 61 72 0d 0a 6d 75 73 69 63 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6c 69 66 65 0d 0a 79 65 61 72 6e 0d 0a 6a 61 76 61 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 62 6c 75 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6e 69 67 68 74 0d 0a 6f 69 6c 0d 0a 6b 69 6e 67 0d 0a 6a 75 64 67 65 0d Data Ascii: kickbluepictureeggeyebluepictureeggeyejudgefallyesterdaymanschooloceancamerawindworkanimallandrainfuncghostguestsugarmusicusuallylifeyearnjavayesterdayblueunderstandnightoilkingjudge
2023-08-29 05:50:51 UTC	8	IN	Data Raw: 6f 72 0d 0a 67 69 72 6c 0d 0a 67 69 72 6c 0d 0a 74 6f 70 0d 0a 69 6e 74 0d 0a 77 6f 72 6b 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 73 74 72 69 6e 67 0d 0a 61 72 74 0d 0a 77 61 72 6e 0d 0a 7a 6f 6f 0d 0a 6d 69 6c 6b 0d 0a 6f 72 64 65 72 0d 0a 6e 65 65 64 0d 0a 61 72 72 6f 77 0d 0a 6d 61 63 68 69 6e 65 0d 0a 64 6f 0d 0a 71 75 6f 74 65 0d 0a 63 68 61 72 0d 0a 61 72 63 68 0d 0a 65 6e 64 0d 0a 65 61 72 74 68 0d 0a 73 63 68 6f 6f 6c 0d 0a 76 69 63 74 6f 72 79 0d 0a 70 61 70 65 72 0d 0a 6c 6f 6e 67 0d 0a 70 69 63 74 75 72 65 0d 0a 67 61 6d 65 0d 0a 73 6e 6f 77 0d 0a 65 6e 65 72 67 79 0d 0a 77 69 6e 74 65 72 0d 0a 62 6f 6f 6b 0d 0a 77 61 72 6e 0d 0a 62 6f 6f 6b 0d 0a 76 69 63 74 6f 72 79 0d 0a 65 61 72 0d 0a 67 72 65 65 6e 0d 0a 6c 6f 6e 67 0d 0a 75 6e 64 65 72 67 72 Data Ascii: orgirlgirltopintworkquantitystringartwarnzoomilkorderneedarrowmachinedoquotechararchendearthschoolvictorypaperlongpicturegamesnowenergywinterbookwarnbookvictoryeargreenlongundergr
2023-08-29 05:50:51 UTC	24	IN	Data Raw: 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 71 75 65 65 6e 0d 0a 68 69 74 0d 0a 6f 66 66 69 63 65 0d 0a 6c 65 67 0d 0a 6d 6f 6f 6e 0d 0a 70 61 70 65 72 0d 0a 64 61 72 6b 0d 0a 69 73 6c 61 6e 64 0d 0a 79 65 6c 6c 6f 77 0d 0a 6d 69 6c 6b 0d 0a 6d 61 70 0d 0a 6c 65 74 74 65 72 0d 0a 63 6c 6f 75 64 0d 0a 6c 65 67 0d 0a 68 69 74 0d 0a 62 61 6e 6b 0d 0a 68 6f 70 65 0d 0a 7a 69 70 70 65 72 0d 0a 61 6e 74 0d 0a 6e 6f 72 74 68 0d 0a 62 69 72 64 0d 0a 79 61 72 64 0d 0a 6f 63 65 61 6e 0d 0a 66 61 72 6d 0d 0a 6f 66 66 69 63 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 79 65 61 72 6e 0d 0a 72 6f 6f 6d 0d 0a 67 72 6f 75 70 0d 0a 70 69 7a 7a 61 0d 0a 73 6f 6e 67 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 71 75 61 72 74 65 72 0d 0a 62 75 73 0d 0a 6d 75 73 69 63 0d 0a 71 75 61 6c Data Ascii: vegetablequeenhitofficelegmoonpaperdarkislandyellowmilkmaplettercloudleghitbankhopezipperantnorthbirdyardoceanfarmofficeuniversityyearnroomgrouppizzasongyesterdayquarterbusmusicqual
2023-08-29 05:50:51 UTC	32	IN	Data Raw: 0a 71 75 65 73 74 69 6f 6e 0d 0a 72 65 64 0d 0a 71 75 69 65 74 0d 0a 74 69 67 65 72 0d 0a 64 6f 6f 72 0d 0a 79 61 77 6e 0d 0a 6f 62 6a 65 63 74 0d 0a 69 73 73 75 65 0d 0a 6e 65 65 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 72 6f 6f 6d 0d 0a 64 65 65 72 0d 0a 7a 69 70 70 65 72 0d 0a 64 61 79 0d 0a 76 61 6e 0d 0a 63 61 6b 65 0d 0a 69 6e 74 0d 0a 6f 70 65 6e 0d 0a 70 6f 77 65 72 0d 0a 6e 6f 72 74 68 0d 0a 65 64 67 65 0d 0a 70 6f 77 65 72 0d 0a 61 6e 69 6d 61 6c 0d 0a 6e 61 74 75 72 65 0d 0a 63 61 72 0d 0a 78 79 6c 65 6d 0d 0a 6f 62 6a 65 63 74 0d 0a 74 65 73 74 0d 0a 79 65 6c 6c 6f 77 0d 0a 6a 61 63 6b 65 74 0d 0a 67 69 72 6c 0d 0a 74 65 61 63 68 65 72 0d 0a 67 72 61 73 73 0d 0a 6e 75 6d 62 65 72 0d 0a 62 61 6e 6b 0d 0a 79 61 72 64 0d 0a 65 69 67 68 74 0d 0a 7a 6f Data Ascii: questionredquiettigerdooryawnobjectissueneedqualifyroomdeerzipperdayvancakeintopenpowernorthedgepoweranimalnaturecarxylemobjecttestyellowjacketgirlteachergrassnumberbankyardeightzo
2023-08-29 05:50:51 UTC	40	IN	Data Raw: 64 0d 0a 66 61 74 68 65 72 0d 0a 67 72 6f 75 70 0d 0a 63 6c 6f 75 64 0d 0a 74 61 6c 6b 0d 0a 73 75 67 61 72 0d 0a 70 69 6e 6b 0d 0a 6a 6f 6b 65 0d 0a 77 68 69 74 65 0d 0a 6f 6e 65 0d 0a 6d 61 6e 0d 0a 63 61 6d 65 72 61 0d 0a 73 65 61 0d 0a 6c 61 6b 65 0d 0a 6f 69 6c 0d 0a 6c 61 6e 64 0d 0a 6e 6f 74 65 0d 0a 63 6c 69 70 0d 0a 6a 75 6d 70 0d 0a 63 69 74 79 0d 0a 72 6f 61 64 0d 0a 6a 75 64 67 65 0d 0a 72 6f 61 64 0d 0a 73 65 61 0d 0a 61 77 61 72 64 0d 0a 70 6f 77 65 72 0d 0a 67 72 61 73 73 0d 0a 6c 69 6f 6e 0d 0a 62 6f 78 0d 0a 72 61 62 62 69 74 0d 0a 6d 65 61 6c 0d 0a 73 75 67 61 72 0d 0a 79 65 61 72 0d 0a 63 61 6b 65 0d 0a 6b 69 63 6b 0d 0a 6a 6f 6b 65 0d 0a 6c 6f 6e 67 0d 0a 77 6f 72 6c 64 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6f 63 65 61 6e 0d 0a 6d Data Ascii: dfathergroupcloudtalksugarpinkjokewhiteonemancamerasealakeoillandnoteclipjumpcityroadjudgeroadseaawardpowergrasslionboxrabbitmealsugaryearcakekickjokelongworlduniversityoceanm
2023-08-29 05:50:52 UTC	48	IN	Data Raw: 68 69 74 0d 0a 76 69 73 69 74 6f 72 0d 0a 61 6c 6f 6e 65 0d 0a 74 61 73 74 65 0d 0a 64 65 73 6b 0d 0a 6a 61 72 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 73 6e 6f 77 0d 0a 6d 6f 6f 6e 0d 0a 63 61 6b 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6e 6f 73 65 0d 0a 6f 72 61 6e 67 65 0d 0a 71 75 69 63 6b 0d 0a 65 69 67 68 74 0d 0a 72 6f 61 64 0d 0a 75 72 67 65 0d 0a 7a 65 61 6c 0d 0a 77 65 73 74 0d 0a 6b 65 65 70 0d 0a 6f 72 61 6e 67 65 0d 0a 73 68 6f 72 74 0d 0a 78 79 6c 65 6d 0d 0a 70 69 7a 7a 61 0d 0a 70 6c 61 6e 74 0d 0a 68 61 74 0d 0a 77 61 74 65 72 0d 0a 64 61 6e 63 65 0d 0a 6c 61 6e 64 0d 0a 6d 61 70 0d 0a 67 69 72 6c 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 69 6e 73 69 64 65 0d 0a 7a 69 70 70 65 72 0d 0a 70 65 61 72 0d 0a 77 61 74 65 72 0d Data Ascii: hitvisitoralonetastedeskjarunderstandsnowmooncakeunsignednoseorangequickeightroadurgezealwestkeeporangeshortxylempizzaplanthatwaterdancelandmapgirlvacationpersoninsidezipperpearwater
2023-08-29 05:50:52 UTC	56	IN	Data Raw: 61 72 63 68 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 77 6f 72 6b 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6f 72 64 65 72 0d 0a 6d 61 6e 0d 0a 63 69 74 79 0d 0a 73 6e 61 6b 65 0d 0a 6c 69 66 65 0d 0a 66 75 6e 63 0d 0a 6f 66 66 69 63 65 0d 0a 6c 65 74 74 65 72 0d 0a 61 70 70 6c 65 0d 0a 6e 6f 72 74 68 0d 0a 66 6f 6f 74 0d 0a 64 6f 67 0d 0a 65 67 67 0d 0a 69 73 6c 61 6e 64 0d 0a 64 75 63 6b 0d 0a 66 69 73 68 0d 0a 62 65 61 63 68 0d 0a 72 69 76 65 72 0d 0a 6a 61 72 0d 0a 66 69 72 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 6c 61 75 67 68 0d 0a 72 65 73 74 0d 0a 68 6f 75 73 65 0d 0a 6d 69 6c 6b 0d 0a 71 75 69 63 6b 0d 0a 77 69 6e 74 65 72 0d 0a 74 72 65 65 0d 0a 6a 61 63 6b 65 74 0d 0a 6e 6f 72 74 68 0d 0a 61 72 63 68 0d 0a 76 69 63 74 6f 72 79 0d 0a 73 63 68 6f 6f 6c Data Ascii: archunderstandworkmachineordermancitysnakelifefuncofficeletterapplenorthfootdogeggislandduckfishbeachriverjarfireknowledgelaughresthousemilkquickwintertreejacketnortharchvictoryschool
2023-08-29 05:50:52 UTC	64	IN	Data Raw: 0d 0a 61 77 61 72 64 0d 0a 66 75 6e 63 0d 0a 62 65 61 63 68 0d 0a 73 65 76 65 6e 0d 0a 61 69 72 0d 0a 79 61 72 64 0d 0a 65 61 73 79 0d 0a 77 68 69 74 65 0d 0a 63 6f 61 74 0d 0a 67 72 61 73 73 0d 0a 77 6f 72 6b 0d 0a 73 68 6f 72 74 0d 0a 73 6e 6f 77 0d 0a 70 68 6f 6e 65 0d 0a 6c 69 66 65 0d 0a 6a 6f 6b 65 0d 0a 72 6f 6f 6d 0d 0a 72 69 76 65 72 0d 0a 70 65 61 72 0d 0a 70 65 6e 0d 0a 75 6e 69 74 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6c 61 6e 64 0d 0a 6c 65 74 74 65 72 0d 0a 61 77 61 72 64 0d 0a 73 74 72 69 6e 67 0d 0a 61 6e 74 0d 0a 69 63 6f 6e 0d 0a 66 6f 72 0d 0a 77 69 6e 74 65 72 0d 0a 62 75 73 0d 0a 61 77 61 72 64 0d 0a 67 72 61 73 73 0d 0a 76 61 6e 0d 0a 6f 70 65 6e 0d 0a 6a 6f 79 0d 0a 6e 61 6d 65 0d 0a 61 6e 69 6d 61 6c 0d 0a 6a 75 6d 70 0d 0a 65 Data Ascii: awardfuncbeachsevenairyardeasywhitecoatgrassworkshortsnowphonelifejokeroomriverpearpenunitunderstandlandletterawardstringanticonforwinterbusawardgrassvanopenjoynameanimaljumpe
2023-08-29 05:50:52 UTC	72	IN	Data Raw: 0a 63 6f 6c 6f 72 0d 0a 64 65 73 6b 0d 0a 65 79 65 0d 0a 6f 66 66 65 72 0d 0a 65 69 67 68 74 0d 0a 6a 61 63 6b 65 74 0d 0a 76 6f 69 63 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 73 75 67 61 72 0d 0a 73 6e 61 6b 65 0d 0a 72 69 76 65 72 0d 0a 79 65 61 72 0d 0a 65 67 67 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6e 6f 74 65 0d 0a 73 63 68 6f 6f 6c 0d 0a 62 65 61 63 68 0d 0a 71 75 61 6c 69 74 79 0d 0a 64 61 74 61 0d 0a 7a 65 61 6c 0d 0a 72 6f 63 6b 0d 0a 62 65 61 63 68 0d 0a 74 65 61 63 68 65 72 0d 0a 69 6e 73 69 64 65 0d 0a 62 61 6c 6c 0d 0a 65 64 67 65 0d 0a 73 6f 6e 67 0d 0a 77 68 69 74 65 0d 0a 64 61 6e 63 65 0d 0a 6f 6e 65 0d 0a 6d 61 6e 0d 0a 73 74 72 69 6e 67 0d 0a 63 61 6d 65 72 61 0d 0a 79 61 72 64 0d 0a 6d 61 70 0d 0a 70 6f 77 65 72 0d 0a 64 65 65 72 0d 0a 70 61 70 65 Data Ascii: colordeskeyeoffereightjacketvoiceyellowsugarsnakeriveryeareggmachinenoteschoolbeachqualitydatazealrockbeachteacherinsideballedgesongwhitedanceonemanstringcamerayardmappowerdeerpape
2023-08-29 05:50:52 UTC	80	IN	Data Raw: 6d 65 72 61 0d 0a 74 65 73 74 0d 0a 64 72 65 61 6d 0d 0a 69 73 6c 61 6e 64 0d 0a 65 64 67 65 0d 0a 79 65 61 72 0d 0a 78 79 6c 65 6d 0d 0a 64 6f 6f 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 68 69 74 0d 0a 75 6e 63 6c 65 0d 0a 6f 6e 65 0d 0a 73 74 6f 6e 65 0d 0a 68 69 67 68 0d 0a 65 72 72 6f 72 0d 0a 66 69 73 68 0d 0a 68 69 74 0d 0a 64 6f 6f 72 0d 0a 65 61 74 0d 0a 6b 69 63 6b 0d 0a 7a 65 62 72 61 0d 0a 68 69 74 0d 0a 64 6f 67 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 70 65 6e 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6d 6f 74 68 65 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 68 65 61 72 74 0d 0a 77 61 74 65 72 0d 0a 6b 69 6e 64 0d 0a 65 64 67 65 0d 0a 6a 6f 79 0d 0a 74 65 73 74 0d 0a 79 61 77 6e 0d 0a 74 69 67 65 72 0d 0a 76 69 65 77 0d 0a 6a 61 72 0d 0a 7a 65 62 72 61 0d Data Ascii: meratestdreamislandedgeyearxylemdoorunsignedhituncleonestonehigherrorfishhitdooreatkickzebrahitdogvegetablepenmachinemotherknowledgeheartwaterkindedgejoytestyawntigerviewjarzebra
2023-08-29 05:50:52 UTC	88	IN	Data Raw: 79 0d 0a 6c 69 6f 6e 0d 0a 6c 61 6e 64 0d 0a 64 65 65 72 0d 0a 6d 65 6e 74 0d 0a 62 69 72 64 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 70 65 72 73 6f 6e 0d 0a 74 69 6d 65 0d 0a 65 61 73 79 0d 0a 6d 61 70 0d 0a 67 72 6f 75 70 0d 0a 63 6c 69 70 0d 0a 7a 65 72 6f 0d 0a 65 6e 64 0d 0a 62 6c 75 65 0d 0a 6d 61 63 68 69 6e 65 0d 0a 74 69 6d 65 0d 0a 67 69 72 6c 0d 0a 79 65 61 72 0d 0a 72 61 62 62 69 74 0d 0a 65 72 72 6f 72 0d 0a 61 63 65 0d 0a 72 65 73 74 0d 0a 74 6f 77 6e 0d 0a 72 6f 6f 6d 0d 0a 68 65 61 64 0d 0a 67 6c 61 73 73 0d 0a 7a 6f 6d 62 69 65 0d 0a 72 65 73 74 0d 0a 73 74 72 69 6e 67 0d 0a 73 65 76 65 6e 0d 0a 65 72 72 6f 72 0d 0a 65 61 73 74 0d 0a 65 79 65 0d 0a 61 70 70 6c 65 0d 0a 67 6f 6c 64 0d 0a 66 61 63 65 0d 0a 63 6c 6f 75 64 0d 0a 6e 75 72 73 65 0d Data Ascii: ylionlanddeermentbirdquantitypersontimeeasymapgroupclipzeroendbluemachinetimegirlyearrabbiterroraceresttownroomheadglasszombiereststringsevenerroreasteyeapplegoldfacecloudnurse
2023-08-29 05:50:52 UTC	96	IN	Data Raw: 6f 6f 72 0d 0a 64 6f 67 0d 0a 62 6f 78 0d 0a 77 61 74 65 72 0d 0a 6e 69 67 68 74 0d 0a 6e 6f 74 65 0d 0a 77 6f 6d 61 6e 0d 0a 6d 65 61 6c 0d 0a 62 6c 75 65 0d 0a 68 69 67 68 0d 0a 6f 72 64 65 72 0d 0a 66 69 72 65 0d 0a 6b 65 79 0d 0a 62 65 61 63 68 0d 0a 67 72 6f 75 70 0d 0a 61 6e 74 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 66 61 63 65 0d 0a 66 6f 6f 74 0d 0a 67 72 61 73 73 0d 0a 76 6f 69 63 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 64 72 65 61 6d 0d 0a 6a 61 76 61 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 6a 61 63 6b 65 74 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 76 69 73 69 74 6f 72 0d 0a 73 6b 79 0d 0a 72 65 64 0d 0a 66 69 73 68 0d 0a 77 61 72 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 63 68 61 72 0d 0a 65 72 72 6f 72 0d 0a 79 65 61 72 0d 0a 6b 69 6e 67 0d 0a 76 61 63 61 74 Data Ascii: oordogboxwaternightnotewomanmealbluehighorderfirekeybeachgroupantknowledgefacefootgrassvoiceunsigneddreamjavaknowledgejacketunsignedvisitorskyredfishwarnpersoncharerroryearkingvacat
2023-08-29 05:50:52 UTC	112	IN	Data Raw: 68 6f 75 73 65 0d 0a 69 6e 6b 0d 0a 6d 6f 6e 6b 65 79 0d 0a 79 65 61 72 0d 0a 6d 6f 6f 6e 0d 0a 74 6f 77 6e 0d 0a 66 61 72 6d 0d 0a 65 72 72 6f 72 0d 0a 6c 75 6e 63 68 0d 0a 75 73 65 0d 0a 75 6e 69 74 0d 0a 71 75 69 65 74 0d 0a 6a 61 72 0d 0a 77 6f 72 6c 64 0d 0a 68 69 67 68 0d 0a 65 79 65 0d 0a 6a 6f 6b 65 0d 0a 6b 69 63 6b 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 6f 6e 65 0d 0a 6c 61 6e 64 0d 0a 6c 69 6f 6e 0d 0a 65 64 67 65 0d 0a 64 61 74 61 0d 0a 65 61 73 79 0d 0a 66 6f 72 0d 0a 68 69 74 0d 0a 75 73 65 0d 0a 66 6f 72 0d 0a 77 65 73 74 0d 0a 6e 61 6d 65 0d 0a 73 6b 79 0d 0a 73 65 76 65 6e 0d 0a 61 6e 74 0d 0a 6c 6f 6e 67 0d 0a 64 61 74 61 0d 0a 6e 6f 73 65 0d 0a 6f 70 65 6e 0d 0a 68 65 6c 70 0d 0a 68 6f 70 65 0d 0a 6d 65 6e 74 0d 0a 73 74 6f 6e 65 Data Ascii: houseinkmonkeyyearmoontownfarmerrorlunchuseunitquietjarworldhigheyejokekickinformationonelandlionedgedataeasyforhituseforwestnameskysevenantlongdatanoseopenhelphopementstone
2023-08-29 05:50:52 UTC	128	IN	Data Raw: 69 63 0d 0a 6c 65 67 0d 0a 76 6f 69 63 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 62 6f 79 0d 0a 66 69 72 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 70 6f 77 65 72 0d 0a 79 61 72 64 0d 0a 67 68 6f 73 74 0d 0a 74 61 6c 6b 0d 0a 7a 6f 6e 65 0d 0a 63 6c 69 70 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 67 6c 61 73 73 0d 0a 6c 61 6e 64 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 77 65 73 74 0d 0a 63 61 72 0d 0a 72 75 6e 0d 0a 66 72 69 65 6e 64 0d 0a 62 6f 6f 6b 0d 0a 62 61 6e 61 6e 61 0d 0a 7a 69 70 70 65 72 0d 0a 6a 6f 6b 65 0d 0a 64 6f 67 0d 0a 6b 69 6e 67 0d 0a 64 61 74 61 0d 0a 68 6f 75 73 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 6c 69 6f 6e 0d 0a 64 72 65 61 6d 0d 0a 71 75 65 65 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 73 6b 79 0d 0a 79 65 73 0d 0a 75 6e 64 65 72 67 72 Data Ascii: iclegvoicevisitorboyfireundergroundpoweryardghosttalkzoneclipknowledgeglasslandunderstandwestcarrunfriendbookbananazipperjokedogkingdatahouseknowledgeliondreamqueenyellowskyyesundergr
2023-08-29 05:50:52 UTC	144	IN	Data Raw: 65 6e 0d 0a 62 6f 6f 6b 0d 0a 72 75 6e 0d 0a 67 6f 6c 64 0d 0a 73 74 61 72 0d 0a 6f 63 65 61 6e 0d 0a 61 72 72 6f 77 0d 0a 6f 6e 65 0d 0a 6a 6f 6b 65 0d 0a 65 6e 65 72 67 79 0d 0a 72 65 64 0d 0a 61 70 70 6c 65 0d 0a 70 65 6e 0d 0a 6d 6f 6e 6b 65 79 0d 0a 74 72 61 69 6e 0d 0a 64 72 65 61 6d 0d 0a 6b 69 73 73 0d 0a 79 65 61 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6e 69 67 68 74 0d 0a 67 72 61 73 73 0d 0a 6b 69 6e 67 0d 0a 73 74 61 72 0d 0a 65 67 67 0d 0a 61 69 72 0d 0a 77 6f 72 6b 0d 0a 63 6f 6c 6f 72 0d 0a 73 68 6f 72 74 0d 0a 77 69 6e 74 65 72 0d 0a 6e 6f 73 65 0d 0a 63 61 74 0d 0a 77 69 6e 64 0d 0a 68 69 74 0d 0a 61 77 61 72 64 0d 0a 79 65 73 0d 0a 6e 6f 73 65 0d 0a 65 61 72 0d 0a 62 61 6c 6c 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 73 75 6e 0d 0a 71 75 61 Data Ascii: enbookrungoldstaroceanarrowonejokeenergyredapplepenmonkeytraindreamkissyearunsignednightgrasskingstareggairworkcolorshortwinternosecatwindhitawardyesnoseearballyesterdaysunqua
2023-08-29 05:50:52 UTC	159	IN	Data Raw: 69 6e 6b 0d 0a 7a 6f 6e 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 65 61 73 79 0d 0a 7a 65 61 6c 0d 0a 64 65 65 72 0d 0a 77 6f 6d 61 6e 0d 0a 6c 69 6f 6e 0d 0a 74 72 65 65 0d 0a 71 75 69 63 6b 0d 0a 7a 6f 6f 0d 0a 74 69 67 65 72 0d 0a 76 61 6e 0d 0a 72 61 69 6e 0d 0a 67 61 6d 65 0d 0a 69 6e 74 0d 0a 6d 6f 6f 6e 0d 0a 6c 61 6d 70 0d 0a 6c 69 6f 6e 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 66 72 69 65 6e 64 0d 0a 78 79 6c 65 6d 0d 0a 76 69 65 77 0d 0a 74 69 6d 65 0d 0a 69 73 73 75 65 0d 0a 76 61 6e 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 65 61 72 0d 0a 72 69 76 65 72 0d 0a 78 79 6c 65 6d 0d 0a 63 61 72 0d 0a 6b 69 64 0d 0a 6e 61 6d 65 0d 0a 6d 61 6e 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 76 6f 69 63 65 0d 0a 72 65 Data Ascii: inkzonequalifyeasyzealdeerwomanliontreequickzootigervanraingameintmoonlamplionquestionunderstandfriendxylemviewtimeissuevanjourneyunsignedearriverxylemcarkidnamemanquestionvoicere
2023-08-29 05:50:52 UTC	175	IN	Data Raw: 0a 77 61 79 0d 0a 61 63 65 0d 0a 67 68 6f 73 74 0d 0a 79 61 72 64 0d 0a 77 69 6e 74 65 72 0d 0a 77 61 79 0d 0a 6f 63 65 61 6e 0d 0a 6d 61 63 68 69 6e 65 0d 0a 73 63 68 6f 6f 6c 0d 0a 63 68 61 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 67 72 6f 75 70 0d 0a 70 69 63 74 75 72 65 0d 0a 73 65 76 65 6e 0d 0a 68 65 61 72 74 0d 0a 6e 69 67 68 74 0d 0a 68 65 61 72 74 0d 0a 6f 62 6a 65 63 74 0d 0a 6a 6f 79 0d 0a 69 63 65 0d 0a 76 6f 69 63 65 0d 0a 6f 70 65 6e 0d 0a 76 69 64 65 6f 0d 0a 71 75 69 63 6b 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 65 69 67 68 74 0d 0a 65 61 74 0d 0a 63 69 74 79 0d 0a 73 75 6e 0d 0a 6d 6f 6f 6e 0d 0a 71 75 61 6c 69 74 79 0d 0a 76 6f 69 63 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 64 61 6e 63 65 0d 0a 70 61 70 65 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 6d 61 6e 0d Data Ascii: wayaceghostyardwinterwayoceanmachineschoolcharKanthangrouppicturesevenheartnightheartobjectjoyicevoiceopenvideoquickvegetableeighteatcitysunmoonqualityvoiceyellowdancepaperyellowman
2023-08-29 05:50:52 UTC	183	IN	Data Raw: 69 74 79 0d 0a 78 79 6c 65 6d 0d 0a 6e 61 74 75 72 65 0d 0a 6b 69 73 73 0d 0a 77 61 79 0d 0a 65 61 72 74 68 0d 0a 65 61 73 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 7a 65 72 6f 0d 0a 6c 61 6b 65 0d 0a 6f 69 6c 0d 0a 75 73 75 61 6c 6c 79 0d 0a 61 6e 69 6d 61 6c 0d 0a 72 6f 61 64 0d 0a 77 6f 6d 61 6e 0d 0a 79 61 77 6e 0d 0a 63 6f 61 74 0d 0a 6f 72 64 65 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 69 6e 74 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 6f 78 0d 0a 67 75 65 73 74 0d 0a 68 61 69 72 0d 0a 6e 75 6d 62 65 72 0d 0a 76 69 64 65 6f 0d 0a 75 72 67 65 0d 0a 79 6f 75 6e 67 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 75 73 0d 0a 6e 6f 74 65 0d 0a 69 6e 6b 0d 0a 7a 65 61 6c 0d 0a 72 61 69 6e 0d 0a 76 69 65 77 0d 0a 64 6f Data Ascii: ityxylemnaturekisswayeartheasyuniversityzerolakeoilusuallyanimalroadwomanyawncoatorderunsignedintvacationinformationboxguesthairnumbervideourgeyounginformationbusnoteinkzealrainviewdo
2023-08-29 05:50:52 UTC	199	IN	Data Raw: 74 65 72 0d 0a 73 6b 79 0d 0a 63 6f 6c 6f 72 0d 0a 63 6c 69 70 0d 0a 74 65 61 63 68 65 72 0d 0a 66 69 73 68 0d 0a 6b 69 73 73 0d 0a 7a 6f 6e 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6e 65 65 64 0d 0a 6c 61 6b 65 0d 0a 6e 6f 73 65 0d 0a 77 69 6e 64 0d 0a 6a 75 6d 70 0d 0a 65 61 73 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6c 65 67 0d 0a 62 6f 6f 6b 0d 0a 6d 6f 6e 6b 65 79 0d 0a 72 75 6e 0d 0a 74 65 61 63 68 65 72 0d 0a 6c 61 75 67 68 0d 0a 6e 75 6d 62 65 72 0d 0a 74 69 67 65 72 0d 0a 73 75 67 61 72 0d 0a 77 68 69 6c 65 0d 0a 66 72 69 65 6e 64 0d 0a 76 61 6e 0d 0a 63 6c 69 70 0d 0a 64 6f 67 0d 0a 6d 61 70 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 70 69 63 74 75 72 65 0d 0a 77 61 79 0d 0a 6e 6f 73 65 0d 0a 74 69 6d 65 0d 0a 6a 65 6c 6c 79 0d 0a 71 75 61 72 74 65 72 0d 0a Data Ascii: terskycolorclipteacherfishkisszonequantityneedlakenosewindjumpeasyKanthanlegbookmonkeyrunteacherlaughnumbertigersugarwhilefriendvanclipdogmapquestionpicturewaynosetimejellyquarter
2023-08-29 05:50:52 UTC	207	IN	Data Raw: 66 66 69 63 65 0d 0a 68 69 74 0d 0a 6f 72 61 6e 67 65 0d 0a 79 61 77 6e 0d 0a 61 72 72 6f 77 0d 0a 6a 61 76 61 0d 0a 6c 61 75 67 68 0d 0a 65 61 73 79 0d 0a 63 6c 69 70 0d 0a 73 65 76 65 6e 0d 0a 63 6c 69 70 0d 0a 72 6f 61 64 0d 0a 64 6f 67 0d 0a 71 75 69 63 6b 0d 0a 6e 75 6d 62 65 72 0d 0a 62 61 6e 61 6e 61 0d 0a 73 68 6f 72 74 0d 0a 76 69 64 65 6f 0d 0a 70 65 72 73 6f 6e 0d 0a 69 6e 73 69 64 65 0d 0a 71 75 69 63 6b 0d 0a 63 6c 69 70 0d 0a 6e 69 67 68 74 0d 0a 66 61 63 65 0d 0a 6c 61 6e 64 0d 0a 61 72 72 61 79 0d 0a 69 6e 6b 0d 0a 79 65 6c 6c 6f 77 0d 0a 70 65 72 73 6f 6e 0d 0a 74 72 61 69 6e 0d 0a 6c 75 6e 63 68 0d 0a 64 75 63 6b 0d 0a 6f 66 66 69 63 65 0d 0a 6a 75 6d 70 0d 0a 74 6f 70 0d 0a 6d 69 6c 6b 0d 0a 6b 69 74 65 0d 0a 75 6e 64 65 72 73 74 61 6e Data Ascii: fficehitorangeyawnarrowjavalaugheasyclipsevencliproaddogquicknumberbananashortvideopersoninsidequickclipnightfacelandarrayinkyellowpersontrainlunchduckofficejumptopmilkkiteunderstan
2023-08-29 05:50:52 UTC	223	IN	Data Raw: 70 0d 0a 72 75 6e 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 66 61 6c 6c 0d 0a 71 75 65 65 6e 0d 0a 61 69 72 0d 0a 7a 65 62 72 61 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 6e 69 67 68 74 0d 0a 74 69 6d 65 0d 0a 69 73 6c 61 6e 64 0d 0a 65 6e 64 0d 0a 72 65 73 74 0d 0a 6d 6f 76 69 65 0d 0a 61 6c 6f 6e 65 0d 0a 73 6f 6e 67 0d 0a 6a 75 64 67 65 0d 0a 68 6f 70 65 0d 0a 65 6e 64 0d 0a 70 6c 61 6e 74 0d 0a 6c 61 6e 64 0d 0a 77 61 74 65 72 0d 0a 71 75 6f 74 65 0d 0a 67 6c 61 73 73 0d 0a 76 69 64 65 6f 0d 0a 6c 65 74 74 65 72 0d 0a 68 61 69 72 0d 0a 6e 65 65 64 0d 0a 67 72 61 73 73 0d 0a 64 72 65 61 6d 0d 0a 65 6e 64 0d 0a 6b 69 63 6b 0d 0a 73 68 6f 72 74 0d 0a 6e 6f 74 65 0d 0a 6b 69 6e 64 0d 0a 63 61 6b 65 0d 0a 72 61 62 62 69 74 0d 0a 62 6f 6f 6b 0d 0a 76 69 73 69 74 6f Data Ascii: prunquestionfallqueenairzebrayesterdaynighttimeislandendrestmoviealonesongjudgehopeendplantlandwaterquoteglassvideoletterhairneedgrassdreamendkickshortnotekindcakerabbitbookvisito
2023-08-29 05:50:52 UTC	231	IN	Data Raw: 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 6c 65 74 74 65 72 0d 0a 74 72 65 65 0d 0a 65 61 74 0d 0a 7a 65 62 72 61 0d 0a 61 69 72 0d 0a 69 6e 74 0d 0a 6b 69 74 65 0d 0a 63 68 61 72 0d 0a 77 65 73 74 0d 0a 6e 75 6d 62 65 72 0d 0a 73 6e 6f 77 0d 0a 6c 6f 76 65 0d 0a 67 72 61 73 73 0d 0a 76 69 65 77 0d 0a 71 75 69 65 74 0d 0a 71 75 6f 74 65 0d 0a 70 61 70 65 72 0d 0a 6a 61 72 0d 0a 69 6e 73 69 64 65 0d 0a 65 73 63 61 70 65 0d 0a 6b 65 65 70 0d 0a 74 72 65 65 0d 0a 66 69 73 68 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 77 6f 72 6b 0d 0a 61 72 72 61 79 0d 0a 79 61 77 6e 0d 0a 77 61 74 65 72 0d 0a 65 69 67 68 74 0d 0a 70 69 7a 7a 61 0d 0a 6d 69 6c 6b 0d 0a 62 6f 78 0d 0a 79 65 73 0d 0a 6d 75 73 69 63 0d 0a 6c 61 6e 64 0d 0a 65 61 72 74 68 0d 0a 6d 61 70 0d 0a 61 72 63 68 Data Ascii: ndergroundlettertreeeatzebraairintkitecharwestnumbersnowlovegrassviewquietquotepaperjarinsideescapekeeptreefishvegetableworkarrayyawnwatereightpizzamilkboxyesmusiclandearthmaparch
2023-08-29 05:50:53 UTC	239	IN	Data Raw: 0d 0a 67 75 65 73 74 0d 0a 65 67 67 0d 0a 70 61 70 65 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 6c 61 6d 70 0d 0a 68 6f 75 73 65 0d 0a 69 63 6f 6e 0d 0a 70 61 70 65 72 0d 0a 7a 65 61 6c 0d 0a 79 6f 75 6e 67 0d 0a 78 79 6c 65 6d 0d 0a 6d 6f 76 69 65 0d 0a 61 77 61 72 64 0d 0a 64 75 63 6b 0d 0a 71 75 61 72 74 65 72 0d 0a 73 6b 79 0d 0a 71 75 61 6c 69 74 79 0d 0a 73 65 61 0d 0a 6f 72 61 6e 67 65 0d 0a 61 6c 6f 6e 65 0d 0a 68 69 67 68 0d 0a 68 61 74 0d 0a 71 75 61 6c 69 74 79 0d 0a 64 61 79 0d 0a 6a 61 76 61 0d 0a 6c 65 74 74 65 72 0d 0a 6c 65 74 74 65 72 0d 0a 70 65 6e 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6b 69 63 6b 0d 0a 63 61 6b 65 0d 0a 6a 75 6d 70 0d 0a 66 69 72 65 0d 0a 77 61 74 65 72 0d 0a 62 61 6e 61 6e 61 0d 0a 76 61 6e 0d 0a 76 69 64 65 6f 0d 0a 6a 75 64 67 65 Data Ascii: guesteggpapermonkeylamphouseiconpaperzealyoungxylemmovieawardduckquarterskyqualityseaorangealonehighhatqualitydayjavaletterletterpenKanthankickcakejumpfirewaterbananavanvideojudge
2023-08-29 05:50:53 UTC	255	IN	Data Raw: 6e 0d 0a 6e 75 6d 62 65 72 0d 0a 65 79 65 0d 0a 63 6f 61 74 0d 0a 70 65 72 73 6f 6e 0d 0a 6c 75 6e 63 68 0d 0a 61 77 61 72 64 0d 0a 6f 70 65 6e 0d 0a 73 6f 6e 67 0d 0a 6b 65 65 70 0d 0a 71 75 65 65 6e 0d 0a 65 61 72 74 68 0d 0a 66 61 72 6d 0d 0a 6d 6f 76 69 65 0d 0a 63 6f 77 0d 0a 6f 72 61 6e 67 65 0d 0a 6f 66 66 65 72 0d 0a 6f 6e 65 0d 0a 6c 61 6b 65 0d 0a 63 6c 6f 75 64 0d 0a 72 65 73 74 0d 0a 66 69 73 68 0d 0a 76 69 63 74 6f 72 79 0d 0a 73 65 76 65 6e 0d 0a 65 79 65 0d 0a 74 65 73 74 0d 0a 62 6f 78 0d 0a 64 6f 67 0d 0a 6b 69 73 73 0d 0a 62 6f 6f 6b 0d 0a 73 65 76 65 6e 0d 0a 6e 69 67 68 74 0d 0a 62 6f 6f 6b 0d 0a 61 6e 74 0d 0a 72 6f 6f 6d 0d 0a 64 61 72 6b 0d 0a 70 6f 77 65 72 0d 0a 72 69 76 65 72 0d 0a 72 69 76 65 72 0d 0a 66 69 73 68 0d 0a 72 75 6e Data Ascii: nnumbereyecoatpersonlunchawardopensongkeepqueenearthfarmmoviecoworangeofferonelakecloudrestfishvictoryseveneyetestboxdogkissbooksevennightbookantroomdarkpowerriverriverfishrun
2023-08-29 05:50:53 UTC	263	IN	Data Raw: 6d 70 0d 0a 6d 6f 76 69 65 0d 0a 63 61 74 0d 0a 6a 75 6d 70 0d 0a 65 6e 65 72 67 79 0d 0a 71 75 69 65 74 0d 0a 6f 66 66 69 63 65 0d 0a 6c 61 6d 70 0d 0a 73 65 61 0d 0a 76 6f 69 63 65 0d 0a 6b 69 73 73 0d 0a 73 63 68 6f 6f 6c 0d 0a 68 65 61 64 0d 0a 76 6f 69 63 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 62 61 6c 6c 0d 0a 71 75 69 65 74 0d 0a 65 61 73 79 0d 0a 6f 66 66 69 63 65 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 61 72 72 61 79 0d 0a 68 65 6c 70 0d 0a 6d 65 6e 74 0d 0a 6a 75 64 67 65 0d 0a 61 6e 74 0d 0a 68 6f 75 73 65 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 67 72 6f 75 70 0d 0a 7a 6f 6e 65 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 66 6c 6f 77 65 72 0d 0a 72 69 76 65 72 0d 0a 6f 70 65 6e 0d 0a 62 6f 6f 6b 0d 0a 73 6b 79 0d 0a 66 61 63 65 0d 0a 72 65 64 0d 0a 73 6e 6f Data Ascii: mpmoviecatjumpenergyquietofficelampseavoicekissschoolheadvoiceunderstandballquieteasyofficeKanthanarrayhelpmentjudgeanthouseyesterdaygroupzoneKanthanflowerriveropenbookskyfaceredsno
2023-08-29 05:50:53 UTC	279	IN	Data Raw: 0d 0a 72 6f 6f 6d 0d 0a 6d 6f 74 68 65 72 0d 0a 73 65 76 65 6e 0d 0a 74 6f 77 6e 0d 0a 67 72 61 73 73 0d 0a 64 75 63 6b 0d 0a 6d 75 73 69 63 0d 0a 7a 6f 6d 62 69 65 0d 0a 6d 61 70 0d 0a 6c 75 6e 63 68 0d 0a 67 69 72 6c 0d 0a 75 6e 63 6c 65 0d 0a 76 61 6e 0d 0a 68 61 69 72 0d 0a 64 65 73 6b 0d 0a 61 70 70 6c 65 0d 0a 67 72 61 73 73 0d 0a 74 61 6c 6b 0d 0a 7a 6f 6d 62 69 65 0d 0a 77 68 69 6c 65 0d 0a 6b 69 63 6b 0d 0a 6a 75 6d 70 0d 0a 66 61 6c 6c 0d 0a 63 6f 61 74 0d 0a 7a 6f 6d 62 69 65 0d 0a 61 72 72 61 79 0d 0a 7a 6f 6f 0d 0a 61 6e 69 6d 61 6c 0d 0a 6f 72 64 65 72 0d 0a 6b 69 6e 64 0d 0a 77 65 65 6b 0d 0a 6f 6e 65 0d 0a 65 64 67 65 0d 0a 73 74 72 69 6e 67 0d 0a 75 72 67 65 0d 0a 65 61 73 74 0d 0a 6e 6f 72 74 68 0d 0a 69 6e 73 69 64 65 0d 0a 79 65 6c 6c Data Ascii: roommotherseventowngrassduckmusiczombiemaplunchgirlunclevanhairdeskapplegrasstalkzombiewhilekickjumpfallcoatzombiearrayzooanimalorderkindweekoneedgestringurgeeastnorthinsideyell
2023-08-29 05:50:53 UTC	287	IN	Data Raw: 0d 0a 6a 61 72 0d 0a 71 75 69 63 6b 0d 0a 65 61 74 0d 0a 68 69 67 68 0d 0a 6d 6f 6e 6b 65 79 0d 0a 76 6f 69 63 65 0d 0a 6c 69 66 65 0d 0a 68 6f 70 65 0d 0a 61 69 72 0d 0a 6a 61 63 6b 65 74 0d 0a 62 6f 6f 6b 0d 0a 77 69 6e 64 0d 0a 67 72 6f 75 70 0d 0a 65 73 63 61 70 65 0d 0a 65 61 74 0d 0a 61 69 72 0d 0a 61 72 74 0d 0a 77 69 6e 74 65 72 0d 0a 68 61 74 0d 0a 77 65 65 6b 0d 0a 6c 69 6f 6e 0d 0a 6b 69 73 73 0d 0a 65 61 74 0d 0a 6e 75 72 73 65 0d 0a 62 65 61 63 68 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 66 6c 6f 77 65 72 0d 0a 63 6f 61 74 0d 0a 61 69 72 0d 0a 6a 6f 79 0d 0a 66 61 74 68 65 72 0d 0a 66 6f 6f 64 0d 0a 63 61 74 0d 0a 74 6f 70 0d 0a 63 6c 69 70 0d 0a 70 65 72 73 6f 6e 0d 0a 66 61 63 65 0d 0a 76 61 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 73 68 6f 72 Data Ascii: jarquickeathighmonkeyvoicelifehopeairjacketbookwindgroupescapeeatairartwinterhatweeklionkisseatnursebeachundergroundflowercoatairjoyfatherfoodcattopclippersonfacevanschoolshor
2023-08-29 05:50:53 UTC	295	IN	Data Raw: 74 69 6f 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 6e 61 6d 65 0d 0a 7a 65 72 6f 0d 0a 61 6c 6f 6e 65 0d 0a 70 69 63 74 75 72 65 0d 0a 65 72 72 6f 72 0d 0a 6e 6f 73 65 0d 0a 67 72 6f 75 70 0d 0a 6f 66 66 69 63 65 0d 0a 65 61 73 74 0d 0a 72 6f 63 6b 0d 0a 74 69 6d 65 0d 0a 79 61 77 6e 0d 0a 70 65 6e 0d 0a 63 61 74 0d 0a 6f 6e 65 0d 0a 77 61 79 0d 0a 73 74 61 72 0d 0a 73 6f 6e 67 0d 0a 72 65 73 74 0d 0a 72 61 69 6e 0d 0a 65 61 72 74 68 0d 0a 71 75 61 6c 69 66 79 0d 0a 6b 69 74 65 0d 0a 69 64 65 61 0d 0a 76 61 6c 75 65 0d 0a 62 6f 6f 6b 0d 0a 74 6f 70 0d 0a 62 6f 6f 6b 0d 0a 7a 6f 6f 0d 0a 66 6c 6f 77 65 72 0d 0a 73 74 61 72 0d 0a 6e 75 6d 62 65 72 0d 0a 73 74 72 69 6e 67 0d 0a 77 6f 72 6c 64 0d 0a 6a 75 64 67 65 0d 0a 63 61 72 0d 0a 79 65 73 0d 0a 65 73 63 61 70 65 Data Ascii: tionschoolnamezeroalonepictureerrornosegroupofficeeastrocktimeyawnpencatonewaystarsongrestrainearthqualifykiteideavaluebooktopbookzooflowerstarnumberstringworldjudgecaryesescape
2023-08-29 05:50:53 UTC	311	IN	Data Raw: 61 0d 0a 70 65 6e 0d 0a 63 6f 6c 6f 72 0d 0a 6f 70 65 6e 0d 0a 70 68 6f 6e 65 0d 0a 75 73 75 61 6c 6c 79 0d 0a 72 69 76 65 72 0d 0a 74 72 61 69 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 69 6e 6b 0d 0a 7a 69 70 70 65 72 0d 0a 63 6c 6f 75 64 0d 0a 6d 6f 76 69 65 0d 0a 7a 6f 6f 0d 0a 65 6e 64 0d 0a 63 6f 61 74 0d 0a 77 69 6e 64 0d 0a 66 72 69 65 6e 64 0d 0a 66 75 6e 63 0d 0a 71 75 61 6c 69 66 79 0d 0a 65 61 73 74 0d 0a 6a 75 6d 70 0d 0a 62 6f 79 0d 0a 62 6f 6f 6b 0d 0a 65 61 72 0d 0a 67 6f 6c 64 0d 0a 69 73 6c 61 6e 64 0d 0a 72 6f 61 64 0d 0a 79 65 61 72 6e 0d 0a 73 6b 79 0d 0a 73 6f 6e 67 0d 0a 6d 61 6e 0d 0a 6b 69 73 73 0d 0a 62 75 73 0d 0a 67 6f 61 74 0d 0a 73 6e 6f 77 0d 0a 74 6f 77 6e 0d 0a 66 6c 6f 77 65 72 0d 0a 7a 6f 6f 0d 0a 73 74 61 72 0d 0a 6a 61 76 61 0d Data Ascii: apencoloropenphoneusuallyrivertrainbananainkzippercloudmoviezooendcoatwindfriendfuncqualifyeastjumpboybookeargoldislandroadyearnskysongmankissbusgoatsnowtownflowerzoostarjava
2023-08-29 05:50:53 UTC	319	IN	Data Raw: 77 65 73 74 0d 0a 66 72 69 65 6e 64 0d 0a 6a 75 64 67 65 0d 0a 72 6f 61 64 0d 0a 61 63 65 0d 0a 77 65 65 6b 0d 0a 67 6c 61 73 73 0d 0a 65 6e 64 0d 0a 69 6e 74 0d 0a 6c 61 6b 65 0d 0a 67 69 72 6c 0d 0a 62 6c 75 65 0d 0a 69 6e 74 0d 0a 61 63 65 0d 0a 65 72 72 6f 72 0d 0a 66 6f 6f 64 0d 0a 66 69 72 65 0d 0a 74 65 73 74 0d 0a 6c 65 67 0d 0a 77 69 6e 64 0d 0a 75 72 67 65 0d 0a 77 69 6e 74 65 72 0d 0a 6e 6f 73 65 0d 0a 67 69 72 6c 0d 0a 61 77 61 72 64 0d 0a 6d 6f 74 68 65 72 0d 0a 66 6f 72 0d 0a 74 72 61 69 6e 0d 0a 77 68 69 6c 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 62 6f 79 0d 0a 6b 69 73 73 0d 0a 62 61 6e 61 6e 61 0d 0a 6b 65 65 70 0d 0a 68 61 69 72 0d 0a 63 6f 6c 6f 72 0d 0a 73 75 6e 0d 0a 77 69 6e 64 0d 0a 6f 72 64 65 72 0d 0a 6e 6f 74 65 0d 0a 66 61 6c 6c 0d Data Ascii: westfriendjudgeroadaceweekglassendintlakegirlblueintaceerrorfoodfiretestlegwindurgewinternosegirlawardmotherfortrainwhilevisitorboykissbananakeephaircolorsunwindordernotefall
2023-08-29 05:50:53 UTC	335	IN	Data Raw: 0d 0a 69 6e 73 69 64 65 0d 0a 6e 61 74 75 72 65 0d 0a 73 75 6e 0d 0a 68 65 61 72 74 0d 0a 6d 75 73 69 63 0d 0a 77 69 6e 74 65 72 0d 0a 62 65 61 63 68 0d 0a 65 61 73 79 0d 0a 62 61 6e 61 6e 61 0d 0a 71 75 61 6c 69 74 79 0d 0a 79 65 61 72 6e 0d 0a 62 61 6c 6c 0d 0a 69 6e 63 6f 6d 65 0d 0a 6b 69 74 65 0d 0a 63 61 74 0d 0a 7a 69 70 70 65 72 0d 0a 64 72 65 61 6d 0d 0a 6b 65 79 0d 0a 71 75 61 6c 69 74 79 0d 0a 71 75 65 65 6e 0d 0a 74 6f 70 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6d 61 70 0d 0a 71 75 6f 74 65 0d 0a 63 69 74 79 0d 0a 71 75 65 65 6e 0d 0a 6d 69 6c 6b 0d 0a 63 61 74 0d 0a 69 73 6c 61 6e 64 0d 0a 70 69 7a 7a 61 0d 0a 6d 6f 74 68 65 72 0d 0a 65 64 67 65 0d 0a 69 6e 73 69 64 65 0d 0a 63 6f 6c 6f 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 70 6f 77 65 72 0d 0a Data Ascii: insidenaturesunheartmusicwinterbeacheasybananaqualityyearnballincomekitecatzipperdreamkeyqualityqueentopunsignedmapquotecityqueenmilkcatislandpizzamotheredgeinsidecolorunsignedpower
2023-08-29 05:50:53 UTC	351	IN	Data Raw: 72 0d 0a 64 65 73 6b 0d 0a 62 75 73 0d 0a 63 61 6d 65 72 61 0d 0a 62 65 61 63 68 0d 0a 61 6e 69 6d 61 6c 0d 0a 65 79 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 63 61 74 0d 0a 69 6e 6b 0d 0a 71 75 61 72 74 65 72 0d 0a 62 61 6e 6b 0d 0a 6e 61 74 75 72 65 0d 0a 61 72 74 0d 0a 69 64 65 61 0d 0a 66 6f 6f 74 0d 0a 65 72 72 6f 72 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 6d 6f 6e 6b 65 79 0d 0a 62 75 73 0d 0a 74 72 65 65 0d 0a 66 61 63 65 0d 0a 69 6e 63 6f 6d 65 0d 0a 65 61 72 74 68 0d 0a 75 73 65 0d 0a 77 61 79 0d 0a 6b 65 65 70 0d 0a 77 69 6e 74 65 72 0d 0a 68 61 74 0d 0a 68 65 61 64 0d 0a 66 69 73 68 0d 0a 6a 65 6c 6c 79 0d 0a 64 61 74 61 0d 0a 6c 61 75 67 68 0d 0a 73 65 76 65 6e 0d 0a 6b 69 6e 67 0d 0a 77 65 73 74 0d 0a 6c 65 74 74 65 72 0d 0a 67 6f 6c 64 0d Data Ascii: rdeskbuscamerabeachanimaleyeunderstandcatinkquarterbanknatureartideafooterroryesterdaymonkeybustreefaceincomeearthusewaykeepwinterhatheadfishjellydatalaughsevenkingwestlettergold
2023-08-29 05:50:53 UTC	367	IN	Data Raw: 74 0d 0a 74 61 6c 6b 0d 0a 77 61 72 6e 0d 0a 77 61 74 65 72 0d 0a 72 6f 6f 6d 0d 0a 77 65 73 74 0d 0a 7a 6f 6f 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 77 61 74 65 72 0d 0a 62 69 72 64 0d 0a 61 72 74 0d 0a 6e 75 6d 62 65 72 0d 0a 67 6f 61 74 0d 0a 6f 72 61 6e 67 65 0d 0a 69 6e 74 0d 0a 73 6e 61 6b 65 0d 0a 77 6f 72 6c 64 0d 0a 6a 75 6d 70 0d 0a 63 61 6d 65 72 61 0d 0a 72 65 73 74 0d 0a 65 61 74 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 64 61 74 61 0d 0a 63 61 72 0d 0a 64 65 65 72 0d 0a 77 68 69 74 65 0d 0a 77 61 72 6e 0d 0a 66 61 63 65 0d 0a 6f 66 66 65 72 0d 0a 6b 69 64 0d 0a 65 61 72 74 68 0d 0a 62 61 6e 61 6e 61 0d 0a 68 6f 70 65 0d 0a 70 69 63 74 75 72 65 0d 0a 70 69 7a 7a 61 0d 0a 6c 69 6f 6e 0d 0a 72 65 64 0d 0a 6a 6f 79 0d 0a 71 75 69 63 6b 0d 0a Data Ascii: ttalkwarnwaterroomwestzoounderstandwaterbirdartnumbergoatorangeintsnakeworldjumpcameraresteatunderstanddatacardeerwhitewarnfaceofferkidearthbananahopepicturepizzalionredjoyquick
2023-08-29 05:50:53 UTC	383	IN	Data Raw: 0a 73 68 6f 72 74 0d 0a 67 72 61 73 73 0d 0a 70 6f 77 65 72 0d 0a 70 65 72 73 6f 6e 0d 0a 65 61 73 74 0d 0a 62 61 6c 6c 0d 0a 6f 6e 65 0d 0a 63 6c 6f 75 64 0d Data Ascii: shortgrasspowerpersoneastballonecloud
2023-08-29 05:50:53 UTC	383	IN	Data Raw: 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 63 6f 77 0d 0a 6e 69 67 68 74 0d 0a 61 72 72 61 79 0d 0a 65 61 72 74 68 0d 0a 77 65 65 6b 0d 0a 6f 66 66 69 63 65 0d 0a 68 69 67 68 0d 0a 68 61 69 72 0d 0a 61 72 72 6f 77 0d 0a 6f 6e 65 0d 0a 64 72 65 61 6d 0d 0a 65 61 73 79 0d 0a 79 61 77 6e 0d 0a 69 63 6f 6e 0d 0a 63 61 6d 65 72 61 0d 0a 62 65 61 63 68 0d 0a 61 72 72 6f 77 0d 0a 6d 6f 6f 6e 0d 0a 72 61 69 6e 0d 0a 70 65 61 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 6c 65 67 0d 0a 6c 65 74 74 65 72 0d 0a 63 61 74 0d 0a 68 6f 75 73 65 0d 0a 6c 65 67 0d 0a 72 61 62 62 69 74 0d 0a 63 61 72 0d 0a 6c 6f 76 65 0d 0a 73 65 61 0d 0a 65 73 63 61 70 65 0d 0a 62 61 6e 6b 0d 0a 71 75 6f 74 65 0d 0a 70 65 72 73 6f 6e 0d 0a 68 61 6e 64 0d 0a 66 69 73 68 0d 0a 6b 69 74 63 68 65 6e Data Ascii: informationcownightarrayearthweekofficehighhairarrowonedreameasyyawniconcamerabeacharrowmoonrainpearvacationleglettercathouselegrabbitcarloveseaescapebankquotepersonhandfishkitchen
2023-08-29 05:50:53 UTC	399	IN	Data Raw: 75 70 0d 0a 70 65 6e 0d 0a 62 61 6c 6c 0d 0a 7a 65 61 6c 0d 0a 69 63 6f 6e 0d 0a 79 61 77 6e 0d 0a 6d 69 6c 6b 0d 0a 6c 61 6e 64 0d 0a 77 68 69 74 65 0d 0a 77 6f 72 6c 64 0d 0a 69 63 65 0d 0a 6f 70 65 6e 0d 0a 66 69 72 65 0d 0a 6b 69 73 73 0d 0a 71 75 61 6c 69 66 79 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 72 75 6e 0d 0a 62 75 73 0d 0a 70 68 6f 6e 65 0d 0a 64 65 73 6b 0d 0a 61 72 63 68 0d 0a 6c 65 74 74 65 72 0d 0a 6d 6f 6f 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a 6e 61 74 75 72 65 0d 0a 70 69 7a 7a 61 0d 0a 62 6f 6f 6b 0d 0a 63 6f 77 0d 0a 79 6f 75 6e 67 0d 0a 68 69 67 68 0d 0a 73 75 6e 0d 0a 6c 61 6e 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 70 69 7a 7a 61 0d 0a 6b 69 74 65 0d 0a 71 75 69 65 74 0d 0a 70 65 6e 0d 0a 68 69 67 68 0d 0a 73 75 6e 0d 0a 69 6e 74 0d 0a 6e 75 6d Data Ascii: uppenballzealiconyawnmilklandwhiteworldiceopenfirekissqualifyquestionrunbusphonedeskarchlettermoonzombienaturepizzabookcowyounghighsunlandqualifypizzakitequietpenhighsunintnum
2023-08-29 05:50:53 UTC	415	IN	Data Raw: 0a 73 6f 6e 67 0d 0a 6e 69 67 68 74 0d 0a 66 69 72 65 0d 0a 69 6e 73 69 64 65 0d 0a 66 72 69 65 6e 64 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 73 75 6e 0d 0a 6e 6f 74 65 0d 0a 6a 61 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 76 69 73 69 74 6f 72 0d 0a 6a 75 6d 70 0d 0a 77 65 65 6b 0d 0a 69 6e 73 69 64 65 0d 0a 70 69 6e 6b 0d 0a 72 6f 63 6b 0d 0a 73 65 61 0d 0a 64 65 73 6b 0d 0a 74 65 73 74 0d 0a 70 65 72 73 6f 6e 0d 0a 61 72 63 68 0d 0a 6d 6f 6f 6e 0d 0a 6e 6f 72 74 68 0d 0a 69 6e 73 69 64 65 0d 0a 6d 75 73 69 63 0d 0a 6d 6f 74 68 65 72 0d 0a 6b 69 64 0d 0a 6e 61 74 75 72 65 0d 0a 65 61 72 0d 0a 6b 69 63 6b 0d 0a 69 73 6c 61 6e 64 0d 0a 75 72 67 65 0d 0a 6a 61 76 61 0d 0a 6c 61 75 67 68 0d 0a 6a 75 64 67 65 0d 0a 70 6f 77 65 72 0d 0a 7a 65 Data Ascii: songnightfireinsidefriendquantitysunnotejarmachinejourneyvisitorjumpweekinsidepinkrockseadesktestpersonarchmoonnorthinsidemusicmotherkidnatureearkickislandurgejavalaughjudgepowerze
2023-08-29 05:50:53 UTC	423	IN	Data Raw: 69 6e 74 65 72 0d 0a 61 6e 69 6d 61 6c 0d 0a 70 6c 61 6e 74 0d 0a 75 6e 69 74 0d 0a 65 61 73 74 0d 0a 74 61 6c 6b 0d 0a 63 61 72 0d 0a 63 6f 6c 6f 72 0d 0a 65 72 72 6f 72 0d 0a 64 6f 67 0d 0a 71 75 69 65 74 0d 0a 72 6f 63 6b 0d 0a 6b 69 63 6b 0d 0a 6d 6f 6f 6e 0d 0a 61 63 65 0d 0a 68 61 6e 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 64 61 79 0d 0a 6c 61 6d 70 0d 0a 70 65 61 72 0d 0a 67 6c 61 73 73 0d 0a 6b 65 79 0d 0a 6c 75 6e 63 68 0d 0a 6e 6f 73 65 0d 0a 65 61 72 74 68 0d 0a 61 72 72 6f 77 0d 0a 67 72 6f 75 70 0d 0a 73 6e 6f 77 0d 0a 62 61 6e 61 6e 61 0d 0a 7a 69 70 70 65 72 0d 0a 6c 65 67 0d 0a 77 69 6e 64 0d 0a 6c 61 6d 70 0d 0a 70 6c 61 6e 74 0d 0a 73 74 61 72 0d 0a 71 75 61 6c 69 74 79 0d 0a 67 72 6f 75 70 0d 0a 77 6f 72 6c 64 0d 0a 64 6f 0d 0a 74 69 6d 65 Data Ascii: interanimalplantuniteasttalkcarcolorerrordogquietrockkickmoonacehandqualifydaylamppearglasskeylunchnoseeartharrowgroupsnowbananazipperlegwindlampplantstarqualitygroupworlddotime
2023-08-29 05:50:53 UTC	439	IN	Data Raw: 0d 0a 73 6b 79 0d 0a 74 65 61 63 68 65 72 0d 0a 71 75 61 6c 69 66 79 0d 0a 65 73 63 61 70 65 0d 0a 63 69 74 79 0d 0a 64 6f 6f 72 0d 0a 64 6f 0d 0a 64 61 6e 63 65 0d 0a 65 6e 64 0d 0a 74 6f 70 0d 0a 65 61 72 74 68 0d 0a 6d 6f 6f 6e 0d 0a 69 63 6f 6e 0d 0a 63 6c 6f 75 64 0d 0a 70 61 70 65 72 0d 0a 79 65 73 0d 0a 64 65 65 72 0d 0a 73 6e 6f 77 0d 0a 65 64 67 65 0d 0a 75 73 65 0d 0a 72 61 69 6e 0d 0a 71 75 61 6c 69 74 79 0d 0a 73 68 6f 72 74 0d 0a 6f 70 65 6e 0d 0a 77 6f 72 6c 64 0d 0a 67 75 65 73 74 0d 0a 62 61 6e 6b 0d 0a 75 73 65 0d 0a 7a 65 61 6c 0d 0a 65 69 67 68 74 0d 0a 67 72 61 73 73 0d 0a 74 69 6d 65 0d 0a 72 69 76 65 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 65 79 65 0d 0a 63 6f 77 0d 0a 75 6e 63 6c 65 0d 0a 7a 6f 6e 65 0d 0a 6d 6f 6f 6e 0d 0a 74 61 Data Ascii: skyteacherqualifyescapecitydoordodanceendtopearthmooniconcloudpaperyesdeersnowedgeuserainqualityshortopenworldguestbankusezealeightgrasstimeriverknowledgeeyecowunclezonemoonta
2023-08-29 05:50:53 UTC	447	IN	Data Raw: 0a 6c 6f 76 65 0d 0a 6f 63 65 61 6e 0d 0a 6e 75 72 73 65 0d 0a 70 6c 61 6e 74 0d 0a 65 61 72 0d 0a 65 61 72 0d 0a 72 69 73 65 0d 0a 74 65 61 63 68 65 72 0d 0a 6d 6f 6f 6e 0d 0a 73 74 61 72 0d 0a 61 72 72 61 79 0d 0a 76 69 73 69 74 6f 72 0d 0a 6b 69 6e 67 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 64 72 65 61 6d 0d 0a 65 72 72 6f 72 0d 0a 6c 6f 6e 67 0d 0a 7a 6f 6f 0d 0a 6d 65 61 6c 0d 0a 77 61 72 6e 0d 0a 6b 69 74 63 68 65 6e 0d 0a 62 75 73 0d 0a 76 69 65 77 0d 0a 6a 6f 6b 65 0d 0a 62 61 6c 6c 0d 0a 6c 69 6f 6e 0d 0a 64 65 65 72 0d 0a 7a 6f 6d 62 69 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 61 6e 74 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 74 61 73 74 65 0d 0a 75 73 65 0d 0a 65 64 67 65 0d 0a 6c 6f 76 65 0d 0a 71 75 61 72 74 65 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6e 75 Data Ascii: loveoceannurseplantearearriseteachermoonstararrayvisitorkingquestiondreamerrorlongzoomealwarnkitchenbusviewjokeballliondeerzombiemonkeyantknowledgetasteuseedgelovequarterunsignednu
2023-08-29 05:50:53 UTC	463	IN	Data Raw: 68 65 72 0d 0a 6d 61 70 0d 0a 63 6f 61 74 0d 0a 71 75 69 65 74 0d 0a 65 69 67 68 74 0d 0a 79 61 72 64 0d 0a 77 65 65 6b 0d 0a 68 6f 75 73 65 0d 0a 65 64 67 65 0d 0a 6c 61 6e 64 0d 0a 6b 69 6e 64 0d 0a 65 6e 65 72 67 79 0d 0a 65 61 73 79 0d 0a 70 68 6f 6e 65 0d 0a 68 65 61 72 74 0d 0a 79 65 61 72 0d 0a 65 67 67 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 76 61 6e 0d 0a 72 61 69 6e 0d 0a 6f 66 66 69 63 65 0d 0a 66 61 74 68 65 72 0d 0a 63 6c 69 70 0d 0a 6f 66 66 69 63 65 0d 0a 62 61 6c 6c 0d 0a 79 65 61 72 0d 0a 71 75 69 63 6b 0d 0a 67 72 6f 75 70 0d 0a 62 6f 78 0d 0a 61 72 74 0d 0a 79 65 73 0d 0a 68 69 74 0d 0a 62 6f 79 0d 0a 7a 6f 6f 0d 0a 6e 61 6d 65 0d 0a 73 65 76 65 6e 0d 0a 6e 6f 74 65 0d 0a 65 69 67 68 74 0d 0a 77 61 74 65 72 0d 0a 67 72 65 65 6e 0d 0a 62 6c 75 Data Ascii: hermapcoatquieteightyardweekhouseedgelandkindenergyeasyphoneheartyeareggKanthanvanrainofficefatherclipofficeballyearquickgroupboxartyeshitboyzoonamesevennoteeightwatergreenblu
2023-08-29 05:50:53 UTC	479	IN	Data Raw: 6f 6f 64 0d 0a 6d 61 70 0d 0a 70 65 6e 0d 0a 72 61 69 6e 0d 0a 7a 65 61 6c 0d 0a 62 6f 79 0d 0a 6c 75 6e 63 68 0d 0a 63 6f 61 74 0d 0a 74 69 67 65 72 0d 0a 77 65 73 74 0d 0a 69 73 6c 61 6e 64 0d 0a 66 6f 6f 74 0d 0a 70 68 6f 6e 65 0d 0a 74 61 6c 6b 0d 0a 62 65 61 63 68 0d 0a 6a 61 76 61 0d 0a 6a 6f 6b 65 0d 0a 66 61 63 65 0d 0a 6e 61 74 75 72 65 0d 0a 74 61 6c 6b 0d 0a 67 72 61 73 73 0d 0a 6c 75 6e 63 68 0d 0a 63 68 61 72 0d 0a 62 6c 75 65 0d 0a 6c 61 6e 64 0d 0a 68 65 61 64 0d 0a 7a 6f 6e 65 0d 0a 6a 6f 79 0d 0a 77 69 6e 64 0d 0a 71 75 61 6c 69 74 79 0d 0a 70 68 6f 6e 65 0d 0a 72 61 69 6e 0d 0a 74 6f 70 0d 0a 63 61 72 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 64 65 73 6b 0d 0a 6b 65 65 70 0d 0a 76 6f 69 63 65 0d 0a 68 69 67 68 0d 0a 69 6e 63 6f 6d 65 0d Data Ascii: oodmappenrainzealboylunchcoattigerwestislandfootphonetalkbeachjavajokefacenaturetalkgrasslunchcharbluelandheadzonejoywindqualityphoneraintopcaruniversitydeskkeepvoicehighincome
2023-08-29 05:50:53 UTC	487	IN	Data Raw: 72 0d 0a 72 69 76 65 72 0d 0a 65 61 73 74 0d 0a 63 61 74 0d 0a 70 69 63 74 75 72 65 0d 0a 6e 6f 74 65 0d 0a 65 6e 64 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 73 6b 79 0d 0a 69 63 65 0d 0a 68 69 74 0d 0a 65 64 67 65 0d 0a 64 61 6e 63 65 0d 0a 6b 69 73 73 0d 0a 72 6f 61 64 0d 0a 6a 61 63 6b 65 74 0d 0a 69 73 73 75 65 0d 0a 77 6f 72 6c 64 0d 0a 62 61 6e 61 6e 61 0d 0a 6a 75 6d 70 0d 0a 72 69 73 65 0d 0a 6d 6f 6f 6e 0d 0a 64 61 72 6b 0d 0a 6a 61 63 6b 65 74 0d 0a 77 6f 72 6c 64 0d 0a 66 61 74 68 65 72 0d 0a 66 61 74 68 65 72 0d 0a 71 75 69 65 74 0d 0a 61 72 74 0d 0a 6e 6f 72 74 68 0d 0a 79 61 77 6e 0d 0a 6d 65 6e 74 0d 0a 73 74 61 72 0d 0a 64 61 6e 63 65 0d 0a 71 75 6f 74 65 0d 0a 75 72 67 65 0d 0a 69 6e 6b 0d 0a 74 69 6d 65 0d 0a 6f 62 6a 65 63 74 0d 0a 6f 62 6a Data Ascii: rrivereastcatpicturenoteendvacationskyicehitedgedancekissroadjacketissueworldbananajumprisemoondarkjacketworldfatherfatherquietartnorthyawnmentstardancequoteurgeinktimeobjectobj
2023-08-29 05:50:53 UTC	495	IN	Data Raw: 74 61 0d 0a 77 69 6e 74 65 72 0d 0a 76 61 6e 0d 0a 79 65 61 72 0d 0a 7a 65 61 6c 0d 0a 71 75 65 65 6e 0d 0a 71 75 69 63 6b 0d 0a 65 61 72 0d 0a 73 63 68 6f 6f 6c 0d 0a 64 65 73 6b 0d 0a 75 6e 69 74 0d 0a 70 68 6f 6e 65 0d 0a 75 73 65 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 63 6f 61 74 0d 0a 74 6f 70 0d 0a 76 61 6c 75 65 0d 0a 71 75 61 72 74 65 72 0d 0a 6e 6f 72 74 68 0d 0a 64 61 72 6b 0d 0a 70 65 72 73 6f 6e 0d 0a 6b 69 74 63 68 65 6e 0d 0a 66 6f 6f 64 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 77 68 69 74 65 0d 0a 66 61 72 6d 0d 0a 67 69 72 6c 0d 0a 6e 6f 72 74 68 0d 0a 74 61 6c 6b 0d 0a 6b 69 6e 64 0d 0a 67 6c 61 73 73 0d 0a 63 6f 61 74 0d 0a 65 6e 65 72 67 79 0d 0a 6a 61 72 0d 0a 6b 65 79 0d 0a 79 65 73 0d 0a 68 65 6c 70 0d 0a 65 6e 65 72 67 79 0d 0a 71 75 61 Data Ascii: tawintervanyearzealqueenquickearschooldeskunitphoneusequestioncoattopvaluequarternorthdarkpersonkitchenfoodknowledgewhitefarmgirlnorthtalkkindglasscoatenergyjarkeyyeshelpenergyqua
2023-08-29 05:50:53 UTC	511	IN	Data Raw: 0a 72 65 73 74 0d 0a 63 61 6b 65 0d 0a 6b 69 73 73 0d 0a 6e 65 65 64 0d 0a 7a 69 70 70 65 72 0d 0a 67 6c 61 73 73 0d 0a 61 77 61 72 64 0d 0a 64 61 79 0d 0a 63 6f 77 0d 0a 6a 75 64 67 65 0d 0a 74 61 73 74 65 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 77 6f 6d 61 6e 0d 0a 61 6e 74 0d 0a 70 65 6e 0d 0a 77 69 6e 74 65 72 0d 0a 77 69 6e 74 65 72 0d 0a 72 65 73 74 0d 0a 67 6f 6c 64 0d 0a 6e 69 67 68 74 0d 0a 63 6c 6f 75 64 0d 0a 6c 6f 6e 67 0d 0a 70 6c 61 6e 74 0d 0a 6c 61 6d 70 0d 0a 7a 65 72 6f 0d 0a 65 69 67 68 74 0d 0a 61 6e 69 6d 61 6c 0d 0a 77 6f 72 6c 64 0d 0a 65 61 74 0d 0a 74 72 61 69 6e 0d 0a 74 6f 77 6e 0d 0a 67 6f 6c 64 0d 0a 77 69 6e 64 0d 0a 73 6f 6e 67 0d 0a 66 6f 72 0d 0a 7a 65 61 6c 0d 0a 6e 6f 73 65 0d 0a 66 61 63 65 0d 0a 6f 69 6c 0d 0a 6c 61 6d Data Ascii: restcakekissneedzipperglassawarddaycowjudgetasteyesterdaywomanantpenwinterwinterrestgoldnightcloudlongplantlampzeroeightanimalworldeattraintowngoldwindsongforzealnosefaceoillam
2023-08-29 05:50:53 UTC	527	IN	Data Raw: 74 65 0d 0a 6c 61 6e 64 0d 0a 77 61 74 65 72 0d 0a 6d 6f 76 69 65 0d 0a 63 6f 6c 6f 72 0d 0a 63 6f 77 0d 0a 61 70 70 6c 65 0d 0a 69 6e 6b 0d 0a 72 69 73 65 0d 0a 61 72 72 6f 77 0d 0a 64 6f 6f 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 68 6f 70 65 0d 0a 7a 69 70 70 65 72 0d 0a 6a 75 6d 70 0d 0a 66 6f 6f 74 0d 0a 68 61 6e 64 0d 0a 64 65 73 6b 0d 0a 62 69 72 64 0d 0a 66 61 63 65 0d 0a 61 70 70 6c 65 0d 0a 62 61 6e 6b 0d 0a 70 65 72 73 6f 6e 0d 0a 63 6c 6f 75 64 0d 0a 71 75 69 65 74 0d 0a 6c 61 6e 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 73 68 6f 72 74 0d 0a 68 6f 75 73 65 0d 0a 6c 69 66 65 0d 0a 77 68 69 74 65 0d 0a 65 69 67 68 74 0d 0a 66 6c 6f 77 65 72 0d 0a 67 72 6f 75 70 0d 0a 67 6c 61 73 73 0d 0a 68 65 61 64 0d 0a 6a 6f 79 0d 0a 6e 6f 72 74 68 0d 0a 69 73 73 75 65 0d Data Ascii: telandwatermoviecolorcowappleinkrisearrowdoorincomehopezipperjumpfoothanddeskbirdfaceapplebankpersoncloudquietlandqualifyshorthouselifewhiteeightflowergroupglassheadjoynorthissue
2023-08-29 05:50:53 UTC	543	IN	Data Raw: 75 72 73 65 0d 0a 61 77 61 72 64 0d 0a 6b 69 6e 67 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 74 6f 70 0d 0a 70 65 61 72 0d 0a 6f 69 6c 0d 0a 6f 72 64 65 72 0d 0a 68 69 74 0d 0a 69 6e 73 69 64 65 0d 0a 6a 75 64 67 65 0d 0a 6f 66 66 65 72 0d 0a 6d 75 73 69 63 0d 0a 66 69 72 65 0d 0a 62 61 6e 6b 0d 0a 75 73 75 61 6c 6c 79 0d 0a 78 79 6c 65 6d 0d 0a 70 65 61 72 0d 0a 66 69 72 65 0d 0a 73 74 6f 6e 65 0d 0a 6c 6f 76 65 0d 0a 65 64 67 65 0d 0a 77 6f 6d 61 6e 0d 0a 69 6e 63 6f 6d 65 0d 0a 74 65 73 74 0d 0a 70 68 6f 6e 65 0d 0a 78 79 6c 65 6d 0d 0a 73 74 72 69 6e 67 0d 0a 75 6e 63 6c 65 0d 0a 67 72 65 65 6e 0d 0a 76 69 64 65 6f 0d 0a 6b 69 73 73 0d 0a 73 68 6f 72 74 0d 0a 70 6c 61 6e 74 0d 0a 69 63 65 0d 0a 6c 61 75 67 68 0d 0a 67 72 61 73 73 0d 0a 70 65 6e 0d 0a 68 69 Data Ascii: urseawardkingunsignedtoppearoilorderhitinsidejudgeoffermusicfirebankusuallyxylempearfirestoneloveedgewomanincometestphonexylemstringunclegreenvideokissshortplanticelaughgrasspenhi
2023-08-29 05:50:53 UTC	559	IN	Data Raw: 64 67 65 0d 0a 77 61 79 0d 0a 66 69 72 65 0d 0a 68 6f 70 65 0d 0a 61 77 61 72 64 0d 0a 64 6f 0d 0a 73 63 68 6f 6f 6c 0d 0a 69 63 65 0d 0a 62 6f 79 0d 0a 6b 69 Data Ascii: dgewayfirehopeawarddoschooliceboyki
2023-08-29 05:50:53 UTC	559	IN	Data Raw: 63 6b 0d 0a 7a 6f 6f 0d 0a 6d 6f 76 69 65 0d 0a 67 61 6d 65 0d 0a 70 69 7a 7a 61 0d 0a 76 69 63 74 6f 72 79 0d 0a 69 73 6c 61 6e 64 0d 0a 61 6e 69 6d 61 6c 0d 0a 73 63 68 6f 6f 6c 0d 0a 77 65 65 6b 0d 0a 6b 69 63 6b 0d 0a 76 61 6c 75 65 0d 0a 62 6f 6f 6b 0d 0a 69 6e 63 6f 6d 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 61 69 72 0d 0a 77 61 74 65 72 0d 0a 70 68 6f 6e 65 0d 0a 66 69 72 65 0d 0a 6f 66 66 65 72 0d 0a 70 65 6e 0d 0a 63 69 74 79 0d 0a 6c 61 6e 64 0d 0a 62 6f 6f 6b 0d 0a 71 75 6f 74 65 0d 0a 76 61 6e 0d 0a 73 74 6f 6e 65 0d 0a 70 6c 61 6e 74 0d 0a 7a 6f 6d 62 69 65 0d 0a 6b 65 79 0d 0a 73 75 6e 0d 0a 73 75 6e 0d 0a 77 61 74 65 72 0d 0a 66 61 72 6d 0d 0a 71 75 65 65 6e 0d 0a 68 61 74 0d 0a 6a 61 63 6b 65 74 0d 0a 68 61 6e 64 0d 0a 6a 61 76 61 0d 0a Data Ascii: ckzoomoviegamepizzavictoryislandanimalschoolweekkickvaluebookincomeknowledgeairwaterphonefireofferpencitylandbookquotevanstoneplantzombiekeysunsunwaterfarmqueenhatjackethandjava
2023-08-29 05:50:53 UTC	575	IN	Data Raw: 72 72 6f 77 0d 0a 74 65 73 74 0d 0a 72 65 64 0d 0a 63 61 74 0d 0a 66 6f 72 0d 0a 66 61 6c 6c 0d 0a 6c 65 67 0d 0a 6e 61 6d 65 0d 0a 61 69 72 0d 0a 6c 65 74 74 65 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 65 61 72 0d 0a 6c 61 6d 70 0d 0a 72 65 64 0d 0a 66 75 6e 63 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 61 6c 6f 6e 65 0d 0a 6c 69 66 65 0d 0a 64 65 65 72 0d 0a 65 64 67 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 76 6f 69 63 65 0d 0a 66 61 74 68 65 72 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 6d 75 73 69 63 0d 0a 74 69 6d 65 0d 0a 66 61 63 65 0d 0a 77 69 6e 64 0d 0a 72 69 76 65 72 0d 0a 77 65 73 74 0d 0a 6b 69 74 65 0d 0a 67 69 72 6c 0d 0a 64 61 6e 63 65 0d 0a 7a 65 61 6c 0d 0a 77 69 6e 74 65 72 0d 0a 71 75 65 65 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 66 6f 72 0d 0a Data Ascii: rrowtestredcatforfalllegnameairlettervacationearlampredfuncuniversityalonelifedeeredgeunsignedvoicefatherinformationmusictimefacewindriverwestkitegirldancezealwinterqueenbananafor
2023-08-29 05:50:53 UTC	583	IN	Data Raw: 0d 0a 77 65 65 6b 0d 0a 6c 61 6e 64 0d 0a 68 69 67 68 0d 0a 62 61 6e 6b 0d 0a 6a 65 6c 6c 79 0d 0a 73 6e 61 6b 65 0d 0a 70 69 63 74 75 72 65 0d 0a 64 6f 67 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 73 65 61 0d 0a 6c 75 6e 63 68 0d 0a 63 6c 69 70 0d 0a 72 6f 63 6b 0d 0a 66 72 69 65 6e 64 0d 0a 6e 6f 72 74 68 0d 0a 6e 61 6d 65 0d 0a 62 75 73 0d 0a 77 68 69 74 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 76 69 73 69 74 6f 72 0d 0a 6b 69 64 0d 0a 77 68 69 74 65 0d 0a 6a 75 64 67 65 0d 0a 77 68 69 6c 65 0d 0a 6b 69 6e 67 0d 0a 73 6f 6e 67 0d 0a 64 61 72 6b 0d 0a 74 6f 77 6e 0d 0a 74 65 61 63 68 65 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 62 6c 75 65 0d 0a 6b 65 79 0d 0a 72 6f 6f 6d 0d 0a 6c 69 6f 6e 0d 0a 72 69 76 65 72 0d 0a 7a 65 61 6c 0d 0a 6c 61 75 67 68 0d 0a 6b 69 74 63 68 Data Ascii: weeklandhighbankjellysnakepicturedogyesterdaysealunchcliprockfriendnorthnamebuswhitequalifyvisitorkidwhitejudgewhilekingsongdarktownteacherincomebluekeyroomlionriverzeallaughkitch
2023-08-29 05:50:53 UTC	591	IN	Data Raw: 0d 0a 62 75 73 0d 0a 6b 69 6e 64 0d 0a 69 64 65 61 0d 0a 6c 61 6b 65 0d 0a 65 69 67 68 74 0d 0a 70 65 61 72 0d 0a 77 65 65 6b 0d 0a 77 65 65 6b 0d 0a 66 6f 6f 74 0d 0a 6d 65 6e 74 0d 0a 68 6f 70 65 0d 0a 68 61 69 72 0d 0a 71 75 69 63 6b 0d 0a 73 6e 6f 77 0d 0a 72 75 6e 0d 0a 7a 6f 6f 0d 0a 63 61 72 0d 0a 73 74 61 72 0d 0a 68 69 67 68 0d 0a 6b 65 65 70 0d 0a 72 61 69 6e 0d 0a 6e 61 74 75 72 65 0d 0a 62 6c 75 65 0d 0a 68 65 61 72 74 0d 0a 7a 6f 6e 65 0d 0a 73 74 6f 6e 65 0d 0a 65 61 73 79 0d 0a 64 61 72 6b 0d 0a 71 75 69 65 74 0d 0a 76 69 73 69 74 6f 72 0d 0a 73 6e 61 6b 65 0d 0a 63 6c 69 70 0d 0a 67 6f 6c 64 0d 0a 61 63 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 66 6f 6f 64 0d 0a 61 63 65 0d 0a 7a 65 62 72 61 0d 0a 73 6e 6f 77 0d 0a 75 6e 69 76 65 72 73 69 74 79 Data Ascii: buskindidealakeeightpearweekweekfootmenthopehairquicksnowrunzoocarstarhighkeeprainnatureblueheartzonestoneeasydarkquietvisitorsnakeclipgoldacevisitorfoodacezebrasnowuniversity
2023-08-29 05:50:53 UTC	607	IN	Data Raw: 6e 0d 0a 7a 65 62 72 61 0d 0a 64 61 74 61 0d 0a 74 6f 77 6e 0d 0a 65 6e 65 72 67 79 0d 0a 63 61 6d 65 72 61 0d 0a 67 6f 61 74 0d 0a 6a 75 6d 70 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 79 6f 75 6e 67 0d 0a 77 61 74 65 72 0d 0a 6d 65 6e 74 0d 0a 63 6c 6f 75 64 0d 0a 63 6f 61 74 0d 0a 66 61 63 65 0d 0a 76 61 6e 0d 0a 77 61 72 6e 0d 0a 62 65 61 63 68 0d 0a 65 72 72 6f 72 0d 0a 70 68 6f 6e 65 0d 0a 77 65 65 6b 0d 0a 6d 6f 74 68 65 72 0d 0a 69 63 6f 6e 0d 0a 65 69 67 68 74 0d 0a 63 6c 69 70 0d 0a 79 61 77 6e 0d 0a 72 65 73 74 0d 0a 68 61 69 72 0d 0a 67 69 72 6c 0d 0a 6a 75 64 67 65 0d 0a 69 73 6c 61 6e 64 0d 0a 73 6b 79 0d 0a 6d 61 70 0d 0a 71 75 69 63 6b 0d 0a 7a 6f 6d 62 69 65 0d 0a 61 72 72 61 79 0d 0a 6b 6e 6f 77 6c 65 64 67 Data Ascii: nzebradatatownenergycameragoatjumpquantityunderstandyoungwatermentcloudcoatfacevanwarnbeacherrorphoneweekmothericoneightclipyawnresthairgirljudgeislandskymapquickzombiearrayknowledg
2023-08-29 05:50:53 UTC	623	IN	Data Raw: 73 74 61 6e 64 0d 0a 68 61 6e 64 0d 0a 77 65 65 6b 0d 0a 6f 66 66 65 72 0d 0a 76 61 6e 0d 0a 76 69 65 77 0d 0a 67 61 6d 65 0d 0a 65 61 74 0d 0a 67 72 65 65 6e 0d 0a 74 69 6d 65 0d 0a 6b 69 74 65 0d 0a 63 68 61 72 0d 0a 75 6e 63 6c 65 0d 0a 6f 72 64 65 72 0d 0a 70 68 6f 6e 65 0d 0a 62 65 61 63 68 0d 0a 72 69 76 65 72 0d 0a 6f 72 61 6e 67 65 0d 0a 74 6f 77 6e 0d 0a 6d 75 73 69 63 0d 0a 62 69 72 64 0d 0a 79 6f 75 6e 67 0d 0a 7a 6f 6e 65 0d 0a 71 75 6f 74 65 0d 0a 65 69 67 68 74 0d 0a 6d 65 61 6c 0d 0a 66 6c 6f 77 65 72 0d 0a 6c 75 6e 63 68 0d 0a 72 6f 63 6b 0d 0a 68 69 74 0d 0a 6c 6f 76 65 0d 0a 61 69 72 0d 0a 76 69 65 77 0d 0a 66 6f 6f 74 0d 0a 66 61 63 65 0d 0a 6d 6f 74 68 65 72 0d 0a 61 70 70 6c 65 0d 0a 61 69 72 0d 0a 70 69 6e 6b 0d 0a 6c 61 6b 65 0d 0a Data Ascii: standhandweekoffervanviewgameeatgreentimekitecharuncleorderphonebeachriverorangetownmusicbirdyoungzonequoteeightmealflowerlunchrockhitloveairviewfootfacemotherappleairpinklake
2023-08-29 05:50:53 UTC	639	IN	Data Raw: 0a 77 61 79 0d 0a 79 6f 75 6e 67 0d 0a 62 6f 79 0d 0a 65 72 72 6f 72 0d 0a 6c 69 6f 6e 0d 0a 66 69 73 68 0d 0a 64 61 74 61 0d 0a 72 6f 61 64 0d 0a 72 65 73 74 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 77 65 73 74 0d 0a 6b 69 73 73 0d 0a 62 69 72 64 0d 0a 6e 6f 73 65 0d 0a 64 6f 6f 72 0d 0a 67 61 6d 65 0d 0a 72 6f 6f 6d 0d 0a 64 61 72 6b 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 65 61 63 68 0d 0a 77 69 6e 64 0d 0a 63 61 74 0d 0a 63 6f 77 0d 0a 6b 69 74 63 68 65 6e 0d 0a 67 6f 6c 64 0d 0a 62 61 6c 6c 0d 0a 6f 70 65 6e 0d 0a 6e 6f 74 65 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 62 69 72 64 0d 0a 74 6f 70 0d 0a 6e 6f 74 65 0d 0a 68 6f 70 65 0d 0a 6c 6f 76 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 74 72 61 69 6e 0d 0a 6b 69 74 65 0d 0a 64 6f 6f 72 0d 0a 6a 6f 79 Data Ascii: wayyoungboyerrorlionfishdataroadrestunderstandwestkissbirdnosedoorgameroomdarkinformationbeachwindcatcowkitchengoldballopennotequestionbirdtopnotehopelovequantitytrainkitedoorjoy
2023-08-29 05:50:53 UTC	655	IN	Data Raw: 0a 61 72 74 0d 0a 65 79 65 0d 0a 66 6f 6f 64 0d 0a 77 61 79 0d 0a 68 6f 75 73 65 0d 0a 6a 61 72 0d 0a 6c 6f 76 65 0d 0a 73 75 6e 0d 0a 65 61 74 0d 0a 6b 69 6e Data Ascii: arteyefoodwayhousejarlovesuneatkin
2023-08-29 05:50:53 UTC	655	IN	Data Raw: 67 0d 0a 64 65 73 6b 0d 0a 65 64 67 65 0d 0a 73 68 6f 72 74 0d 0a 72 6f 6f 6d 0d 0a 73 6b 79 0d 0a 74 61 6c 6b 0d 0a 79 65 61 72 6e 0d 0a 61 6e 74 0d 0a 79 61 72 64 0d 0a 6f 66 66 65 72 0d 0a 63 6f 61 74 0d 0a 6b 69 73 73 0d 0a 65 6e 64 0d 0a 76 69 64 65 6f 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 77 68 69 74 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 6b 69 74 63 68 65 6e 0d 0a 6d 6f 6f 6e 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 66 61 6c 6c 0d 0a 66 6c 6f 77 65 72 0d 0a 62 75 73 0d 0a 76 69 63 74 6f 72 79 0d 0a 6a 61 76 61 0d 0a 6e 75 72 73 65 0d 0a 64 61 6e 63 65 0d 0a 79 61 72 64 0d 0a 65 61 73 74 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6c 65 74 74 65 72 0d 0a 6d 65 61 6c 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 68 61 6e 64 0d 0a 76 61 6c 75 65 0d 0a 67 Data Ascii: gdeskedgeshortroomskytalkyearnantyardoffercoatkissendvideounsignedwhiteundergroundkitchenmoonunderstandfallflowerbusvictoryjavanursedanceyardeastmachinelettermealinformationhandvalueg
2023-08-29 05:50:53 UTC	663	IN	Data Raw: 61 6e 6b 0d 0a 68 69 67 68 0d 0a 77 69 6e 64 0d 0a 6c 69 6f 6e 0d 0a 6d 61 63 68 69 6e 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 79 6f 75 6e 67 0d 0a 69 6e 6b 0d 0a 68 61 69 72 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 69 63 65 0d 0a 68 6f 75 73 65 0d 0a 79 61 72 64 0d 0a 6d 69 6c 6b 0d 0a 63 69 74 79 0d 0a 6d 6f 74 68 65 72 0d 0a 6b 69 6e 64 0d 0a 76 69 64 65 6f 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6a 6f 79 0d 0a 6b 69 6e 64 0d 0a 70 61 70 65 72 0d 0a 61 6e 74 0d 0a 65 61 74 0d 0a 6d 6f 74 68 65 72 0d 0a 68 6f 75 73 65 0d 0a 64 61 79 0d 0a 6b 69 64 0d 0a 6f 63 65 61 6e 0d 0a 61 72 74 0d 0a 6e 69 67 68 74 0d 0a 79 61 77 6e 0d 0a 67 6f 6c 64 0d 0a 75 73 65 0d 0a 70 65 6e 0d 0a 64 65 65 72 0d 0a 74 72 65 65 0d 0a 69 64 65 61 0d 0a 7a 65 62 72 61 0d 0a 6b 69 6e 64 0d 0a 6e Data Ascii: ankhighwindlionmachinequantityyounginkhairjourneyicehouseyardmilkcitymotherkindvideousuallyjoykindpaperanteatmotherhousedaykidoceanartnightyawngoldusependeertreeideazebrakindn
2023-08-29 05:50:55 UTC	671	IN	Data Raw: 68 0d 0a 61 6e 69 6d 61 6c 0d 0a 61 72 74 0d 0a 69 63 6f 6e 0d 0a 69 6e 74 0d 0a 63 61 6b 65 0d 0a 71 75 61 6c 69 74 79 0d 0a 61 72 72 61 79 0d 0a 72 61 62 62 69 74 0d 0a 79 65 6c 6c 6f 77 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 6f 70 65 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a 68 6f 70 65 0d 0a 6e 65 65 64 0d 0a 6f 72 61 6e 67 65 0d 0a 63 6f 61 74 0d 0a 70 65 61 72 0d 0a 6a 6f 6b 65 0d 0a 6d 65 61 6c 0d 0a 66 6f 6f 64 0d 0a 6c 69 6f 6e 0d 0a 64 72 65 61 6d 0d 0a 66 6c 6f 77 65 72 0d 0a 68 6f 70 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 7a 65 72 6f 0d 0a 6a 75 6d 70 0d 0a 72 75 6e 0d 0a 77 69 6e 64 0d 0a 64 61 72 6b 0d 0a 66 6f 72 0d 0a 79 65 61 72 0d 0a 65 67 67 0d 0a 6b 69 6e 67 0d 0a 6f 72 61 6e 67 65 0d 0a 63 6f 77 0d 0a 70 69 63 74 75 72 65 0d 0a 77 65 73 74 0d 0a Data Ascii: hanimalarticonintcakequalityarrayrabbityellowvegetableopenzombiehopeneedorangecoatpearjokemealfoodliondreamflowerhopequalifyzerojumprunwinddarkforyeareggkingorangecowpicturewest
2023-08-29 05:50:55 UTC	687	IN	Data Raw: 65 72 0d 0a 64 61 6e 63 65 0d 0a 68 61 6e 64 0d 0a 6d 6f 74 68 65 72 0d 0a 65 6e 65 72 67 79 0d 0a 68 65 6c 70 0d 0a 79 65 61 72 6e 0d 0a 79 61 72 64 0d 0a 6d 61 6e 0d 0a 62 61 6e 6b 0d 0a 6e 61 74 75 72 65 0d 0a 65 61 74 0d 0a 70 69 7a 7a 61 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 62 61 6e 61 6e 61 0d 0a 74 69 67 65 72 0d 0a 77 61 79 0d 0a 77 61 79 0d 0a 74 6f 77 6e 0d 0a 63 6f 77 0d 0a 6e 6f 74 65 0d 0a 67 72 6f 75 70 0d 0a 73 63 68 6f 6f 6c 0d 0a 76 61 6c 75 65 0d 0a 66 61 6c 6c 0d 0a 6d 6f 76 69 65 0d 0a 78 79 6c 65 6d 0d 0a 74 61 6c 6b 0d 0a 70 69 6e 6b 0d 0a 6b 69 6e 64 0d 0a 65 61 73 79 0d 0a 63 6c 69 70 0d 0a 66 6c 6f 77 65 72 0d 0a 6c 6f 76 65 0d 0a 68 65 61 72 74 0d 0a 63 69 74 79 0d 0a 63 68 61 72 0d 0a 75 6e 63 6c 65 0d 0a 67 6f 6c 64 0d 0a Data Ascii: erdancehandmotherenergyhelpyearnyardmanbanknatureeatpizzauniversitybananatigerwaywaytowncownotegroupschoolvaluefallmoviexylemtalkpinkkindeasyclipflowerloveheartcitycharunclegold
2023-08-29 05:50:55 UTC	703	IN	Data Raw: 6d 62 65 72 0d 0a 67 6f 6c 64 0d 0a 73 74 6f 6e 65 0d 0a 79 65 61 72 0d 0a 70 68 6f 6e 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 62 69 72 64 0d 0a 65 6e 64 0d 0a 6d 61 70 0d 0a 69 6e 6b 0d 0a 6c 65 74 74 65 72 0d 0a 6c 6f 6e 67 0d 0a 6b 69 6e 64 0d 0a 62 75 73 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6a 75 6d 70 0d 0a 6b 65 65 70 0d 0a 70 69 6e 6b 0d 0a 6f 66 66 65 72 0d 0a 68 65 61 64 0d 0a 6a 75 6d 70 0d 0a 76 69 73 69 74 6f 72 0d 0a 73 6b 79 0d 0a 69 63 65 0d 0a 6b 69 64 0d 0a 69 64 65 61 0d 0a 61 72 72 6f 77 0d 0a 76 69 73 69 74 6f 72 0d 0a 6a 6f 79 0d 0a 7a 65 61 6c 0d 0a 66 61 6c 6c 0d 0a 62 75 73 0d 0a 62 65 61 63 68 0d 0a 64 61 72 6b 0d 0a 6e 61 6d 65 0d 0a 77 6f 72 6c 64 0d 0a 71 75 61 6c 69 74 79 0d 0a 70 6f 77 65 72 0d 0a 76 69 63 74 6f 72 79 0d 0a 67 Data Ascii: mbergoldstoneyearphonemonkeybirdendmapinkletterlongkindbusunderstandjumpkeeppinkofferheadjumpvisitorskyicekidideaarrowvisitorjoyzealfallbusbeachdarknameworldqualitypowervictoryg
2023-08-29 05:50:55 UTC	719	IN	Data Raw: 65 74 61 62 6c 65 0d 0a 61 72 63 68 0d 0a 68 6f 70 65 0d 0a 61 69 72 0d 0a 70 61 70 65 72 0d 0a 79 6f 75 6e 67 0d 0a 66 6c 6f 77 65 72 0d 0a 67 75 65 73 74 0d 0a 62 6f 6f 6b 0d 0a 61 69 72 0d 0a 65 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 71 75 61 6c 69 66 79 0d 0a 70 65 61 72 0d 0a 6c 6f 76 65 0d 0a 76 6f 69 63 65 0d 0a 6e 75 72 73 65 0d 0a 77 61 79 0d 0a 64 75 63 6b 0d 0a 65 6e 64 0d 0a 6e 61 6d 65 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 6a 6f 6b 65 0d 0a 61 6e 74 0d 0a 79 65 61 72 6e 0d 0a 63 6f 61 74 0d 0a 70 6c 61 6e 74 0d 0a 70 65 6e 0d 0a 6a 75 64 67 65 0d 0a 74 61 6c 6b 0d 0a 66 6f 72 0d 0a 70 61 70 65 72 0d 0a 62 6f 79 0d 0a 70 69 7a 7a 61 0d 0a 72 69 73 65 0d 0a 77 61 79 0d 0a 67 6c 61 73 73 0d 0a 66 6f 6f 64 0d 0a 79 65 6c 6c 6f 77 0d 0a 69 73 73 75 65 Data Ascii: etablearchhopeairpaperyoungflowerguestbookairearmonkeyqualifypearlovevoicenursewayduckendnamequestionjokeantyearncoatplantpenjudgetalkforpaperboypizzarisewayglassfoodyellowissue
2023-08-29 05:50:55 UTC	735	IN	Data Raw: 0d 0a 77 6f 72 6b 0d 0a 73 74 72 69 6e 67 0d 0a 79 65 61 72 6e 0d 0a 66 61 72 6d 0d 0a 63 61 6d 65 72 61 0d 0a 73 6e 61 6b 65 0d 0a 63 61 72 0d 0a 63 61 72 0d Data Ascii: workstringyearnfarmcamerasnakecarcar
2023-08-29 05:50:55 UTC	735	IN	Data Raw: 0a 64 72 65 61 6d 0d 0a 75 6e 69 74 0d 0a 70 69 7a 7a 61 0d 0a 70 69 63 74 75 72 65 0d 0a 69 6e 74 0d 0a 68 65 61 64 0d 0a 74 61 6c 6b 0d 0a 6d 61 70 0d 0a 66 61 63 65 0d 0a 70 6f 77 65 72 0d 0a 69 73 73 75 65 0d 0a 67 72 61 73 73 0d 0a 73 6b 79 0d 0a 74 61 73 74 65 0d 0a 73 63 68 6f 6f 6c 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 67 6c 61 73 73 0d 0a 6a 6f 6b 65 0d 0a 6c 69 66 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 68 69 74 0d 0a 66 61 6c 6c 0d 0a 79 6f 75 6e 67 0d 0a 6d 6f 6e 6b 65 79 0d 0a 68 65 61 64 0d 0a 69 73 73 75 65 0d 0a 76 61 6e 0d 0a 6d 69 6c 6b 0d 0a 70 68 6f 6e 65 0d 0a 65 6e 65 72 67 79 0d 0a 6d 75 73 69 63 0d 0a 66 6c 6f 77 65 72 0d 0a 68 65 61 72 74 0d 0a 68 61 69 72 0d 0a 70 69 7a 7a 61 0d 0a 74 65 73 74 0d 0a 67 61 6d 65 0d 0a 70 65 72 73 Data Ascii: dreamunitpizzapictureintheadtalkmapfacepowerissuegrassskytasteschoolvacationglassjokelifeknowledgehitfallyoungmonkeyheadissuevanmilkphoneenergymusicflowerhearthairpizzatestgamepers
2023-08-29 05:50:55 UTC	743	IN	Data Raw: 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 6b 69 6e 67 0d 0a 6b 69 6e 64 0d 0a 68 65 61 72 74 0d 0a 63 61 74 0d 0a 73 65 61 0d 0a 67 75 65 73 74 0d 0a 6f 66 66 65 72 0d 0a 6f 6e 65 0d 0a 61 6c 6f 6e 65 0d 0a 64 72 65 61 6d 0d 0a 72 69 73 65 0d 0a 78 79 6c 65 6d 0d 0a 76 6f 69 63 65 0d 0a 75 73 65 0d 0a 73 65 76 65 6e 0d 0a 73 75 67 61 72 0d 0a 78 79 6c 65 6d 0d 0a 66 72 69 65 6e 64 0d 0a 6b 65 79 0d 0a 6c 61 6d 70 0d 0a 68 65 6c 70 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 73 75 6e 0d 0a 77 68 69 74 65 0d 0a 74 65 61 63 68 65 72 0d 0a 65 61 72 74 68 0d 0a 72 6f 61 64 0d 0a 67 72 65 65 6e 0d 0a 78 79 6c 65 6d 0d 0a 7a 6f 6e 65 0d 0a 6a 61 72 0d 0a 66 6f 6f 64 0d 0a 70 68 6f 6e 65 0d 0a 79 65 61 72 0d 0a 62 6f 78 0d 0a 77 68 69 6c 65 0d 0a 77 6f 72 6c 64 0d 0a 64 61 Data Ascii: undergroundkingkindheartcatseaguestofferonealonedreamrisexylemvoiceusesevensugarxylemfriendkeylamphelpquantitysunwhiteteacherearthroadgreenxylemzonejarfoodphoneyearboxwhileworldda
2023-08-29 05:50:55 UTC	751	IN	Data Raw: 6f 76 69 65 0d 0a 6b 69 63 6b 0d 0a 6f 72 64 65 72 0d 0a 69 73 73 75 65 0d 0a 70 68 6f 6e 65 0d 0a 74 61 6c 6b 0d 0a 65 61 72 74 68 0d 0a 63 61 74 0d 0a 76 61 6e 0d 0a 70 68 6f 6e 65 0d 0a 6f 6e 65 0d 0a 73 65 61 0d 0a 63 6f 61 74 0d 0a 63 61 6d 65 72 61 0d 0a 69 6e 73 69 64 65 0d 0a 6a 65 6c 6c 79 0d 0a 61 72 72 6f 77 0d 0a 66 69 73 68 0d 0a 6c 75 6e 63 68 0d 0a 74 65 61 63 68 65 72 0d 0a 65 61 73 79 0d 0a 6b 69 73 73 0d 0a 68 69 74 0d 0a 6e 61 74 75 72 65 0d 0a 64 61 72 6b 0d 0a 65 64 67 65 0d 0a 74 6f 77 6e 0d 0a 6a 61 63 6b 65 74 0d 0a 66 61 74 68 65 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 66 6f 6f 64 0d 0a 71 75 69 65 74 0d 0a 68 6f 70 65 0d 0a 6e 75 6d 62 65 72 0d 0a 66 72 69 65 6e 64 0d 0a 61 6e 69 6d 61 6c 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a Data Ascii: oviekickorderissuephonetalkearthcatvanphoneoneseacoatcamerainsidejellyarrowfishlunchteachereasykisshitnaturedarkedgetownjacketfatherKanthanfoodquiethopenumberfriendanimalinformation
2023-08-29 05:50:55 UTC	767	IN	Data Raw: 0a 61 6c 6f 6e 65 0d 0a 6c 6f 6e 67 0d 0a 69 6e 73 69 64 65 0d 0a 65 67 67 0d 0a 63 61 6b 65 0d 0a 65 61 73 74 0d 0a 6b 69 64 0d 0a 6c 61 6e 64 0d 0a 73 75 6e 0d 0a 71 75 65 65 6e 0d 0a 6e 69 67 68 74 0d 0a 75 6e 63 6c 65 0d 0a 67 69 72 6c 0d 0a 71 75 61 6c 69 74 79 0d 0a 63 61 6b 65 0d 0a 61 63 65 0d 0a 78 79 6c 65 6d 0d 0a 6b 69 63 6b 0d 0a 66 6f 72 0d 0a 6e 6f 72 74 68 0d 0a 77 61 79 0d 0a 74 61 6c 6b 0d 0a 68 65 61 72 74 0d 0a 6a 6f 6b 65 0d 0a 6e 75 6d 62 65 72 0d 0a 6d 65 6e 74 0d 0a 73 74 72 69 6e 67 0d 0a 65 61 73 74 0d 0a 6d 6f 6f 6e 0d 0a 64 61 6e 63 65 0d 0a 6c 65 67 0d 0a 66 61 63 65 0d 0a 62 61 6e 61 6e 61 0d 0a 66 61 72 6d 0d 0a 6f 63 65 61 6e 0d 0a 68 69 67 68 0d 0a 68 65 61 64 0d 0a 6c 61 75 67 68 0d 0a 72 61 62 62 69 74 0d 0a 6c 6f 76 65 Data Ascii: alonelonginsideeggcakeeastkidlandsunqueennightunclegirlqualitycakeacexylemkickfornorthwaytalkheartjokenumbermentstringeastmoondancelegfacebananafarmoceanhighheadlaughrabbitlove
2023-08-29 05:50:55 UTC	783	IN	Data Raw: 79 0d 0a 6a 6f 79 0d 0a 78 79 6c 65 6d 0d 0a 68 65 6c 70 0d 0a 77 61 74 65 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 61 72 74 0d 0a 77 65 65 6b 0d 0a 6f 6e 65 0d 0a 61 72 72 61 79 0d 0a 65 79 65 0d 0a 76 69 65 77 0d 0a 66 6f 6f 74 0d 0a 6d 61 70 0d 0a 70 69 6e 6b 0d 0a 65 69 67 68 74 0d 0a 6e 75 6d 62 65 72 0d 0a 61 72 74 0d 0a 65 6e 64 0d 0a 70 65 61 72 0d 0a 73 74 6f 6e 65 0d 0a 65 69 67 68 74 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 62 6c 75 65 0d 0a 65 72 72 6f 72 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 62 61 6e 6b 0d 0a 6b 65 65 70 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 74 69 6d 65 0d 0a 61 72 74 0d 0a 67 72 65 65 6e 0d 0a 73 74 6f 6e 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 6d 61 63 68 69 6e 65 0d 0a 66 6f 6f 74 0d 0a 72 6f 63 6b 0d 0a 77 61 72 6e 0d 0a 62 61 6c 6c 0d Data Ascii: yjoyxylemhelpwatervacationartweekonearrayeyeviewfootmappinkeightnumberartendpearstoneeightquestionblueerrorunderstandbankkeepKanthantimeartgreenstoneyellowmachinefootrockwarnball
2023-08-29 05:50:55 UTC	799	IN	Data Raw: 62 65 72 0d 0a 71 75 69 65 74 0d 0a 65 61 73 74 0d 0a 61 72 74 0d 0a 64 65 65 72 0d 0a 62 65 61 63 68 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 6d 65 61 6c 0d 0a 73 63 68 6f 6f 6c 0d 0a 61 6e 69 6d 61 6c 0d 0a 77 68 69 74 65 0d 0a 63 6f 6c 6f 72 0d 0a 6d 65 61 6c 0d 0a 79 65 6c 6c 6f 77 0d 0a 72 65 73 74 0d 0a 6d 61 63 68 69 6e 65 0d 0a 73 74 61 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 62 65 61 63 68 0d 0a 72 6f 63 6b 0d 0a 6a 65 6c 6c 79 0d 0a 6d 69 6c 6b 0d 0a 61 6e 74 0d 0a 65 61 72 0d 0a 66 72 69 65 6e 64 0d 0a 68 61 74 0d 0a 65 61 72 74 68 0d 0a 77 69 6e 64 0d 0a 63 69 74 79 0d 0a 65 73 63 61 70 65 0d 0a 76 69 64 65 6f 0d 0a 65 61 72 0d 0a 72 65 64 0d 0a 70 69 63 74 75 72 65 0d 0a 62 61 6e 61 6e 61 0d 0a 64 75 63 6b 0d 0a 70 65 6e 0d 0a 66 61 63 65 Data Ascii: berquieteastartdeerbeachinformationmealschoolanimalwhitecolormealyellowrestmachinestarvacationbeachrockjellymilkantearfriendhatearthwindcityescapevideoearredpicturebananaduckpenface
2023-08-29 05:50:55 UTC	815	IN	Data Raw: 6b 0d 0a 74 72 61 69 6e 0d 0a 7a 65 61 6c 0d 0a 69 73 6c 61 6e 64 0d 0a 71 75 69 65 74 0d 0a 61 72 72 6f 77 0d 0a 63 6f 77 0d 0a 68 65 61 64 0d 0a 6b 69 73 73 Data Ascii: ktrainzealislandquietarrowcowheadkiss
2023-08-29 05:50:55 UTC	815	IN	Data Raw: 0d 0a 6e 69 67 68 74 0d 0a 70 69 6e 6b 0d 0a 6f 70 65 6e 0d 0a 70 68 6f 6e 65 0d 0a 73 65 76 65 6e 0d 0a 64 61 6e 63 65 0d 0a 6d 6f 74 68 65 72 0d 0a 6d 75 73 69 63 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 72 65 64 0d 0a 61 63 65 0d 0a 77 69 6e 64 0d 0a 64 6f 6f 72 0d 0a 77 61 79 0d 0a 69 6e 6b 0d 0a 69 73 73 75 65 0d 0a 6c 69 66 65 0d 0a 65 67 67 0d 0a 6d 65 61 6c 0d 0a 64 72 65 61 6d 0d 0a 6b 69 6e 64 0d 0a 7a 6f 6d 62 69 65 0d 0a 62 6c 75 65 0d 0a 6b 69 63 6b 0d 0a 65 72 72 6f 72 0d 0a 62 61 6e 61 6e 61 0d 0a 68 65 6c 70 0d 0a 61 70 70 6c 65 0d 0a 76 61 6c 75 65 0d 0a 66 6f 6f 64 0d 0a 77 69 6e 74 65 72 0d 0a 63 61 6b 65 0d 0a 62 69 72 64 0d 0a 74 61 6c 6b 0d 0a 74 6f 77 6e 0d 0a 72 61 69 6e 0d 0a 70 65 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 79 65 73 74 65 72 64 Data Ascii: nightpinkopenphonesevendancemothermusicvacationredacewinddoorwayinkissuelifeeggmealdreamkindzombiebluekickerrorbananahelpapplevaluefoodwintercakebirdtalktownrainpenyellowyesterd
2023-08-29 05:50:55 UTC	823	IN	Data Raw: 65 6b 0d 0a 6d 6f 76 69 65 0d 0a 70 69 7a 7a 61 0d 0a 6d 6f 6f 6e 0d 0a 71 75 61 6c 69 74 79 0d 0a 70 6c 61 6e 74 0d 0a 6a 61 72 0d 0a 67 6f 6c 64 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a 66 61 74 68 65 72 0d 0a 68 65 6c 70 0d 0a 69 6e 63 6f 6d 65 0d 0a 6d 65 6e 74 0d 0a 6d 69 6c 6b 0d 0a 77 68 69 6c 65 0d 0a 64 6f 67 0d 0a 6e 6f 72 74 68 0d 0a 73 63 68 6f 6f 6c 0d 0a 71 75 6f 74 65 0d 0a 7a 6f 6e 65 0d 0a 72 61 62 62 69 74 0d 0a 77 69 6e 64 0d 0a 64 6f 67 0d 0a 70 65 72 73 6f 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 6a 75 64 67 65 0d 0a 6e 6f 74 65 0d 0a 72 69 73 65 0d 0a 75 73 65 0d 0a 72 75 6e 0d 0a 73 65 76 65 6e 0d 0a 65 61 72 0d 0a 66 69 73 68 0d 0a 69 63 6f 6e 0d 0a 75 6e 69 74 0d 0a 75 6e 63 6c 65 0d 0a 74 69 6d 65 0d 0a 62 61 6c 6c 0d Data Ascii: ekmoviepizzamoonqualityplantjargoldvacationzombiefatherhelpincomementmilkwhiledognorthschoolquotezonerabbitwinddogpersonschooljudgenoteriseuserunsevenearfishiconunituncletimeball
2023-08-29 05:50:55 UTC	831	IN	Data Raw: 74 63 68 65 6e 0d 0a 78 79 6c 65 6d 0d 0a 7a 65 72 6f 0d 0a 63 68 61 72 0d 0a 64 6f 6f 72 0d 0a 66 61 74 68 65 72 0d 0a 69 64 65 61 0d 0a 76 6f 69 63 65 0d 0a 6e 61 74 75 72 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 65 61 72 0d 0a 6e 65 65 64 0d 0a 6a 61 63 6b 65 74 0d 0a 65 69 67 68 74 0d 0a 62 6f 6f 6b 0d 0a 76 61 6c 75 65 0d 0a 6c 61 6e 64 0d 0a 62 69 72 64 0d 0a 6f 62 6a 65 63 74 0d 0a 6b 65 79 0d 0a 68 61 74 0d 0a 6e 65 65 64 0d 0a 6d 65 6e 74 0d 0a 61 6c 6f 6e 65 0d 0a 62 69 72 64 0d 0a 70 6f 77 65 72 0d 0a 6c 65 74 74 65 72 0d 0a 66 61 72 6d 0d 0a 6e 69 67 68 74 0d 0a 6c 75 6e 63 68 0d 0a 69 63 6f 6e 0d 0a 69 6e 63 6f 6d 65 0d 0a 76 69 64 65 6f 0d 0a 70 69 6e 6b 0d 0a 62 6c 75 65 0d 0a 6c 65 74 74 65 72 0d 0a 68 61 74 0d 0a 65 61 73 74 0d 0a 6b 69 74 Data Ascii: tchenxylemzerochardoorfatherideavoicenaturequantityearneedjacketeightbookvaluelandbirdobjectkeyhatneedmentalonebirdpowerletterfarmnightlunchiconincomevideopinkblueletterhateastkit
2023-08-29 05:50:55 UTC	847	IN	Data Raw: 0d 0a 61 6c 6f 6e 65 0d 0a 71 75 61 72 74 65 72 0d 0a 68 65 61 64 0d 0a 6c 61 75 67 68 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6c 6f 76 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 66 61 6c 6c 0d 0a 72 6f 63 6b 0d 0a 62 61 6c 6c 0d 0a 73 74 61 72 0d 0a 79 6f 75 6e 67 0d 0a 78 79 6c 65 6d 0d 0a 6c 69 6f 6e 0d 0a 6c 75 6e 63 68 0d 0a 6d 65 61 6c 0d 0a 6b 69 6e 67 0d 0a 6a 75 6d 70 0d 0a 6c 6f 76 65 0d 0a 67 72 61 73 73 0d 0a 6d 6f 6e 6b 65 79 0d 0a 68 61 69 72 0d 0a 74 6f 77 6e 0d 0a 65 72 72 6f 72 0d 0a 68 61 6e 64 0d 0a 6a 61 72 0d 0a 70 6c 61 6e 74 0d 0a 77 6f 72 6b 0d 0a 6a 61 63 6b 65 74 0d 0a 6e 6f 74 65 0d 0a 72 61 69 6e 0d 0a 6b 69 6e 64 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 74 72 65 65 0d 0a 61 72 74 0d 0a 71 75 69 65 74 0d 0a 79 65 6c 6c 6f 77 0d Data Ascii: alonequarterheadlaughuniversityloveundergroundfallrockballstaryoungxylemlionlunchmealkingjumplovegrassmonkeyhairtownerrorhandjarplantworkjacketnoterainkindjourneytreeartquietyellow
2023-08-29 05:50:55 UTC	863	IN	Data Raw: 6f 72 64 65 72 0d 0a 72 75 6e 0d 0a 68 6f 70 65 0d 0a 77 61 72 6e 0d 0a 73 68 6f 72 74 0d 0a 61 63 65 0d 0a 6a 61 76 61 0d 0a 79 65 73 0d 0a 6d 6f 6e 6b 65 79 0d 0a 75 73 65 0d 0a 64 61 74 61 0d 0a 6d 6f 76 69 65 0d 0a 63 61 6d 65 72 61 0d 0a 69 63 6f 6e 0d 0a 63 6f 6c 6f 72 0d 0a 73 6e 6f 77 0d 0a 65 6e 65 72 67 79 0d 0a 6a 61 72 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 72 6f 61 64 0d 0a 72 75 6e 0d 0a 72 69 73 65 0d 0a 65 61 72 0d 0a 6b 65 65 70 0d 0a 6b 69 73 73 0d 0a 6e 75 72 73 65 0d 0a 65 6e 64 0d 0a 6b 65 65 70 0d 0a 77 68 69 74 65 0d 0a 64 75 63 6b 0d 0a 61 6c 6f 6e 65 0d 0a 77 65 65 6b 0d 0a 61 6e 74 0d 0a 63 61 72 0d 0a 71 75 69 63 6b 0d 0a 74 69 67 65 72 0d 0a 64 72 65 61 6d 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 65 61 72 74 68 0d 0a 64 75 63 6b Data Ascii: orderrunhopewarnshortacejavayesmonkeyusedatamoviecameraiconcolorsnowenergyjarvegetableroadrunriseearkeepkissnurseendkeepwhiteduckaloneweekantcarquicktigerdreamyesterdayearthduck
2023-08-29 05:50:55 UTC	879	IN	Data Raw: 6e 63 6c 65 0d 0a 70 6c 61 6e 74 0d 0a 6c 69 66 65 0d 0a 79 61 72 64 0d 0a 73 65 76 65 6e 0d 0a 6d 6f 6e 6b 65 79 0d 0a 65 6e 64 0d 0a 63 68 61 72 0d 0a 62 69 72 64 0d 0a 6e 6f 73 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 69 6e 73 69 64 65 0d 0a 68 6f 75 73 65 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 6b 69 64 0d 0a 73 65 76 65 6e 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 77 61 72 6e 0d 0a 67 61 6d 65 0d 0a 75 6e 69 74 0d 0a 74 72 65 65 0d 0a 68 61 6e 64 0d 0a 6a 6f 6b 65 0d 0a 70 65 72 73 6f 6e 0d 0a 77 6f 72 6b 0d 0a 6f 6e 65 0d 0a 65 61 72 74 68 0d 0a 75 6e 63 6c 65 0d 0a 71 75 6f 74 65 0d 0a 62 6c 75 65 0d 0a 66 61 63 65 0d 0a 62 61 6e 6b 0d 0a 61 6e 74 0d 0a 66 6f 6f 64 0d 0a 6d 65 61 6c 0d 0a 6b 69 63 6b 0d 0a 6f 70 65 6e 0d 0a 6d 61 Data Ascii: ncleplantlifeyardsevenmonkeyendcharbirdnoseuniversityinsidehousevacationbananakidsevenunsignedwarngameunittreehandjokepersonworkoneearthunclequotebluefacebankantfoodmealkickopenma
2023-08-29 05:50:55 UTC	895	IN	Data Raw: 62 72 61 0d 0a 6a 6f 79 0d 0a 77 69 6e 74 65 72 0d 0a 6c 61 75 67 68 0d 0a 6f 66 66 69 63 65 0d 0a 71 75 61 6c 69 74 79 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e Data Ascii: brajoywinterlaughofficequalityinformation
2023-08-29 05:50:55 UTC	895	IN	Data Raw: 0d 0a 6d 61 70 0d 0a 70 65 61 72 0d 0a 6d 6f 74 68 65 72 0d 0a 65 61 73 79 0d 0a 76 69 65 77 0d 0a 64 6f 0d 0a 72 61 62 62 69 74 0d 0a 63 61 6d 65 72 61 0d 0a 61 6e 69 6d 61 6c 0d 0a 6a 65 6c 6c 79 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 66 6f 72 0d 0a 61 72 74 0d 0a 74 6f 77 6e 0d 0a 74 72 61 69 6e 0d 0a 6c 61 6d 70 0d 0a 6f 66 66 69 63 65 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6b 69 64 0d 0a 79 65 61 72 6e 0d 0a 62 6f 6f 6b 0d 0a 6e 75 6d 62 65 72 0d 0a 68 65 61 64 0d 0a 68 6f 75 73 65 0d 0a 66 61 74 68 65 72 0d 0a 7a 65 72 6f 0d 0a 66 61 74 68 65 72 0d 0a 68 61 69 72 0d 0a 61 72 63 68 0d 0a 77 61 74 65 72 0d 0a 67 68 6f 73 74 0d 0a 63 61 74 0d 0a 72 65 73 74 0d 0a 63 69 74 79 0d 0a 77 68 69 74 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6b 69 73 73 0d 0a 72 69 73 65 Data Ascii: mappearmothereasyviewdorabbitcameraanimaljellyquantityforarttowntrainlampofficeKanthankidyearnbooknumberheadhousefatherzerofatherhairarchwaterghostcatrestcitywhitequantitykissrise
2023-08-29 05:50:55 UTC	903	IN	Data Raw: 64 0d 0a 63 61 72 0d 0a 71 75 69 65 74 0d 0a 6b 65 79 0d 0a 76 69 65 77 0d 0a 61 63 65 0d 0a 73 68 6f 72 74 0d 0a 73 65 61 0d 0a 68 69 67 68 0d 0a 61 72 72 6f 77 0d 0a 64 61 79 0d 0a 6d 61 63 68 69 6e 65 0d 0a 71 75 69 65 74 0d 0a 6d 75 73 69 63 0d 0a 63 61 6d 65 72 61 0d 0a 77 61 74 65 72 0d 0a 6e 65 65 64 0d 0a 70 65 6e 0d 0a 71 75 69 65 74 0d 0a 64 65 65 72 0d 0a 6b 69 6e 64 0d 0a 6d 75 73 69 63 0d 0a 64 75 63 6b 0d 0a 62 61 6e 6b 0d 0a 7a 6f 6d 62 69 65 0d 0a 63 6c 69 70 0d 0a 6b 69 6e 64 0d 0a 69 6e 63 6f 6d 65 0d 0a 73 65 76 65 6e 0d 0a 73 75 6e 0d 0a 78 79 6c 65 6d 0d 0a 74 61 73 74 65 0d 0a 75 73 65 0d 0a 67 6c 61 73 73 0d 0a 66 6c 6f 77 65 72 0d 0a 72 69 76 65 72 0d 0a 6e 6f 72 74 68 0d 0a 6c 6f 6e 67 0d 0a 6a 75 6d 70 0d 0a 67 61 6d 65 0d 0a 73 Data Ascii: dcarquietkeyviewaceshortseahigharrowdaymachinequietmusiccamerawaterneedpenquietdeerkindmusicduckbankzombieclipkindincomesevensunxylemtasteuseglassflowerrivernorthlongjumpgames
2023-08-29 05:50:55 UTC	911	IN	Data Raw: 6b 65 79 0d 0a 6c 75 6e 63 68 0d 0a 69 6e 6b 0d 0a 6f 72 64 65 72 0d 0a 64 61 74 61 0d 0a 70 65 6e 0d 0a 67 6c 61 73 73 0d 0a 73 75 6e 0d 0a 70 69 6e 6b 0d 0a 77 68 69 74 65 0d 0a 73 6b 79 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 62 61 6c 6c 0d 0a 67 72 65 65 6e 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 76 69 64 65 6f 0d 0a 6b 69 64 0d 0a 71 75 69 65 74 0d 0a 67 6f 61 74 0d 0a 6f 66 66 69 63 65 0d 0a 68 65 61 64 0d 0a 71 75 69 63 6b 0d 0a 61 70 70 6c 65 0d 0a 73 6b 79 0d 0a 75 6e 69 74 0d 0a 6e 75 6d 62 65 72 0d 0a 78 79 6c 65 6d 0d 0a 7a 6f 6e 65 0d 0a 73 6e 61 6b 65 0d 0a 76 69 64 65 6f 0d 0a 73 75 6e 0d 0a 6f 66 66 69 63 65 0d 0a 6f 69 6c 0d 0a 74 72 65 65 0d 0a 67 61 6d 65 0d 0a 75 6e 69 74 0d 0a 6a 6f 79 0d 0a 67 6c 61 73 73 0d 0a 7a 65 72 6f 0d 0a 6e 65 65 Data Ascii: keylunchinkorderdatapenglasssunpinkwhiteskyvacationballgreenyesterdayvideokidquietgoatofficeheadquickappleskyunitnumberxylemzonesnakevideosunofficeoiltreegameunitjoyglasszeronee
2023-08-29 05:50:55 UTC	927	IN	Data Raw: 65 0d 0a 63 6f 77 0d 0a 69 6e 6b 0d 0a 6a 75 64 67 65 0d 0a 6e 61 6d 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 77 65 65 6b 0d 0a 73 75 6e 0d 0a 6b 65 65 70 0d 0a 63 6f 61 74 0d 0a 79 65 61 72 6e 0d 0a 77 69 6e 64 0d 0a 66 69 73 68 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 65 69 67 68 74 0d 0a 66 69 73 68 0d 0a 65 61 72 0d 0a 6f 62 6a 65 63 74 0d 0a 63 68 61 72 0d 0a 67 72 65 65 6e 0d 0a 76 6f 69 63 65 0d 0a 64 65 73 6b 0d 0a 64 6f 67 0d 0a 62 61 6e 61 6e 61 0d 0a 66 61 74 68 65 72 0d 0a 67 72 6f 75 70 0d 0a 70 61 70 65 72 0d 0a 6c 61 6b 65 0d 0a 74 61 6c 6b 0d 0a 71 75 61 6c 69 74 79 0d 0a 79 65 61 72 0d 0a 64 61 72 6b 0d 0a 6b 69 64 0d 0a 66 6f 6f 74 0d 0a 68 61 69 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 79 65 73 0d 0a 6d 6f 6f 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a Data Ascii: ecowinkjudgenamequalifyweeksunkeepcoatyearnwindfishundergroundeightfishearobjectchargreenvoicedeskdogbananafathergrouppaperlaketalkqualityyeardarkkidfoothairmachineyesmoonzombie
2023-08-29 05:50:55 UTC	943	IN	Data Raw: 68 0d 0a 74 61 6c 6b 0d 0a 6b 69 74 65 0d 0a 71 75 65 65 6e 0d 0a 69 6e 73 69 64 65 0d 0a 75 6e 63 6c 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 79 65 6c 6c 6f 77 0d 0a 66 61 63 65 0d 0a 61 69 72 0d 0a 72 65 73 74 0d 0a 6e 61 6d 65 0d 0a 6e 61 6d 65 0d 0a 77 65 73 74 0d 0a 64 61 72 6b 0d 0a 63 6c 69 70 0d 0a 65 6e 65 72 67 79 0d 0a 73 6f 6e 67 0d 0a 6f 70 65 6e 0d 0a 65 79 65 0d 0a 64 61 6e 63 65 0d 0a 74 69 67 65 72 0d 0a 61 72 74 0d 0a 70 6f 77 65 72 0d 0a 62 6c 75 65 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 76 69 63 74 6f 72 79 0d 0a 63 68 61 72 0d 0a 64 75 63 6b 0d 0a 62 75 73 0d 0a 6d 65 61 6c 0d 0a 6c 69 66 65 0d 0a 76 69 63 74 6f 72 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 63 61 6d 65 72 61 0d 0a 70 65 72 73 6f 6e 0d 0a 72 65 64 0d 0a 65 61 74 0d 0a 62 Data Ascii: htalkkitequeeninsideunclequalifyyellowfaceairrestnamenamewestdarkclipenergysongopeneyedancetigerartpowerbluevegetablevictorycharduckbusmeallifevictoryuniversitycamerapersonredeatb
2023-08-29 05:50:55 UTC	959	IN	Data Raw: 73 65 61 0d 0a 75 6e 63 6c 65 0d 0a 76 69 65 77 0d 0a 6b 69 63 6b 0d 0a 73 75 67 61 72 0d 0a 71 75 69 63 6b 0d 0a 6c 61 6b 65 0d 0a 65 61 72 0d 0a 62 65 61 63 68 0d 0a 63 61 6b 65 0d 0a 77 61 72 6e 0d 0a 62 6f 6f 6b 0d 0a 69 63 6f 6e 0d 0a 66 72 69 65 6e 64 0d 0a 72 6f 63 6b 0d 0a 79 61 77 6e 0d 0a 79 61 77 6e 0d 0a 73 74 61 72 0d 0a 72 6f 63 6b 0d 0a 76 69 65 77 0d 0a 61 72 72 6f 77 0d 0a 65 6e 65 72 67 79 0d 0a 6a 75 64 67 65 0d 0a 75 6e 63 6c 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 70 6f 77 65 72 0d 0a 6d 6f 76 69 65 0d 0a 72 69 73 65 0d 0a 73 74 72 69 6e 67 0d 0a 72 75 6e 0d 0a 72 65 73 74 0d 0a 66 75 6e 63 0d 0a 62 6f 6f 6b 0d 0a 65 72 72 6f 72 0d 0a 68 69 74 0d 0a 76 69 65 77 0d 0a 66 61 74 68 65 72 0d 0a 6a 65 6c 6c 79 0d 0a 79 65 6c 6c 6f 77 Data Ascii: seauncleviewkicksugarquicklakeearbeachcakewarnbookiconfriendrockyawnyawnstarrockviewarrowenergyjudgeuncleuniversitypowermovierisestringrunrestfuncbookerrorhitviewfatherjellyyellow
2023-08-29 05:50:55 UTC	975	IN	Data Raw: 6f 69 6c 0d 0a 67 6f 6c 64 0d 0a 75 72 67 65 0d 0a 61 6e 74 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 77 6f 72 6b 0d 0a 67 6f 61 74 0d 0a 65 67 67 0d 0a 68 6f 75 73 65 Data Ascii: oilgoldurgeantKanthanworkgoategghouse
2023-08-29 05:50:55 UTC	975	IN	Data Raw: 0d 0a 73 74 72 69 6e 67 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 66 61 6c 6c 0d 0a 66 6c 6f 77 65 72 0d 0a 71 75 6f 74 65 0d 0a 6e 6f 72 74 68 0d 0a 6b 69 74 63 68 65 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 67 6f 6c 64 0d 0a 63 6c 6f 75 64 0d 0a 63 6f 77 0d 0a 66 61 72 6d 0d 0a 6b 65 79 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 61 72 72 61 79 0d 0a 70 69 63 74 75 72 65 0d 0a 64 61 6e 63 65 0d 0a 74 72 61 69 6e 0d 0a 6a 61 72 0d 0a 66 61 6c 6c 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6f 66 66 65 72 0d 0a 73 68 6f 72 74 0d 0a 69 64 65 61 0d 0a 69 6e 6b 0d 0a 6a 61 72 0d 0a 6c 65 74 74 65 72 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 64 61 74 61 0d 0a 64 72 65 61 6d 0d 0a 65 67 67 0d 0a 77 6f 6d 61 6e 0d 0a 69 63 65 0d 0a 6f 63 65 61 6e 0d 0a 64 61 6e 63 65 0d 0a 6d 6f 6e 6b Data Ascii: stringuniversityfallflowerquotenorthkitchenschoolgoldcloudcowfarmkeyunderstandarraypicturedancetrainjarfallusuallyoffershortideainkjarletteryesterdaydatadreameggwomaniceoceandancemonk
2023-08-29 05:50:55 UTC	983	IN	Data Raw: 72 6f 6f 6d 0d 0a 67 72 61 73 73 0d 0a 73 65 61 0d 0a 64 61 72 6b 0d 0a 66 75 6e 63 0d 0a 77 69 6e 64 0d 0a 6c 61 6d 70 0d 0a 6f 72 64 65 72 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6f 69 6c 0d 0a 63 68 61 72 0d 0a 73 6e 61 6b 65 0d 0a 6b 69 63 6b 0d 0a 6a 75 64 67 65 0d 0a 76 61 6e 0d 0a 72 69 73 65 0d 0a 72 65 73 74 0d 0a 74 6f 77 6e 0d 0a 73 65 61 0d 0a 6f 66 66 65 72 0d 0a 6b 69 6e 67 0d 0a 6b 69 64 0d 0a 68 61 6e 64 0d 0a 61 6e 74 0d 0a 7a 65 61 6c 0d 0a 65 6e 65 72 67 79 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 70 69 63 74 75 72 65 0d 0a 6f 70 65 6e 0d 0a 6b 69 6e 67 0d 0a 79 6f 75 6e 67 0d 0a 77 61 72 6e 0d 0a 74 69 6d 65 0d 0a 70 65 61 72 0d 0a 75 6e 63 6c 65 0d 0a 72 61 62 62 69 74 0d 0a 79 61 72 64 0d 0a 66 61 74 68 65 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6c Data Ascii: roomgrassseadarkfuncwindlamporderjourneyoilcharsnakekickjudgevanriseresttownseaofferkingkidhandantzealenergyunsignedpictureopenkingyoungwarntimepearunclerabbityardfatherKanthanl
2023-08-29 05:50:55 UTC	991	IN	Data Raw: 74 0d 0a 73 6e 6f 77 0d 0a 70 68 6f 6e 65 0d 0a 63 6f 6c 6f 72 0d 0a 7a 65 72 6f 0d 0a 73 75 6e 0d 0a 6c 61 6b 65 0d 0a 71 75 6f 74 65 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6e 61 6d 65 0d 0a 67 68 6f 73 74 0d 0a 69 6e 6b 0d 0a 70 65 72 73 6f 6e 0d 0a 72 69 76 65 72 0d 0a 65 61 72 74 68 0d 0a 65 61 72 0d 0a 72 6f 6f 6d 0d 0a 63 61 6d 65 72 61 0d 0a 62 75 73 0d 0a 70 69 7a 7a 61 0d 0a 74 65 61 63 68 65 72 0d 0a 77 69 6e 64 0d 0a 64 61 79 0d 0a 66 75 6e 63 0d 0a 68 69 67 68 0d 0a 6f 69 6c 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 65 6e 64 0d 0a 61 63 65 0d 0a 70 68 6f 6e 65 0d 0a 6b 69 74 63 68 65 6e 0d 0a 64 72 65 61 6d 0d 0a 72 69 73 65 0d 0a 6c 61 6e 64 0d 0a 6f 63 65 61 6e 0d 0a 63 61 6b 65 0d 0a 6f 66 66 65 72 0d 0a 67 6f 61 74 0d 0a 74 72 65 65 0d 0a 72 65 Data Ascii: tsnowphonecolorzerosunlakequoteusuallynameghostinkpersonriverearthearroomcamerabuspizzateacherwinddayfunchighoilunderstandendacephonekitchendreamriselandoceancakeoffergoattreere
2023-08-29 05:50:55 UTC	1007	IN	Data Raw: 69 67 68 74 0d 0a 70 69 7a 7a 61 0d 0a 66 6f 6f 74 0d 0a 77 65 73 74 0d 0a 74 69 67 65 72 0d 0a 6e 61 6d 65 0d 0a 64 65 65 72 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 63 61 74 0d 0a 66 61 63 65 0d 0a 61 72 72 61 79 0d 0a 72 65 73 74 0d 0a 6d 61 6e 0d 0a 6a 61 72 0d 0a 62 6f 6f 6b 0d 0a 6f 72 61 6e 67 65 0d 0a 64 72 65 61 6d 0d 0a 62 6f 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 64 65 73 6b 0d 0a 6e 61 74 75 72 65 0d 0a 68 61 69 72 0d 0a 72 65 64 0d 0a 79 61 72 64 0d 0a 74 69 67 65 72 0d 0a 61 6c 6f 6e 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 73 74 72 69 6e 67 0d 0a 69 73 6c 61 6e 64 0d 0a 6a 61 76 61 0d 0a 70 65 72 73 6f 6e 0d 0a 6e 61 6d 65 0d 0a 67 6f 61 74 0d 0a 69 6e 73 69 64 65 0d 0a 65 67 67 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 6d 65 61 6c 0d 0a Data Ascii: ightpizzafootwesttigernamedeervegetablecatfacearrayrestmanjarbookorangedreamboyuniversitydesknaturehairredyardtigeraloneuniversitystringislandjavapersonnamegoatinsideeggvacationmeal
2023-08-29 05:50:55 UTC	1023	IN	Data Raw: 61 63 68 69 6e 65 0d 0a 72 6f 6f 6d 0d 0a 6b 69 6e 64 0d 0a 6e 6f 72 74 68 0d 0a 6a 61 63 6b 65 74 0d 0a 69 73 6c 61 6e 64 0d 0a 65 61 72 0d 0a 67 6f 61 74 0d 0a 6c 75 6e 63 68 0d 0a 6d 6f 6f 6e 0d 0a 6f 62 6a 65 63 74 0d 0a 6c 75 6e 63 68 0d 0a 6c 6f 6e 67 0d 0a 76 6f 69 63 65 0d 0a 62 69 72 64 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 65 72 72 6f 72 0d 0a 72 69 76 65 72 0d 0a 64 61 79 0d 0a 72 75 6e 0d 0a 6c 75 6e 63 68 0d 0a 68 69 67 68 0d 0a 72 6f 61 64 0d 0a 63 6f 6c 6f 72 0d 0a 61 77 61 72 64 0d 0a 77 65 73 74 0d 0a 61 63 65 0d 0a 69 64 65 61 0d 0a 6c 61 75 67 68 0d 0a 66 61 63 65 0d 0a 65 69 67 68 74 0d 0a 73 6e 61 6b 65 0d 0a 7a 65 62 72 61 0d 0a 64 61 74 61 0d 0a 72 75 6e 0d 0a 62 61 6e 6b 0d 0a 6b 69 73 73 0d 0a 73 75 67 61 72 0d 0a 73 74 72 69 6e 67 0d Data Ascii: achineroomkindnorthjacketislandeargoatlunchmoonobjectlunchlongvoicebirdKanthanerrorriverdayrunlunchhighroadcolorawardwestaceidealaughfaceeightsnakezebradatarunbankkisssugarstring
2023-08-29 05:50:55 UTC	1039	IN	Data Raw: 6e 61 6b 65 0d 0a 6a 61 76 61 0d 0a 66 6c 6f 77 65 72 0d 0a 76 69 63 74 6f 72 79 0d 0a 6e 75 6d 62 65 72 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 62 6f 78 0d 0a 6c 65 74 74 65 72 0d 0a 6f 62 6a 65 63 74 0d 0a 73 75 67 61 72 0d 0a 62 69 72 64 0d 0a 69 6e 74 0d 0a 6b 69 73 73 0d 0a 69 63 6f 6e 0d 0a 6b 69 6e 64 0d 0a 67 72 6f 75 70 0d 0a 65 72 72 6f 72 0d 0a 66 61 74 68 65 72 0d 0a 66 61 63 65 0d 0a 6f 66 66 65 72 0d 0a 6a 75 64 67 65 0d 0a 65 6e 64 0d 0a 64 61 72 6b 0d 0a 70 61 70 65 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 70 69 6e 6b 0d 0a 6d 75 73 69 63 0d 0a 69 6e 63 6f 6d 65 0d 0a 77 69 6e 74 65 72 0d 0a 79 65 61 72 6e 0d 0a 6d 65 6e 74 0d 0a 70 68 6f 6e 65 0d 0a 65 6e 64 0d 0a 71 75 65 65 6e 0d 0a 63 6f 77 0d 0a 61 72 72 6f 77 0d 0a 68 65 61 64 0d 0a 78 Data Ascii: nakejavaflowervictorynumberunderstandboxletterobjectsugarbirdintkissiconkindgrouperrorfatherfaceofferjudgeenddarkpaperKanthanpinkmusicincomewinteryearnmentphoneendqueencowarrowheadx
2023-08-29 05:50:55 UTC	1055	IN	Data Raw: 72 0d 0a 67 69 72 6c 0d 0a 75 6e 69 74 0d 0a 63 61 6d 65 72 61 0d 0a 69 6e 6b 0d 0a 61 6e 74 0d 0a 77 61 74 65 72 0d 0a 6c 61 6b 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 67 75 65 73 74 0d 0a 64 61 72 6b 0d 0a 70 65 72 73 6f 6e 0d 0a 6e 6f 74 65 0d 0a 6f 66 66 65 72 0d 0a 61 72 72 61 79 0d 0a 73 63 68 6f 6f 6c 0d 0a 71 75 69 63 6b 0d 0a 73 6f 6e 67 0d 0a 6d 6f 76 69 65 0d 0a 77 68 69 6c 65 0d 0a 6c 61 6e 64 0d 0a 72 65 73 74 0d 0a 61 72 72 61 79 0d 0a 77 6f 6d 61 6e 0d 0a 75 6e 63 6c 65 0d 0a 70 69 7a 7a 61 0d 0a 66 61 6c 6c 0d 0a 79 65 6c 6c 6f 77 0d 0a 72 61 62 62 69 74 0d 0a 67 6f 61 74 0d 0a 71 75 69 63 6b 0d 0a 65 6e 64 0d 0a 73 63 68 6f 6f 6c 0d 0a 6a 61 76 61 0d 0a 62 65 61 63 68 0d 0a 77 69 6e 64 0d 0a 6a 6f 75 72 6e 65 Data Ascii: rgirlunitcamerainkantwaterlakequalifyyesterdayguestdarkpersonnoteofferarrayschoolquicksongmoviewhilelandrestarraywomanunclepizzafallyellowrabbitgoatquickendschooljavabeachwindjourne
2023-08-29 05:50:55 UTC	1071	IN	Data Raw: 68 74 0d 0a 73 68 6f 72 74 0d 0a 77 61 79 0d 0a 6c 69 66 65 0d 0a 69 6e 6b 0d 0a 71 75 6f 74 65 0d 0a 6c 69 6f 6e 0d 0a 61 6e 69 6d 61 6c 0d 0a 67 6f 61 74 0d 0a 65 64 67 65 0d 0a 66 61 63 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 64 6f 0d 0a 69 6e 63 6f 6d 65 0d 0a 7a 65 62 72 61 0d 0a 77 65 73 74 0d 0a 79 6f 75 6e 67 0d 0a 6c 65 74 74 65 72 0d 0a 74 72 65 65 0d 0a 6c 6f 6e 67 0d 0a 61 72 72 61 79 0d 0a 67 6c 61 73 73 0d 0a 67 61 6d 65 0d 0a 79 61 77 6e 0d 0a 61 72 72 61 79 0d 0a 67 6f 61 74 0d 0a 64 6f 6f 72 0d 0a 66 61 6c 6c 0d 0a 65 72 72 6f 72 0d 0a 61 70 70 6c 65 0d 0a 6f 72 64 65 72 0d 0a 64 75 63 6b 0d 0a 6a 75 6d 70 0d 0a 74 65 73 74 0d 0a 76 6f 69 63 65 0d 0a 6e 6f 74 65 0d 0a 66 75 6e 63 0d 0a 61 69 72 0d 0a 77 69 6e 64 0d 0a 74 65 61 63 68 65 Data Ascii: htshortwaylifeinkquotelionanimalgoatedgefaceknowledgedoincomezebrawestyounglettertreelongarrayglassgameyawnarraygoatdoorfallerrorappleorderduckjumptestvoicenotefuncairwindteache
2023-08-29 05:50:55 UTC	1087	IN	Data Raw: 75 65 0d 0a 6c 61 6d 70 0d 0a 6e 61 74 75 72 65 0d 0a 62 65 61 63 68 0d 0a 64 61 6e 63 65 0d 0a 77 68 69 74 65 0d 0a 63 6c 6f 75 64 0d 0a 71 75 61 6c 69 74 79 0d 0a 6c 69 66 65 0d 0a 6f 72 61 6e 67 65 0d 0a 77 65 73 74 0d 0a 66 69 73 68 0d 0a 6a 6f 6b 65 0d 0a 6c 6f 6e 67 0d 0a 67 72 6f 75 70 0d 0a 62 75 73 0d 0a 61 6e 74 0d 0a 76 69 64 65 6f 0d 0a 63 6c 6f 75 64 0d 0a 6a 75 6d 70 0d 0a 62 6c 75 65 0d 0a 6b 69 64 0d 0a 65 69 67 68 74 0d 0a 67 61 6d 65 0d 0a 63 6c 69 70 0d 0a 66 69 73 68 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6d 6f 6f 6e 0d 0a 6c 61 6d 70 0d 0a 77 61 74 65 72 0d 0a 6b 69 6e 64 0d 0a 6e 61 6d 65 0d 0a 64 72 65 61 6d 0d 0a 73 74 6f 6e 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 76 61 6e 0d 0a 67 6f 61 74 0d 0a 67 72 61 73 73 0d 0a 62 6f Data Ascii: uelampnaturebeachdancewhitecloudqualitylifeorangewestfishjokelonggroupbusantvideocloudjumpbluekideightgameclipfishuniversitymoonlampwaterkindnamedreamstoneunderstandvangoatgrassbo
2023-08-29 05:50:55 UTC	1103	IN	Data Raw: 65 0d 0a 6e 61 6d 65 0d 0a 66 75 6e 63 0d 0a 64 6f 6f 72 0d 0a 61 69 72 0d 0a 6d 61 6e 0d 0a 6a 61 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 78 79 6c 65 6d 0d 0a 65 73 63 61 70 65 0d 0a 68 61 69 72 0d 0a 75 6e 63 6c 65 0d 0a 62 6f 79 0d 0a 6c 6f 76 65 0d 0a 77 68 69 6c 65 0d 0a 65 6e 65 72 67 79 0d 0a 7a 69 70 70 65 72 0d 0a 66 6f 72 0d 0a 77 61 79 0d 0a 75 73 75 61 6c 6c 79 0d 0a 79 6f 75 6e 67 0d 0a 72 61 62 62 69 74 0d 0a 67 6c 61 73 73 0d 0a 73 6b 79 0d 0a 63 61 72 0d 0a 67 6f 6c 64 0d 0a 77 68 69 74 65 0d 0a 6d 69 6c 6b 0d 0a 65 69 67 68 74 0d 0a 6b 69 63 6b 0d 0a 7a 6f 6f 0d 0a 74 6f 70 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 66 61 74 68 65 72 0d 0a 75 72 67 65 0d 0a 71 75 61 72 74 65 72 0d 0a 72 61 62 62 69 74 0d 0a 66 61 72 6d 0d 0a 62 61 6c 6c 0d Data Ascii: enamefuncdoorairmanjarmachinexylemescapehairuncleboylovewhileenergyzipperforwayusuallyyoungrabbitglassskycargoldwhitemilkeightkickzootopundergroundfatherurgequarterrabbitfarmball
2023-08-29 05:50:55 UTC	1119	IN	Data Raw: 0d 0a 69 6e 63 6f 6d 65 0d 0a 63 61 72 0d 0a 77 65 73 74 0d 0a 64 61 79 0d 0a 7a 65 61 6c 0d 0a 62 61 6e 61 6e 61 0d 0a 74 72 61 69 6e 0d 0a 61 77 61 72 64 0d 0a 66 6f 6f 64 0d 0a 64 61 79 0d 0a 67 68 6f 73 74 0d 0a 74 65 61 63 68 65 72 0d 0a 70 65 6e 0d 0a 62 65 61 63 68 0d 0a 69 63 65 0d 0a 64 61 72 6b 0d 0a 61 72 72 6f 77 0d 0a 74 61 73 74 65 0d 0a 61 69 72 0d 0a 71 75 69 65 74 0d 0a 6e 61 74 75 72 65 0d 0a 72 69 73 65 0d 0a 6c 61 75 67 68 0d 0a 70 65 72 73 6f 6e 0d 0a 77 61 79 0d 0a 62 6f 78 0d 0a 70 61 70 65 72 0d 0a 66 6f 6f 64 0d 0a 67 61 6d 65 0d 0a 73 74 72 69 6e 67 0d 0a 62 6c 75 65 0d 0a 6a 6f 6b 65 0d 0a 70 65 61 72 0d 0a 69 6e 6b 0d 0a 79 65 61 72 0d 0a 6b 65 65 70 0d 0a 74 72 65 65 0d 0a 67 6f 61 74 0d 0a 6c 6f 6e 67 0d 0a 66 61 6c 6c 0d 0a Data Ascii: incomecarwestdayzealbananatrainawardfooddayghostteacherpenbeachicedarkarrowtasteairquietnatureriselaughpersonwayboxpaperfoodgamestringbluejokepearinkyearkeeptreegoatlongfall
2023-08-29 05:50:55 UTC	1135	IN	Data Raw: 0a 79 65 73 74 65 72 64 61 79 0d 0a 73 74 72 69 6e 67 0d 0a 67 6f 61 74 0d 0a 65 61 72 74 68 0d 0a 73 74 72 69 6e 67 0d 0a 75 73 75 61 6c 6c 79 0d 0a 73 68 6f 72 74 0d 0a 65 64 67 65 0d 0a 64 6f 0d 0a 6a 61 76 61 0d 0a 79 61 77 6e 0d 0a 66 61 74 68 65 72 0d 0a 73 6e 61 6b 65 0d 0a 73 74 61 72 0d 0a 6d 6f 6f 6e 0d 0a 70 69 7a 7a 61 0d 0a 68 6f 70 65 0d 0a 65 69 67 68 74 0d 0a 65 61 74 0d 0a 77 69 6e 74 65 72 0d 0a 65 73 63 61 70 65 0d 0a 64 61 74 61 0d 0a 63 69 74 79 0d 0a 6e 6f 73 65 0d 0a 69 6e 6b 0d 0a 72 65 73 74 0d 0a 70 61 70 65 72 0d 0a 69 73 6c 61 6e 64 0d 0a 63 6c 69 70 0d 0a 68 65 6c 70 0d 0a 6a 61 63 6b 65 74 0d 0a 6e 6f 73 65 0d 0a 77 69 6e 64 0d 0a 76 69 63 74 6f 72 79 0d 0a 69 73 73 75 65 0d 0a 6d 61 63 68 69 6e 65 0d 0a 77 6f 72 6c 64 0d 0a Data Ascii: yesterdaystringgoatearthstringusuallyshortedgedojavayawnfathersnakestarmoonpizzahopeeighteatwinterescapedatacitynoseinkrestpaperislandcliphelpjacketnosewindvictoryissuemachineworld
2023-08-29 05:50:55 UTC	1151	IN	Data Raw: 79 0d 0a 69 63 65 0d 0a 70 61 70 65 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 70 65 6e 0d 0a 70 65 6e 0d 0a 64 61 72 6b 0d 0a 73 65 76 65 6e 0d 0a 74 6f 70 0d 0a 77 61 79 0d 0a 68 69 74 0d 0a 74 69 6d 65 0d 0a 64 61 79 0d 0a 61 6c 6f 6e 65 0d 0a 66 69 73 68 0d 0a 7a 65 61 6c 0d 0a 66 69 72 65 0d 0a 6f 66 66 69 63 65 0d 0a 70 6c 61 6e 74 0d 0a 62 61 6e 61 6e 61 0d 0a 6e 6f 74 65 0d 0a 64 61 72 6b 0d 0a 6b 69 63 6b 0d 0a 74 65 61 63 68 65 72 0d 0a 79 6f 75 6e 67 0d 0a 63 6c 6f 75 64 0d 0a 69 6e 73 69 64 65 0d 0a 63 61 72 0d 0a 68 65 61 72 74 0d 0a 66 61 74 68 65 72 0d 0a 69 6e 6b 0d 0a 73 74 61 72 0d 0a 64 65 73 6b 0d 0a 70 61 70 65 72 0d 0a 6b 69 74 65 0d 0a 62 61 6c 6c 0d 0a 70 69 7a 7a 61 0d 0a 76 69 63 74 6f 72 79 0d 0a 66 6c 6f 77 65 72 0d 0a 73 6f 6e Data Ascii: yicepaperknowledgepenpendarkseventopwayhittimedayalonefishzealfireofficeplantbanananotedarkkickteacheryoungcloudinsidecarheartfatherinkstardeskpaperkiteballpizzavictoryflowerson
2023-08-29 05:50:55 UTC	1167	IN	Data Raw: 6c 6f 72 0d 0a 69 64 65 61 0d 0a 65 64 67 65 0d 0a 6d 6f 6f 6e 0d 0a 67 72 61 73 73 0d 0a 6b 69 6e 67 0d 0a 68 61 6e 64 0d 0a 64 6f 6f 72 0d 0a 73 6b 79 0d 0a 6f 66 66 65 72 0d 0a 6d 69 6c 6b 0d 0a 7a 65 72 6f 0d 0a 77 6f 72 6b 0d 0a 75 73 65 0d 0a 72 69 73 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6a 65 6c 6c 79 0d 0a 6d 61 63 68 69 6e 65 0d 0a 66 61 72 6d 0d 0a 7a 6f 6e 65 0d 0a 79 6f 75 6e 67 0d 0a 64 65 65 72 0d 0a 76 69 73 69 74 6f 72 0d 0a 70 69 7a 7a 61 0d 0a 6d 75 73 69 63 0d 0a 74 69 67 65 72 0d 0a 77 69 6e 74 65 72 0d 0a 7a 65 61 6c 0d 0a 68 65 61 72 74 0d 0a 61 63 65 0d 0a 67 6f 6c 64 0d 0a 76 69 64 65 6f 0d 0a 67 6f 6c 64 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 76 69 63 74 6f 72 79 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 74 72 61 69 6e 0d 0a 6d Data Ascii: lorideaedgemoongrasskinghanddoorskyoffermilkzeroworkuseriseunderstandjellymachinefarmzoneyoungdeervisitorpizzamusictigerwinterzealheartacegoldvideogolduniversityvictoryjourneytrainm
2023-08-29 05:50:55 UTC	1183	IN	Data Raw: 0a 6f 72 61 6e 67 65 0d 0a 76 61 6c 75 65 0d 0a 65 61 74 0d 0a 68 6f 75 73 65 0d 0a 67 6f 6c 64 0d 0a 65 61 73 79 0d 0a 67 6f 6c 64 0d 0a 66 69 73 68 0d 0a 70 69 63 74 75 72 65 0d 0a 64 6f 6f 72 0d 0a 63 69 74 79 0d 0a 72 6f 61 64 0d 0a 66 6c 6f 77 65 72 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 6b 69 74 65 0d 0a 67 6f 6c 64 0d 0a 73 6e 6f 77 0d 0a 6c 61 6d 70 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 67 68 6f 73 74 0d 0a 6f 66 66 65 72 0d 0a 6b 69 64 0d 0a 6d 61 6e 0d 0a 76 61 6c 75 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 64 6f 0d 0a 6f 62 6a 65 63 74 0d 0a 7a 6f 6d 62 69 65 0d 0a 73 6b 79 0d 0a 61 72 72 61 79 0d 0a 61 6e 74 0d 0a 70 69 6e 6b 0d 0a 6f 62 6a 65 63 74 0d 0a 76 69 73 69 74 6f 72 0d 0a 6f 6e 65 0d 0a 6f 66 66 65 72 0d 0a 66 6f 72 0d 0a 71 75 61 6c 69 66 79 Data Ascii: orangevalueeathousegoldeasygoldfishpicturedoorcityroadfloweryesterdaykitegoldsnowlampunsignedghostofferkidmanvaluemonkeydoobjectzombieskyarrayantpinkobjectvisitoroneofferforqualify
2023-08-29 05:50:55 UTC	1199	IN	Data Raw: 65 64 67 65 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 71 75 61 6c 69 66 79 0d 0a 69 6e 63 6f 6d 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 76 69 73 69 74 6f 72 0d 0a 75 73 65 0d 0a 69 6e 74 0d 0a 70 69 6e 6b 0d 0a 73 75 6e 0d 0a 6a 75 64 67 65 0d 0a 72 6f 63 6b 0d 0a 79 6f 75 6e 67 0d 0a 64 65 65 72 0d 0a 6b 69 6e 64 0d 0a 77 69 6e 64 0d 0a 67 72 61 73 73 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6f 70 65 6e 0d 0a 72 69 73 65 0d 0a 63 6f 77 0d 0a 6b 65 65 70 0d 0a 63 61 74 0d 0a 6a 61 72 0d 0a 6f 72 64 65 72 0d 0a 61 63 65 0d 0a 65 61 74 0d 0a 68 61 69 72 0d 0a 72 65 64 0d 0a 79 6f 75 6e 67 0d 0a 6c 69 6f 6e 0d 0a 7a 65 72 6f 0d 0a 68 61 74 0d 0a 65 69 67 68 74 0d 0a 67 68 6f 73 74 0d 0a 63 61 6d 65 72 61 0d 0a 65 64 67 65 0d Data Ascii: edgeinformationinformationqualifyincomequantityvisitoruseintpinksunjudgerockyoungdeerkindwindgrassKanthanopenrisecowkeepcatjarorderaceeathairredyounglionzerohateightghostcameraedge
2023-08-29 05:50:55 UTC	1215	IN	Data Raw: 72 65 65 6e 0d 0a 77 68 69 6c 65 0d 0a 61 6e 69 6d 61 6c 0d 0a 75 6e 63 6c 65 0d 0a 62 6f 6f 6b 0d 0a 67 72 6f 75 70 0d 0a 63 69 74 79 0d 0a 73 74 72 69 6e 67 0d 0a 66 6f 72 0d 0a 68 6f 70 65 0d 0a 70 65 72 73 6f 6e 0d 0a 79 65 61 72 0d 0a 63 61 74 0d 0a 74 72 65 65 0d 0a 68 61 69 72 0d 0a 73 65 76 65 6e 0d 0a 6a 61 63 6b 65 74 0d 0a 6a 6f 6b 65 0d 0a 70 69 7a 7a 61 0d 0a 62 65 61 63 68 0d 0a 79 61 77 6e 0d 0a 77 6f 6d 61 6e 0d 0a 72 61 69 6e 0d 0a 77 68 69 74 65 0d 0a 76 6f 69 63 65 0d 0a 62 75 73 0d 0a 76 69 64 65 6f 0d 0a 6d 6f 6e 6b 65 79 0d 0a 61 6e 74 0d 0a 74 61 6c 6b 0d 0a 73 75 67 61 72 0d 0a 6b 65 79 0d 0a 72 6f 63 6b 0d 0a 74 65 73 74 0d 0a 6b 69 74 65 0d 0a 6d 6f 74 68 65 72 0d 0a 77 68 69 6c 65 0d 0a 64 6f 0d 0a 70 69 6e 6b 0d 0a 77 69 6e 64 Data Ascii: reenwhileanimalunclebookgroupcitystringforhopepersonyearcattreehairsevenjacketjokepizzabeachyawnwomanrainwhitevoicebusvideomonkeyanttalksugarkeyrocktestkitemotherwhiledopinkwind
2023-08-29 05:50:55 UTC	1231	IN	Data Raw: 65 0d 0a 6e 6f 74 65 0d 0a 72 6f 6f 6d 0d 0a 61 77 61 72 64 0d 0a 6b 69 74 65 0d 0a 69 6e 74 0d 0a 64 61 74 61 0d 0a 7a 69 70 70 65 72 0d 0a 6f 69 6c 0d 0a 72 69 73 65 0d 0a 6a 65 6c 6c 79 0d 0a 79 65 61 72 0d 0a 6d 61 6e 0d 0a 6b 69 64 0d 0a 71 75 61 72 74 65 72 0d 0a 63 6f 61 74 0d 0a 67 6c 61 73 73 0d 0a 72 6f 6f 6d 0d 0a 6d 75 73 69 63 0d 0a 79 65 61 72 0d 0a 79 61 77 6e 0d 0a 63 61 6b 65 0d 0a 76 6f 69 63 65 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 77 6f 6d 61 6e 0d 0a 6d 61 6e 0d 0a 6d 61 6e 0d 0a 6c 6f 76 65 0d 0a 74 72 61 69 6e 0d 0a 72 65 64 0d 0a 63 6f 77 0d 0a 6f 62 6a 65 63 74 0d 0a 73 6f 6e 67 0d 0a 65 64 67 65 0d 0a 76 6f 69 63 65 0d 0a 78 79 6c 65 6d 0d 0a 74 6f 70 0d 0a 77 69 6e 64 0d 0a 72 69 73 65 0d 0a 70 61 70 65 72 0d 0a 68 65 61 72 74 0d 0a Data Ascii: enoteroomawardkiteintdatazipperoilrisejellyyearmankidquartercoatglassroommusicyearyawncakevoicejourneywomanmanmanlovetrainredcowobjectsongedgevoicexylemtopwindrisepaperheart
2023-08-29 05:50:55 UTC	1246	IN	Data Raw: 6f 6f 74 0d 0a 62 69 72 64 0d 0a 6a 6f 79 0d 0a 62 61 6c 6c 0d 0a 66 69 73 68 0d 0a 79 65 61 72 0d 0a 7a 69 70 70 65 72 0d 0a 66 61 74 68 65 72 0d 0a 72 75 6e 0d 0a 63 6c 69 70 0d 0a 71 75 61 72 74 65 72 0d 0a 62 6f 6f 6b 0d 0a 70 6c 61 6e 74 0d 0a 76 69 65 77 0d 0a 62 69 72 64 0d 0a 76 69 65 77 0d 0a 73 74 61 72 0d 0a 67 68 6f 73 74 0d 0a 61 6e 74 0d 0a 70 65 72 73 6f 6e 0d 0a 64 75 63 6b 0d 0a 64 65 65 72 0d 0a 6c 65 67 0d 0a 70 69 7a 7a 61 0d 0a 77 6f 72 6c 64 0d 0a 62 6f 78 0d 0a 68 65 6c 70 0d 0a 65 79 65 0d 0a 68 6f 75 73 65 0d 0a 64 75 63 6b 0d 0a 77 6f 6d 61 6e 0d 0a 6e 6f 73 65 0d 0a 6d 61 6e 0d 0a 7a 6f 6e 65 0d 0a 7a 69 70 70 65 72 0d 0a 61 69 72 0d 0a 64 61 6e 63 65 0d 0a 65 61 74 0d 0a 64 61 74 61 0d 0a 66 61 74 68 65 72 0d 0a 64 75 63 6b 0d Data Ascii: ootbirdjoyballfishyearzipperfatherrunclipquarterbookplantviewbirdviewstarghostantpersonduckdeerlegpizzaworldboxhelpeyehouseduckwomannosemanzonezipperairdanceeatdatafatherduck
2023-08-29 05:50:55 UTC	1262	IN	Data Raw: 61 63 65 0d 0a 69 73 6c 61 6e 64 0d 0a 66 61 72 6d 0d 0a 79 65 6c 6c 6f 77 0d 0a 72 6f 6f 6d 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 63 61 6d 65 72 61 0d 0a 61 70 70 6c 65 0d 0a 62 6c 75 65 0d 0a 6d 6f 76 69 65 0d 0a 64 61 79 0d 0a 6b 65 79 0d 0a 61 6c 6f 6e 65 0d 0a 6c 61 6e 64 0d 0a 73 65 76 65 6e 0d 0a 6e 65 65 64 0d 0a 69 6e 6b 0d 0a 67 72 61 73 73 0d 0a 74 61 6c 6b 0d 0a 65 6e 65 72 67 79 0d 0a 75 6e 63 6c 65 0d 0a 6a 61 63 6b 65 74 0d 0a 66 61 6c 6c 0d 0a 6f 66 66 65 72 0d 0a 72 61 62 62 69 74 0d 0a 70 6c 61 6e 74 0d 0a 6a 61 63 6b 65 74 0d 0a 6b 69 73 73 0d 0a 6e 75 6d 62 65 72 0d 0a 6f 62 6a 65 63 74 0d 0a 6d 61 70 0d 0a 77 6f 72 6b 0d 0a 6f 66 66 65 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 69 6e 6b 0d 0a 6b 69 74 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 Data Ascii: aceislandfarmyellowroomunderstandcameraapplebluemoviedaykeyalonelandsevenneedinkgrasstalkenergyunclejacketfallofferrabbitplantjacketkissnumberobjectmapworkofferincomeinkkiteunderstand
2023-08-29 05:50:55 UTC	1278	IN	Data Raw: 62 6f 78 0d 0a 64 61 74 61 0d 0a 69 73 73 75 65 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 69 73 73 75 65 0d 0a 73 75 6e 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6a 75 6d 70 0d 0a 75 73 65 0d 0a 6a 75 64 67 65 0d 0a 63 6f 77 0d 0a 70 68 6f 6e 65 0d 0a 6c 61 75 67 68 0d 0a 69 6e 63 6f 6d 65 0d 0a 73 75 67 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 69 6e 63 6f 6d 65 0d 0a 68 65 61 72 74 0d 0a 65 64 67 65 0d 0a 6d 6f 74 68 65 72 0d 0a 76 69 64 65 6f 0d 0a 65 79 65 0d 0a 6c 61 75 67 68 0d 0a 62 6c 75 65 0d 0a 68 69 74 0d 0a 72 69 76 65 72 0d 0a 6f 6e 65 0d 0a 77 61 74 65 72 0d 0a 6e 61 74 75 72 65 0d 0a 6b 69 64 0d 0a 6b 69 73 73 0d 0a 66 6c 6f 77 65 72 0d 0a 72 75 6e 0d 0a 6d 6f 74 68 65 72 0d 0a 66 6f 6f 64 0d 0a 67 75 65 73 74 0d 0a 65 79 65 0d 0a 6f 72 64 65 72 0d 0a 6d 65 6e Data Ascii: boxdataissuevacationissuesunjourneyjumpusejudgecowphonelaughincomesugarmonkeyincomeheartedgemothervideoeyelaughbluehitriveronewaternaturekidkissflowerrunmotherfoodguesteyeordermen
2023-08-29 05:50:55 UTC	1294	IN	Data Raw: 6f 6f 64 0d 0a 63 61 6d 65 72 61 0d 0a 62 6c 75 65 0d 0a 66 61 74 68 65 72 0d 0a 63 61 74 0d 0a 68 65 61 72 74 0d 0a 65 67 67 0d 0a 79 65 73 0d 0a 62 6f 6f 6b 0d 0a 68 61 6e 64 0d 0a 66 6c 6f 77 65 72 0d 0a 61 70 70 6c 65 0d 0a 6d 6f 6f 6e 0d 0a 74 6f 77 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 79 61 77 6e 0d 0a 6b 69 74 63 68 65 6e 0d 0a 78 79 6c 65 6d 0d 0a 6d 6f 74 68 65 72 0d 0a 79 65 61 72 6e 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 63 61 6d 65 72 61 0d 0a 62 75 73 0d 0a 65 79 65 0d 0a 6d 6f 74 68 65 72 0d 0a 64 61 6e 63 65 0d 0a 70 65 6e 0d 0a 6c 69 6f 6e 0d 0a 75 6e 69 74 0d 0a 74 6f 70 0d 0a 76 69 73 69 74 6f 72 0d 0a 75 72 67 65 0d 0a 64 61 74 61 0d 0a 6e 75 6d 62 65 72 0d 0a 6f 69 6c 0d 0a 66 6c 6f 77 65 72 0d 0a 72 6f 63 6b 0d 0a 7a 65 72 6f 0d 0a Data Ascii: oodcamerabluefathercathearteggyesbookhandflowerapplemoontownbananayawnkitchenxylemmotheryearnundergroundcamerabuseyemotherdancepenlionunittopvisitorurgedatanumberoilflowerrockzero
2023-08-29 05:50:55 UTC	1310	IN	Data Raw: 0d 0a 6b 69 74 65 0d 0a 77 6f 72 6c 64 0d 0a 66 61 63 65 0d 0a 77 65 73 74 0d 0a 65 61 73 74 0d 0a 77 6f 72 6c 64 0d 0a 79 61 72 64 0d 0a 6c 65 74 74 65 72 0d 0a 63 6c 69 70 0d 0a 74 72 61 69 6e 0d 0a 6e 75 6d 62 65 72 0d 0a 61 63 65 0d 0a 6a 65 6c 6c 79 0d 0a 65 61 74 0d 0a 67 6c 61 73 73 0d 0a 65 64 67 65 0d 0a 63 68 61 72 0d 0a 63 68 61 72 0d 0a 67 6f 6c 64 0d 0a 76 61 6e 0d 0a 6b 69 74 63 68 65 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 6b 69 6e 64 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 77 68 69 6c 65 0d 0a 66 69 72 65 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 68 69 74 0d 0a 6e 6f 72 74 68 0d 0a 69 63 65 0d 0a 65 6e 64 0d 0a 7a 6f 6d 62 69 65 0d 0a 61 72 74 0d 0a 69 63 65 0d 0a 74 6f 70 0d 0a 70 68 6f 6e 65 0d 0a 73 6f 6e 67 0d 0a 63 6c 6f 75 64 0d 0a 61 72 63 68 Data Ascii: kiteworldfacewesteastworldyardlettercliptrainnumberacejellyeatglassedgecharchargoldvankitchenpersonkindknowledgewhilefirevegetablehitnorthiceendzombiearticetopphonesongcloudarch
2023-08-29 05:50:55 UTC	1326	IN	Data Raw: 73 65 76 65 6e 0d 0a 72 61 62 62 69 74 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 66 6f 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 65 61 73 79 0d 0a 71 75 6f 74 65 0d 0a 66 75 6e 63 0d 0a 64 61 74 61 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 74 72 61 69 6e 0d 0a 66 61 72 6d 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 77 61 74 65 72 0d 0a 68 69 74 0d 0a 79 65 61 72 0d 0a 62 61 6e 6b 0d 0a 77 65 73 74 0d 0a 70 68 6f 6e 65 0d 0a 67 68 6f 73 74 0d 0a 66 6f 6f 64 0d 0a 63 61 6d 65 72 61 0d 0a 68 61 69 72 0d 0a 6c 6f 76 65 0d 0a 70 65 72 73 6f 6e 0d 0a 67 75 65 73 74 0d 0a 71 75 69 63 6b 0d 0a 6b 65 79 0d 0a 6b 69 73 73 0d 0a 6d 61 6e 0d 0a 70 65 6e 0d 0a 6a 6f 79 0d 0a 7a 6f 6f 0d 0a 6d 61 70 0d 0a 69 6e 6b 0d 0a 70 65 72 73 6f 6e 0d 0a 6c 65 Data Ascii: sevenrabbitvegetableforincomeeasyquotefuncdataknowledgetrainfarmyesterdayundergroundwaterhityearbankwestphoneghostfoodcamerahairlovepersonguestquickkeykissmanpenjoyzoomapinkpersonle
2023-08-29 05:50:55 UTC	1342	IN	Data Raw: 6d 65 0d 0a 74 61 73 74 65 0d 0a 6d 75 73 69 63 0d 0a 6f 63 65 61 6e 0d 0a 73 75 6e 0d 0a 63 6f 61 74 0d 0a 74 69 6d 65 0d 0a 79 61 77 6e 0d 0a 66 6f 6f 74 0d 0a 75 6e 63 6c 65 0d 0a 6c 61 6d 70 0d 0a 73 74 61 72 0d 0a 6f 72 64 65 72 0d 0a 67 72 61 73 73 0d 0a 6d 65 61 6c 0d 0a 70 65 61 72 0d 0a 62 6c 75 65 0d 0a 69 6e 74 0d 0a 6d 6f 74 68 65 72 0d 0a 65 61 72 0d 0a 62 61 6e 6b 0d 0a 79 6f 75 6e 67 0d 0a 77 61 79 0d 0a 79 61 77 6e 0d 0a 76 6f 69 63 65 0d 0a 77 68 69 6c 65 0d 0a 69 63 65 0d 0a 78 79 6c 65 6d 0d 0a 6e 75 6d 62 65 72 0d 0a 6c 69 6f 6e 0d 0a 64 6f 6f 72 0d 0a 72 61 62 62 69 74 0d 0a 63 68 61 72 0d 0a 75 73 65 0d 0a 62 6f 79 0d 0a 67 6f 6c 64 0d 0a 76 69 63 74 6f 72 79 0d 0a 70 6c 61 6e 74 0d 0a 6e 6f 74 65 0d 0a 74 72 65 65 0d 0a 62 6f 79 0d Data Ascii: metastemusicoceansuncoattimeyawnfootunclelampstarordergrassmealpearblueintmotherearbankyoungwayyawnvoicewhileicexylemnumberliondoorrabbitcharuseboygoldvictoryplantnotetreeboy
2023-08-29 05:50:55 UTC	1358	IN	Data Raw: 69 63 65 0d 0a 63 6f 61 74 0d 0a 67 6f 6c 64 0d 0a 65 61 72 0d 0a 72 6f 61 64 0d 0a 65 67 67 0d 0a 6c 61 75 67 68 0d 0a 6a 6f 79 0d 0a 6f 63 65 61 6e 0d 0a 62 6f 78 0d 0a 65 61 74 0d 0a 6c 65 67 0d 0a 65 61 73 74 0d 0a 75 6e 69 74 0d 0a 61 72 63 68 0d 0a 76 69 65 77 0d 0a 76 69 73 69 74 6f 72 0d 0a 74 72 61 69 6e 0d 0a 6b 69 6e 64 0d 0a 73 6e 61 6b 65 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6f 70 65 6e 0d 0a 67 72 6f 75 70 0d 0a 73 63 68 6f 6f 6c 0d 0a 76 61 6c 75 65 0d 0a 71 75 61 6c 69 74 79 0d 0a 70 68 6f 6e 65 0d 0a 6f 6e 65 0d 0a 67 75 65 73 74 0d 0a 6e 6f 72 74 68 0d 0a 68 65 61 72 74 0d 0a 61 69 72 0d 0a 6f 69 6c 0d 0a 65 6e 64 0d 0a 61 6c 6f 6e 65 0d 0a 72 69 73 65 0d 0a 6d 61 70 0d 0a 65 6e 64 0d 0a 75 6e 69 74 0d 0a 73 6f 6e 67 0d 0a 6d 69 6c 6b 0d 0a Data Ascii: icecoatgoldearroadegglaughjoyoceanboxeatlegeastunitarchviewvisitortrainkindsnakeusuallyopengroupschoolvaluequalityphoneoneguestnorthheartairoilendalonerisemapendunitsongmilk
2023-08-29 05:50:55 UTC	1374	IN	Data Raw: 6f 77 0d 0a 77 65 65 6b 0d 0a 74 69 67 65 72 0d 0a 61 6c 6f 6e 65 0d 0a 69 6e 74 0d 0a 68 65 6c 70 0d 0a 6f 72 64 65 72 0d 0a 72 61 62 62 69 74 0d 0a 70 65 61 72 0d 0a 61 69 72 0d 0a 61 72 74 0d 0a 65 6e 65 72 67 79 0d 0a 66 61 72 6d 0d 0a 69 73 73 75 65 0d 0a 71 75 61 72 74 65 72 0d 0a 67 61 6d 65 0d 0a 65 61 72 74 68 0d 0a 68 6f 70 65 0d 0a 75 73 65 0d 0a 62 6f 79 0d 0a 6f 70 65 6e 0d 0a 68 65 61 64 0d 0a 62 6c 75 65 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 67 69 72 6c 0d 0a 6b 69 74 65 0d 0a 63 61 72 0d 0a 6f 66 66 69 63 65 0d 0a 64 72 65 61 6d 0d 0a 70 69 6e 6b 0d 0a 75 73 75 61 6c 6c 79 0d 0a 65 73 63 61 70 65 0d 0a 75 6e 69 74 0d 0a 77 61 74 65 72 0d 0a 6e 65 65 64 0d 0a 78 79 6c 65 6d 0d 0a 61 69 72 0d 0a 68 6f 70 65 0d 0a 75 6e 64 65 72 67 72 6f 75 Data Ascii: owweektigeraloneinthelporderrabbitpearairartenergyfarmissuequartergameearthhopeuseboyopenheadbluevegetablegirlkitecarofficedreampinkusuallyescapeunitwaterneedxylemairhopeundergrou
2023-08-29 05:50:55 UTC	1390	IN	Data Raw: 69 73 69 74 6f 72 0d 0a 70 69 6e 6b 0d 0a 79 61 77 6e 0d 0a 64 6f 67 0d 0a 6b 69 74 65 0d 0a 66 61 6c 6c 0d 0a 6e 6f 72 74 68 0d 0a 76 69 65 77 0d 0a 7a 69 70 70 65 72 0d 0a 63 6f 6c 6f 72 0d 0a 73 74 61 72 0d 0a 64 65 73 6b 0d 0a 74 72 65 65 0d 0a 6c 65 74 74 65 72 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 69 6e 73 69 64 65 0d 0a 77 69 6e 74 65 72 0d 0a 75 73 75 61 6c 6c 79 0d 0a 76 6f 69 63 65 0d 0a 61 6e 74 0d 0a 7a 6f 6e 65 0d 0a 62 61 6c 6c 0d 0a 6f 63 65 61 6e 0d 0a 61 6e 69 6d 61 6c 0d 0a 76 61 6c 75 65 0d 0a 66 6c 6f 77 65 72 0d 0a 61 63 65 0d 0a 6c 69 6f 6e 0d 0a 6d 65 6e 74 0d 0a 63 68 61 72 0d 0a 6c 61 6b 65 0d 0a 7a 65 62 72 61 0d 0a 67 61 6d 65 0d 0a 6e 6f 73 65 0d 0a 6d 61 70 0d 0a 72 6f 61 64 0d 0a 6d 6f 76 69 65 0d 0a 6b 65 79 0d 0a 62 Data Ascii: isitorpinkyawndogkitefallnorthviewzippercolorstardesktreeletterundergroundinsidewinterusuallyvoiceantzoneballoceananimalvaluefloweracelionmentcharlakezebragamenosemaproadmoviekeyb
2023-08-29 05:50:55 UTC	1406	IN	Data Raw: 72 65 73 74 0d 0a 76 69 65 77 0d 0a 77 65 65 6b 0d 0a 72 61 62 62 69 74 0d 0a 62 61 6c 6c 0d 0a 6f 66 66 69 63 65 0d 0a 6b 69 63 6b 0d 0a 61 6e 69 6d 61 6c 0d 0a 6b 65 65 70 0d 0a 63 69 74 79 0d 0a 6e 6f 73 65 0d 0a 6c 61 6d 70 0d 0a 6a 75 6d 70 0d 0a 67 72 6f 75 70 0d 0a 67 72 61 73 73 0d 0a 72 75 6e 0d 0a 71 75 61 6c 69 74 79 0d 0a 61 72 74 0d 0a 65 61 73 79 0d 0a 65 61 72 0d 0a 76 6f 69 63 65 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 77 68 69 6c 65 0d 0a 62 6f 6f 6b 0d 0a 6e 6f 72 74 68 0d 0a 74 6f 70 0d 0a 77 6f 6d 61 6e 0d 0a 6c 61 6d 70 0d 0a 7a 6f 6d 62 69 65 0d 0a 63 6f 6c 6f 72 0d 0a 76 6f 69 63 65 0d 0a 63 6f 77 0d 0a 68 6f 75 73 65 0d 0a 73 75 6e 0d 0a 65 72 72 6f 72 0d 0a 6f 70 65 6e 0d 0a 70 65 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 6f 66 66 69 63 65 Data Ascii: restviewweekrabbitballofficekickanimalkeepcitynoselampjumpgroupgrassrunqualityarteasyearvoicequestionwhilebooknorthtopwomanlampzombiecolorvoicecowhousesunerroropenpearmonkeyoffice
2023-08-29 05:50:55 UTC	1422	IN	Data Raw: 0a 66 6c 6f 77 65 72 0d 0a 79 61 77 6e 0d 0a 6b 69 64 0d 0a 7a 6f 6f 0d 0a 6f 62 6a 65 63 74 0d 0a 73 6b 79 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6c 61 6d 70 0d 0a 6a 65 6c 6c 79 0d 0a 7a 69 70 70 65 72 0d 0a 66 61 72 6d 0d 0a 76 69 73 69 74 6f 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6c 61 6e 64 0d 0a 69 6e 6b 0d 0a 6f 66 66 69 63 65 0d 0a 74 65 61 63 68 65 72 0d 0a 66 61 74 68 65 72 0d 0a 6d 6f 6f 6e 0d 0a 65 73 63 61 70 65 0d 0a 70 65 72 73 6f 6e 0d 0a 69 6e 6b 0d 0a 6e 6f 74 65 0d 0a 62 6f 6f 6b 0d 0a 63 68 61 72 0d 0a 77 65 65 6b 0d 0a 6d 6f 76 69 65 0d 0a 6d 69 6c 6b 0d 0a 70 6c 61 6e 74 0d 0a 6e 75 6d 62 65 72 0d 0a 77 61 74 65 72 0d 0a 75 6e 69 74 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 6c 69 6f 6e 0d 0a 6e 65 65 64 0d 0a 64 61 74 61 0d 0a 65 6e 64 0d 0a 66 Data Ascii: floweryawnkidzooobjectskyquantitylampjellyzipperfarmvisitormachinelandinkofficeteacherfathermoonescapepersoninknotebookcharweekmoviemilkplantnumberwaterunitquestionlionneeddataendf
2023-08-29 05:50:55 UTC	1438	IN	Data Raw: 6e 6f 73 65 0d 0a 72 69 73 65 0d 0a 6d 61 70 0d 0a 71 75 61 72 74 65 72 0d 0a 61 77 61 72 64 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6b 69 74 65 0d 0a 67 6c 61 73 73 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 64 6f 6f 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 61 72 74 0d 0a 64 65 73 6b 0d 0a 7a 65 72 6f 0d 0a 6f 6e 65 0d 0a 73 65 76 65 6e 0d 0a 68 61 74 0d 0a 64 6f 6f 72 0d 0a 6f 72 64 65 72 0d 0a 64 6f 6f 72 0d 0a 6b 69 64 0d 0a 73 75 67 61 72 0d 0a 68 61 69 72 0d 0a 72 6f 63 6b 0d 0a 7a 65 62 72 61 0d 0a 6d 65 61 6c 0d 0a 6c 61 6e 64 0d 0a 6c 61 6b 65 0d 0a 68 6f 75 73 65 0d 0a 70 61 70 65 72 0d 0a 79 6f 75 6e 67 0d 0a 6c 65 67 0d 0a 74 69 6d 65 0d 0a 6b 65 79 0d 0a 6b 69 74 63 68 65 6e 0d 0a 66 6f 72 0d 0a 64 65 73 6b 0d 0a 6f 66 66 65 72 0d 0a 75 73 75 61 6c 6c Data Ascii: noserisemapquarterawarduniversitykiteglassjourneydoorunsignedartdeskzeroonesevenhatdoororderdoorkidsugarhairrockzebrameallandlakehousepaperyounglegtimekeykitchenfordeskofferusuall
2023-08-29 05:50:55 UTC	1454	IN	Data Raw: 66 66 69 63 65 0d 0a 68 69 74 0d 0a 6c 69 6f 6e 0d 0a 6f 66 66 69 63 65 0d 0a 64 61 79 0d 0a 68 69 74 0d 0a 7a 65 61 6c 0d 0a 74 72 65 65 0d 0a 6b 69 6e 64 0d 0a 7a 6f 6d 62 69 65 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 70 6c 61 6e 74 0d 0a 63 61 72 0d 0a 68 65 61 72 74 0d 0a 73 68 6f 72 74 0d 0a 7a 69 70 70 65 72 0d 0a 64 75 63 6b 0d 0a 63 61 6d 65 72 61 0d 0a 72 75 6e 0d 0a 71 75 69 65 74 0d 0a 70 6f 77 65 72 0d 0a 66 72 69 65 6e 64 0d 0a 6a 6f 6b 65 0d 0a 6c 75 6e 63 68 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 70 6f 77 65 72 0d 0a 6c 61 6d 70 0d 0a 66 61 72 6d 0d 0a 65 61 72 74 68 0d 0a 62 6f 79 0d 0a 67 72 65 65 6e 0d 0a 77 65 65 6b 0d 0a 74 72 65 65 0d 0a 61 72 72 6f 77 0d 0a 7a 65 61 6c 0d 0a 7a 6f 6d 62 69 65 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 67 68 6f 73 74 Data Ascii: fficehitlionofficedayhitzealtreekindzombievacationplantcarheartshortzipperduckcamerarunquietpowerfriendjokelunchunsignedpowerlampfarmearthboygreenweektreearrowzealzombieKanthanghost
2023-08-29 05:50:55 UTC	1470	IN	Data Raw: 0a 65 6e 64 0d 0a 68 61 69 72 0d 0a 6a 61 72 0d 0a 67 68 6f 73 74 0d 0a 72 6f 6f 6d 0d 0a 64 75 63 6b 0d 0a 66 6f 72 0d 0a 77 61 74 65 72 0d 0a 73 68 6f 72 74 0d 0a 79 65 73 0d 0a 6b 69 74 63 68 65 6e 0d 0a 67 6c 61 73 73 0d 0a 6f 72 64 65 72 0d 0a 70 6f 77 65 72 0d 0a 62 6f 6f 6b 0d 0a 66 6f 72 0d 0a 66 61 72 6d 0d 0a 71 75 6f 74 65 0d 0a 7a 69 70 70 65 72 0d 0a 6e 69 67 68 74 0d 0a 69 73 73 75 65 0d 0a 6f 62 6a 65 63 74 0d 0a 71 75 61 6c 69 74 79 0d 0a 6d 65 6e 74 0d 0a 64 6f 0d 0a 71 75 61 6c 69 74 79 0d 0a 73 74 61 72 0d 0a 73 65 76 65 6e 0d 0a 74 72 65 65 0d 0a 70 68 6f 6e 65 0d 0a 62 6f 78 0d 0a 77 61 72 6e 0d 0a 6d 6f 6f 6e 0d 0a 70 61 70 65 72 0d 0a 64 6f 0d 0a 69 64 65 61 0d 0a 74 72 61 69 6e 0d 0a 69 6e 6b 0d 0a 65 73 63 61 70 65 0d 0a 6b 6e 6f Data Ascii: endhairjarghostroomduckforwatershortyeskitchenglassorderpowerbookforfarmquotezippernightissueobjectqualitymentdoqualitystarseventreephoneboxwarnmoonpaperdoideatraininkescapekno
2023-08-29 05:50:55 UTC	1486	IN	Data Raw: 0d 0a 69 6e 6b 0d 0a 6f 62 6a 65 63 74 0d 0a 72 61 62 62 69 74 0d 0a 6b 65 65 70 0d 0a 62 61 6c 6c 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 6e 75 72 73 65 0d 0a 63 68 61 72 0d 0a 6c 69 66 65 0d 0a 64 6f 67 0d 0a 77 6f 6d 61 6e 0d 0a 66 69 72 65 0d 0a 65 6e 64 0d 0a 6a 61 76 61 0d 0a 6b 69 6e 64 0d 0a 6f 72 64 65 72 0d 0a 68 61 6e 64 0d 0a 64 65 73 6b 0d 0a 6d 75 73 69 63 0d 0a 79 65 6c 6c 6f 77 0d 0a 74 69 67 65 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 6c 75 6e 63 68 0d 0a 77 68 69 74 65 0d 0a 65 61 73 79 0d 0a 6d 75 73 69 63 0d 0a 6c 75 6e 63 68 0d 0a 76 69 73 69 74 6f 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 6d 6f 76 69 65 0d 0a 6b 69 63 6b 0d 0a 68 65 6c 70 0d 0a 63 6c 69 70 0d 0a 6d 69 6c 6b 0d 0a 70 61 70 65 72 0d 0a 6a 61 72 0d 0a 74 72 61 69 6e 0d 0a Data Ascii: inkobjectrabbitkeepballvacationnursecharlifedogwomanfireendjavakindorderhanddeskmusicyellowtigerknowledgelunchwhiteeasymusiclunchvisitorknowledgemoviekickhelpclipmilkpaperjartrain
2023-08-29 05:50:55 UTC	1502	IN	Data Raw: 69 67 6e 65 64 0d 0a 6f 66 66 69 63 65 0d 0a 6f 6e 65 0d 0a 70 65 6e 0d 0a 69 73 6c 61 6e 64 0d 0a 77 6f 72 6c 64 0d 0a 63 6f 61 74 0d 0a 61 70 70 6c 65 0d 0a 6e 61 74 75 72 65 0d 0a 66 69 73 68 0d 0a 76 69 65 77 0d 0a 72 69 76 65 72 0d 0a 6b 69 74 65 0d 0a 75 72 67 65 0d 0a 66 6f 6f 64 0d 0a 69 63 65 0d 0a 7a 6f 6f 0d 0a 72 69 76 65 72 0d 0a 69 63 65 0d 0a 73 74 6f 6e 65 0d 0a 63 61 72 0d 0a 62 6f 6f 6b 0d 0a 70 69 7a 7a 61 0d 0a 64 6f 6f 72 0d 0a 62 69 72 64 0d 0a 6b 69 64 0d 0a 77 65 73 74 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6b 69 6e 64 0d 0a 77 6f 72 6b 0d 0a 6f 62 6a 65 63 74 0d 0a 63 68 61 72 0d 0a 6d 61 6e 0d 0a 7a 69 70 70 65 72 0d 0a 63 6f 6c 6f 72 0d 0a 68 65 61 64 0d 0a 67 75 65 73 74 0d 0a 65 72 72 6f 72 0d 0a 6f 63 65 61 6e 0d 0a 6a 75 6d 70 0d Data Ascii: ignedofficeonepenislandworldcoatapplenaturefishviewriverkiteurgefoodicezoorivericestonecarbookpizzadoorbirdkidwestKanthankindworkobjectcharmanzippercolorheadguesterroroceanjump
2023-08-29 05:50:55 UTC	1518	IN	Data Raw: 66 61 63 65 0d 0a 70 68 6f 6e 65 0d 0a 7a 69 70 70 65 72 0d 0a 72 6f 63 6b 0d 0a 6d 6f 76 69 65 0d 0a 73 75 67 61 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 66 69 72 65 0d 0a 74 6f 77 6e 0d 0a 68 65 61 64 0d 0a 76 61 6c 75 65 0d 0a 6e 65 65 64 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 68 61 74 0d 0a 73 63 68 6f 6f 6c 0d 0a 6c 69 6f 6e 0d 0a 70 61 70 65 72 0d 0a 6b 69 73 73 0d 0a 6b 69 6e 67 0d 0a 6c 6f 6e 67 0d 0a 72 69 76 65 72 0d 0a 74 61 6c 6b 0d 0a 73 63 68 6f 6f 6c 0d 0a 74 6f 70 0d 0a 70 65 61 72 0d 0a 67 6f 61 74 0d 0a 62 6f 78 0d 0a 76 69 63 74 6f 72 79 0d 0a 74 61 73 74 65 0d 0a 63 61 74 0d 0a 73 74 72 69 6e 67 0d 0a 65 64 67 65 0d 0a 6d 69 6c 6b 0d 0a 6e 6f 74 65 0d 0a 66 61 6c 6c 0d 0a 7a 6f 6e 65 0d 0a 74 61 6c 6b 0d 0a 69 6e 73 69 64 65 0d 0a 71 75 61 6c Data Ascii: facephonezipperrockmoviesugarKanthanfiretownheadvalueneedquestionhatschoollionpaperkisskinglongrivertalkschooltoppeargoatboxvictorytastecatstringedgemilknotefallzonetalkinsidequal
2023-08-29 05:50:55 UTC	1534	IN	Data Raw: 73 73 0d 0a 65 61 74 0d 0a 65 61 72 0d 0a 7a 69 70 70 65 72 0d 0a 76 69 73 69 74 6f 72 0d 0a 66 69 72 65 0d 0a 6e 6f 72 74 68 0d 0a 6c 69 6f 6e 0d 0a 65 61 73 74 0d 0a 63 68 61 72 0d 0a 62 6f 78 0d 0a 66 6f 72 0d 0a 68 61 74 0d 0a 6f 72 64 65 72 0d 0a 67 72 61 73 73 0d 0a 67 61 6d 65 0d 0a 62 61 6e 61 6e 61 0d 0a 77 61 79 0d 0a 6e 75 72 73 65 0d 0a 66 61 63 65 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 65 61 72 0d 0a 72 6f 6f 6d 0d 0a 72 69 76 65 72 0d 0a 67 6c 61 73 73 0d 0a 69 64 65 61 0d 0a 66 6f 72 0d 0a 77 61 72 6e 0d 0a 6f 66 66 65 72 0d 0a 6a 6f 79 0d 0a 77 68 69 6c 65 0d 0a 71 75 61 72 74 65 72 0d 0a 62 61 6e 61 6e 61 0d 0a 72 6f 61 64 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 62 6f 6f 6b 0d 0a 75 72 67 65 0d 0a 75 6e 69 74 0d 0a 72 6f 61 64 0d 0a 78 79 Data Ascii: sseatearzippervisitorfirenorthlioneastcharboxforhatordergrassgamebananawaynursefaceyesterdayearroomriverglassideaforwarnofferjoywhilequarterbananaroadvegetablebookurgeunitroadxy
2023-08-29 05:50:55 UTC	1550	IN	Data Raw: 0a 66 6f 6f 74 0d 0a 72 6f 63 6b 0d 0a 67 75 65 73 74 0d 0a 63 6f 77 0d 0a 77 69 6e 74 65 72 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 65 61 72 0d 0a 68 65 61 64 0d 0a 6a 75 64 67 65 0d 0a 6e 75 72 73 65 0d 0a 65 64 67 65 0d 0a 65 69 67 68 74 0d 0a 66 69 72 65 0d 0a 77 65 65 6b 0d 0a 65 61 74 0d 0a 64 61 6e 63 65 0d 0a 79 65 61 72 0d 0a 6c 69 66 65 0d 0a 6d 6f 74 68 65 72 0d 0a 68 65 6c 70 0d 0a 71 75 61 6c 69 66 79 0d 0a 6b 69 74 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 64 61 6e 63 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 66 69 72 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 66 61 6c 6c 0d 0a 6b 69 74 65 0d 0a 77 65 73 74 0d 0a 74 61 73 74 65 0d 0a 6f 72 61 6e 67 65 0d 0a 6d 61 70 0d 0a 6f 62 6a 65 63 74 0d 0a 74 65 61 63 68 65 72 0d 0a 6b 69 74 65 0d 0a 65 61 72 Data Ascii: footrockguestcowwinteryesterdayearheadjudgenurseedgeeightfireweekeatdanceyearlifemotherhelpqualifykitequantitydanceunderstandfirevisitorfallkitewesttasteorangemapobjectteacherkiteear
2023-08-29 05:50:55 UTC	1566	IN	Data Raw: 75 70 0d 0a 6d 6f 74 68 65 72 0d 0a 6c 69 66 65 0d 0a 69 63 6f 6e 0d 0a 6f 72 61 6e 67 65 0d 0a 61 72 74 0d 0a 6f 6e 65 0d 0a 72 65 64 0d 0a 73 75 6e 0d 0a 6c 61 75 67 68 0d 0a 74 6f 77 6e 0d 0a 69 6e 73 69 64 65 0d 0a 69 63 6f 6e 0d 0a 79 61 77 6e 0d 0a 64 65 65 72 0d 0a 6b 69 6e 64 0d 0a 6e 6f 73 65 0d 0a 65 6e 64 0d 0a 6a 6f 79 0d 0a 67 6f 61 74 0d 0a 79 65 73 0d 0a 64 61 72 6b 0d 0a 69 6e 74 0d 0a 63 6c 69 70 0d 0a 61 6e 69 6d 61 6c 0d 0a 70 65 72 73 6f 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 62 6f 6f 6b 0d 0a 64 65 73 6b 0d 0a 76 61 6e 0d 0a 70 69 6e 6b 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6e 75 72 73 65 0d 0a 6e 6f 74 65 0d 0a 63 6c 69 70 0d 0a 61 77 61 72 64 0d 0a 64 75 63 6b 0d 0a 76 61 6c 75 65 0d 0a 76 61 6c 75 65 0d 0a 69 63 6f 6e 0d 0a 6a 6f 6b 65 0d Data Ascii: upmotherlifeiconorangeartoneredsunlaughtowninsideiconyawndeerkindnoseendjoygoatyesdarkintclipanimalpersonyellowbookdeskvanpinkunsignednursenoteclipawardduckvaluevalueiconjoke
2023-08-29 05:50:55 UTC	1582	IN	Data Raw: 64 65 61 0d 0a 67 75 65 73 74 0d 0a 6d 61 63 68 69 6e 65 0d 0a 62 61 6e 61 6e 61 0d 0a 69 64 65 61 0d 0a 67 6f 6c 64 0d 0a 6d 6f 74 68 65 72 0d 0a 79 61 77 6e 0d 0a 6f 66 66 65 72 0d 0a 71 75 69 63 6b 0d 0a 62 61 6c 6c 0d 0a 79 61 77 6e 0d 0a 62 6c 75 65 0d 0a 6e 65 65 64 0d 0a 79 6f 75 6e 67 0d 0a 6b 69 74 65 0d 0a 69 6e 74 0d 0a 6d 6f 6f 6e 0d 0a 70 69 7a 7a 61 0d 0a 79 65 6c 6c 6f 77 0d 0a 71 75 61 6c 69 66 79 0d 0a 6c 69 66 65 0d 0a 6e 6f 74 65 0d 0a 72 75 6e 0d 0a 6c 61 6e 64 0d 0a 62 6f 79 0d 0a 65 6e 65 72 67 79 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6e 75 6d 62 65 72 0d 0a 69 63 6f 6e 0d 0a 6f 63 65 61 6e 0d 0a 73 74 6f 6e 65 0d 0a 70 65 61 72 0d 0a 6e 75 72 73 65 0d 0a 67 6f 6c 64 0d 0a 66 61 74 68 65 72 0d 0a 6b 69 6e 64 0d 0a 6a 65 6c 6c 79 0d 0a 62 Data Ascii: deaguestmachinebananaideagoldmotheryawnofferquickballyawnblueneedyoungkiteintmoonpizzayellowqualifylifenoterunlandboyenergyjourneynumbericonoceanstonepearnursegoldfatherkindjellyb
2023-08-29 05:50:55 UTC	1598	IN	Data Raw: 0d 0a 75 6e 69 74 0d 0a 61 6e 74 0d 0a 7a 65 72 6f 0d 0a 6f 72 61 6e 67 65 0d 0a 69 73 73 75 65 0d 0a 69 6e 63 6f 6d 65 0d 0a 70 65 6e 0d 0a 6d 6f 6f 6e 0d 0a 61 6e 69 6d 61 6c 0d 0a 6e 75 6d 62 65 72 0d 0a 6d 61 70 0d 0a 63 6c 69 70 0d 0a 61 6c 6f 6e 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 75 72 67 65 0d 0a 64 61 6e 63 65 0d 0a 65 69 67 68 74 0d 0a 68 6f 70 65 0d 0a 67 72 6f 75 70 0d 0a 66 61 72 6d 0d 0a 66 6c 6f 77 65 72 0d 0a 64 61 79 0d 0a 67 6c 61 73 73 0d 0a 6f 6e 65 0d 0a 68 69 74 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 71 75 69 65 74 0d 0a 6d 69 6c 6b 0d 0a 66 61 74 68 65 72 0d 0a 72 69 76 65 72 0d 0a 6c 61 6d 70 0d 0a 6e 6f 72 74 68 0d 0a 70 61 70 65 72 0d 0a 72 65 64 0d 0a 6d 6f 6f 6e 0d 0a 6c 69 6f 6e 0d 0a 67 75 65 73 74 0d 0a 79 61 77 6e 0d 0a 64 61 Data Ascii: unitantzeroorangeissueincomepenmoonanimalnumbermapclipaloneyellowurgedanceeighthopegroupfarmflowerdayglassonehityesterdayquietmilkfatherriverlampnorthpaperredmoonlionguestyawnda
2023-08-29 05:50:55 UTC	1614	IN	Data Raw: 61 72 0d 0a 6a 65 6c 6c 79 0d 0a 6d 61 63 68 69 6e 65 0d 0a 63 6c 6f 75 64 0d 0a 73 75 67 61 72 0d 0a 62 61 6e 61 6e 61 0d 0a 73 75 67 61 72 0d 0a 73 74 61 72 0d 0a 77 6f 72 6b 0d 0a 67 72 61 73 73 0d 0a 75 73 75 61 6c 6c 79 0d 0a 61 72 72 6f 77 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 77 6f 6d 61 6e 0d 0a 74 6f 70 0d 0a 70 65 72 73 6f 6e 0d 0a 64 65 73 6b 0d 0a 64 6f 6f 72 0d 0a 7a 69 70 70 65 72 0d 0a 63 6f 6c 6f 72 0d 0a 62 61 6c 6c 0d 0a 73 74 6f 6e 65 0d 0a 6f 6e 65 0d 0a 6e 65 65 64 0d 0a 77 61 79 0d 0a 69 73 73 75 65 0d 0a 75 6e 63 6c 65 0d 0a 69 63 6f 6e 0d 0a 79 65 61 72 0d 0a 72 69 76 65 72 0d 0a 6f 6e 65 0d 0a 62 6f 78 0d 0a 6b 69 74 63 68 65 6e 0d 0a 63 61 74 0d 0a 77 6f 72 6b 0d 0a 68 65 61 72 74 0d 0a 73 6e 61 6b 65 0d 0a 67 72 65 65 6e Data Ascii: arjellymachinecloudsugarbananasugarstarworkgrassusuallyarrowinformationwomantoppersondeskdoorzippercolorballstoneoneneedwayissueuncleiconyearriveroneboxkitchencatworkheartsnakegreen
2023-08-29 05:50:55 UTC	1630	IN	Data Raw: 0a 77 69 6e 64 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 6c 65 74 74 65 72 0d 0a 67 75 65 73 74 0d 0a 77 65 73 74 0d 0a 79 65 61 72 0d 0a 66 61 6c 6c 0d 0a 76 61 6e 0d 0a 70 65 6e 0d 0a 6f 70 65 6e 0d 0a 73 6e 61 6b 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 7a 6f 6e 65 0d 0a 6f 66 66 65 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 65 6e 64 0d 0a 6a 6f 6b 65 0d 0a 69 63 65 0d 0a 77 61 72 6e 0d 0a 6a 61 63 6b 65 74 0d 0a 66 6f 6f 64 0d 0a 62 61 6e 61 6e 61 0d 0a 6e 75 72 73 65 0d 0a 64 61 79 0d 0a 6c 6f 76 65 0d 0a 65 72 72 6f 72 0d 0a 76 6f 69 63 65 0d 0a 70 65 6e 0d 0a 6d 61 6e 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 6c 69 66 65 0d 0a 65 61 72 0d 0a 73 75 6e 0d 0a 72 6f 61 64 0d 0a 63 61 72 0d 0a 6c 69 6f 6e 0d 0a 68 61 74 0d 0a 62 65 61 63 68 0d 0a 62 61 6c 6c 0d 0a 76 6f Data Ascii: windvegetableletterguestwestyearfallvanpenopensnakemonkeyzoneofferincomeendjokeicewarnjacketfoodbanananursedayloveerrorvoicepenmaninformationlifeearsunroadcarlionhatbeachballvo
2023-08-29 05:50:55 UTC	1646	IN	Data Raw: 73 6f 6e 0d 0a 63 68 61 72 0d 0a 73 6e 61 6b 65 0d 0a 6d 75 73 69 63 0d 0a 74 69 67 65 72 0d 0a 6f 70 65 6e 0d 0a 6f 66 66 69 63 65 0d 0a 63 61 74 0d 0a 6b 69 6e 67 0d 0a 72 69 73 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 67 75 65 73 74 0d 0a 74 6f 70 0d 0a 61 72 72 6f 77 0d 0a 64 6f 6f 72 0d 0a 72 65 64 0d 0a 76 69 73 69 74 6f 72 0d 0a 69 73 6c 61 6e 64 0d 0a 62 6f 79 0d 0a 76 61 6e 0d 0a 65 61 72 0d 0a 71 75 61 72 74 65 72 0d 0a 65 67 67 0d 0a 70 68 6f 6e 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 7a 6f 6d 62 69 65 0d 0a 79 65 61 72 6e 0d 0a 6c 6f 76 65 0d 0a 72 6f 61 64 0d 0a 6e 61 74 75 72 65 0d 0a 64 61 72 6b 0d 0a 6c 61 6e 64 0d 0a 6f 72 61 6e 67 65 0d 0a 67 72 65 65 6e 0d 0a 61 72 72 61 79 0d 0a 7a 65 72 6f 0d 0a 73 68 6f 72 74 0d 0a 61 69 72 0d 0a 79 65 Data Ascii: soncharsnakemusictigeropenofficecatkingriseunderstandguesttoparrowdoorredvisitorislandboyvanearquartereggphoneyellowzombieyearnloveroadnaturedarklandorangegreenarrayzeroshortairye
2023-08-29 05:50:55 UTC	1662	IN	Data Raw: 73 73 0d 0a 74 65 73 74 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 77 6f 72 6b 0d 0a 6b 65 79 0d 0a 65 73 63 61 70 65 0d 0a 64 6f 0d 0a 6c 69 6f 6e 0d 0a 6d 65 6e 74 0d 0a 77 65 65 6b 0d 0a 79 65 73 0d 0a 7a 65 72 6f 0d 0a 79 65 61 72 0d 0a 62 6f 79 0d 0a 62 69 72 64 0d 0a 65 72 72 6f 72 0d 0a 61 77 61 72 64 0d 0a 6f 62 6a 65 63 74 0d 0a 79 65 6c 6c 6f 77 0d 0a 70 68 6f 6e 65 0d 0a 62 6f 79 0d 0a 76 69 64 65 6f 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 65 73 63 61 70 65 0d 0a 6c 69 66 65 0d 0a 7a 65 61 6c 0d 0a 62 75 73 0d 0a 61 63 65 0d 0a 61 69 72 0d 0a 6a 75 6d 70 0d 0a 73 6b 79 0d 0a 65 69 67 68 74 0d 0a 72 65 64 0d 0a 79 65 61 72 0d 0a 69 6e 6b 0d 0a 68 61 6e 64 0d 0a 77 6f 72 6c 64 0d 0a 69 73 6c 61 6e 64 0d 0a 71 75 6f 74 65 0d 0a 6b 65 65 70 0d 0a 70 61 70 Data Ascii: sstestvegetableworkkeyescapedolionmentweekyeszeroyearboybirderrorawardobjectyellowphoneboyvideoquestionescapelifezealbusaceairjumpskyeightredyearinkhandworldislandquotekeeppap
2023-08-29 05:50:55 UTC	1678	IN	Data Raw: 73 75 61 6c 6c 79 0d 0a 71 75 61 6c 69 74 79 0d 0a 63 61 74 0d 0a 7a 65 72 6f 0d 0a 73 6e 6f 77 0d 0a 65 73 63 61 70 65 0d 0a 77 6f 6d 61 6e 0d 0a 70 69 63 74 75 72 65 0d 0a 6a 61 76 61 0d 0a 73 74 61 72 0d 0a 76 69 65 77 0d 0a 70 61 70 65 72 0d 0a 76 61 6e 0d 0a 67 72 6f 75 70 0d 0a 6c 69 66 65 0d 0a 6a 61 76 61 0d 0a 6c 75 6e 63 68 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6e 6f 72 74 68 0d 0a 67 68 6f 73 74 0d 0a 64 65 73 6b 0d 0a 75 6e 69 74 0d 0a 62 69 72 64 0d 0a 6b 69 6e 67 0d 0a 6c 61 6b 65 0d 0a 73 6f 6e 67 0d 0a 79 61 77 6e 0d 0a 6a 65 6c 6c 79 0d 0a 68 61 69 72 0d 0a 69 6e 73 69 64 65 0d 0a 72 69 73 65 0d 0a 75 6e 63 6c 65 0d 0a 6e 61 74 75 72 65 0d 0a 76 61 6e 0d 0a 72 65 73 74 0d 0a 74 69 67 65 72 0d 0a 79 6f 75 6e 67 0d 0a 63 61 6b 65 0d 0a 6c 6f Data Ascii: suallyqualitycatzerosnowescapewomanpicturejavastarviewpapervangrouplifejavalunchquantitynorthghostdeskunitbirdkinglakesongyawnjellyhairinsideriseunclenaturevanresttigeryoungcakelo
2023-08-29 05:50:55 UTC	1694	IN	Data Raw: 70 61 70 65 72 0d 0a 6d 65 61 6c 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 71 75 65 65 6e 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 77 68 69 74 65 0d 0a 68 65 6c 70 0d 0a 68 65 61 64 0d 0a 70 69 7a 7a 61 0d 0a 76 6f 69 63 65 0d 0a 64 65 73 6b 0d 0a 6b 69 74 63 68 65 6e 0d 0a 63 61 74 0d 0a 7a 6f 6f 0d 0a 68 69 67 68 0d 0a 63 61 74 0d 0a 64 61 6e 63 65 0d 0a 62 69 72 64 0d 0a 7a 65 61 6c 0d 0a 70 68 6f 6e 65 0d 0a 6a 75 6d 70 0d 0a 67 6c 61 73 73 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 69 6e 63 6f 6d 65 0d 0a 73 6e 61 6b 65 0d 0a 6d 61 70 0d 0a 70 69 6e 6b 0d 0a 6d 69 6c 6b 0d 0a 68 61 69 72 0d 0a 62 61 6c 6c 0d 0a 6f 63 65 61 6e 0d 0a 63 69 74 79 0d 0a 72 6f 6f 6d 0d 0a 71 75 61 6c 69 66 79 0d 0a 70 69 63 74 75 72 65 0d 0a 69 6e 66 6f 72 6d Data Ascii: papermealyesterdayqueenvacationwhitehelpheadpizzavoicedeskkitchencatzoohighcatdancebirdzealphonejumpglassvegetablemonkeyincomesnakemappinkmilkhairballoceancityroomqualifypictureinform
2023-08-29 05:50:55 UTC	1710	IN	Data Raw: 61 79 0d 0a 66 61 6c 6c 0d 0a 6b 69 64 0d 0a 61 72 63 68 0d 0a 7a 65 62 72 61 0d 0a 6a 61 63 6b 65 74 0d 0a 71 75 65 65 6e 0d 0a 66 61 63 65 0d 0a 77 61 74 65 72 0d 0a 6a 61 63 6b 65 74 0d 0a 6f 72 61 6e 67 65 0d 0a 6a 61 76 61 0d 0a 76 69 63 74 6f 72 79 0d 0a 73 74 6f 6e 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6f 72 61 6e 67 65 0d 0a 6c 6f 6e 67 0d 0a 62 65 61 63 68 0d 0a 6e 69 67 68 74 0d 0a 6f 6e 65 0d 0a 64 6f 6f 72 0d 0a 79 65 61 72 0d 0a 66 6f 6f 64 0d 0a 6c 69 6f 6e 0d 0a 6e 69 67 68 74 0d 0a 62 6f 6f 6b 0d 0a 76 69 63 74 6f 72 79 0d 0a 74 6f 70 0d 0a 61 63 65 0d 0a 67 72 61 73 73 0d 0a 68 65 61 64 0d 0a 76 69 65 77 0d 0a 76 61 6c 75 65 0d 0a 72 69 76 65 72 0d 0a 63 61 72 0d 0a 72 61 62 62 69 74 0d 0a 70 68 6f 6e 65 0d 0a 4b 61 6e 74 68 61 6e Data Ascii: ayfallkidarchzebrajacketqueenfacewaterjacketorangejavavictorystoneuniversityorangelongbeachnightonedooryearfoodlionnightbookvictorytopacegrassheadviewvaluerivercarrabbitphoneKanthan
2023-08-29 05:50:55 UTC	1726	IN	Data Raw: 74 6f 77 6e 0d 0a 72 6f 61 64 0d 0a 70 65 72 73 6f 6e 0d 0a 67 75 65 73 74 0d 0a 6f 70 65 6e 0d 0a 68 65 61 64 0d 0a 69 6e 6b 0d 0a 75 72 67 65 0d 0a 72 6f 63 6b 0d 0a 74 65 73 74 0d 0a 6f 62 6a 65 63 74 0d 0a 6f 72 61 6e 67 65 0d 0a 77 61 79 0d 0a 70 61 70 65 72 0d 0a 65 61 73 74 0d 0a 67 6f 6c 64 0d 0a 75 6e 69 74 0d 0a 66 69 72 65 0d 0a 6d 65 6e 74 0d 0a 6c 65 74 74 65 72 0d 0a 63 61 6b 65 0d 0a 67 6c 61 73 73 0d 0a 66 6c 6f 77 65 72 0d 0a 74 65 61 63 68 65 72 0d 0a 77 68 69 6c 65 0d 0a 6d 69 6c 6b 0d 0a 6d 61 6e 0d 0a 67 72 6f 75 70 0d 0a 70 65 6e 0d 0a 7a 6f 6e 65 0d 0a 65 69 67 68 74 0d 0a 6c 61 6e 64 0d 0a 6c 6f 6e 67 0d 0a 7a 6f 6f 0d 0a 78 79 6c 65 6d 0d 0a 70 61 70 65 72 0d 0a 74 69 6d 65 0d 0a 62 61 6c 6c 0d 0a 68 65 61 72 74 0d 0a 67 72 61 73 Data Ascii: townroadpersonguestopenheadinkurgerocktestobjectorangewaypapereastgoldunitfirementlettercakeglassflowerteacherwhilemilkmangrouppenzoneeightlandlongzooxylempapertimeballheartgras
2023-08-29 05:50:55 UTC	1742	IN	Data Raw: 72 0d 0a 65 69 67 68 74 0d 0a 70 65 72 73 6f 6e 0d 0a 6c 61 75 67 68 0d 0a 6d 61 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 77 6f 72 6b 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6e 65 65 64 0d 0a 73 74 6f 6e 65 0d 0a 73 65 61 0d 0a 61 69 72 0d 0a 61 63 65 0d 0a 6d 65 61 6c 0d 0a 6f 63 65 61 6e 0d 0a 6c 61 75 67 68 0d 0a 67 6f 6c 64 0d 0a 75 6e 63 6c 65 0d 0a 61 72 63 68 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 63 6f 6c 6f 72 0d 0a 77 69 6e 64 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 61 72 72 61 79 0d 0a 73 6e 61 6b 65 0d 0a 73 74 61 72 0d 0a 65 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 79 61 77 6e 0d 0a 79 61 77 6e 0d 0a 72 61 62 62 69 74 0d 0a 79 65 61 72 6e 0d 0a 6f 70 65 6e 0d 0a 6b 69 64 0d 0a 74 6f 70 0d 0a 69 6e 6b 0d 0a 67 72 65 65 6e 0d 0a 6c 6f 76 65 0d 0a 6c 61 Data Ascii: reightpersonlaughmanyellowworkuniversityneedstoneseaairacemealoceanlaughgoldunclearchvegetablecolorwindunderstandarraysnakestarearmonkeyyawnyawnrabbityearnopenkidtopinkgreenlovela
2023-08-29 05:50:55 UTC	1758	IN	Data Raw: 0d 0a 6d 6f 6f 6e 0d 0a 63 68 61 72 0d 0a 73 74 72 69 6e 67 0d 0a 74 65 61 63 68 65 72 0d 0a 6f 62 6a 65 63 74 0d 0a 6b 69 63 6b 0d 0a 6b 69 73 73 0d 0a 67 6f 6c 64 0d 0a 64 65 65 72 0d 0a 67 72 65 65 6e 0d 0a 6d 65 61 6c 0d 0a 74 72 61 69 6e 0d 0a 6e 61 74 75 72 65 0d 0a 65 72 72 6f 72 0d 0a 61 63 65 0d 0a 74 72 61 69 6e 0d 0a 76 69 64 65 6f 0d 0a 69 6e 6b 0d 0a 69 73 6c 61 6e 64 0d 0a 72 75 6e 0d 0a 6c 6f 76 65 0d 0a 6f 66 66 65 72 0d 0a 6e 6f 74 65 0d 0a 72 6f 63 6b 0d 0a 71 75 6f 74 65 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 66 6f 6f 74 0d 0a 73 74 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 68 65 6c 70 0d 0a 77 69 6e 64 0d 0a 78 79 6c 65 6d 0d 0a 64 72 65 61 6d 0d 0a 75 6e 69 74 0d 0a 73 65 76 65 6e 0d 0a 6b 69 74 63 68 65 6e 0d 0a 75 72 67 65 0d 0a 6f Data Ascii: mooncharstringteacherobjectkickkissgolddeergreenmealtrainnatureerroracetrainvideoinkislandrunloveoffernoterockquoteinformationfootstarmonkeyhelpwindxylemdreamunitsevenkitchenurgeo
2023-08-29 05:50:55 UTC	1774	IN	Data Raw: 70 69 63 74 75 72 65 0d 0a 74 65 61 63 68 65 72 0d 0a 6a 61 72 0d 0a 69 63 65 0d 0a 72 65 73 74 0d 0a 71 75 61 6c 69 74 79 0d 0a 66 72 69 65 6e 64 0d 0a 6b 69 74 65 0d 0a 6d 6f 6f 6e 0d 0a 62 6f 78 0d 0a 6c 61 6e 64 0d 0a 6e 75 72 73 65 0d 0a 6b 69 74 65 0d 0a 64 65 73 6b 0d 0a 63 6f 6c 6f 72 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6d 6f 76 69 65 0d 0a 66 61 63 65 0d 0a 65 61 73 74 0d 0a 6f 66 66 69 63 65 0d 0a 64 72 65 61 6d 0d 0a 74 72 65 65 0d 0a 73 74 61 72 0d 0a 73 65 61 0d 0a 62 75 73 0d 0a 65 6e 65 72 67 79 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 63 68 61 72 0d 0a 6d 61 70 0d 0a 77 69 6e 64 0d 0a 6b 65 65 70 0d 0a 68 6f 75 73 65 0d 0a 6b 69 73 73 0d 0a 6f 72 61 6e 67 65 0d 0a 66 6f 6f 74 0d 0a 72 6f 61 64 0d 0a 73 68 6f 72 74 0d 0a 68 69 67 68 0d 0a 65 61 Data Ascii: pictureteacherjaricerestqualityfriendkitemoonboxlandnursekitedeskcolorjourneymoviefaceeastofficedreamtreestarseabusenergyknowledgecharmapwindkeephousekissorangefootroadshorthighea
2023-08-29 05:50:55 UTC	1790	IN	Data Raw: 72 0d 0a 76 61 6c 75 65 0d 0a 74 6f 70 0d 0a 6b 69 6e 67 0d 0a 6b 69 6e 67 0d 0a 75 6e 69 74 0d 0a 68 69 67 68 0d 0a 70 61 70 65 72 0d 0a 6f 62 6a 65 63 74 0d 0a 6c 69 66 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 77 6f 72 6b 0d 0a 70 68 6f 6e 65 0d 0a 6a 65 6c 6c 79 0d 0a 6b 69 63 6b 0d 0a 65 64 67 65 0d 0a 72 65 64 0d 0a 65 72 72 6f 72 0d 0a 6a 75 64 67 65 0d 0a 77 61 79 0d 0a 63 6c 69 70 0d 0a 73 6e 61 6b 65 0d 0a 68 69 67 68 0d 0a 77 61 74 65 72 0d 0a 79 61 77 6e 0d 0a 62 65 61 63 68 0d 0a 63 61 6d 65 72 61 0d 0a 74 72 65 65 0d 0a 62 61 6e 61 6e 61 0d 0a 69 73 73 75 65 0d 0a 7a 65 72 6f 0d 0a 6f 66 66 69 63 65 0d 0a 6a 75 64 67 65 0d 0a 74 69 67 65 72 0d 0a 71 75 69 65 74 0d 0a 61 72 63 68 0d 0a 69 73 73 75 65 0d 0a 6b 65 65 70 0d 0a 6c 6f 76 65 Data Ascii: rvaluetopkingkingunithighpaperobjectlifeundergroundworkphonejellykickedgerederrorjudgewayclipsnakehighwateryawnbeachcameratreebananaissuezeroofficejudgetigerquietarchissuekeeplove
2023-08-29 05:50:56 UTC	1806	IN	Data Raw: 75 72 65 0d 0a 63 68 61 72 0d 0a 61 6e 74 0d 0a 73 6b 79 0d 0a 62 61 6c 6c 0d 0a 68 61 6e 64 0d 0a 6c 75 6e 63 68 0d 0a 65 61 72 74 68 0d 0a 66 6f 6f 74 0d 0a 73 75 6e 0d 0a 62 6c 75 65 0d 0a 6f 70 65 6e 0d 0a 65 61 74 0d 0a 61 63 65 0d 0a 73 74 6f 6e 65 0d 0a 63 6c 6f 75 64 0d 0a 6c 69 66 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 72 6f 61 64 0d 0a 73 65 76 65 6e 0d 0a 74 72 65 65 0d 0a 6b 69 63 6b 0d 0a 73 65 61 0d 0a 65 61 73 74 0d 0a 6a 6f 6b 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 74 61 6c 6b 0d 0a 79 65 73 0d 0a 69 73 73 75 65 0d 0a 65 73 63 61 70 65 0d 0a 61 70 70 6c 65 0d 0a 65 64 67 65 0d 0a 70 61 70 65 72 0d 0a 77 6f 72 6b 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6c 69 66 65 0d 0a 74 65 73 74 0d 0a 73 75 67 61 72 0d 0a 71 75 61 6c 69 66 79 0d 0a 66 Data Ascii: urecharantskyballhandlunchearthfootsunblueopeneatacestonecloudlifeuniversityroadseventreekickseaeastjokeyellowtalkyesissueescapeappleedgepaperworkuniversitylifetestsugarqualifyf
2023-08-29 05:50:56 UTC	1822	IN	Data Raw: 0d 0a 61 72 72 6f 77 0d 0a 65 61 72 74 68 0d 0a 74 6f 77 6e 0d 0a 64 65 65 72 0d 0a 76 69 64 65 6f 0d 0a 66 69 73 68 0d 0a 7a 6f 6e 65 0d 0a 79 65 73 0d 0a 63 6c 69 70 0d 0a 7a 65 61 6c 0d 0a 71 75 61 6c 69 66 79 0d 0a 67 61 6d 65 0d 0a 69 6e 74 0d 0a 67 72 6f 75 70 0d 0a 71 75 61 72 74 65 72 0d 0a 65 6e 64 0d 0a 66 61 74 68 65 72 0d 0a 62 6f 78 0d 0a 6a 61 72 0d 0a 77 68 69 6c 65 0d 0a 73 6e 61 6b 65 0d 0a 68 6f 75 73 65 0d 0a 76 61 6e 0d 0a 61 72 74 0d 0a 77 6f 72 6b 0d 0a 77 6f 72 6b 0d 0a 77 65 65 6b 0d 0a 6c 6f 76 65 0d 0a 6b 69 6e 64 0d 0a 66 6f 6f 64 0d 0a 65 61 73 74 0d 0a 74 61 6c 6b 0d 0a 74 65 61 63 68 65 72 0d 0a 79 65 61 72 6e 0d 0a 74 69 6d 65 0d 0a 63 6f 61 74 0d 0a 61 72 74 0d 0a 6e 75 6d 62 65 72 0d 0a 63 61 74 0d 0a 6a 75 6d 70 0d 0a 69 Data Ascii: arrowearthtowndeervideofishzoneyesclipzealqualifygameintgroupquarterendfatherboxjarwhilesnakehousevanartworkworkweeklovekindfoodeasttalkteacheryearntimecoatartnumbercatjumpi
2023-08-29 05:50:56 UTC	1838	IN	Data Raw: 6f 77 65 72 0d 0a 75 72 67 65 0d 0a 63 6f 61 74 0d 0a 6c 6f 6e 67 0d 0a 70 6f 77 65 72 0d 0a 65 61 73 74 0d 0a 64 61 79 0d 0a 72 61 62 62 69 74 0d 0a 63 6c 69 70 0d 0a 72 65 73 74 0d 0a 6b 69 74 63 68 65 6e 0d 0a 6f 62 6a 65 63 74 0d 0a 64 6f 0d 0a 6f 63 65 61 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 6c 6f 76 65 0d 0a 73 65 76 65 6e 0d 0a 64 65 73 6b 0d 0a 72 75 6e 0d 0a 61 63 65 0d 0a 6c 61 6e 64 0d 0a 69 6e 63 6f 6d 65 0d 0a 7a 65 72 6f 0d 0a 70 6f 77 65 72 0d 0a 74 65 73 74 0d 0a 6f 6e 65 0d 0a 67 75 65 73 74 0d 0a 61 70 70 6c 65 0d 0a 73 6b 79 0d 0a 73 68 6f 72 74 0d 0a 6c 61 6e 64 0d 0a 65 79 65 0d 0a 71 75 61 72 74 65 72 0d 0a 67 61 6d 65 0d 0a 77 6f 6d 61 6e 0d 0a 75 73 65 0d 0a 77 6f 72 6c 64 0d 0a 66 61 6c 6c 0d 0a 6a 61 72 0d 0a 61 69 72 0d 0a 73 6f 6e Data Ascii: owerurgecoatlongpowereastdayrabbitcliprestkitchenobjectdooceanbananalovesevendeskrunacelandincomezeropowertestoneguestappleskyshortlandeyequartergamewomanuseworldfalljarairson
2023-08-29 05:50:56 UTC	1854	IN	Data Raw: 6f 72 0d 0a 64 72 65 61 6d 0d 0a 64 6f 0d 0a 77 61 72 6e 0d 0a 65 61 74 0d 0a 66 6f 6f 64 0d 0a 7a 65 72 6f 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 73 6e 61 6b 65 0d 0a 6c 61 6d 70 0d 0a 72 65 73 74 0d 0a 66 6c 6f 77 65 72 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 65 67 67 0d 0a 61 6e 74 0d 0a 66 6f 6f 74 0d 0a 71 75 69 65 74 0d 0a 6c 61 6b 65 0d 0a 62 6f 79 0d 0a 65 61 72 0d 0a 69 63 65 0d 0a 65 67 67 0d 0a 6b 69 6e 67 0d 0a 70 69 63 74 75 72 65 0d 0a 70 6c 61 6e 74 0d 0a 61 63 65 0d 0a 67 72 6f 75 70 0d 0a 68 6f 70 65 0d 0a 77 61 72 6e 0d 0a 6b 69 63 6b 0d 0a 61 72 72 6f 77 0d 0a 7a 6f 6d 62 69 65 0d 0a 66 61 72 6d 0d 0a 74 6f 77 6e 0d 0a 66 61 74 68 65 72 0d 0a 67 6f 61 74 0d 0a 71 75 61 6c 69 66 79 0d 0a 79 65 73 0d Data Ascii: ordreamdowarneatfoodzeroquestionunderstandsnakelamprestflowerundergroundeggantfootquietlakeboyeariceeggkingpictureplantacegrouphopewarnkickarrowzombiefarmtownfathergoatqualifyyes
2023-08-29 05:50:56 UTC	1870	IN	Data Raw: 65 0d 0a 6c 61 6d 70 0d 0a 69 73 6c 61 6e 64 0d 0a 66 6c 6f 77 65 72 0d 0a 63 6f 61 74 0d 0a 77 65 65 6b 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 70 69 7a 7a 61 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 75 72 67 65 0d 0a 64 72 65 61 6d 0d 0a 7a 65 72 6f 0d 0a 67 6f 6c 64 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6c 69 6f 6e 0d 0a 6a 75 6d 70 0d 0a 73 74 61 72 0d 0a 71 75 61 6c 69 74 79 0d 0a 75 72 67 65 0d 0a 66 6c 6f 77 65 72 0d 0a 72 69 73 65 0d 0a 77 61 79 0d 0a 77 61 79 0d 0a 6e 61 74 75 72 65 0d 0a 72 75 6e 0d 0a 76 69 73 69 74 6f 72 0d 0a 67 61 6d 65 0d 0a 64 6f 0d 0a 74 61 73 74 65 0d 0a 63 6f 77 0d 0a 62 65 61 63 68 0d 0a 6c 65 67 0d 0a 76 6f 69 63 65 0d 0a 68 65 61 72 74 0d 0a 69 73 6c 61 6e 64 0d 0a 6f 69 6c 0d 0a 63 68 61 72 0d 0a 6f 72 64 65 72 0d 0a 6d 61 6e 0d 0a Data Ascii: elampislandflowercoatweekjourneypizzavacationurgedreamzerogoldjourneylionjumpstarqualityurgeflowerrisewaywaynaturerunvisitorgamedotastecowbeachlegvoiceheartislandoilcharorderman
2023-08-29 05:50:56 UTC	1886	IN	Data Raw: 0d 0a 70 68 6f 6e 65 0d 0a 67 72 65 65 6e 0d 0a 62 61 6e 61 6e 61 0d 0a 79 65 61 72 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 64 65 65 72 0d 0a 71 75 61 72 74 65 72 0d 0a 74 61 6c 6b 0d 0a 65 61 72 74 68 0d 0a 64 61 79 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 67 72 65 65 6e 0d 0a 62 65 61 63 68 0d 0a 6a 61 63 6b 65 74 0d 0a 72 6f 61 64 0d 0a 6d 6f 76 69 65 0d 0a 6a 61 72 0d 0a 77 68 69 6c 65 0d 0a 66 61 63 65 0d 0a 63 69 74 79 0d 0a 6a 6f 6b 65 0d 0a 66 61 63 65 0d 0a 75 72 67 65 0d 0a 62 61 6c 6c 0d 0a 70 69 7a 7a 61 0d 0a 72 69 76 65 72 0d 0a 67 72 6f 75 70 0d 0a 72 75 6e 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 70 65 6e 0d 0a 63 6c 69 70 0d 0a 63 6f 77 0d 0a 6e 61 6d 65 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 74 61 73 74 65 0d 0a 65 73 63 61 70 65 0d 0a 79 65 Data Ascii: phonegreenbananayearyesterdaydeerquartertalkearthdayinformationgreenbeachjacketroadmoviejarwhilefacecityjokefaceurgeballpizzarivergrouprunvegetablepenclipcownamejourneytasteescapeye
2023-08-29 05:50:57 UTC	1902	IN	Data Raw: 61 72 72 6f 77 0d 0a 75 73 75 61 6c 6c 79 0d 0a 69 63 6f 6e 0d 0a 67 6f 6c 64 0d 0a 64 6f 0d 0a 65 61 74 0d 0a 77 69 6e 64 0d 0a 6b 65 79 0d 0a 6f 72 61 6e 67 65 0d 0a 71 75 61 6c 69 74 79 0d 0a 68 61 74 0d 0a 6a 65 6c 6c 79 0d 0a 64 75 63 6b 0d 0a 77 6f 72 6c 64 0d 0a 6b 69 74 63 68 65 6e 0d 0a 6d 75 73 69 63 0d 0a 68 69 74 0d 0a 77 61 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 66 61 63 65 0d 0a 71 75 65 65 6e 0d 0a 6d 61 6e 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 75 73 65 0d 0a 72 6f 61 64 0d 0a 77 65 73 74 0d 0a 75 6e 63 6c 65 0d 0a 66 75 6e 63 0d 0a 6b 65 65 70 0d 0a 6e 65 65 64 0d 0a 70 61 70 65 72 0d 0a 68 65 61 72 74 0d 0a 64 6f 6f 72 0d 0a 61 69 72 0d 0a 6c 61 6d 70 0d 0a 72 61 62 62 69 74 0d 0a 7a 6f 6f 0d 0a 71 75 69 65 74 0d 0a 73 65 76 65 6e 0d 0a 7a Data Ascii: arrowusuallyicongolddoeatwindkeyorangequalityhatjellyduckworldkitchenmusichitwayKanthanfacequeenmanvegetableuseroadwestunclefunckeepneedpaperheartdoorairlamprabbitzooquietsevenz
2023-08-29 05:50:57 UTC	1918	IN	Data Raw: 0d 0a 70 65 6e 0d 0a 74 72 65 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 73 65 61 0d 0a 72 75 6e 0d 0a 75 6e 63 6c 65 0d 0a 66 69 73 68 0d 0a 66 69 72 65 0d 0a 6e 6f 73 65 0d 0a 63 61 74 0d 0a 76 69 73 69 74 6f 72 0d 0a 64 6f 67 0d 0a 6f 72 61 6e 67 65 0d 0a 67 6f 61 74 0d 0a 71 75 65 65 6e 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 6c 61 6e 64 0d 0a 77 69 6e 74 65 72 0d 0a 66 6f 72 0d 0a 7a 6f 6f 0d 0a 66 6f 6f 74 0d 0a 67 6c 61 73 73 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 6f 78 0d 0a 73 68 6f 72 74 0d 0a 6f 66 66 65 72 0d 0a 70 65 6e 0d 0a 64 61 79 0d 0a 74 65 61 63 68 65 72 0d 0a 6c 61 75 67 68 0d 0a 68 65 61 72 74 0d 0a 6e 61 6d 65 0d 0a 61 72 72 61 79 0d 0a 67 75 65 73 74 0d 0a 75 73 65 0d 0a 7a 69 70 70 65 72 0d 0a 67 72 65 65 6e 0d 0a 61 72 74 0d 0a 63 68 61 Data Ascii: pentreeyellowsearununclefishfirenosecatvisitordogorangegoatqueenjourneylandwinterforzoofootglassinformationboxshortofferpendayteacherlaughheartnamearrayguestusezippergreenartcha
2023-08-29 05:50:57 UTC	1934	IN	Data Raw: 61 73 74 0d 0a 64 65 65 72 0d 0a 66 61 74 68 65 72 0d 0a 68 65 61 64 0d 0a 74 6f 77 6e 0d 0a 68 61 6e 64 0d 0a 6c 75 6e 63 68 0d 0a 6f 72 61 6e 67 65 0d 0a 6d 75 73 69 63 0d 0a 7a 6f 6e 65 0d 0a 73 6e 6f 77 0d 0a 64 61 79 0d 0a 6d 6f 6e 6b 65 79 0d 0a 71 75 6f 74 65 0d 0a 68 6f 70 65 0d 0a 77 61 79 0d 0a 65 6e 64 0d 0a 69 6e 74 0d 0a 68 6f 75 73 65 0d 0a 76 61 6e 0d 0a 67 69 72 6c 0d 0a 69 73 73 75 65 0d 0a 69 6e 74 0d 0a 73 6e 6f 77 0d 0a 73 6e 61 6b 65 0d 0a 72 69 73 65 0d 0a 65 61 73 79 0d 0a 64 75 63 6b 0d 0a 69 64 65 61 0d 0a 6c 69 6f 6e 0d 0a 67 61 6d 65 0d 0a 73 68 6f 72 74 0d 0a 70 65 72 73 6f 6e 0d 0a 7a 6f 6f 0d 0a 71 75 61 6c 69 74 79 0d 0a 6d 65 6e 74 0d 0a 75 73 75 61 6c 6c 79 0d 0a 63 6f 6c 6f 72 0d 0a 74 6f 77 6e 0d 0a 6c 69 66 65 0d 0a 74 Data Ascii: astdeerfatherheadtownhandlunchorangemusiczonesnowdaymonkeyquotehopewayendinthousevangirlissueintsnowsnakeriseeasyduckidealiongameshortpersonzooqualitymentusuallycolortownlifet
2023-08-29 05:50:57 UTC	1950	IN	Data Raw: 6f 6e 0d 0a 75 6e 63 6c 65 0d 0a 6d 6f 6e 6b 65 79 0d 0a 70 69 63 74 75 72 65 0d 0a 6c 69 6f 6e 0d 0a 6f 69 6c 0d 0a 73 6e 61 6b 65 0d 0a 61 63 65 0d 0a 73 74 61 72 0d 0a 74 65 73 74 0d 0a 63 61 6d 65 72 61 0d 0a 75 6e 69 74 0d 0a 77 61 74 65 72 0d 0a 6d 69 6c 6b 0d 0a 6b 69 73 73 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 68 6f 70 65 0d 0a 61 69 72 0d 0a 74 65 61 63 68 65 72 0d 0a 6e 61 6d 65 0d 0a 77 68 69 6c 65 0d 0a 6c 75 6e 63 68 0d 0a 76 69 65 77 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 66 61 63 65 0d 0a 6d 6f 76 69 65 0d 0a 6c 61 6e 64 0d 0a 72 61 62 62 69 74 0d 0a 6e 6f 72 74 68 0d 0a 6d 69 6c 6b 0d 0a 74 61 73 74 65 0d 0a 67 6f 61 74 0d 0a 73 65 61 0d 0a 65 61 73 79 0d 0a 6c 69 66 65 0d 0a 77 6f 72 6c 64 0d 0a 6f 70 65 6e 0d 0a 79 61 77 6e Data Ascii: onunclemonkeypicturelionoilsnakeacestartestcameraunitwatermilkkissinformationhopeairteachernamewhilelunchviewundergroundfacemovielandrabbitnorthmilktastegoatseaeasylifeworldopenyawn
2023-08-29 05:50:57 UTC	1966	IN	Data Raw: 67 0d 0a 71 75 69 65 74 0d 0a 75 6e 63 6c 65 0d 0a 64 65 73 6b 0d 0a 6e 75 6d 62 65 72 0d 0a 71 75 65 65 6e 0d 0a 65 64 67 65 0d 0a 71 75 69 65 74 0d 0a 73 68 6f 72 74 0d 0a 62 61 6e 61 6e 61 0d 0a 6e 6f 74 65 0d 0a 79 65 61 72 6e 0d 0a 62 61 6c 6c 0d 0a 63 6f 61 74 0d 0a 6c 69 6f 6e 0d 0a 6a 75 6d 70 0d 0a 62 61 6c 6c 0d 0a 6e 6f 73 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 61 72 72 61 79 0d 0a 65 6e 64 0d 0a 64 6f 0d 0a 73 74 6f 6e 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 77 68 69 6c 65 0d 0a 70 68 6f 6e 65 0d 0a 72 61 62 62 69 74 0d 0a 6e 75 6d 62 65 72 0d 0a 6d 61 70 0d 0a 6c 61 6e 64 0d 0a 61 69 72 0d 0a 61 72 63 68 0d 0a 70 69 63 74 75 72 65 0d 0a 76 6f 69 63 65 0d 0a 72 6f 61 64 0d 0a 74 72 61 69 6e 0d 0a 69 64 65 61 0d 0a 76 Data Ascii: gquietuncledesknumberqueenedgequietshortbanananoteyearnballcoatlionjumpballnoseuniversityarrayenddostonevisitoryellowwhilephonerabbitnumbermaplandairarchpicturevoiceroadtrainideav
2023-08-29 05:50:57 UTC	1982	IN	Data Raw: 6f 6f 6e 0d 0a 63 61 74 0d 0a 64 65 65 72 0d 0a 64 61 6e 63 65 0d 0a 63 6c 6f 75 64 0d 0a 62 6f 78 0d 0a 70 65 6e 0d 0a 6f 70 65 6e 0d 0a 73 75 67 61 72 0d 0a 6d 61 70 0d 0a 6c 61 6b 65 0d 0a 62 61 6c 6c 0d 0a 63 6f 61 74 0d 0a 77 68 69 6c 65 0d 0a 64 61 6e 63 65 0d 0a 69 64 65 61 0d 0a 61 6c 6f 6e 65 0d 0a 6f 66 66 65 72 0d 0a 6a 75 6d 70 0d 0a 72 6f 63 6b 0d 0a 75 6e 69 74 0d 0a 6b 69 63 6b 0d 0a 6a 75 64 67 65 0d 0a 6e 69 67 68 74 0d 0a 63 6f 6c 6f 72 0d 0a 72 75 6e 0d 0a 73 75 67 61 72 0d 0a 66 69 72 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 72 75 6e 0d 0a 73 74 72 69 6e 67 0d 0a 73 65 76 65 6e 0d 0a 61 72 63 68 0d 0a 73 74 6f 6e 65 0d 0a 6e 61 6d 65 0d 0a 6f 63 65 61 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 6e 61 74 75 72 65 0d 0a 67 6f 6c 64 0d 0a 6f 72 61 Data Ascii: ooncatdeerdancecloudboxpenopensugarmaplakeballcoatwhiledanceideaaloneofferjumprockunitkickjudgenightcolorrunsugarfireknowledgerunstringsevenarchstonenameoceanpersonnaturegoldora
2023-08-29 05:50:57 UTC	1998	IN	Data Raw: 0a 6f 66 66 65 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 68 6f 70 65 0d 0a 66 75 6e 63 0d 0a 70 61 70 65 72 0d 0a 6e 69 67 68 74 0d 0a 64 61 72 6b 0d 0a 66 72 69 65 6e 64 0d 0a 6c 69 6f 6e 0d 0a 66 61 6c 6c 0d 0a 64 61 72 6b 0d 0a 69 6e 6b 0d 0a 74 65 61 63 68 65 72 0d 0a 64 75 63 6b 0d 0a 72 69 73 65 0d 0a 77 61 74 65 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 65 79 65 0d 0a 76 69 65 77 0d 0a 62 69 72 64 0d 0a 6a 6f 6b 65 0d 0a 71 75 6f 74 65 0d 0a 65 72 72 6f 72 0d 0a 63 6c 6f 75 64 0d 0a 62 69 72 64 0d 0a 71 75 65 65 6e 0d 0a 6c 61 6d 70 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 76 61 6e 0d 0a 71 75 61 6c 69 74 79 0d 0a 65 67 67 0d 0a 69 63 65 0d 0a 65 61 73 79 0d 0a 71 75 69 65 74 0d 0a 6c 61 6e 64 0d 0a 63 61 74 0d 0a 61 69 72 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 6d 6f Data Ascii: offermonkeyhopefuncpapernightdarkfriendlionfalldarkinkteacherduckrisewaterunsignedeyeviewbirdjokequoteerrorcloudbirdqueenlampyesterdayvanqualityeggiceeasyquietlandcatairKanthanmo
2023-08-29 05:50:57 UTC	2014	IN	Data Raw: 6c 79 0d 0a 79 6f 75 6e 67 0d 0a 75 73 75 61 6c 6c 79 0d 0a 69 6e 63 6f 6d 65 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 63 6f 77 0d 0a 73 6e 6f 77 0d 0a 6b 69 6e 67 0d 0a 75 73 65 0d 0a 63 6f 6c 6f 72 0d 0a 69 73 73 75 65 0d 0a 68 65 6c 70 0d 0a 6f 6e 65 0d 0a 68 65 6c 70 0d 0a 66 61 6c 6c 0d 0a 64 61 74 61 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 67 6f 61 74 0d 0a 72 61 62 62 69 74 0d 0a 63 61 6b 65 0d 0a 64 61 74 61 0d 0a 74 65 73 74 0d 0a 6d 69 6c 6b 0d 0a 6b 65 79 0d 0a 77 6f 72 6c 64 0d 0a 72 6f 61 64 0d 0a 70 6f 77 65 72 0d 0a 63 61 72 0d 0a 73 75 67 61 72 0d 0a 73 6f 6e 67 0d 0a 67 6f 6c 64 0d 0a 77 6f 6d 61 6e 0d 0a 73 74 72 69 6e 67 0d 0a 64 65 73 6b 0d 0a 71 75 6f 74 65 0d 0a 65 61 72 74 68 0d 0a 69 6e 73 69 64 65 0d 0a 71 75 65 65 6e 0d 0a 6b 69 64 Data Ascii: lyyoungusuallyincomeinformationcowsnowkingusecolorissuehelponehelpfalldataKanthangoatrabbitcakedatatestmilkkeyworldroadpowercarsugarsonggoldwomanstringdeskquoteearthinsidequeenkid
2023-08-29 05:50:57 UTC	2030	IN	Data Raw: 73 75 65 0d 0a 7a 6f 6d 62 69 65 0d 0a 62 6f 6f 6b 0d 0a 68 65 6c 70 0d 0a 70 69 7a 7a 61 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 63 6c 6f 75 64 0d 0a 7a 6f 6f 0d 0a 6d 61 70 0d 0a 6d 6f 6f 6e 0d 0a 61 72 72 6f 77 0d 0a 66 6f 72 0d 0a 6e 61 6d 65 0d 0a 66 72 69 65 6e 64 0d 0a 70 6c 61 6e 74 0d 0a 72 61 69 6e 0d 0a 72 6f 63 6b 0d 0a 74 6f 70 0d 0a 63 69 74 79 0d 0a 75 73 65 0d 0a 79 65 73 0d 0a 6e 6f 74 65 0d 0a 67 6f 6c 64 0d 0a 6d 69 6c 6b 0d 0a 6e 6f 74 65 0d 0a 73 6f 6e 67 0d 0a 73 6e 6f 77 0d 0a 6d 6f 6f 6e 0d 0a 73 6e 61 6b 65 0d 0a 6a 61 63 6b 65 74 0d 0a 70 65 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 73 74 72 69 6e 67 0d 0a 6d 6f 74 68 65 72 0d 0a 6f 66 66 65 72 0d 0a 6e 75 72 73 65 0d 0a 7a 65 72 6f 0d 0a 75 73 65 0d 0a 6d 61 63 68 69 6e 65 0d 0a 76 69 65 77 Data Ascii: suezombiebookhelppizzavacationcloudzoomapmoonarrowfornamefriendplantrainrocktopcityuseyesnotegoldmilknotesongsnowmoonsnakejacketpenyellowstringmotheroffernursezerousemachineview
2023-08-29 05:50:57 UTC	2046	IN	Data Raw: 6f 77 6c 65 64 67 65 0d 0a 73 75 6e 0d 0a 65 67 67 0d 0a 6f 70 65 6e 0d 0a 64 6f 67 0d 0a 63 61 6d 65 72 61 0d 0a 69 73 73 75 65 0d 0a 70 6f 77 65 72 0d 0a 74 61 6c 6b 0d 0a 61 77 61 72 64 0d 0a 64 65 65 72 0d 0a 71 75 61 72 74 65 72 0d 0a 6e 61 74 75 72 65 0d 0a 73 74 61 72 0d 0a 6c 61 6b 65 0d 0a 73 68 6f 72 74 0d 0a 63 61 72 0d 0a 62 61 6e 61 6e 61 0d 0a 6b 65 79 0d 0a 79 65 61 72 6e 0d 0a 64 65 73 6b 0d 0a 74 69 67 65 72 0d 0a 6a 61 76 61 0d 0a 65 61 73 74 0d 0a 63 68 61 72 0d 0a 62 61 6e 61 6e 61 0d 0a 73 75 6e 0d 0a 6c 61 6e 64 0d 0a 6c 69 66 65 0d 0a 6a 6f 6b 65 0d 0a 73 65 76 65 6e 0d 0a 79 65 61 72 0d 0a 75 6e 69 74 0d 0a 64 61 79 0d 0a 73 6b 79 0d 0a 72 65 64 0d 0a 6c 6f 6e 67 0d 0a 77 69 6e 64 0d 0a 63 68 61 72 0d 0a 6e 6f 74 65 0d 0a 6c 61 6d Data Ascii: owledgesuneggopendogcameraissuepowertalkawarddeerquarternaturestarlakeshortcarbananakeyyearndesktigerjavaeastcharbananasunlandlifejokesevenyearunitdayskyredlongwindcharnotelam
2023-08-29 05:50:57 UTC	2062	IN	Data Raw: 64 61 79 0d 0a 6f 69 6c 0d 0a 71 75 61 6c 69 74 79 0d 0a 63 61 6d 65 72 61 0d 0a 6d 6f 76 69 65 0d 0a 77 65 73 74 0d 0a 73 74 6f 6e 65 0d 0a 61 63 65 0d 0a 70 6f 77 65 72 0d 0a 66 75 6e 63 0d 0a 70 65 72 73 6f 6e 0d 0a 77 61 72 6e 0d 0a 64 61 72 6b 0d 0a 73 74 6f 6e 65 0d 0a 61 72 74 0d 0a 67 61 6d 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 6b 69 6e 64 0d 0a 6e 75 6d 62 65 72 0d 0a 72 65 64 0d 0a 73 6e 6f 77 0d 0a 6d 61 63 68 69 6e 65 0d 0a 77 69 6e 64 0d 0a 6e 6f 73 65 0d 0a 6b 65 79 0d 0a 75 73 65 0d 0a 77 65 73 74 0d 0a 6f 66 66 65 72 0d 0a 6a 75 6d 70 0d 0a 63 61 6b 65 0d 0a 6e 6f 74 65 0d 0a 77 69 6e 64 0d 0a 65 61 74 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 68 69 67 68 0d 0a 72 6f 61 64 0d 0a 61 77 61 72 64 0d 0a 76 6f 69 63 65 0d 0a 71 75 61 6c 69 Data Ascii: dayoilqualitycameramovieweststoneacepowerfuncpersonwarndarkstoneartgameundergroundkindnumberredsnowmachinewindnosekeyusewestofferjumpcakenotewindeatvacationhighroadawardvoicequali
2023-08-29 05:50:57 UTC	2078	IN	Data Raw: 0a 70 6c 61 6e 74 0d 0a 74 72 65 65 0d 0a 73 6e 6f 77 0d 0a 6d 6f 76 69 65 0d 0a 6d 65 6e 74 0d 0a 79 61 77 6e 0d 0a 64 61 6e 63 65 0d 0a 77 6f 72 6b 0d 0a 68 61 74 0d 0a 6b 69 63 6b 0d 0a 6e 61 74 75 72 65 0d 0a 62 69 72 64 0d 0a 76 69 73 69 74 6f 72 0d 0a 63 61 74 0d 0a 66 61 63 65 0d 0a 6e 75 6d 62 65 72 0d 0a 62 61 6e 61 6e 61 0d 0a 68 69 67 68 0d 0a 66 61 74 68 65 72 0d 0a 6f 72 64 65 72 0d 0a 65 61 74 0d 0a 79 65 61 72 6e 0d 0a 6f 6e 65 0d 0a 69 6e 6b 0d 0a 70 61 70 65 72 0d 0a 69 63 65 0d 0a 6c 61 6b 65 0d 0a 6f 63 65 61 6e 0d 0a 72 6f 61 64 0d 0a 68 61 69 72 0d 0a 6c 61 6e 64 0d 0a 75 6e 69 74 0d 0a 73 6e 61 6b 65 0d 0a 73 65 76 65 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a 75 73 65 0d 0a 61 6e 74 0d 0a 7a 6f 6f 0d 0a 72 69 76 65 72 0d 0a 66 69 73 68 0d 0a Data Ascii: planttreesnowmoviementyawndanceworkhatkicknaturebirdvisitorcatfacenumberbananahighfatherordereatyearnoneinkpapericelakeoceanroadhairlandunitsnakesevenzombieuseantzooriverfish
2023-08-29 05:50:57 UTC	2094	IN	Data Raw: 72 74 0d 0a 64 61 6e 63 65 0d 0a 72 75 6e 0d 0a 77 68 69 74 65 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 76 6f 69 63 65 0d 0a 74 65 73 74 0d 0a 74 72 61 69 6e 0d 0a 72 6f 6f 6d 0d 0a 62 61 6e 61 6e 61 0d 0a 63 6c 69 70 0d 0a 77 69 6e 74 65 72 0d 0a 62 61 6e 6b 0d 0a 72 61 62 62 69 74 0d 0a 76 61 6e 0d 0a 72 69 73 65 0d 0a 79 65 61 72 6e 0d 0a 79 6f 75 6e 67 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 61 77 61 72 64 0d 0a 6a 6f 79 0d 0a 68 6f 75 73 65 0d 0a 72 75 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 6c 61 75 67 68 0d 0a 65 67 67 0d 0a 79 61 77 6e 0d 0a 73 75 67 61 72 0d 0a 70 69 6e 6b 0d 0a 69 63 6f 6e 0d 0a 67 75 65 73 74 0d 0a 6d 65 6e 74 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 72 6f 6f 6d 0d 0a 68 61 6e 64 0d 0a 7a 69 70 70 65 72 0d 0a 6e 6f 73 65 0d 0a 74 65 61 63 68 65 72 0d Data Ascii: rtdancerunwhiteyesterdayvoicetesttrainroombananaclipwinterbankrabbitvanriseyearnyoungjourneyawardjoyhouserunschoollaugheggyawnsugarpinkiconguestmentjourneyroomhandzippernoseteacher
2023-08-29 05:50:57 UTC	2110	IN	Data Raw: 79 0d 0a 6f 62 6a 65 63 74 0d 0a 73 68 6f 72 74 0d 0a 70 6f 77 65 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 71 75 65 65 6e 0d 0a 66 6f 6f 74 0d 0a 62 6f 79 0d 0a 63 6f 61 74 0d 0a 6b 69 74 63 68 65 6e 0d 0a 62 65 61 63 68 0d 0a 6b 65 79 0d 0a 73 6e 6f 77 0d 0a 65 61 72 0d 0a 6b 69 6e 67 0d 0a 6b 69 74 65 0d 0a 64 61 74 61 0d 0a 74 61 6c 6b 0d 0a 68 61 6e 64 0d 0a 73 68 6f 72 74 0d 0a 6a 6f 6b 65 0d 0a 61 77 61 72 64 0d 0a 71 75 69 63 6b 0d 0a 67 61 6d 65 0d 0a 6c 6f 6e 67 0d 0a 6b 69 6e 67 0d 0a 75 6e 69 74 0d 0a 6c 65 67 0d 0a 75 6e 63 6c 65 0d 0a 61 6c 6f 6e 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 73 6b 79 0d 0a 66 72 69 65 6e 64 0d 0a 6f 63 65 61 6e 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 77 61 79 0d 0a 61 6e 69 6d 61 6c 0d 0a 73 75 67 61 72 0d 0a 74 61 Data Ascii: yobjectshortpowervacationqueenfootboycoatkitchenbeachkeysnowearkingkitedatatalkhandshortjokeawardquickgamelongkingunitlegunclealoneunderstandskyfriendoceanunsignedwayanimalsugarta
2023-08-29 05:50:57 UTC	2126	IN	Data Raw: 72 69 6e 67 0d 0a 61 77 61 72 64 0d 0a 64 6f 67 0d 0a 79 61 72 64 0d 0a 70 65 72 73 6f 6e 0d 0a 70 61 70 65 72 0d 0a 61 63 65 0d 0a 6e 75 72 73 65 0d 0a 72 69 73 65 0d 0a 6c 6f 6e 67 0d 0a 64 61 6e 63 65 0d 0a 66 6f 6f 74 0d 0a 7a 6f 6f 0d 0a 62 61 6e 61 6e 61 0d 0a 74 6f 77 6e 0d 0a 76 69 63 74 6f 72 79 0d 0a 70 69 63 74 75 72 65 0d 0a 79 61 77 6e 0d 0a 70 68 6f 6e 65 0d 0a 66 69 72 65 0d 0a 77 68 69 74 65 0d 0a 68 61 74 0d 0a 6d 61 63 68 69 6e 65 0d 0a 73 6b 79 0d 0a 77 6f 6d 61 6e 0d 0a 62 6c 75 65 0d 0a 6c 75 6e 63 68 0d 0a 70 69 63 74 75 72 65 0d 0a 68 6f 75 73 65 0d 0a 61 6c 6f 6e 65 0d 0a 61 72 72 6f 77 0d 0a 71 75 69 63 6b 0d 0a 63 69 74 79 0d 0a 68 69 67 68 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 77 68 69 6c 65 0d 0a 69 73 73 75 65 0d 0a 77 6f 6d 61 Data Ascii: ringawarddogyardpersonpaperacenurseriselongdancefootzoobananatownvictorypictureyawnphonefirewhitehatmachineskywomanbluelunchpicturehousealonearrowquickcityhighunsignedwhileissuewoma
2023-08-29 05:50:57 UTC	2142	IN	Data Raw: 0a 75 73 65 0d 0a 62 6c 75 65 0d 0a 6d 61 6e 0d 0a 6a 61 76 61 0d 0a 64 61 79 0d 0a 64 65 73 6b 0d 0a 61 63 65 0d 0a 6b 65 79 0d 0a 6b 69 73 73 0d 0a 72 69 76 65 72 0d 0a 6f 72 61 6e 67 65 0d 0a 6b 69 64 0d 0a 7a 69 70 70 65 72 0d 0a 6a 6f 79 0d 0a 64 6f 0d 0a 64 65 65 72 0d 0a 6a 61 63 6b 65 74 0d 0a 7a 6f 6f 0d 0a 6b 69 64 0d 0a 6e 65 65 64 0d 0a 62 6f 78 0d 0a 77 69 6e 64 0d 0a 62 69 72 64 0d 0a 6d 65 61 6c 0d 0a 73 75 67 61 72 0d 0a 6b 69 6e 67 0d 0a 69 6e 73 69 64 65 0d 0a 6f 62 6a 65 63 74 0d 0a 73 65 61 0d 0a 61 72 72 61 79 0d 0a 62 61 6e 61 6e 61 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 6a 61 63 6b 65 74 0d 0a 6c 61 6e 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 77 61 72 6e 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 65 6e 64 0d 0a 63 6c 6f 75 64 0d 0a 74 Data Ascii: usebluemanjavadaydeskacekeykissriverorangekidzipperjoydodeerjacketzookidneedboxwindbirdmealsugarkinginsideobjectseaarraybananainformationjacketlandqualifywarnknowledgeendcloudt
2023-08-29 05:50:57 UTC	2158	IN	Data Raw: 0d 0a 69 6e 6b 0d 0a 6e 75 6d 62 65 72 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 72 6f 63 6b 0d 0a 64 75 63 6b 0d 0a 73 75 6e 0d 0a 73 63 68 6f 6f 6c 0d 0a 63 61 74 0d 0a 6b 65 65 70 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 73 74 6f 6e 65 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6d 75 73 69 63 0d 0a 77 65 73 74 0d 0a 61 72 72 6f 77 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 61 70 70 6c 65 0d 0a 6d 69 6c 6b 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 68 65 61 72 74 0d 0a 6a 6f 6b 65 0d 0a 68 65 6c 70 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 61 6c 6c 0d 0a 67 72 65 65 6e 0d 0a 61 72 72 61 79 0d 0a 6d 69 6c 6b 0d 0a 66 69 73 68 0d 0a 6e 6f 73 65 0d 0a 67 6f 61 74 0d 0a 6b 65 79 0d 0a 79 6f 75 6e 67 0d 0a 64 61 74 61 0d 0a 66 61 72 6d 0d 0a 61 70 70 6c 65 0d 0a 6b 65 65 Data Ascii: inknumberquestionrockducksunschoolcatkeepuniversitystonequantitymusicwestarrowunsignedapplemilkuniversityheartjokehelpinformationballgreenarraymilkfishnosegoatkeyyoungdatafarmapplekee
2023-08-29 05:50:57 UTC	2174	IN	Data Raw: 61 6c 6c 0d 0a 68 61 6e 64 0d 0a 6d 61 70 0d 0a 61 6e 74 0d 0a 65 61 72 0d 0a 77 68 69 6c 65 0d 0a 79 61 77 6e 0d 0a 74 6f 70 0d 0a 6e 75 72 73 65 0d 0a 69 63 65 0d 0a 61 69 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6e 6f 74 65 0d 0a 72 65 64 0d 0a 72 75 6e 0d 0a 79 6f 75 6e 67 0d 0a 63 61 74 0d 0a 6a 61 72 0d 0a 75 73 65 0d 0a 77 6f 6d 61 6e 0d 0a 63 6f 77 0d 0a 70 6f 77 65 72 0d 0a 62 6f 6f 6b 0d 0a 64 6f 6f 72 0d 0a 63 61 72 0d 0a 61 72 72 61 79 0d 0a 6a 61 76 61 0d 0a 64 6f 67 0d 0a 6c 65 67 0d 0a 6e 61 6d 65 0d 0a 6d 61 6e 0d 0a 67 6c 61 73 73 0d 0a 6d 61 70 0d 0a 73 6f 6e 67 0d 0a 6e 6f 73 65 0d 0a 76 69 73 69 74 6f 72 0d 0a 7a 69 70 70 65 72 0d 0a 66 72 69 65 6e 64 0d 0a 67 72 65 65 6e 0d 0a 77 61 74 65 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 75 6e 64 65 72 73 Data Ascii: allhandmapantearwhileyawntopnurseiceairmachinenoteredrunyoungcatjarusewomancowpowerbookdoorcararrayjavadoglegnamemanglassmapsongnosevisitorzipperfriendgreenwateryellowunders
2023-08-29 05:50:57 UTC	2190	IN	Data Raw: 69 74 79 0d 0a 63 61 72 0d 0a 6d 61 63 68 69 6e 65 0d 0a 68 69 74 0d 0a 79 61 72 64 0d 0a 68 61 69 72 0d 0a 75 72 67 65 0d 0a 6d 6f 74 68 65 72 0d 0a 6f 66 66 69 63 65 0d 0a 65 69 67 68 74 0d 0a 68 69 67 68 0d 0a 67 75 65 73 74 0d 0a 6e 6f 74 65 0d 0a 62 61 6e 6b 0d 0a 6a 65 6c 6c 79 0d 0a 64 61 6e 63 65 0d 0a 62 61 6e 61 6e 61 0d 0a 64 6f 0d 0a 74 65 61 63 68 65 72 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 73 65 76 65 6e 0d 0a 77 61 79 0d 0a 67 72 61 73 73 0d 0a 67 69 72 6c 0d 0a 6d 65 6e 74 0d 0a 63 6c 69 70 0d 0a 61 70 70 6c 65 0d 0a 73 6b 79 0d 0a 66 69 73 68 0d 0a 76 69 64 65 6f 0d 0a 69 6e 74 0d 0a 79 61 77 6e 0d 0a 73 65 76 65 6e 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 6e 6f 72 74 68 0d 0a 6c 61 6b 65 0d 0a 62 61 6e 6b 0d 0a 74 69 67 65 72 0d 0a 64 65 65 Data Ascii: itycarmachinehityardhairurgemotherofficeeighthighguestnotebankjellydancebananadoteacherquestionsevenwaygrassgirlmentclipappleskyfishvideointyawnsevenyesterdaynorthlakebanktigerdee
2023-08-29 05:50:57 UTC	2206	IN	Data Raw: 6e 65 0d 0a 68 6f 70 65 0d 0a 67 72 6f 75 70 0d 0a 68 69 74 0d 0a 65 67 67 0d 0a 62 6f 6f 6b 0d 0a 71 75 65 65 6e 0d 0a 66 6c 6f 77 65 72 0d 0a 65 6e 64 0d 0a 69 6e 6b 0d 0a 61 72 72 6f 77 0d 0a 77 6f 72 6c 64 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6b 69 74 63 68 65 6e 0d 0a 69 6e 73 69 64 65 0d 0a 73 6e 61 6b 65 0d 0a 66 72 69 65 6e 64 0d 0a 71 75 61 72 74 65 72 0d 0a 70 69 63 74 75 72 65 0d 0a 66 61 72 6d 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 63 61 6d 65 72 61 0d 0a 68 65 6c 70 0d 0a 70 69 7a 7a 61 0d 0a 6d 6f 74 68 65 72 0d 0a 74 6f 70 0d 0a 67 72 6f 75 70 0d 0a 7a 65 62 72 61 0d 0a 66 61 72 6d 0d 0a 64 61 72 6b 0d 0a 68 69 67 68 0d 0a 65 73 63 61 70 65 0d 0a 62 69 72 64 0d 0a 65 61 72 74 68 0d 0a 61 70 70 6c 65 0d 0a 74 61 73 74 65 0d 0a 66 6f 6f Data Ascii: nehopegrouphiteggbookqueenflowerendinkarrowworldunderstandkitcheninsidesnakefriendquarterpicturefarmyesterdaycamerahelppizzamothertopgroupzebrafarmdarkhighescapebirdearthappletastefoo
2023-08-29 05:50:57 UTC	2222	IN	Data Raw: 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 76 69 64 65 6f 0d 0a 7a 69 70 70 65 72 0d 0a 62 6f 6f 6b 0d 0a 76 6f 69 63 65 0d 0a 69 6e 6b 0d 0a 63 6f 6c 6f 72 0d 0a 67 69 72 6c 0d 0a 62 6f 79 0d 0a 74 65 73 74 0d 0a 62 61 6c 6c 0d 0a 66 75 6e 63 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 71 75 65 65 6e 0d 0a 67 6f 61 74 0d 0a 6a 61 63 6b 65 74 0d 0a 6d 75 73 69 63 0d 0a 66 61 74 68 65 72 0d 0a 67 6f 61 74 0d 0a 77 61 79 0d 0a 77 61 72 6e 0d 0a 77 61 74 65 72 0d 0a 65 6e 65 72 67 79 0d 0a 61 6c 6f 6e 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 77 65 73 74 0d 0a 71 75 61 6c 69 66 79 0d 0a 6b 69 74 63 68 65 6e 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 6c 6f 76 65 0d 0a 61 69 72 0d 0a 73 6f 6e 67 0d 0a 69 63 6f 6e 0d 0a 72 65 64 0d 0a 6f 70 65 6e 0d 0a 66 61 74 68 65 Data Ascii: informationvideozipperbookvoiceinkcolorgirlboytestballfuncinformationqueengoatjacketmusicfathergoatwaywarnwaterenergyaloneunsignedwestqualifykitchenquestionloveairsongiconredopenfathe
2023-08-29 05:50:57 UTC	2238	IN	Data Raw: 61 79 0d 0a 73 6b 79 0d 0a 6d 6f 74 68 65 72 0d 0a 66 69 73 68 0d 0a 6b 69 74 65 0d 0a 68 61 6e 64 0d 0a 71 75 65 65 6e 0d 0a 66 6c 6f 77 65 72 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 70 65 6e 0d 0a 75 73 75 61 6c 6c 79 0d 0a 74 61 73 74 65 0d 0a 77 6f 6d 61 6e 0d 0a 6f 70 65 6e 0d 0a 75 6e 69 74 0d 0a 6e 6f 73 65 0d 0a 7a 6f 6d 62 69 65 0d 0a 72 69 76 65 72 0d 0a 68 6f 70 65 0d 0a 63 6f 77 0d 0a 67 72 65 65 6e 0d 0a 6f 66 66 69 63 65 0d 0a 62 6f 78 0d 0a 67 72 65 65 6e 0d 0a 67 75 65 73 74 0d 0a 6e 61 74 75 72 65 0d 0a 6c 61 6d 70 0d 0a 74 6f 70 0d 0a 69 6e 74 0d 0a 68 65 61 64 0d 0a 65 6e 64 0d 0a 61 6c 6f 6e 65 0d 0a 77 68 69 6c 65 0d 0a 65 61 74 0d 0a 74 65 61 63 68 65 72 0d 0a 72 65 64 0d 0a 61 77 61 72 64 0d 0a 73 74 61 72 0d 0a 65 61 73 74 0d 0a 61 63 Data Ascii: ayskymotherfishkitehandqueenflowerunsignedpenusuallytastewomanopenunitnosezombieriverhopecowgreenofficeboxgreenguestnaturelamptopintheadendalonewhileeatteacherredawardstareastac
2023-08-29 05:50:57 UTC	2254	IN	Data Raw: 65 67 0d 0a 67 72 6f 75 70 0d 0a 79 61 77 6e 0d 0a 6e 6f 74 65 0d 0a 63 6c 6f 75 64 0d 0a 6f 72 61 6e 67 65 0d 0a 77 61 72 6e 0d 0a 6c 65 67 0d 0a 63 6f 61 74 0d 0a 6c 61 6e 64 0d 0a 61 69 72 0d 0a 66 61 6c 6c 0d 0a 62 6f 79 0d 0a 74 69 67 65 72 0d 0a 75 73 65 0d 0a 73 74 6f 6e 65 0d 0a 71 75 69 65 74 0d 0a 76 69 63 74 6f 72 79 0d 0a 66 61 74 68 65 72 0d 0a 6e 6f 73 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 64 61 79 0d 0a 61 77 61 72 64 0d 0a 6f 72 61 6e 67 65 0d 0a 73 6f 6e 67 0d 0a 7a 6f 6d 62 69 65 0d 0a 76 61 6e 0d 0a 70 69 6e 6b 0d 0a 74 69 67 65 72 0d 0a 72 69 76 65 72 0d 0a 69 73 6c 61 6e 64 0d 0a 63 6f 61 74 0d 0a 63 6f 61 74 0d 0a 63 6f 61 74 0d 0a 69 6e 73 69 64 65 0d 0a 68 69 74 0d 0a 6d 6f 74 68 65 72 0d 0a 68 65 61 64 0d 0a 66 69 73 68 0d 0a 70 Data Ascii: eggroupyawnnotecloudorangewarnlegcoatlandairfallboytigerusestonequietvictoryfathernoseunsigneddayawardorangesongzombievanpinktigerriverislandcoatcoatcoatinsidehitmotherheadfishp
2023-08-29 05:50:57 UTC	2269	IN	Data Raw: 0d 0a 73 65 76 65 6e 0d 0a 67 72 65 65 6e 0d 0a 64 6f 0d 0a 6e 6f 74 65 0d 0a 6f 66 66 65 72 0d 0a 75 73 65 0d 0a 72 65 73 74 0d 0a 73 74 6f 6e 65 0d 0a 74 65 61 63 68 65 72 0d 0a 63 6f 6c 6f 72 0d 0a 78 79 6c 65 6d 0d 0a 65 79 65 0d 0a 62 6f 78 0d 0a 73 6e 61 6b 65 0d 0a 69 6e 73 69 64 65 0d 0a 66 61 63 65 0d 0a 70 61 70 65 72 0d 0a 79 65 73 0d 0a 63 69 74 79 0d 0a 79 61 72 64 0d 0a 6c 75 6e 63 68 0d 0a 73 65 76 65 6e 0d 0a 66 69 73 68 0d 0a 6d 6f 6e 6b 65 79 0d 0a 77 65 73 74 0d 0a 74 61 6c 6b 0d 0a 6a 61 72 0d 0a 6b 69 64 0d 0a 65 73 63 61 70 65 0d 0a 68 69 67 68 0d 0a 73 6f 6e 67 0d 0a 79 61 77 6e 0d 0a 65 64 67 65 0d 0a 65 61 74 0d 0a 73 74 61 72 0d 0a 6d 75 73 69 63 0d 0a 65 61 73 74 0d 0a 63 6c 6f 75 64 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 73 6e 61 Data Ascii: sevengreendonoteofferusereststoneteachercolorxylemeyeboxsnakeinsidefacepaperyescityyardlunchsevenfishmonkeywesttalkjarkidescapehighsongyawnedgeeatstarmusiceastcloudquestionsna
2023-08-29 05:50:57 UTC	2285	IN	Data Raw: 77 0d 0a 65 79 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 77 68 69 74 65 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 62 61 6e 61 6e 61 0d 0a 79 65 73 0d 0a 73 75 67 61 72 0d 0a 6c 61 75 67 68 0d 0a 62 61 6c 6c 0d 0a 72 75 6e 0d 0a 64 61 6e 63 65 0d 0a 63 6c 6f 75 64 0d 0a 74 65 61 63 68 65 72 0d 0a 6a 61 76 61 0d 0a 7a 6f 6d 62 69 65 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 74 65 73 74 0d 0a 6a 61 63 6b 65 74 0d 0a 6f 6e 65 0d 0a 63 69 74 79 0d 0a 63 61 6d 65 72 61 0d 0a 70 65 61 72 0d 0a 65 61 73 74 0d 0a 6d 65 61 6c 0d 0a 69 6e 73 69 64 65 0d 0a 63 61 72 0d 0a 6d 69 6c 6b 0d 0a 67 6c 61 73 73 0d 0a 69 73 6c 61 6e 64 0d 0a 76 61 6c 75 65 0d 0a 66 69 72 65 0d 0a 6e 61 74 75 72 65 0d 0a 6e 6f 72 74 68 0d 0a 67 72 65 65 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 65 Data Ascii: weyeundergroundwhiteyesterdaybananayessugarlaughballrundancecloudteacherjavazombieuniversitytestjacketonecitycamerapeareastmealinsidecarmilkglassislandvaluefirenaturenorthgreenyellowe
2023-08-29 05:50:57 UTC	2301	IN	Data Raw: 6f 6e 65 0d 0a 62 6f 79 0d 0a 7a 6f 6f 0d 0a 6d 61 63 68 69 6e 65 0d 0a 71 75 61 6c 69 66 79 0d 0a 64 65 73 6b 0d 0a 74 6f 77 6e 0d 0a 62 6f 79 0d 0a 6f 72 61 6e 67 65 0d 0a 76 61 6e 0d 0a 72 61 62 62 69 74 0d 0a 6e 61 74 75 72 65 0d 0a 63 69 74 79 0d 0a 70 69 6e 6b 0d 0a 62 65 61 63 68 0d 0a 65 73 63 61 70 65 0d 0a 69 73 73 75 65 0d 0a 6d 65 6e 74 0d 0a 6c 61 75 67 68 0d 0a 67 72 65 65 6e 0d 0a 6d 61 6e 0d 0a 70 65 61 72 0d 0a 72 6f 61 64 0d 0a 79 61 72 64 0d 0a 70 69 6e 6b 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 65 79 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 63 68 61 72 0d 0a 7a 65 62 72 61 0d 0a 6d 61 70 0d 0a 63 61 6d 65 72 61 0d 0a 69 6e 73 69 64 65 0d 0a 70 69 63 74 75 72 65 0d 0a 68 65 6c 70 0d 0a 65 79 65 0d 0a 71 75 6f 74 65 0d 0a 65 67 Data Ascii: oneboyzoomachinequalifydesktownboyorangevanrabbitnaturecitypinkbeachescapeissuementlaughgreenmanpearroadyardpinkuniversityeyeundergroundcharzebramapcamerainsidepicturehelpeyequoteeg
2023-08-29 05:50:57 UTC	2317	IN	Data Raw: 0a 64 6f 6f 72 0d 0a 70 6f 77 65 72 0d 0a 74 72 65 65 0d 0a 6b 69 64 0d 0a 77 61 72 6e 0d 0a 6b 69 73 73 0d 0a 61 77 61 72 64 0d 0a 6e 75 72 73 65 0d 0a 67 6c 61 73 73 0d 0a 65 73 63 61 70 65 0d 0a 65 69 67 68 74 0d 0a 6e 69 67 68 74 0d 0a 74 6f 77 6e 0d 0a 77 65 65 6b 0d 0a 65 73 63 61 70 65 0d 0a 73 68 6f 72 74 0d 0a 61 72 63 68 0d 0a 73 6f 6e 67 0d 0a 63 61 72 0d 0a 6d 65 6e 74 0d 0a 6b 65 79 0d 0a 71 75 61 72 74 65 72 0d 0a 63 6f 6c 6f 72 0d 0a 6a 61 72 0d 0a 6a 61 72 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 74 72 65 65 0d 0a 76 69 64 65 6f 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 75 6e 69 74 0d 0a 64 75 63 6b 0d 0a 65 73 63 61 70 65 0d 0a 64 61 79 0d 0a 70 65 72 73 6f 6e 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 66 6f 6f 74 0d 0a 76 61 6c 75 65 0d 0a Data Ascii: doorpowertreekidwarnkissawardnurseglassescapeeightnighttownweekescapeshortarchsongcarmentkeyquartercolorjarjarunderstandtreevideouniversityunitduckescapedaypersonknowledgefootvalue
2023-08-29 05:50:57 UTC	2333	IN	Data Raw: 0a 69 64 65 61 0d 0a 73 6f 6e 67 0d 0a 68 61 69 72 0d 0a 74 69 67 65 72 0d 0a 7a 6f 6f 0d 0a 63 61 6b 65 0d 0a 73 63 68 6f 6f 6c 0d 0a 77 68 69 6c 65 0d 0a 76 6f 69 63 65 0d 0a 6b 65 65 70 0d 0a 63 68 61 72 0d 0a 6e 75 6d 62 65 72 0d 0a 61 70 70 6c 65 0d 0a 7a 6f 6e 65 0d 0a 6e 75 6d 62 65 72 0d 0a 65 6e 65 72 67 79 0d 0a 6b 69 73 73 0d 0a 6e 75 72 73 65 0d 0a 63 6f 61 74 0d 0a 66 6f 6f 64 0d 0a 65 61 72 0d 0a 79 65 61 72 0d 0a 70 65 72 73 6f 6e 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 65 64 67 65 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6b 69 73 73 0d 0a 6e 61 74 75 72 65 0d 0a 6c 6f 6e 67 0d 0a 63 6c 69 70 0d 0a 77 61 74 65 72 0d 0a 6c 6f 76 65 0d 0a 62 61 6e 6b 0d 0a 6b 69 6e 67 0d 0a 6d 6f 74 68 65 72 0d 0a 66 6c 6f 77 65 72 Data Ascii: ideasonghairtigerzoocakeschoolwhilevoicekeepcharnumberapplezonenumberenergykissnursecoatfoodearyearpersonvegetableedgeunderstandmachinekissnaturelongclipwaterlovebankkingmotherflower
2023-08-29 05:50:57 UTC	2349	IN	Data Raw: 0a 6c 69 66 65 0d 0a 62 61 6e 61 6e 61 0d 0a 6e 65 65 64 0d 0a 6a 61 72 0d 0a 76 61 6e 0d 0a 6b 69 64 0d 0a 75 73 75 61 6c 6c 79 0d 0a 63 6c 69 70 0d 0a 71 75 69 63 6b 0d 0a 7a 6f 6e 65 0d 0a 65 69 67 68 74 0d 0a 63 61 6d 65 72 61 0d 0a 66 69 73 68 0d 0a 66 61 6c 6c 0d 0a 67 61 6d 65 0d 0a 62 6f 6f 6b 0d 0a 67 61 6d 65 0d 0a 6f 66 66 69 63 65 0d 0a 73 6e 61 6b 65 0d 0a 62 6f 79 0d 0a 73 74 6f 6e 65 0d 0a 72 6f 6f 6d 0d 0a 61 69 72 0d 0a 6b 69 6e 64 0d 0a 66 6c 6f 77 65 72 0d 0a 6c 65 67 0d 0a 74 72 65 65 0d 0a 73 6e 61 6b 65 0d 0a 6b 65 65 70 0d 0a 7a 65 61 6c 0d 0a 72 6f 6f 6d 0d 0a 79 61 77 6e 0d 0a 76 61 6c 75 65 0d 0a 6f 70 65 6e 0d 0a 6d 6f 6f 6e 0d 0a 61 72 63 68 0d 0a 6d 65 61 6c 0d 0a 6e 69 67 68 74 0d 0a 6c 6f 6e 67 0d 0a 6e 75 72 73 65 0d 0a 69 Data Ascii: lifebanananeedjarvankidusuallyclipquickzoneeightcamerafishfallgamebookgameofficesnakeboystoneroomairkindflowerlegtreesnakekeepzealroomyawnvalueopenmoonarchmealnightlongnursei
2023-08-29 05:50:57 UTC	2365	IN	Data Raw: 68 65 61 72 74 0d 0a 73 6f 6e 67 0d 0a 6a 75 64 67 65 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 75 73 75 61 6c 6c 79 0d 0a 70 68 6f 6e 65 0d 0a 68 69 67 68 0d 0a 76 69 63 74 6f 72 79 0d 0a 70 65 61 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 6f 69 6c 0d 0a 6d 6f 6f 6e 0d 0a 76 69 64 65 6f 0d 0a 77 6f 6d 61 6e 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 77 68 69 6c 65 0d 0a 65 61 73 79 0d 0a 73 6b 79 0d 0a 69 63 65 0d 0a 77 69 6e 64 0d 0a 6f 63 65 61 6e 0d 0a 6d 65 6e 74 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 61 6e 69 6d 61 6c 0d 0a 74 61 73 74 65 0d 0a 65 69 67 68 74 0d 0a 63 61 74 0d 0a 76 69 65 77 0d 0a 64 6f 0d 0a 6c 69 66 65 0d 0a 67 72 65 65 6e 0d 0a 67 6c 61 73 73 0d 0a 61 72 72 61 79 0d 0a 7a 65 61 6c 0d 0a 6d 61 6e 0d 0a 77 65 65 6b 0d 0a 74 65 61 63 68 65 72 Data Ascii: heartsongjudgeinformationusuallyphonehighvictorypearyellowoilmoonvideowomanKanthanwhileeasyskyicewindoceanmentundergroundanimaltasteeightcatviewdolifegreenglassarrayzealmanweekteacher
2023-08-29 05:50:57 UTC	2381	IN	Data Raw: 72 0d 0a 6b 69 6e 67 0d 0a 79 65 61 72 6e 0d 0a 6f 66 66 69 63 65 0d 0a 76 61 6c 75 65 0d 0a 61 63 65 0d 0a 69 6e 6b 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 67 68 6f 73 74 0d 0a 65 61 73 79 0d 0a 62 75 73 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 6b 65 79 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 79 65 73 0d 0a 6f 62 6a 65 63 74 0d 0a 62 69 72 64 0d 0a 79 6f 75 6e 67 0d 0a 6d 75 73 69 63 0d 0a 75 6e 69 74 0d 0a 74 65 73 74 0d 0a 61 77 61 72 64 0d 0a 77 69 6e 64 0d 0a 64 61 72 6b 0d 0a 75 72 67 65 0d 0a 72 6f 6f 6d 0d 0a 6e 6f 74 65 0d 0a 64 61 74 61 0d 0a 75 73 65 0d 0a 6f 62 6a 65 63 74 0d 0a 65 67 67 0d 0a 66 6f 72 0d 0a 63 61 72 0d 0a 63 6c 6f 75 64 0d 0a 70 65 6e 0d 0a 6b 69 64 0d 0a 72 61 69 6e 0d 0a 7a 6f 6d 62 69 65 0d 0a 72 69 73 65 0d 0a 70 69 7a 7a 61 Data Ascii: rkingyearnofficevalueaceinkvacationghosteasybusquestionkeyundergroundyesobjectbirdyoungmusicunittestawardwinddarkurgeroomnotedatauseobjecteggforcarcloudpenkidrainzombierisepizza
2023-08-29 05:50:57 UTC	2397	IN	Data Raw: 0d 0a 72 75 6e 0d 0a 6a 65 6c 6c 79 0d 0a 72 69 76 65 72 0d 0a 69 6e 6b 0d 0a 6d 6f 76 69 65 0d 0a 6a 61 72 0d 0a 6c 61 6b 65 0d 0a 70 69 7a 7a 61 0d 0a 73 65 76 65 6e 0d 0a 62 6f 78 0d 0a 65 61 73 74 0d 0a 62 69 72 64 0d 0a 75 6e 69 74 0d 0a 73 65 76 65 6e 0d 0a 6a 75 64 67 65 0d 0a 6a 61 72 0d 0a 66 6f 72 0d 0a 68 61 6e 64 0d 0a 68 61 69 72 0d 0a 72 65 64 0d 0a 70 61 70 65 72 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 6c 65 67 0d 0a 72 6f 61 64 0d 0a 75 6e 63 6c 65 0d 0a 6d 6f 76 69 65 0d 0a 74 65 61 63 68 65 72 0d 0a 6a 61 63 6b 65 74 0d 0a 66 69 73 68 0d 0a 62 65 61 63 68 0d 0a 68 65 6c 70 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 70 65 72 73 6f 6e 0d 0a 6f 69 6c 0d 0a 65 6e 64 0d 0a 77 69 6e 64 0d 0a 6b 69 6e 67 0d 0a 72 65 64 0d 0a 64 61 6e 63 65 0d 0a Data Ascii: runjellyriverinkmoviejarlakepizzasevenboxeastbirdunitsevenjudgejarforhandhairredpaperquantitylegroadunclemovieteacherjacketfishbeachhelpundergroundpersonoilendwindkingreddance
2023-08-29 05:50:57 UTC	2413	IN	Data Raw: 79 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 65 61 72 74 68 0d 0a 76 69 63 74 6f 72 79 0d 0a 77 6f 72 6c 64 0d 0a 6f 72 64 65 72 0d 0a 75 72 67 65 0d 0a 61 70 70 6c 65 0d 0a 70 6f 77 65 72 0d 0a 73 74 72 69 6e 67 0d 0a 6b 65 65 70 0d 0a 63 69 74 79 0d 0a 66 6f 72 0d 0a 6d 65 6e 74 0d 0a 72 6f 63 6b 0d 0a 68 6f 75 73 65 0d 0a 72 65 73 74 0d 0a 70 65 6e 0d 0a 73 65 61 0d 0a 73 74 61 72 0d 0a 73 65 76 65 6e 0d 0a 70 68 6f 6e 65 0d 0a 73 74 72 69 6e 67 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 61 77 61 72 64 0d 0a 70 6f 77 65 72 0d 0a 61 6c 6f 6e 65 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 61 77 61 72 64 0d 0a 64 75 63 6b 0d 0a 6d 61 70 0d 0a 6c 65 67 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6d 61 63 68 69 6e 65 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 65 61 74 0d 0a 67 6f Data Ascii: yvacationearthvictoryworldorderurgeapplepowerstringkeepcityformentrockhouserestpenseastarsevenphonestringinformationawardpoweralonequestionawardduckmapleguniversitymachinejourneyeatgo
2023-08-29 05:50:57 UTC	2429	IN	Data Raw: 6e 6f 74 65 0d 0a 68 61 69 72 0d 0a 6e 65 65 64 0d 0a 63 6c 6f 75 64 0d 0a 62 61 6e 61 6e 61 0d 0a 6b 69 6e 67 0d 0a 6c 61 6e 64 0d 0a 76 61 6e 0d 0a 70 65 61 72 0d 0a 6b 65 79 0d 0a 61 6e 69 6d 61 6c 0d 0a 69 6e 73 69 64 65 0d 0a 7a 6f 6e 65 0d 0a 69 6e 74 0d 0a 79 65 61 72 6e 0d 0a 7a 6f 6f 0d 0a 70 61 70 65 72 0d 0a 6b 65 65 70 0d 0a 70 69 63 74 75 72 65 0d 0a 65 61 72 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 70 68 6f 6e 65 0d 0a 7a 65 62 72 61 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 75 73 75 61 6c 6c 79 0d 0a 75 6e 69 74 0d 0a 66 75 6e 63 0d 0a 6c 61 6e 64 0d 0a 70 6f 77 65 72 0d 0a 74 6f 77 6e 0d 0a 62 65 61 63 68 0d 0a 6a 61 72 0d 0a 6a 61 76 61 0d 0a 72 6f 61 64 0d 0a 74 72 61 69 6e 0d 0a 69 6e 74 0d 0a 68 61 6e 64 0d 0a 6f 69 6c Data Ascii: notehairneedcloudbananakinglandvanpearkeyanimalinsidezoneintyearnzoopaperkeeppictureearvacationpersonphonezebravegetableusuallyunitfunclandpowertownbeachjarjavaroadtraininthandoil
2023-08-29 05:50:57 UTC	2445	IN	Data Raw: 68 65 72 0d 0a 77 68 69 74 65 0d 0a 70 69 6e 6b 0d 0a 6e 6f 73 65 0d 0a 6d 61 70 0d 0a 6c 65 67 0d 0a 63 6c 69 70 0d 0a 63 6c 6f 75 64 0d 0a 6f 6e 65 0d 0a 79 61 77 6e 0d 0a 68 6f 70 65 0d 0a 71 75 65 65 6e 0d 0a 68 61 74 0d 0a 66 69 73 68 0d 0a 73 65 76 65 6e 0d 0a 68 69 67 68 0d 0a 75 73 65 0d 0a 68 65 61 64 0d 0a 70 65 61 72 0d 0a 66 61 74 68 65 72 0d 0a 75 73 65 0d 0a 6b 69 6e 67 0d 0a 77 6f 72 6b 0d 0a 6f 62 6a 65 63 74 0d 0a 72 61 69 6e 0d 0a 68 6f 70 65 0d 0a 6f 62 6a 65 63 74 0d 0a 78 79 6c 65 6d 0d 0a 66 6f 72 0d 0a 6e 6f 74 65 0d 0a 70 69 6e 6b 0d 0a 6e 65 65 64 0d 0a 6c 6f 6e 67 0d 0a 70 6f 77 65 72 0d 0a 67 72 61 73 73 0d 0a 77 65 73 74 0d 0a 70 69 6e 6b 0d 0a 77 68 69 74 65 0d 0a 67 6f 6c 64 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 65 64 Data Ascii: herwhitepinknosemaplegclipcloudoneyawnhopequeenhatfishsevenhighuseheadpearfatherusekingworkobjectrainhopeobjectxylemfornotepinkneedlongpowergrasswestpinkwhitegoldinformationed
2023-08-29 05:50:57 UTC	2461	IN	Data Raw: 0a 6d 6f 76 69 65 0d 0a 63 61 6d 65 72 61 0d 0a 70 61 70 65 72 0d 0a 6d 69 6c 6b 0d 0a 66 6f 72 0d 0a 6e 6f 73 65 0d 0a 66 6f 6f 74 0d 0a 68 61 69 72 0d 0a 66 61 74 68 65 72 0d 0a 74 6f 70 0d 0a 73 6f 6e 67 0d 0a 74 65 61 63 68 65 72 0d 0a 73 6e 61 6b 65 0d 0a 62 61 6e 6b 0d 0a 66 61 72 6d 0d 0a 66 6c 6f 77 65 72 0d 0a 6e 65 65 64 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 68 65 6c 70 0d 0a 73 65 61 0d 0a 75 73 65 0d 0a 66 75 6e 63 0d 0a 66 6f 72 0d 0a 62 6f 79 0d 0a 64 61 79 0d 0a 61 72 74 0d 0a 70 65 61 72 0d 0a 63 6f 61 74 0d 0a 65 64 67 65 0d 0a 77 69 6e 74 65 72 0d 0a 6c 65 67 0d 0a 70 65 61 72 0d 0a 74 69 67 65 72 0d 0a 70 61 70 65 72 0d 0a 67 75 65 73 74 0d 0a 79 65 73 0d 0a 7a 65 72 6f 0d 0a 6b 69 63 6b 0d 0a 6c 61 6b 65 0d 0a 6a 75 64 67 65 0d 0a 6d 6f 74 Data Ascii: moviecamerapapermilkfornosefoothairfathertopsongteachersnakebankfarmflowerneedKanthanhelpseausefuncforboydayartpearcoatedgewinterlegpeartigerpaperguestyeszerokicklakejudgemot
2023-08-29 05:50:57 UTC	2477	IN	Data Raw: 69 74 6f 72 0d 0a 64 72 65 61 6d 0d 0a 65 69 67 68 74 0d 0a 74 69 67 65 72 0d 0a 68 69 67 68 0d 0a 6c 61 75 67 68 0d 0a 70 65 61 72 0d 0a 74 6f 70 0d 0a 6e 61 74 75 72 65 0d 0a 6d 61 63 68 69 6e 65 0d 0a 7a 65 62 72 61 0d 0a 74 6f 70 0d 0a 6a 6f 79 0d 0a 6d 65 61 6c 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 64 75 63 6b 0d 0a 64 6f 6f 72 0d 0a 6c 61 6e 64 0d 0a 68 61 74 0d 0a 74 65 61 63 68 65 72 0d 0a 61 69 72 0d 0a 61 72 74 0d 0a 77 6f 6d 61 6e 0d 0a 61 63 65 0d 0a 79 65 73 0d 0a 75 72 67 65 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 65 61 72 74 68 0d 0a 63 6f 61 74 0d 0a 65 79 65 0d 0a 72 61 69 6e 0d 0a 73 68 6f 72 74 0d 0a 6b 65 65 70 0d 0a 6b 69 63 6b 0d 0a 73 65 76 65 6e 0d 0a 6e 6f 73 65 0d 0a 6b 69 6e 64 0d 0a 6f 66 66 65 72 0d 0a 62 6c 75 65 0d 0a Data Ascii: itordreameighttigerhighlaughpeartopnaturemachinezebratopjoymealinformationduckdoorlandhatteacherairartwomanaceyesurgeknowledgeearthcoateyerainshortkeepkicksevennosekindofferblue
2023-08-29 05:50:57 UTC	2493	IN	Data Raw: 72 65 65 6e 0d 0a 65 6e 64 0d 0a 6b 69 64 0d 0a 64 75 63 6b 0d 0a 74 65 73 74 0d 0a 72 6f 63 6b 0d 0a 6c 61 6b 65 0d 0a 6b 69 74 63 68 65 6e 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 61 63 65 0d 0a 72 69 76 65 72 0d 0a 6f 62 6a 65 63 74 0d 0a 72 65 73 74 0d 0a 79 65 6c 6c 6f 77 0d 0a 66 69 73 68 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 65 61 72 74 68 0d 0a 67 72 61 73 73 0d 0a 61 6c 6f 6e 65 0d 0a 66 61 72 6d 0d 0a 77 69 6e 74 65 72 0d 0a 69 73 6c 61 6e 64 0d 0a 67 72 6f 75 70 0d 0a 69 63 65 0d 0a 6c 6f 76 65 0d 0a 67 6c 61 73 73 0d 0a 66 6c 6f 77 65 72 0d 0a 6d 6f 74 68 65 72 0d 0a 67 6f 61 74 0d 0a 67 61 6d 65 0d 0a 77 65 73 74 0d 0a 79 65 6c 6c 6f 77 0d 0a 65 6e 64 0d 0a 6c 65 67 0d 0a 6e 61 74 75 72 65 0d 0a 73 68 6f 72 74 0d 0a 62 61 6c 6c 0d 0a 6b 69 6e 64 0d Data Ascii: reenendkidducktestrocklakekitchenKanthanaceriverobjectrestyellowfishvegetableearthgrassalonefarmwinterislandgroupiceloveglassflowermothergoatgamewestyellowendlegnatureshortballkind
2023-08-29 05:50:57 UTC	2509	IN	Data Raw: 72 79 0d 0a 73 65 61 0d 0a 69 73 73 75 65 0d 0a 6b 69 73 73 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 71 75 61 6e 74 69 74 79 0d 0a 63 61 6b 65 0d 0a 64 61 74 61 0d 0a 73 68 6f 72 74 0d 0a 6c 61 6e 64 0d 0a 71 75 65 65 6e 0d 0a 6b 69 6e 64 0d 0a 70 65 61 72 0d 0a 6b 6e 6f 77 6c 65 64 67 65 0d 0a 63 61 74 0d 0a 7a 65 62 72 61 0d 0a 63 69 74 79 0d 0a 6c 61 75 67 68 0d 0a 77 68 69 6c 65 0d 0a 75 72 67 65 0d 0a 6e 65 65 64 0d 0a 73 65 61 0d 0a 6f 66 66 65 72 0d 0a 69 6e 73 69 64 65 0d 0a 62 61 6e 61 6e 61 0d 0a 79 65 61 72 0d 0a 6d 61 70 0d 0a 64 6f 0d 0a 62 61 6e 61 6e 61 0d 0a 66 6f 72 0d 0a 77 69 6e 64 0d 0a 6a 61 76 61 0d 0a 76 69 73 69 74 6f 72 0d 0a 66 6f 6f 74 0d 0a 78 79 6c 65 6d 0d 0a 74 6f 70 0d 0a 6b 69 74 65 0d 0a 6c 6f 76 65 0d 0a 66 61 6c 6c Data Ascii: ryseaissuekissundergroundquantitycakedatashortlandqueenkindpearknowledgecatzebracitylaughwhileurgeneedseaofferinsidebananayearmapdobananaforwindjavavisitorfootxylemtopkitelovefall
2023-08-29 05:50:57 UTC	2525	IN	Data Raw: 67 0d 0a 62 69 72 64 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 75 72 67 65 0d 0a 72 69 73 65 0d 0a 68 61 69 72 0d 0a 79 6f 75 6e 67 0d 0a 67 69 72 6c 0d 0a 75 6e 63 6c 65 0d 0a 64 61 72 6b 0d 0a 70 65 61 72 0d 0a 76 61 6e 0d 0a 77 69 6e 74 65 72 0d 0a 77 61 79 0d 0a 72 69 73 65 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 66 61 74 68 65 72 0d 0a 6f 66 66 65 72 0d 0a 6e 61 74 75 72 65 0d 0a 6b 65 65 70 0d 0a 72 75 6e 0d 0a 79 61 72 64 0d 0a 69 6e 63 6f 6d 65 0d 0a 72 6f 63 6b 0d 0a 6f 70 65 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 67 6f 61 74 0d 0a 7a 65 61 6c 0d 0a 7a 6f 6e 65 0d 0a 6c 65 74 74 65 72 0d 0a 74 65 61 63 68 65 72 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 69 73 6c 61 6e 64 0d 0a 69 64 65 61 0d 0a 75 72 67 65 0d 0a 65 73 63 61 70 65 0d 0a 64 61 6e 63 65 0d 0a Data Ascii: gbirdunsignedurgerisehairyounggirluncledarkpearvanwinterwayriseundergroundfatheroffernaturekeeprunyardincomerockopenpersongoatzealzoneletterteachervegetableislandideaurgeescapedance
2023-08-29 05:50:57 UTC	2541	IN	Data Raw: 6c 65 0d 0a 63 6f 61 74 0d 0a 64 75 63 6b 0d 0a 6f 66 66 69 63 65 0d 0a 77 6f 72 6b 0d 0a 6a 6f 79 0d 0a 6d 69 6c 6b 0d 0a 61 70 70 6c 65 0d 0a 61 63 65 0d 0a 75 6e 69 74 0d 0a 6f 66 66 69 63 65 0d 0a 64 61 6e 63 65 0d 0a 6e 6f 73 65 0d 0a 6f 62 6a 65 63 74 0d 0a 6c 61 6d 70 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 66 6f 72 0d 0a 66 69 73 68 0d 0a 73 6e 61 6b 65 0d 0a 67 72 61 73 73 0d 0a 71 75 6f 74 65 0d 0a 73 65 76 65 6e 0d 0a 65 69 67 68 74 0d 0a 65 61 73 74 0d 0a 63 68 61 72 0d 0a 77 68 69 74 65 0d 0a 62 61 6e 6b 0d 0a 6c 6f 76 65 0d 0a 72 61 69 6e 0d 0a 76 69 65 77 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 61 6e 69 6d 61 6c 0d 0a 6f 69 6c 0d 0a 76 61 6e 0d 0a 77 6f 72 6b 0d 0a 6d 6f 6f 6e 0d 0a 66 61 74 68 65 72 0d 0a 63 61 6d 65 72 61 0d 0a 6a 6f 75 72 6e 65 79 0d Data Ascii: lecoatduckofficeworkjoymilkappleaceunitofficedancenoseobjectlampjourneyforfishsnakegrassquoteseveneighteastcharwhitebankloverainviewjourneyanimaloilvanworkmoonfathercamerajourney
2023-08-29 05:50:57 UTC	2557	IN	Data Raw: 65 72 0d 0a 69 6e 63 6f 6d 65 0d 0a 63 6c 69 70 0d 0a 6c 75 6e 63 68 0d 0a 65 79 65 0d 0a 6e 61 74 75 72 65 0d 0a 62 61 6c 6c 0d 0a 66 61 6c 6c 0d 0a 64 75 63 6b 0d 0a 6b 69 6e 64 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 65 61 73 79 0d 0a 6c 65 67 0d 0a 63 6c 6f 75 64 0d 0a 71 75 6f 74 65 0d 0a 6e 61 6d 65 0d 0a 77 69 6e 64 0d 0a 79 61 77 6e 0d 0a 67 68 6f 73 74 0d 0a 61 6e 74 0d 0a 6c 6f 76 65 0d 0a 65 72 72 6f 72 0d 0a 75 6e 64 65 72 67 72 6f 75 6e 64 0d 0a 6d 69 6c 6b 0d 0a 75 6e 69 74 0d 0a 79 6f 75 6e 67 0d 0a 67 68 6f 73 74 0d 0a 6f 72 64 65 72 0d 0a 66 61 6c 6c 0d 0a 73 75 6e 0d 0a 61 72 63 68 0d 0a 65 67 67 0d 0a 63 69 74 79 0d 0a 6f 69 6c 0d 0a 77 65 73 74 0d 0a 6b 69 73 73 0d 0a 68 69 67 68 0d 0a 6a 6f 79 0d 0a 6e 6f 72 74 68 0d 0a 71 75 69 65 74 0d 0a Data Ascii: erincomeclipluncheyenatureballfallduckkindKanthaneasylegcloudquotenamewindyawnghostantloveerrorundergroundmilkunityoungghostorderfallsunarcheggcityoilwestkisshighjoynorthquiet
2023-08-29 05:50:57 UTC	2573	IN	Data Raw: 72 0d 0a 65 73 63 61 70 65 0d 0a 70 6c 61 6e 74 0d 0a 72 6f 63 6b 0d 0a 6b 69 6e 67 0d 0a 7a 6f 6f 0d 0a 69 63 65 0d 0a 6e 6f 73 65 0d 0a 61 77 61 72 64 0d 0a 6c 6f 76 65 0d 0a 63 61 6d 65 72 61 0d 0a 70 69 7a 7a 61 0d 0a 79 65 73 0d 0a 63 6f 77 0d 0a 7a 69 70 70 65 72 0d 0a 66 61 6c 6c 0d 0a 74 6f 70 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 67 72 61 73 73 0d 0a 6c 61 6b 65 0d 0a 75 6e 69 74 0d 0a 63 6c 6f 75 64 0d 0a 79 65 6c 6c 6f 77 0d 0a 77 6f 72 6c 64 0d 0a 73 65 76 65 6e 0d 0a 62 6f 78 0d 0a 6a 6f 79 0d 0a 77 69 6e 74 65 72 0d 0a 70 6f 77 65 72 0d 0a 76 6f 69 63 65 0d 0a 66 6f 6f 64 0d 0a 71 75 61 72 74 65 72 0d 0a 6a 61 76 61 0d 0a 64 61 79 0d 0a 76 69 73 69 74 6f 72 0d 0a 65 61 74 0d 0a 6b 69 73 73 0d 0a 6c 6f 6e 67 0d 0a 73 6e 6f 77 0d 0a 66 75 6e 63 Data Ascii: rescapeplantrockkingzooicenoseawardlovecamerapizzayescowzipperfalltopvacationgrasslakeunitcloudyellowworldsevenboxjoywinterpowervoicefoodquarterjavadayvisitoreatkisslongsnowfunc
2023-08-29 05:50:57 UTC	2589	IN	Data Raw: 72 73 65 0d 0a 6f 62 6a 65 63 74 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 62 6f 78 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 72 6f 6f 6d 0d 0a 67 75 65 73 74 0d 0a 79 61 72 64 0d 0a 7a 65 62 72 61 0d 0a 71 75 69 65 74 0d 0a 6c 6f 76 65 0d 0a 7a 69 70 70 65 72 0d 0a 64 6f 6f 72 0d 0a 6b 65 65 70 0d 0a 70 69 7a 7a 61 0d 0a 62 6f 79 0d 0a 71 75 69 65 74 0d 0a 79 65 73 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 6a 61 72 0d 0a 79 65 61 72 6e 0d 0a 75 73 75 61 6c 6c 79 0d 0a 6d 6f 6e 6b 65 79 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 7a 6f 6d 62 69 65 0d 0a 6a 6f 6b 65 0d 0a 6b 69 6e 64 0d 0a 79 61 77 6e 0d 0a 6f 72 64 65 72 0d 0a 61 72 74 0d 0a 68 61 6e 64 0d 0a 64 65 73 6b 0d 0a 6b 69 6e 67 0d 0a 72 65 73 74 0d 0a 69 64 65 61 0d 0a 6b 69 73 73 0d 0a 63 6f 61 74 0d 0a 75 Data Ascii: rseobjectvegetableboxunderstandroomguestyardzebraquietlovezipperdoorkeeppizzaboyquietyesunsignedjaryearnusuallymonkeyvegetablezombiejokekindyawnorderarthanddeskkingrestideakisscoatu
2023-08-29 05:50:57 UTC	2605	IN	Data Raw: 74 65 61 63 68 65 72 0d 0a 66 6f 72 0d 0a 79 61 77 6e 0d 0a 61 72 63 68 0d 0a 74 6f 77 6e 0d 0a 69 64 65 61 0d 0a 62 6c 75 65 0d 0a 70 65 61 72 0d 0a 72 6f 61 64 0d 0a 6c 75 6e 63 68 0d 0a 6f 63 65 61 6e 0d 0a 74 61 73 74 65 0d 0a 6e 61 6d 65 0d 0a 6b 65 65 70 0d 0a 70 6c 61 6e 74 0d 0a 70 68 6f 6e 65 0d 0a 66 6f 72 0d 0a 6c 75 6e 63 68 0d 0a 65 61 74 0d 0a 62 69 72 64 0d 0a 6c 6f 76 65 0d 0a 77 61 72 6e 0d 0a 67 61 6d 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 67 6f 6c 64 0d 0a 73 75 67 61 72 0d 0a 65 64 67 65 0d 0a 64 6f 0d 0a 66 61 74 68 65 72 0d 0a 72 6f 61 64 0d 0a 74 72 61 69 6e 0d 0a 73 74 61 72 0d 0a 6e 6f 73 65 0d 0a 69 73 6c 61 6e 64 0d 0a 71 75 61 6c 69 66 79 0d 0a 6b 69 63 6b 0d 0a 72 69 76 65 72 0d 0a 7a 6f 6d 62 69 65 0d 0a 66 6f 6f 74 0d 0a 77 Data Ascii: teacherforyawnarchtownideabluepearroadlunchoceantastenamekeepplantphoneforluncheatbirdlovewarngameunsignedgoldsugaredgedofatherroadtrainstarnoseislandqualifykickriverzombiefootw
2023-08-29 05:50:57 UTC	2621	IN	Data Raw: 61 73 79 0d 0a 76 69 63 74 6f 72 79 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 70 61 70 65 72 0d 0a 6e 6f 74 65 0d 0a 65 61 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 74 61 6c 6b 0d 0a 76 6f 69 63 65 0d 0a 65 61 73 74 0d 0a 61 69 72 0d 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 62 69 72 64 0d 0a 76 61 6c 75 65 0d 0a 6e 6f 73 65 0d 0a 65 67 67 0d 0a 79 61 72 64 0d 0a 6d 6f 6e 6b 65 79 0d 0a 68 69 67 68 0d 0a 76 6f 69 63 65 0d 0a 63 6f 6c 6f 72 0d 0a 71 75 61 6c 69 66 79 0d 0a 74 6f 70 0d 0a 6c 61 6d 70 0d 0a 72 61 69 6e 0d 0a 65 6e 64 0d 0a 6c 69 6f 6e 0d 0a 65 6e 64 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 65 61 72 0d 0a 6b 69 6e 64 0d 0a 6e 65 65 64 0d 0a 6e 61 6d 65 0d 0a 65 61 73 74 0d 0a 63 6f 61 74 0d 0a 68 65 61 64 0d 0a 70 65 6e 0d 0a 77 61 72 6e 0d 0a 72 69 76 65 72 Data Ascii: asyvictoryjourneypapernoteearmonkeytalkvoiceeastairinformationbirdvaluenoseeggyardmonkeyhighvoicecolorqualifytoplamprainendlionenduniversityearkindneednameeastcoatheadpenwarnriver
2023-08-29 05:50:57 UTC	2637	IN	Data Raw: 6f 76 69 65 0d 0a 77 6f 72 6c 64 0d 0a 79 65 6c 6c 6f 77 0d 0a 6b 69 74 65 0d 0a 76 69 65 77 0d 0a 62 65 61 63 68 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 76 69 73 69 74 6f 72 0d 0a 72 65 64 0d 0a 79 65 73 74 65 72 64 61 79 0d 0a 70 65 6e 0d 0a 61 63 65 0d 0a 62 6c 75 65 0d 0a 6b 65 65 70 0d 0a 76 61 63 61 74 69 6f 6e 0d 0a 79 65 6c 6c 6f 77 0d 0a 75 6e 69 74 0d 0a 66 72 69 65 6e 64 0d 0a 76 69 73 69 74 6f 72 0d 0a 61 6e 74 0d 0a 6a 6f 75 72 6e 65 79 0d 0a 72 6f 61 64 0d 0a 64 6f 67 0d 0a 71 75 69 65 74 0d 0a 69 6e 6b 0d 0a 65 61 73 74 0d 0a 7a 6f 6d 62 69 65 0d 0a 65 61 73 79 0d 0a 6f 6e 65 0d 0a 6f 66 66 69 63 65 0d 0a 67 69 72 6c 0d 0a 70 61 70 65 72 0d 0a 6c 65 67 0d 0a 6b 69 73 73 0d 0a 61 6c 6f 6e 65 0d 0a 73 6b 79 0d 0a 61 70 70 6c 65 0d 0a 74 69 6d 65 Data Ascii: ovieworldyellowkiteviewbeachunsignedvisitorredyesterdaypenacebluekeepvacationyellowunitfriendvisitorantjourneyroaddogquietinkeastzombieeasyoneofficegirlpaperlegkissaloneskyappletime
2023-08-29 05:50:57 UTC	2653	IN	Data Raw: 0a 6c 61 75 67 68 0d 0a 76 61 6c 75 65 0d 0a 70 6f 77 65 72 0d 0a 70 69 6e 6b 0d 0a 73 65 76 65 6e 0d 0a 6b 69 74 65 0d 0a 6d 6f 76 69 65 0d 0a 7a 6f 6e 65 0d 0a 64 65 73 6b 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 76 69 65 77 0d 0a 62 6f 78 0d 0a 63 6f 6c 6f 72 0d 0a 70 68 6f 6e 65 0d 0a 68 61 74 0d 0a 73 68 6f 72 74 0d 0a 6c 65 74 74 65 72 0d 0a 64 75 63 6b 0d 0a 6f 66 66 69 63 65 0d 0a 68 65 61 72 74 0d 0a 70 69 6e 6b 0d 0a 67 6c 61 73 73 0d 0a 68 61 74 0d 0a 7a 65 61 6c 0d 0a 71 75 61 6c 69 66 79 0d 0a 73 6b 79 0d 0a 70 69 6e 6b 0d 0a 61 6e 74 0d 0a 6e 61 74 75 72 65 0d 0a 63 61 74 0d 0a 73 65 76 65 6e 0d 0a 6b 69 64 0d 0a 72 6f 61 64 0d 0a 64 65 73 6b 0d 0a 6b 69 74 63 68 65 6e 0d 0a 62 6c 75 65 0d 0a 77 65 65 6b 0d 0a 7a 6f 6f 0d 0a 76 6f 69 63 65 Data Ascii: laughvaluepowerpinksevenkitemoviezonedeskuniversityviewboxcolorphonehatshortletterduckofficeheartpinkglasshatzealqualifyskypinkantnaturecatsevenkidroaddeskkitchenblueweekzoovoice
2023-08-29 05:50:57 UTC	2669	IN	Data Raw: 66 61 63 65 0d 0a 6c 61 6e 64 0d 0a 62 65 61 63 68 0d 0a 6c 6f 6e 67 0d 0a 70 69 7a 7a 61 0d 0a 70 6c 61 6e 74 0d 0a 77 6f 72 6c 64 0d 0a 69 63 65 0d 0a 73 6b 79 0d 0a 69 64 65 61 0d 0a 76 69 63 74 6f 72 79 0d 0a 6d 69 6c 6b 0d 0a 67 72 65 65 6e 0d 0a 67 72 6f 75 70 0d 0a 6b 69 74 63 68 65 6e 0d 0a 72 6f 63 6b 0d 0a 6a 61 63 6b 65 74 0d 0a 6b 69 64 0d 0a 69 73 73 75 65 0d 0a 6b 69 74 65 0d 0a 67 61 6d 65 0d 0a 6d 6f 6f 6e 0d 0a 74 61 6c 6b 0d 0a 61 72 74 0d 0a 61 6c 6f 6e 65 0d 0a 79 65 6c 6c 6f 77 0d 0a 70 6c 61 6e 74 0d 0a 68 69 74 0d 0a 66 61 6c 6c 0d 0a 7a 6f 6d 62 69 65 0d 0a 6c 65 74 74 65 72 0d 0a 6c 6f 76 65 0d 0a 6c 65 67 0d 0a 74 65 61 63 68 65 72 0d 0a 68 6f 75 73 65 0d 0a 69 6e 6b 0d 0a 76 61 6c 75 65 0d 0a 75 6e 73 69 67 6e 65 64 0d 0a 76 61 Data Ascii: facelandbeachlongpizzaplantworldiceskyideavictorymilkgreengroupkitchenrockjacketkidissuekitegamemoontalkartaloneyellowplanthitfallzombieletterlovelegteacherhouseinkvalueunsignedva
2023-08-29 05:50:57 UTC	2685	IN	Data Raw: 6f 61 74 0d 0a 75 6e 63 6c 65 0d 0a 73 6e 6f 77 0d 0a 62 6c 75 65 0d 0a 79 61 72 64 0d 0a 79 61 72 64 0d 0a 73 75 6e 0d 0a 67 68 6f 73 74 0d 0a 75 6e 63 6c 65 0d 0a 64 61 72 6b 0d 0a 6c 69 6f 6e 0d 0a 6f 66 66 69 63 65 0d 0a 62 69 72 64 0d 0a 68 61 6e 64 0d 0a 69 6e 63 6f 6d 65 0d 0a 70 65 72 73 6f 6e 0d 0a 6e 75 6d 62 65 72 0d 0a 67 6c 61 73 73 0d 0a 6d 61 70 0d 0a 66 6f 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 6d 61 70 0d 0a 71 75 6f 74 65 0d 0a 66 61 74 68 65 72 0d 0a 72 69 73 65 0d 0a 64 6f 67 0d 0a 70 68 6f 6e 65 0d 0a 62 69 72 64 0d 0a 6c 61 6b 65 0d 0a 61 6e 69 6d 61 6c 0d 0a 66 6f 6f 74 0d 0a 70 61 70 65 72 0d 0a 63 61 72 0d 0a 7a 6f 6f 0d 0a 62 61 6e 61 6e 61 0d 0a 79 61 72 64 0d 0a 7a 6f 6d 62 69 65 0d 0a 75 73 75 61 6c 6c 79 0d 0a 61 72 63 68 0d 0a 69 Data Ascii: oatunclesnowblueyardyardsunghostuncledarklionofficebirdhandincomepersonnumberglassmapforyellowmapquotefatherrisedogphonebirdlakeanimalfootpapercarzoobananayardzombieusuallyarchi
2023-08-29 05:50:57 UTC	2701	IN	Data Raw: 74 61 72 0d 0a 71 75 61 6c 69 66 79 0d 0a 76 69 63 74 6f 72 79 0d 0a 62 6f 6f 6b 0d 0a 74 61 73 74 65 0d 0a 72 75 6e 0d 0a 6a 61 63 6b 65 74 0d 0a 73 74 72 69 6e 67 0d 0a 72 69 76 65 72 0d 0a 6b 69 64 0d 0a 75 6e 64 65 72 73 74 61 6e 64 0d 0a 6f 69 6c 0d 0a 6a 65 6c 6c 79 0d 0a 61 6c 6f 6e 65 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 69 6e 63 6f 6d 65 0d 0a 65 61 72 74 68 0d 0a 71 75 69 63 6b 0d 0a 71 75 6f 74 65 0d 0a 63 6c 6f 75 64 0d 0a 79 65 73 0d 0a 69 6e 6b 0d 0a 77 65 73 74 0d 0a 66 72 69 65 6e 64 0d 0a 73 75 67 61 72 0d 0a 75 73 75 61 6c 6c 79 0d 0a 63 6c 69 70 0d 0a 6a 6f 6b 65 0d 0a 70 69 63 74 75 72 65 0d 0a 66 6f 72 0d 0a 6b 69 73 73 0d 0a 65 67 67 0d 0a 6b 65 65 70 0d 0a 64 6f 67 0d 0a 74 61 73 74 65 0d 0a 6c 6f 76 65 0d 0a 7a 6f 6e 65 0d 0a 70 Data Ascii: tarqualifyvictorybooktasterunjacketstringriverkidunderstandoiljellyalonevegetableincomeearthquickquotecloudyesinkwestfriendsugarusuallyclipjokepictureforkisseggkeepdogtastelovezonep
2023-08-29 05:50:57 UTC	2717	IN	Data Raw: 65 72 0d 0a 61 69 72 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 74 72 65 65 0d 0a 62 6c 75 65 0d 0a 73 6b 79 0d 0a 7a 65 72 6f 0d 0a 65 61 72 74 68 0d 0a 65 72 72 6f 72 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 72 69 73 65 0d 0a 64 6f 0d 0a 61 63 65 0d 0a 6c 61 75 67 68 0d 0a 7a 65 72 6f 0d 0a 72 6f 61 64 0d 0a 72 61 69 6e 0d 0a 66 69 73 68 0d 0a 6c 61 75 67 68 0d 0a 7a 65 72 6f 0d 0a 74 61 73 74 65 0d 0a 76 6f 69 63 65 0d 0a 7a 65 72 6f 0d 0a 72 6f 61 64 0d 0a 71 75 61 6c 69 74 79 0d 0a 6a 65 6c 6c 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 6c 6f 6e 67 0d 0a 6f 70 65 6e 0d 0a 73 6b 79 0d 0a 70 6f 77 65 72 0d 0a 74 69 6d 65 0d 0a 7a 6f 6d 62 69 65 0d 0a 73 6b 79 0d 0a 7a 65 72 Data Ascii: erairskyKanthantreeblueskyzeroeartherroruniversityrisedoacelaughzeroroadrainfishlaughzerotastevoicezeroroadqualityjellyuniversityuniversityuniversitylongopenskypowertimezombieskyzer
2023-08-29 05:50:57 UTC	2733	IN	Data Raw: 65 0d 0a 70 61 70 65 72 0d 0a 6c 65 74 74 65 72 0d 0a 73 6b 79 0d 0a 7a 65 72 6f 0d 0a 71 75 65 73 74 69 6f 6e 0d 0a 64 6f 0d 0a 77 6f 72 6c 64 0d 0a 62 61 6e 61 6e 61 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 7a 65 62 72 61 0d 0a 6e 61 74 75 72 65 0d 0a 61 6e 69 6d 61 6c 0d 0a 6e 75 72 73 65 0d 0a 63 6f 6c 6f 72 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 70 61 70 65 72 0d 0a 65 69 67 68 74 0d 0a 73 6b 79 0d 0a 7a 65 72 6f 0d 0a 63 6f 77 0d 0a 6b 69 63 6b 0d 0a 69 6e 74 0d 0a 79 65 61 72 6e 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 71 75 61 72 74 65 72 0d 0a 72 6f 61 64 0d 0a 77 6f 72 6b 0d 0a 6b 69 73 73 0d 0a 70 6f 77 65 72 0d 0a 6d 6f 6e 6b 65 79 0d 0a 6e 75 72 73 65 0d 0a 63 6f 6c 6f 72 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 6e 69 Data Ascii: epaperletterskyzeroquestiondoworldbananaeyeeyezebranatureanimalnursecoloreyeeyepapereightskyzerocowkickintyearnuniversityuniversityquarterroadworkkisspowermonkeynursecoloreyeeyeni
2023-08-29 05:50:57 UTC	2749	IN	Data Raw: 65 79 65 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 71 75 65 65 6e 0d 0a 77 68 69 6c 65 0d 0a 77 65 73 74 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 62 6c 75 65 0d 0a 68 61 69 72 0d 0a 65 79 65 0d 0a 70 61 70 65 72 0d 0a 79 65 6c 6c 6f 77 0d 0a 7a 65 72 6f 0d 0a 71 75 61 72 74 65 72 0d 0a 77 68 69 6c 65 0d 0a 63 6f 6c 6f 72 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 71 75 61 72 74 65 72 0d 0a 72 6f 61 64 0d 0a 70 61 70 65 72 0d 0a 79 61 77 6e 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 7a 65 62 72 61 0d 0a 64 6f 0d 0a 6c 6f 6e 67 0d 0a 68 6f 75 73 65 0d 0a 7a 65 62 72 61 0d 0a 64 6f 0d 0a 76 69 73 69 74 6f 72 0d 0a 65 79 65 0d 0a 62 61 6e 61 6e 61 0d 0a 65 79 65 0d 0a 65 79 65 0d 0a 65 72 72 6f 72 0d 0a 70 6f 77 65 72 0d 0a 6a 61 72 0d 0a 75 6e 69 76 65 72 73 Data Ascii: eyeskyKanthanqueenwhilewesteyeeyebluehaireyepaperyellowzeroquarterwhilecoloreyeeyequarterroadpaperyawnskyKanthanzebradolonghousezebradovisitoreyebananaeyeeyeerrorpowerjarunivers
2023-08-29 05:50:57 UTC	2765	IN	Data Raw: 0a 6a 61 72 0d 0a 76 65 67 65 74 61 62 6c 65 0d 0a 6e 69 67 68 74 0d 0a 63 6f 61 74 0d 0a 75 6e 69 76 65 72 73 69 74 79 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 69 6e 73 69 64 65 0d 0a 62 61 6e 61 6e 61 0d 0a 73 6b 79 0d 0a 7a 65 72 6f 0d 0a 6d 6f 76 69 65 0d 0a 73 6b 79 0d 0a 73 68 6f 72 74 0d 0a 6b 69 6e 67 0d 0a 6b 69 63 6b 0d 0a 6b 69 6e 67 0d 0a 7a 65 72 6f 0d 0a 67 68 6f 73 74 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 65 72 72 6f 72 0d 0a 62 61 6e 61 6e 61 0d 0a 73 6b 79 0d 0a 73 68 6f 72 74 0d 0a 6b 69 6e 67 0d 0a 77 65 65 6b 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 72 65 73 74 0d 0a 62 61 6e 61 6e 61 0d 0a 73 6b 79 0d 0a 4b 61 6e 74 68 61 6e 0d 0a 70 65 72 73 6f 6e 0d 0a 77 65 65 6b 0d 0a 6b 69 63 6b 0d 0a 66 61 6c 6c 0d 0a 62 61 6e 61 6e 61 Data Ascii: jarvegetablenightcoatuniversityskyKanthaninsidebananaskyzeromovieskyshortkingkickkingzeroghostskyKanthanerrorbananaskyshortkingweekKanthanrestbananaskyKanthanpersonweekkickfallbanana

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 4a9OE5cKJo.exePID: 7064, Parent PID: 3512

General

Target ID:	0
Start time:	07:50:41
Start date:	29/08/2023
Path:	C:\Users\user\Desktop\4a9OE5cKJo.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\4a9OE5cKJo.exe
Imagebase:	0x7ff739c80000
File size:	1'084'632 bytes
MD5 hash:	9652452E6863BFCB4FB2C1C20702CA7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: bReporter.exePID: 7080, Parent PID: 7064

General

Target ID:	1
Start time:	07:50:42
Start date:	29/08/2023
Path:	C:\Users\Public\Music\Picture\bReporter.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Music\Picture\bReporter.exe --version
Imagebase:	0x400000
File size:	152'080 bytes
MD5 hash:	BB63FD178AFFCCAAB180BCE1689157CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000001.00000002.615912201.0000000002330000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7088, Parent PID: 7080

General

Target ID:	2
Start time:	07:50:42
Start date:	29/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6264, Parent PID: 7064

General

Target ID:	4
Start time:	07:50:47
Start date:	29/08/2023
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7064 -s 916
Imagebase:	0x7ff7008d0000
File size:	494'488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 4a9OE5cKJo.exePID: 7064, Parent PID: 3512COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.4%
Total number of Nodes:	792
Total number of Limit Nodes:	20

Executed Functions

Function 00007FF739CC0890 Relevance: 92.9, APIs: 24, Strings: 29, Instructions: 151
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00007FF77FF739CC0890(void* __eax) {
				signed int _v24;
				signed long long _t11;
				void* _t13;
				signed long long _t18;

				_t11 =  *0x39d830d8; // 0x8accada1b9e9
				_v24 = _t11 ^ _t18;
				__imp__GetModuleHandleExW();
				if (__eax != 0) goto 0x39cc08e5;
				E00007FF77FF739CBFB90(0x10008, __eax, _t13, "Win32: Failed to retrieve own module handle");
				return E00007FF77FF739CC6B50(0, 0x10008, _v24 ^ _t18);
			}

0x7ff739cc0894
0x7ff739cc089e
0x7ff739cc08b6
0x7ff739cc08be
0x7ff739cc08cc
0x7ff739cc08e4

APIs

GetModuleHandleExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF739CBFE76), ref: 00007FF739CC08B6
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF739CBFE76), ref: 00007FF739CC08EC

Part of subcall function 00007FF739CBFB90: GetLastError.KERNEL32 ref: 00007FF739CBFBDB
Part of subcall function 00007FF739CBFB90: FormatMessageW.KERNEL32 ref: 00007FF739CBFC10
Part of subcall function 00007FF739CBFB90: WideCharToMultiByte.KERNEL32 ref: 00007FF739CBFC4F

Strings

dinput8.dll, xrefs: 00007FF739CC09DA
EnableNonClientDpiScaling, xrefs: 00007FF739CC095A
GetSystemMetricsForDpi, xrefs: 00007FF739CC09C6
shcore.dll, xrefs: 00007FF739CC0B30
SetProcessDpiAwareness, xrefs: 00007FF739CC0B49
user32.dll, xrefs: 00007FF739CC08E5
GetDpiForWindow, xrefs: 00007FF739CC0990
DwmGetColorizationColor, xrefs: 00007FF739CC0B15
xinput9_1_0.dll, xrefs: 00007FF739CC0A26
XInputGetCapabilities, xrefs: 00007FF739CC0A78
dwmapi.dll, xrefs: 00007FF739CC0AAA
DirectInput8Create, xrefs: 00007FF739CC09FA
Win32: Failed to load user32.dll, xrefs: 00007FF739CC08FE
DwmEnableBlurBehindWindow, xrefs: 00007FF739CC0AFA
xinput1_4.dll, xrefs: 00007FF739CC0A1F
Win32: Failed to retrieve own module handle, xrefs: 00007FF739CC08C0
RtlVerifyVersionInfo, xrefs: 00007FF739CC0B94
GetDpiForMonitor, xrefs: 00007FF739CC0B60
AdjustWindowRectExForDpi, xrefs: 00007FF739CC09AB
SetProcessDpiAwarenessContext, xrefs: 00007FF739CC0975
ChangeWindowMessageFilterEx, xrefs: 00007FF739CC093F
xinput1_2.dll, xrefs: 00007FF739CC0A37
ntdll.dll, xrefs: 00007FF739CC0B7B
xinput1_1.dll, xrefs: 00007FF739CC0A43
DwmIsCompositionEnabled, xrefs: 00007FF739CC0AC8
SetProcessDPIAware, xrefs: 00007FF739CC0923
DwmFlush, xrefs: 00007FF739CC0ADF
XInputGetState, xrefs: 00007FF739CC0A8F
xinput1_3.dll, xrefs: 00007FF739CC0A11

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ByteCharErrorFormatHandleLastLibraryLoadMessageModuleMultiWide
String ID: AdjustWindowRectExForDpi$ChangeWindowMessageFilterEx$DirectInput8Create$DwmEnableBlurBehindWindow$DwmFlush$DwmGetColorizationColor$DwmIsCompositionEnabled$EnableNonClientDpiScaling$GetDpiForMonitor$GetDpiForWindow$GetSystemMetricsForDpi$RtlVerifyVersionInfo$SetProcessDPIAware$SetProcessDpiAwareness$SetProcessDpiAwarenessContext$Win32: Failed to load user32.dll$Win32: Failed to retrieve own module handle$XInputGetCapabilities$XInputGetState$dinput8.dll$dwmapi.dll$ntdll.dll$shcore.dll$user32.dll$xinput1_1.dll$xinput1_2.dll$xinput1_3.dll$xinput1_4.dll$xinput9_1_0.dll
API String ID: 1648301694-1088760994
Opcode ID: 511412ed3d2e6a6a6d7b745dcfd560206b107f865f9b9d58446667d78d2323e9
Instruction ID: a252b83ba1d68b8d8f721ee7bbb04afa792b39f945a168d51f21a764f6b3dd67
Opcode Fuzzy Hash: 511412ed3d2e6a6a6d7b745dcfd560206b107f865f9b9d58446667d78d2323e9
Instruction Fuzzy Hash: D9919C24A2DF47A1EA00FF24F866164F3B2BF48755FC01535C88E46369EE7CE559A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBDDF0 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 288
libraryfilenativeCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E00007FF77FF739CBDDF0(void* __edi, void* __rax, long long __rbx, long long __rsi, void* __r8, void* __r13, long long __r14) {
				void* __rdi;
				void* __rbp;
				int _t87;
				intOrPtr _t88;
				long _t95;
				long _t96;
				int _t100;
				void* _t110;
				int _t134;
				struct _OSVERSIONINFOA* _t138;
				void* _t180;
				signed long long _t183;
				void* _t187;
				intOrPtr _t188;
				intOrPtr _t191;
				void* _t212;
				signed long long _t247;
				void* _t262;
				long _t263;
				char _t276;
				void* _t277;
				void* _t279;
				void* _t280;
				void* _t294;
				struct _OSVERSIONINFOA* _t302;

				_t180 = __rax;
				 *((long long*)(_t279 + 0x10)) = __rbx;
				 *((long long*)(_t279 + 0x18)) = __rsi;
				_t277 = _t279 - 0x2c0;
				_t280 = _t279 - 0x3c0;
				 *((intOrPtr*)(_t277 + 0x70)) = 0x94;
				_t87 = GetVersionExA(_t302);
				r15d = 0;
				if (_t87 == 0) goto 0x39cbdeff;
				_t88 =  *((intOrPtr*)(_t277 + 0x74));
				if (_t88 != 0xa) goto 0x39cbde50;
				_t7 =  &(_t302->dwMajorVersion); // 0x4
				r8d = _t7;
				 *((intOrPtr*)(_t280 + 0x58)) = 1;
				__imp__SetProcessMitigationPolicy();
				goto 0x39cbdeff;
				if (_t88 - 6 < 0) goto 0x39cbdeff;
				r8d = 0;
				RtlAdjustPrivilege(_t263, _t276); // executed
				GetCurrentProcess();
				GetModuleHandleA(??);
				GetProcAddress(??, ??);
				_t273 = __rax;
				if (__rax == 0) goto 0x39cbdeff;
				GetModuleHandleA(??);
				GetProcAddress(??, ??);
				_t187 = __rax;
				if (__rax == 0) goto 0x39cbdeff;
				r9d = 8;
				 *(_t280 + 0x50) = 8;
				 *(_t280 + 0x20) = _t302;
				_t95 = NtQueryInformationProcess(??, ??, ??, ??, ??); // executed
				if (_t95 < 0) goto 0x39cbdeff;
				 *(_t280 + 0x54) =  *(_t280 + 0x54) | 0x00000001;
				r9d = 8;
				_t96 = NtSetInformationProcess(??, ??, ??, ??); // executed
				 *(_t280 + 0x50) = _t302;
				r8d = 0;
				_t138 = r15d; // executed
				0x39cc5456(); // executed
				if (_t96 < 0) goto 0x39cbe23a;
				asm("xorps xmm0, xmm0");
				asm("xorps xmm1, xmm1");
				asm("movups [esp+0x60], xmm0");
				asm("movdqu [esp+0x70], xmm1");
				if ( *((intOrPtr*)( *(_t280 + 0x50) + 0xfffffffffffffffe)) != _t138) goto 0x39cbdf42;
				E00007FF77FF739C81D30(__rax, _t280 + 0x60,  *(_t280 + 0x50), __rax, __rax, _t277, 0);
				r8d = 4;
				E00007FF77FF739C84140(_t187, _t280 + 0x60, L"\\*.*", _t277, 0, __r13);
				_t212 =  >=  ?  *((void*)(_t280 + 0x60)) : _t280 + 0x60;
				FindFirstFileW(??, ??); // executed
				if (_t180 == 0xffffffff) goto 0x39cbdfc6;
				asm("o16 nop [eax+eax]");
				_t36 = _t187 + 1; // 0x1
				_t143 =  !=  ? _t138 : _t36;
				_t139 =  !=  ? _t138 : _t36;
				_t100 = FindNextFileW(??, ??); // executed
				if (_t100 != 0) goto 0x39cbdfa0;
				FindClose(??); // executed
				__imp__CoTaskMemFree();
				_t247 =  *((intOrPtr*)(_t280 + 0x78));
				if (_t247 - 8 < 0) goto 0x39cbe013;
				if (2 + _t247 * 2 - 0x1000 < 0) goto 0x39cbe00e;
				_t183 =  *((intOrPtr*)(_t280 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x60)) - 8)) + 0xfffffff8;
				if (_t183 - 0x1f > 0) goto 0x39cbe2c8;
				0x39cc6464();
				_t174 = ( !=  ? _t138 : _t36) - 6;
				if (( !=  ? _t138 : _t36) - 6 <= 0) goto 0x39cbe23a;
				E00007FF77FF739CCF9F8(( !=  ? _t138 : _t36) - 6, _t183,  *((intOrPtr*)( *((intOrPtr*)(_t280 + 0x60)) - 8)));
				E00007FF77FF739CCD070(0, _t183);
				_t188 =  *0x39d842b0; // 0x22547a6b500
				E00007FF77FF739CCD044(_t183);
				_t191 =  *0x39d84300; // 0x22547a6b290
				E00007FF77FF739CCD044(_t183);
				_t110 = E00007FF77FF739C836B0( !=  ? _t138 : _t36, 0, _t183, (_t183 % (_t191 -  *0x39d842f8 >> 5) << 5) +  *0x39d842f8, (_t183 % (_t188 -  *0x39d842a8 >> 5) << 5) +  *0x39d842a8, (_t183 % (_t191 -  *0x39d842f8 >> 5) << 5) +  *0x39d842f8, (_t183 % (_t188 -  *0x39d842a8 >> 5) << 5) +  *0x39d842a8, _t273); // executed
				if (_t110 == 0) goto 0x39cbe274;
				 *((long long*)(_t280 + 0x3e0)) = __r14;
				E00007FF77FF739C81C00(_t277 - 0x48, (_t183 % (_t188 -  *0x39d842a8 >> 5) << 5) +  *0x39d842a8, 0x39cec138);
				E00007FF77FF739C81AB0((_t183 % (_t191 -  *0x39d842f8 >> 5) << 5) +  *0x39d842f8, _t280 + 0x60, _t183, (_t183 % (_t191 -  *0x39d842f8 >> 5) << 5) +  *0x39d842f8);
				E00007FF77FF739CBDBA0(E00007FF77FF739C83100(E00007FF77FF739C82EC0(E00007FF77FF739C82EC0(E00007FF77FF739C81B20((_t183 % (_t191 -  *0x39d842f8 >> 5) << 5) +  *0x39d842f8, _t277 - 0x68, _t183, 0x39cebf38), _t280 + 0x60), _t277 - 0x48), 0x39d842e0, _t183), 0x39d842c8);
				E00007FF77FF739CCD044(_t183);
				E00007FF77FF739C84420(E00007FF77FF739C84420(E00007FF77FF739C84420(E00007FF77FF739C83100(_t183 / _t183, 0x39d842c8, _t183 % _t183), _t277 - 0x68), _t183), _t183);
				E00007FF77FF739C83A90(_t183, _t183, _t183, _t183, _t183, _t280 + 0x50); // executed
				E00007FF77FF739C83B60(_t183, _t183, _t183, _t183, _t183, _t280 + 0x50); // executed
				asm("xorps xmm1, xmm1");
				 *((intOrPtr*)(_t277 - 0x20)) = 0x68;
				asm("xorps xmm0, xmm0");
				 *(_t277 - 0x70) = _t183;
				 *((intOrPtr*)(_t277 + 0x44)) = 0;
				asm("movups [ebp-0x80], xmm0");
				asm("movups [ebp-0x1c], xmm1");
				asm("movups [ebp-0xc], xmm1");
				asm("movups [ebp+0x4], xmm1");
				asm("movups [ebp+0x14], xmm1");
				asm("movups [ebp+0x24], xmm1");
				asm("movups [ebp+0x34], xmm1");
				E00007FF77FF739C824B0(_t183, _t277 - 0x48, " --version");
				E00007FF77FF739C81B90(_t280 + 0x60, _t277 - 0x68, _t183);
				E00007FF77FF739C84420(E00007FF77FF739C84420(E00007FF77FF739C82EC0(E00007FF77FF739C81AB0(_t183, _t277 + 0x50, _t183, _t277 - 0x48), _t280 + 0x60), _t277 - 0x68), _t277 + 0x50);
				 *((long long*)(_t280 + 0x48)) = _t277 - 0x80;
				r9d = 0;
				 *((long long*)(_t280 + 0x40)) = _t277 - 0x20;
				r8d = 0;
				 *(_t280 + 0x38) = _t183;
				 *(_t280 + 0x30) = _t302;
				 *((intOrPtr*)(_t280 + 0x28)) = 0x8000000;
				 *(_t280 + 0x20) = r15d;
				_t134 = CreateProcessA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				if (_t134 != 0) goto 0x39cbe28e;
				E00007FF77FF739C84420(_t134, 0x39d82088);
				goto 0x39cbe2ac;
				_t294 =  >=  ?  *0x39d820c8 : 0x39d820c8;
				_t262 =  >=  ?  *0x39d82048 : 0x39d82048;
				r9d = 0x7ff739d820c8;
				MessageBoxA(??, ??, ??, ??);
				return 0;
			}

0x7ff739cbddf0
0x7ff739cbddf0
0x7ff739cbddf5
0x7ff739cbddfe
0x7ff739cbde06
0x7ff739cbde11
0x7ff739cbde18
0x7ff739cbde1e
0x7ff739cbde23
0x7ff739cbde29
0x7ff739cbde2f
0x7ff739cbde31
0x7ff739cbde31
0x7ff739cbde35
0x7ff739cbde45
0x7ff739cbde4b
0x7ff739cbde53
0x7ff739cbde59
0x7ff739cbde68
0x7ff739cbde6e
0x7ff739cbde7e
0x7ff739cbde8e
0x7ff739cbde94
0x7ff739cbde9a
0x7ff739cbdea3
0x7ff739cbdeb3
0x7ff739cbdeb9
0x7ff739cbdebf
0x7ff739cbdec1
0x7ff739cbdec7
0x7ff739cbded4
0x7ff739cbdee0
0x7ff739cbdee4
0x7ff739cbdee6
0x7ff739cbdef0
0x7ff739cbdefd
0x7ff739cbdf04
0x7ff739cbdf09
0x7ff739cbdf15
0x7ff739cbdf18
0x7ff739cbdf1f
0x7ff739cbdf2a
0x7ff739cbdf2d
0x7ff739cbdf37
0x7ff739cbdf3c
0x7ff739cbdf4a
0x7ff739cbdf51
0x7ff739cbdf56
0x7ff739cbdf68
0x7ff739cbdf7c
0x7ff739cbdf82
0x7ff739cbdf8f
0x7ff739cbdf95
0x7ff739cbdfa4
0x7ff739cbdfab
0x7ff739cbdfae
0x7ff739cbdfb3
0x7ff739cbdfbb
0x7ff739cbdfc0
0x7ff739cbdfcb
0x7ff739cbdfd1
0x7ff739cbdfda
0x7ff739cbdff3
0x7ff739cbe000
0x7ff739cbe008
0x7ff739cbe00e
0x7ff739cbe013
0x7ff739cbe016
0x7ff739cbe01e
0x7ff739cbe026
0x7ff739cbe02b
0x7ff739cbe03d
0x7ff739cbe049
0x7ff739cbe069
0x7ff739cbe089
0x7ff739cbe090
0x7ff739cbe09d
0x7ff739cbe0ac
0x7ff739cbe0bc
0x7ff739cbe0ff
0x7ff739cbe107
0x7ff739cbe13f
0x7ff739cbe14d
0x7ff739cbe158
0x7ff739cbe15d
0x7ff739cbe160
0x7ff739cbe170
0x7ff739cbe173
0x7ff739cbe17b
0x7ff739cbe17e
0x7ff739cbe182
0x7ff739cbe186
0x7ff739cbe18a
0x7ff739cbe18e
0x7ff739cbe192
0x7ff739cbe196
0x7ff739cbe19a
0x7ff739cbe1ab
0x7ff739cbe1da
0x7ff739cbe1e6
0x7ff739cbe1ef
0x7ff739cbe1f2
0x7ff739cbe1f7
0x7ff739cbe1fa
0x7ff739cbe201
0x7ff739cbe206
0x7ff739cbe20e
0x7ff739cbe213
0x7ff739cbe223
0x7ff739cbe22c
0x7ff739cbe238
0x7ff739cbe250
0x7ff739cbe260
0x7ff739cbe26a
0x7ff739cbe26e
0x7ff739cbe28d

APIs

GetVersionExA.KERNEL32 ref: 00007FF739CBDE18
SetProcessMitigationPolicy.KERNEL32 ref: 00007FF739CBDE45
RtlAdjustPrivilege.NTDLL ref: 00007FF739CBDE68
GetCurrentProcess.KERNEL32 ref: 00007FF739CBDE6E
GetModuleHandleA.KERNEL32 ref: 00007FF739CBDE7E
GetProcAddress.KERNEL32 ref: 00007FF739CBDE8E
GetModuleHandleA.KERNEL32 ref: 00007FF739CBDEA3
GetProcAddress.KERNEL32 ref: 00007FF739CBDEB3
NtQueryInformationProcess.NTDLL ref: 00007FF739CBDEE0
NtSetInformationProcess.NTDLL ref: 00007FF739CBDEFD
SHGetKnownFolderPath.SHELL32 ref: 00007FF739CBDF18
FindFirstFileW.KERNELBASE ref: 00007FF739CBDF82
FindNextFileW.KERNELBASE ref: 00007FF739CBDFB3
FindClose.KERNELBASE ref: 00007FF739CBDFC0
CoTaskMemFree.OLE32 ref: 00007FF739CBDFCB
CreateProcessA.KERNELBASE ref: 00007FF739CBE213
MessageBoxA.USER32 ref: 00007FF739CBE2B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CBE2C8

Strings

--version, xrefs: 00007FF739CBE169
NtSetInformationProcess, xrefs: 00007FF739CBDEAC
NtDll.dll, xrefs: 00007FF739CBDE74
error, xrefs: 00007FF739CBE231
\*.*, xrefs: 00007FF739CBDF5C
NtDll.dll, xrefs: 00007FF739CBDE9C
NtQueryInformationProcess, xrefs: 00007FF739CBDE87

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Process$Find$AddressFileHandleInformationModuleProc$AdjustCloseCreateCurrentFirstFolderFreeKnownMessageMitigationNextPathPolicyPrivilegeQueryTaskVersion_invalid_parameter_noinfo_noreturn
String ID: --version$NtDll.dll$NtDll.dll$NtQueryInformationProcess$NtSetInformationProcess$\*.*$error
API String ID: 2737874586-3560420863
Opcode ID: 8deceea6a9141c730de043f7f2b353c4ef91a337643ee8f9cc638efe56074e3e
Instruction ID: 4c08c56830b8fb0f3cb245fbbe943e467771262c8ac119aea1948f08b4a97e5d
Opcode Fuzzy Hash: 8deceea6a9141c730de043f7f2b353c4ef91a337643ee8f9cc638efe56074e3e
Instruction Fuzzy Hash: 3CD18062A1C682A1EB00EF75E8511A9F3B2FF84794FC04235DA4D47AA6DF3CE145E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBFE20 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 222
windowkeyboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoW.USER32 ref: 00007FF739CBFE55
SystemParametersInfoW.USER32 ref: 00007FF739CBFE6B

Part of subcall function 00007FF739CC0890: GetModuleHandleExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF739CBFE76), ref: 00007FF739CC08B6

MapVirtualKeyW.USER32 ref: 00007FF739CBFFC7
ToUnicode.USER32 ref: 00007FF739CBFFEC
ToUnicode.USER32 ref: 00007FF739CC0014
WideCharToMultiByte.KERNEL32 ref: 00007FF739CC004A
VerSetConditionMask.KERNEL32 ref: 00007FF739CC009F
VerSetConditionMask.KERNEL32 ref: 00007FF739CC00B0
VerSetConditionMask.KERNEL32 ref: 00007FF739CC00C1
RtlVerifyVersionInfo.NTDLL ref: 00007FF739CC00D4
SetProcessDPIAware.USER32 ref: 00007FF739CC0115
SetProcessDPIAware.USER32 ref: 00007FF739CC014E
CreateWindowExW.USER32 ref: 00007FF739CC01AB
ShowWindow.USER32 ref: 00007FF739CC01EF
RegisterDeviceNotificationW.USER32 ref: 00007FF739CC0230
PeekMessageW.USER32 ref: 00007FF739CC0259
TranslateMessage.USER32 ref: 00007FF739CC026A
DispatchMessageW.USER32 ref: 00007FF739CC0277
PeekMessageW.USER32 ref: 00007FF739CC0299

Strings

GLFW30, xrefs: 00007FF739CC0170
GLFW message window, xrefs: 00007FF739CC0164
Win32: Failed to create helper window, xrefs: 00007FF739CC01BD

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Message$ConditionInfoMask$AwareParametersPeekProcessSystemUnicodeWindow$ByteCharCreateDeviceDispatchHandleModuleMultiNotificationRegisterShowTranslateVerifyVersionVirtualWide
String ID: GLFW message window$GLFW30$Win32: Failed to create helper window
API String ID: 1073997163-594211362
Opcode ID: d7f35a74974983d7244fa1ac2972b03a362dbe9c52f97fc476129fca5d1db966
Instruction ID: 1cc8dd67c2e68b15d9a31ad7d9ee2da32939c8b312e58ba20b4c09241b0c5bce
Opcode Fuzzy Hash: d7f35a74974983d7244fa1ac2972b03a362dbe9c52f97fc476129fca5d1db966
Instruction Fuzzy Hash: 3CB1A132A1878296F720EF30E8143AAB7B2FB44758F804135DA8D47A95CF3DD149EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC3520 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPropW.USER32 ref: 00007FF739CC3559
EnableNonClientDpiScaling.USER32 ref: 00007FF739CC35D7
DefWindowProcW.USER32 ref: 00007FF739CC35EF

Strings

GLFW, xrefs: 00007FF739CC3549
Win32: Failed to retrieve raw input data, xrefs: 00007FF739CC3A25

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ClientEnableProcPropScalingWindow
String ID: GLFW$Win32: Failed to retrieve raw input data
API String ID: 439044783-2352637977
Opcode ID: 92b5fe2ca1ba1bdea4699f74b8f4d33814fc5997f98ec20bdb5c9f0ed48a3f62
Instruction ID: 75048bab98a42026496042bd375da799abd7e42a81b9236d456cfd5a4f42da48
Opcode Fuzzy Hash: 92b5fe2ca1ba1bdea4699f74b8f4d33814fc5997f98ec20bdb5c9f0ed48a3f62
Instruction Fuzzy Hash: 6391C532A1C642A6FB64AF75E4443B8FAB6BB44744FC49031D98E536D1CF3CB546EA20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6914 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF739CC691D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD6D98

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: d85dde4f9a7d39774fd595a5593eed77bebc784d2c34c533e815ed72882958ee
Instruction ID: 7c326bf0314beba4f60a9eeaf6fbd20fb5693b953b224d58e98fbeb16731ecea
Opcode Fuzzy Hash: d85dde4f9a7d39774fd595a5593eed77bebc784d2c34c533e815ed72882958ee
Instruction Fuzzy Hash: 86E08C22E4D003A1F9283F751D931BCA9B26F09720FE00239E11C453C2CE2C2483BA72

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC66C4 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00007FF77FF739CC66C4(long long __rax, struct _CRITICAL_SECTION* __rbx, void* __r9, void* _a8) {

				InitializeCriticalSectionAndSpinCount(__rbx);
				GetModuleHandleW(??); // executed
				if (__rax != 0) goto 0x39cc670a;
				GetModuleHandleW(??);
				if (__rax == 0) goto 0x39cc6789;
				GetProcAddress(??, ??);
				GetProcAddress(??, ??);
				if (__rax == 0) goto 0x39cc6747;
				if (__rax == 0) goto 0x39cc6747;
				 *0x39d87280 = __rax;
				 *0x39d87288 = __rax;
				goto 0x39cc6765;
				r9d = 0;
				r8d = 0;
				CreateEventW(??, ??, ??, ??);
				 *0x39d87250 = __rax;
				if (__rax == 0) goto 0x39cc6789;
				if (E00007FF77FF739CC64FC(0, __rax) == 0) goto 0x39cc6789;
				E00007FF77FF739CC66AC(E00007FF77FF739CC64FC(0, __rax), __rax);
				return 0;
			}

0x7ff739cc66da
0x7ff739cc66e7
0x7ff739cc66f3
0x7ff739cc66fc
0x7ff739cc6708
0x7ff739cc6714
0x7ff739cc6727
0x7ff739cc6730
0x7ff739cc6735
0x7ff739cc6737
0x7ff739cc673e
0x7ff739cc6745
0x7ff739cc6747
0x7ff739cc674a
0x7ff739cc6753
0x7ff739cc6759
0x7ff739cc6763
0x7ff739cc676e
0x7ff739cc6777
0x7ff739cc6788

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF739CC66DA
GetModuleHandleW.KERNELBASE ref: 00007FF739CC66E7
GetModuleHandleW.KERNEL32 ref: 00007FF739CC66FC
GetProcAddress.KERNEL32 ref: 00007FF739CC6714
GetProcAddress.KERNEL32 ref: 00007FF739CC6727
CreateEventW.KERNEL32 ref: 00007FF739CC6753
DeleteCriticalSection.KERNEL32 ref: 00007FF739CC679F
CloseHandle.KERNEL32 ref: 00007FF739CC67B1

Strings

kernel32.dll, xrefs: 00007FF739CC66F5
SleepConditionVariableCS, xrefs: 00007FF739CC670A
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF739CC66E0
WakeAllConditionVariable, xrefs: 00007FF739CC671A

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3c0a4179882d312a10002faa4d7cf0e8f19c57dc9d112eb0d0cc45f5f940d466
Instruction ID: 84eabb45531e1b2acb2a7953ba2bb4443ea387ffff68b88c141e9ec389644baf
Opcode Fuzzy Hash: 3c0a4179882d312a10002faa4d7cf0e8f19c57dc9d112eb0d0cc45f5f940d466
Instruction Fuzzy Hash: EA210E20E1EA43B1FA54BF34AA55278F772AF48745FC41435D54E066A1DE3CE846B720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE2180 Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF739CE1D64: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1DA5
Part of subcall function 00007FF739CE1D64: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1E25
Part of subcall function 00007FF739CE1D64: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1E79
Part of subcall function 00007FF739CE1D64: _get_daylight.LIBCMT ref: 00007FF739CE1ED1

CreateFileW.KERNELBASE ref: 00007FF739CE2286
CreateFileW.KERNEL32 ref: 00007FF739CE22D6
GetLastError.KERNEL32 ref: 00007FF739CE2306
GetFileType.KERNELBASE ref: 00007FF739CE231B
GetLastError.KERNEL32 ref: 00007FF739CE2325
CloseHandle.KERNEL32 ref: 00007FF739CE2358
CloseHandle.KERNEL32 ref: 00007FF739CE24B3
CreateFileW.KERNEL32 ref: 00007FF739CE24E8
GetLastError.KERNEL32 ref: 00007FF739CE24F7

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 1ec794c6caa5a56ca22219668622e1969aba9d1c7c6d232f74062584279e366c
Instruction ID: 7e2832347fe10c3618c459b6fd342195b22f08de90283c670647e61851f80d9e
Opcode Fuzzy Hash: 1ec794c6caa5a56ca22219668622e1969aba9d1c7c6d232f74062584279e366c
Instruction Fuzzy Hash: 0FC1AE33F24A4696EB10DF78C4902BCB772F749BA8B901229DA2E57795CF38D412E750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD8E50 Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD8E91
GetConsoleMode.KERNEL32 ref: 00007FF739CD8F50
GetLastError.KERNEL32 ref: 00007FF739CD8FD0

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 2c0159935363e0c6623ccffb36355c0f1d2abf12ab2c81bc3d61a2736295bbba
Instruction ID: cc0d82eb7836b2a3a481f134fb02ced697d82d21fbec3f2511f005045b6dcbd5
Opcode Fuzzy Hash: 2c0159935363e0c6623ccffb36355c0f1d2abf12ab2c81bc3d61a2736295bbba
Instruction Fuzzy Hash: A7819327E18612A5F760BF7598402BDF6B3BB48B84FC40136DA0E536A1DF3CA845E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6930 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF739CC693F

Part of subcall function 00007FF739CC64B0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF739CC64D2

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF739CC6954
__scrt_release_startup_lock.LIBCMT ref: 00007FF739CC69C2
__scrt_get_show_window_mode.LIBCMT ref: 00007FF739CC6A15

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: ef2ccd5201982756bac760afed489aa714dfc5164bd047c73faf5d1f3ea967c5
Instruction ID: d740e876406b7012cb0b199d16d9a3e141150fa4a33c2a2f706932ab259cdfa0
Opcode Fuzzy Hash: ef2ccd5201982756bac760afed489aa714dfc5164bd047c73faf5d1f3ea967c5
Instruction Fuzzy Hash: 94316D61E0D10361FA24BF7497113B9EAB3AF41784FC46435E68E472D3DE2CA806AA70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C83A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF739CCCEF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCCF1D

Part of subcall function 00007FF739CCCF58: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCCF80

CreateFileA.KERNELBASE ref: 00007FF739C83AFC
MessageBoxA.USER32 ref: 00007FF739C83B44

Strings

error, xrefs: 00007FF739C83B33

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$CreateFileMessage
String ID: error
API String ID: 1011835292-1574812785
Opcode ID: 323f20145ed762962f373e3328f59e3f06667911fc6fb34285090196f6630c77
Instruction ID: 5f93c4243579d57436004c9c51f06f24f27a42e0de0aa4434b03507faed5913d
Opcode Fuzzy Hash: 323f20145ed762962f373e3328f59e3f06667911fc6fb34285090196f6630c77
Instruction Fuzzy Hash: 90117F71A1C782A2EB10AF21E4153AAE772FB897C0F904035DA4D07B85DF3CD945D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C83B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF739CCCEF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCCF1D

Part of subcall function 00007FF739CCCF58: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCCF80

CreateFileA.KERNELBASE ref: 00007FF739C83BCC
MessageBoxA.USER32 ref: 00007FF739C83C14

Strings

error, xrefs: 00007FF739C83C03

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$CreateFileMessage
String ID: error
API String ID: 1011835292-1574812785
Opcode ID: e57e0228bae49d9b9c69dc3c426df4c283c62fa0f2a936f8eb02681a48b03481
Instruction ID: b1ddfe8e5858afa332778bce8702d70ab9fdab2d4bd386a5e055b128059911e6
Opcode Fuzzy Hash: e57e0228bae49d9b9c69dc3c426df4c283c62fa0f2a936f8eb02681a48b03481
Instruction Fuzzy Hash: BA114F71A1C782A2EB10AF21E4053AAB772FB89780F904035DA4D47B99DF3DD949E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C836B0 Relevance: 4.6, APIs: 3, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE ref: 00007FF739C837D0
GetLastError.KERNEL32 ref: 00007FF739C83818
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739C8384D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CreateDirectoryErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1363081247-0
Opcode ID: 68ca25814c36a89ce375cf069b4add9f66e8610ff21bd6f15c38923d8255b6b8
Instruction ID: 68d26385e26679fc5bf2691417368bd5b136211f9676ba05f06545168d45e71a
Opcode Fuzzy Hash: 68ca25814c36a89ce375cf069b4add9f66e8610ff21bd6f15c38923d8255b6b8
Instruction Fuzzy Hash: 0941C2A2A1CB8195EB10EF75D4542BEE372FB89BC0F906132EA4D43699DF2CD080D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC5888 Relevance: 4.6, APIs: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF739CC58A5
std::locale::_Setgloballocale.LIBCPMT ref: 00007FF739CC58C8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF739CC595D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Setgloballocalestd::locale::_
String ID:
API String ID: 2016263034-0
Opcode ID: ef8fe9146ca14f22f59af206ae272b17371f41c0f837a45c8350363b9dfb276c
Instruction ID: b50b2970b9ff2dba4cdfd5db1a4608d3e5eca44f944a6517cefc43eea6345b82
Opcode Fuzzy Hash: ef8fe9146ca14f22f59af206ae272b17371f41c0f837a45c8350363b9dfb276c
Instruction Fuzzy Hash: C6216021A0DA8665EB14BF32D450279BA72FB44F94FD85035DA8D47366CF3CE442D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDE150 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF739CD49E7), ref: 00007FF739CDE169
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF739CD49E7), ref: 00007FF739CDE22D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: e6c90702e7699d90ef8183dcd58ada11519777d4e2f3ffdfcf431c3589643132
Instruction ID: da49088d134d64cf9f8bb21cd5c0c07a8b36309012c3f2741759ed165c91d956
Opcode Fuzzy Hash: e6c90702e7699d90ef8183dcd58ada11519777d4e2f3ffdfcf431c3589643132
Instruction Fuzzy Hash: 3621B632F1879191E620AF22644002AF6B5FF49BD0B884235DE8E63BD9DF3CE452A750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD8130 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF739CE23F6), ref: 00007FF739CD8196
GetLastError.KERNEL32(?,?,?,00007FF739CE23F6), ref: 00007FF739CD81A0

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b6c3ad1864da4fc903e4ee8714b9a5b710aa1d92daed93d14babf9df6703bea7
Instruction ID: 8ca79035db2a69fc7c841f387a76383d4ed3aa12d0089441743473adb649b812
Opcode Fuzzy Hash: b6c3ad1864da4fc903e4ee8714b9a5b710aa1d92daed93d14babf9df6703bea7
Instruction Fuzzy Hash: C0117212B1964261EE907F7494913BD92B36F44BA4FD40239D62E472D2CE6CE448A220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC684C Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF739CC6863
_RTC_Initialize.LIBCMT ref: 00007FF739CC6884

Part of subcall function 00007FF739CD483C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD486E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 5a49cdc73d11755e6532bcf4c9cfea960e06602780bcc4135ab124cf8d894c67
Instruction ID: 7f4bc9c4560059f03f821a49a55529f8a5e0deffbbd18d07d14fe669d330dafd
Opcode Fuzzy Hash: 5a49cdc73d11755e6532bcf4c9cfea960e06602780bcc4135ab124cf8d894c67
Instruction Fuzzy Hash: 1C119281E1C28372FE147FF55A662B9DAB39F54344FC02434E68D4A2C3DD1DB9426A32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD7430 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL(?,?,0B33A42583480000,00007FF739CDF428,?,?,?,00007FF739CDF7AB,?,?,00008ACCADA1B9E9,00007FF739CDFCF0,?,?,00007FF739CD4FEA,00007FF739CDFC23), ref: 00007FF739CD7446
GetLastError.KERNEL32(?,?,0B33A42583480000,00007FF739CDF428,?,?,?,00007FF739CDF7AB,?,?,00008ACCADA1B9E9,00007FF739CDFCF0,?,?,00007FF739CD4FEA,00007FF739CDFC23), ref: 00007FF739CD7458

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: BoundaryDeleteDescriptorErrorLast
String ID:
API String ID: 2050971199-0
Opcode ID: 37d4fc302b688b4f9abb6a4751a7692922be9ede30c41b9f780b1f9b95c665d1
Instruction ID: ebac26914faa91161facfc99f40ea80ff18ac2bf48e6b781fb8cdadbe6afb0d3
Opcode Fuzzy Hash: 37d4fc302b688b4f9abb6a4751a7692922be9ede30c41b9f780b1f9b95c665d1
Instruction Fuzzy Hash: 9EE08652E0950362FF197FF2580517DA5B36F45B41F845034C80E57352DE2C64416670

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE314 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE356

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 283688b1c983b5bbfccc69b061f9be4fc93bddaf16667bb11e9bae108185b967
Instruction ID: 13c1d3db545128545b1cfb00325531cda0af7b79dba635099cf52352ff4adfc7
Opcode Fuzzy Hash: 283688b1c983b5bbfccc69b061f9be4fc93bddaf16667bb11e9bae108185b967
Instruction Fuzzy Hash: C0410661B0825166EA64FD765500239FAB2AF46FE0F885234DD9D477D5CE3CFC439A20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD8D64 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7714d0573e63f25507b2be8489397c71a0c19a763208cba6fd3206eff11542
Instruction ID: 631ae3d302127ff7d546944a51ccacb125aa3784d40569907191991c8f4dc46d
Opcode Fuzzy Hash: 1e7714d0573e63f25507b2be8489397c71a0c19a763208cba6fd3206eff11542
Instruction Fuzzy Hash: 8E21AC23A0824662E2517F31984133DBA72BF40BE0F955539E96D477E3CE7CE842AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE1A0C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1A2F

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 63989578f4481a657dfebc99918e79b9b86268c6d850b5c01b735cfb9afc51c3
Instruction ID: 5d23acb016b024183f5bd0b4447e5aee526e920e002a97ada49660b811b0db6b
Opcode Fuzzy Hash: 63989578f4481a657dfebc99918e79b9b86268c6d850b5c01b735cfb9afc51c3
Instruction Fuzzy Hash: 7C210432A0868196DB60AF38D44037AF6B2EB84B94FA44234E65E472D9DF3CD910EB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE074 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE09C

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 81d6a40524d096a1626041ed73ad73b7a7d85405b898a5e3dcaee59ef9f1c0d6
Instruction ID: b0742ae86a24a2715d8ebb6aa01bc6402ab422fd515c749dd2340e7c6411bf2d
Opcode Fuzzy Hash: 81d6a40524d096a1626041ed73ad73b7a7d85405b898a5e3dcaee59ef9f1c0d6
Instruction Fuzzy Hash: 4C119662A0C55561FB61BF35940037DEAB2AF46B80FD45435EACC47686CF3CDC42ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD808C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4565368ae485d7ef13361c82a3cf8d407a1a8a5e839cace3bd1673ee8c5215ba
Instruction ID: 93fd5637f152cc2f9732b9265463a55005bb4a01ac66fbeac85e5feaf1e03bdc
Opcode Fuzzy Hash: 4565368ae485d7ef13361c82a3cf8d407a1a8a5e839cace3bd1673ee8c5215ba
Instruction Fuzzy Hash: 8911BF73908642A1E610AF24C4402BDFB72FB80B90FD04236E24D022E6CF7CE445EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE188 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE1A5

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3b92a5f1f2e0aa284cb794e6fd54520bbf5e79f590d6cbac3a701ccc2d8f961
Instruction ID: 957296c2e3588541b48a57842ab1bc427b861e4b7100835933c24ba8f85efb69
Opcode Fuzzy Hash: c3b92a5f1f2e0aa284cb794e6fd54520bbf5e79f590d6cbac3a701ccc2d8f961
Instruction Fuzzy Hash: 27018422A0854261FE24BE75985137995726F467A4FE42730E969472D3CE3CEC42AAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE4C0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE4F5

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5b575e67002d2dedee6967ee5440534dd775457cc11eeebf968f3320105c5400
Instruction ID: ca2c2a2d98bd9e29720c2e1bab07bb0e972749e4040b88fa8bba94f3b5908d4e
Opcode Fuzzy Hash: 5b575e67002d2dedee6967ee5440534dd775457cc11eeebf968f3320105c5400
Instruction Fuzzy Hash: E1016D72A00B1AA8EB01EFB0D4404EC7BB8FB25748B901535DE8D13749EF34D6A6D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDB084 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF739CD7361,?,?,00008ACCADA1B9E9,00007FF739CCCEE1,?,?,?,?,00007FF739CDB132,?,?,00000000), ref: 00007FF739CDB0D9

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 59adfd6addcb3c78acf6b710494132aa3448c3ac84dbe37c1f7944313cad5359
Instruction ID: 5552c91a1f12ea5be164c27eb495ea6f48e4c405f7bcd31381017deced11ab5a
Opcode Fuzzy Hash: 59adfd6addcb3c78acf6b710494132aa3448c3ac84dbe37c1f7944313cad5359
Instruction Fuzzy Hash: D9F04F86B0960365FE547E72A5513B9D2B65F58B80FC84434C91E462C2DE1CF481A270

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE20C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE22E

Part of subcall function 00007FF739CCE188: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE1A5

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bda713a2d4e3bb9f3d3c9588b0f0069bab27d1bdc244728914fd3543b377c4c9
Instruction ID: 0f8e13b42f664e71667e3377b77d68427ff2ab3d8a06074d6b419ac6a4060d4d
Opcode Fuzzy Hash: bda713a2d4e3bb9f3d3c9588b0f0069bab27d1bdc244728914fd3543b377c4c9
Instruction Fuzzy Hash: 2EF03A22A4814261F924BF78A5412B9AA769F46794FD82130E999472C7CE2CE852AA70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD7470 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF739CDB119,?,?,00000000,00007FF739CDE2B3,?,?,?,00007FF739CD4D23,?,?,?,00007FF739CD4C19), ref: 00007FF739CD74AE

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fa583f48bcd9da3eb2c85f5f7ad190b6a3caafe8286a2039598b6ec46cf98300
Instruction ID: a6dacfe4d0012eda96d993a3d0bc17523826c22160f7cfec2038c390d3a4f684
Opcode Fuzzy Hash: fa583f48bcd9da3eb2c85f5f7ad190b6a3caafe8286a2039598b6ec46cf98300
Instruction Fuzzy Hash: 57F05E42B0D60665FA557F796841279D5B25F88BA0F880634D82E862C2DE3CA841BA30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCE130 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCE154

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7cd1be37ee043298a6be58b6f7db199c370753a47522793cb02e85c40be44c5b
Instruction ID: 00c7ae3a70071fe4974e4c8995e98cbba0a4719db13317a4143eae9e44a519ce
Opcode Fuzzy Hash: 7cd1be37ee043298a6be58b6f7db199c370753a47522793cb02e85c40be44c5b
Instruction Fuzzy Hash: 3DF0893174574195EB54BF7794C1978A9715F09BC0FC06434DA8D03342DE2CA9655B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6024 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,?,?,00007FF739CC5AD5,?,?,00000000,00007FF739CC58CD,?,?,00000000,00007FF739C9789D), ref: 00007FF739CC6032

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d841d635b4541f26f61ace2fa429ef51cea82accc7e9989e18c2cf73379f1839
Instruction ID: b5c4ecc18ae7c03846234bad3493532d7cbddc897d598aea5024a3863ffd005a
Opcode Fuzzy Hash: d841d635b4541f26f61ace2fa429ef51cea82accc7e9989e18c2cf73379f1839
Instruction Fuzzy Hash: 9DE0E224D2CA47B5EA047F50FE86738F6B2BB48704FD00434D14D866A28E3CA0AAB720

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF739CC4C30 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF739CC4C30(void* __eax, void* __rcx, long long __rdi, long long __rsi, void* __r8, long long __r14, long long __r15) {
				void* __rbx;
				void* __rbp;
				void* _t132;
				signed int _t133;
				void* _t171;
				unsigned int _t197;
				signed long long _t229;
				intOrPtr _t232;
				long long _t240;
				intOrPtr _t244;
				void* _t247;
				intOrPtr* _t256;
				intOrPtr _t274;
				intOrPtr _t291;
				void* _t301;
				void* _t302;
				signed long long _t303;
				void* _t316;
				void* _t317;
				signed int _t318;

				_t296 = __rdi;
				_t317 = _t302;
				_t301 = _t317 - 0x278;
				_t303 = _t302 - 0x360;
				_t229 =  *0x39d830d8; // 0x8accada1b9e9
				 *(_t301 + 0x240) = _t229 ^ _t303;
				 *((long long*)(_t317 + 0x10)) = __rsi;
				 *((long long*)(_t317 + 0x18)) = __rdi;
				r12d = 0;
				 *((long long*)(_t317 - 0x20)) = __r14;
				_t247 = __rcx;
				 *((long long*)(_t317 - 0x28)) = __r15;
				r8d = r12d;
				if ( *0x7FF739D8472C == r12d) goto 0x39cc4c96;
				if ( *0x39d84834 !=  *((intOrPtr*)(__rcx + 4))) goto 0x39cc4c96;
				_t232 =  *0x7FF739D8483C;
				if (_t232 ==  *((intOrPtr*)(__rcx + 0xc))) goto 0x39cc5102;
				if (__r8 + 0x120 - 0x10e0 <= 0) goto 0x39cc4c76;
				r8d = 0x10;
				 *(_t303 + 0x78) = r12d;
				r15d = r12d;
				__imp__GetRawInputDeviceList();
				if (__eax != 0) goto 0x39cc4df0;
				0x39ccfad0();
				r8d = 0x10;
				__imp__GetRawInputDeviceList();
				if (__eax != 0xffffffff) goto 0x39cc4d05;
				_t132 = E00007FF77FF739CCCFD0(_t232, __r8 + 0x120);
				goto 0x39cc4df0;
				if ( *(_t303 + 0x78) == 0) goto 0x39cc4ddf;
				_t299 = __rsi + __rsi;
				if ( *((intOrPtr*)(_t232 + 8 + (__rsi + __rsi) * 8)) != 2) goto 0x39cc4dcd;
				asm("xorps xmm0, xmm0");
				 *(_t303 + 0x7c) = 0x20;
				asm("movups [ebp-0x58], xmm0");
				 *(_t301 - 0x58) = 0x20;
				asm("movups [ebp-0x48], xmm0");
				__imp__GetRawInputDeviceInfoA();
				if (_t132 == 0xffffffff) goto 0x39cc4dc9;
				_t133 =  *(_t301 - 0x50) & 0x0000ffff;
				if ((( *(_t301 - 0x4c) & 0x0000ffff) << 0x00000010 | _t133) !=  *((intOrPtr*)(__rcx + 0x14))) goto 0x39cc4dc9;
				r8d = 0x100;
				E00007FF77FF739CC8BD0();
				 *(_t303 + 0x7c) = 0x100;
				__imp__GetRawInputDeviceInfoA();
				if (_t133 == 0xffffffff) goto 0x39cc4ddf;
				 *((intOrPtr*)(_t301 + 0x23f)) = r12b;
				E00007FF77FF739CC8F58(_t133, __rcx, _t301 + 0x140, "IG_", __rdi, __rsi + __rsi, _t316, _t317);
				if (_t232 != 0) goto 0x39cc4dd9;
				if (r12d + 1 -  *(_t303 + 0x78) < 0) goto 0x39cc4d14;
				goto 0x39cc4ddf;
				r15d = 1;
				E00007FF77FF739CCCFD0(_t232, _t301 + 0x140);
				if (r15d != 0) goto 0x39cc5102;
				_t256 =  *0x39d867c0; // 0x225497ae878
				_t323 = __rcx + 4;
				r9d = 0;
				if ( *((intOrPtr*)( *_t256 + 0x18))() >= 0) goto 0x39cc4e26;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to create device", _t296, _t299, _t303 + 0x70, _t303 + 0x7c);
				goto 0x39cc5102;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x58))() >= 0) goto 0x39cc4e5d;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to set device data format", _t296, _t299, _t303 + 0x70, _t303 + 0x7c);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x10))();
				goto 0x39cc5102;
				asm("xorps xmm0, xmm0");
				 *(_t301 - 0x14) = _t318;
				asm("xorps xmm1, xmm1");
				 *((intOrPtr*)(_t301 - 0x38)) = 0x2c;
				asm("movdqu [ebp-0x34], xmm0");
				asm("movdqu [ebp-0x24], xmm1");
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x18))() >= 0) goto 0x39cc4eac;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to query device capabilities", _t296, _t299, _t303 + 0x70, _t303 + 0x7c);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x10))();
				goto 0x39cc5102;
				 *((long long*)(_t301 - 4)) = 0x10;
				 *((intOrPtr*)(_t301 - 8)) = 0x14;
				 *(_t301 + 4) = _t318;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x30))() >= 0) goto 0x39cc4ef8;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to set device axis mode", _t296, _t299, _t301 - 8, _t303 + 0x7c);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x10))();
				goto 0x39cc5102;
				_t240 =  *((intOrPtr*)(_t303 + 0x70));
				asm("xorps xmm0, xmm0");
				 *((long long*)(_t301 - 0x80)) = _t240;
				 *(_t301 - 0x60) = _t318;
				asm("movdqu [ebp-0x70], xmm0");
				0x39ccfad0();
				 *((long long*)(_t301 - 0x78)) = _t240;
				r9d = 0x1f;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x20))() >= 0) goto 0x39cc4f74;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to enumerate device objects", _t296, _t299, _t301 - 0x80, _t303 + 0x7c);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))) + 0x10))();
				E00007FF77FF739CCCFD0( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70)))), _t301 - 0x80);
				goto 0x39cc5102;
				_t291 =  *((intOrPtr*)(_t301 - 0x70));
				r8d = 8;
				E00007FF77FF739CD0560(_t247,  *((intOrPtr*)(_t301 - 0x78)), _t291, _t296, _t299, _t301, _t301 - 0x80, 0x7ff739cc4c10, _t323);
				 *(_t303 + 0x38) = _t318;
				 *(_t303 + 0x30) = _t318;
				 *(_t303 + 0x28) = 0x100;
				 *(_t303 + 0x20) = _t301 + 0x40;
				_t82 = _t291 - 1; // -1
				r9d = _t82;
				if (WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??) != 0) goto 0x39cc4fee;
				E00007FF77FF739CBE2E0(0x10008, "Win32: Failed to convert joystick name to UTF-8", _t296, _t299, _t247 + 0x28, 0x7ff739cc4c10);
				_t244 =  *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x70))));
				 *((intOrPtr*)(_t244 + 0x10))();
				E00007FF77FF739CCCFD0(_t244, _t247 + 0x28);
				goto 0x39cc5107;
				if ( *((intOrPtr*)(_t247 + 0x1e)) != 0x56444950) goto 0x39cc5039;
				if ( *((short*)(_t247 + 0x22)) != 0x4449) goto 0x39cc5039;
				_t197 =  *(_t247 + 0x14);
				r10d = _t197;
				r10d = r10d >> 0x18;
				 *(_t303 + 0x28) = r10d;
				r8d = _t197 & 0x000000ff;
				 *(_t303 + 0x20) = _t197 >> 0x00000010 & 0x000000ff;
				r9d = _t197 >> 0x00000008 & 0x000000ff;
				E00007FF77FF739CC5360(_t171, _t244, _t301 + 0x10, "03000000%02x%02x0000%02x%02x000000000000", _t247 + 0x28, 0x7ff739cc4c10);
				goto 0x39cc50a1;
				r10d =  *((char*)(_t301 + 0x47));
				r11d =  *((char*)(_t301 + 0x46));
				r14d =  *((char*)(_t301 + 0x42));
				r9d =  *((char*)(_t301 + 0x41));
				r8d =  *((char*)(_t301 + 0x40));
				 *((intOrPtr*)(_t303 + 0x60)) =  *((char*)(_t301 + 0x4a));
				 *((intOrPtr*)(_t303 + 0x58)) =  *((char*)(_t301 + 0x49));
				 *((intOrPtr*)(_t303 + 0x50)) =  *((char*)(_t301 + 0x48));
				 *(_t303 + 0x48) = r10d;
				 *((intOrPtr*)(_t303 + 0x40)) = r11d;
				 *(_t303 + 0x38) =  *((char*)(_t301 + 0x45));
				 *(_t303 + 0x30) =  *((char*)(_t301 + 0x44));
				 *(_t303 + 0x28) =  *((char*)(_t301 + 0x43));
				 *(_t303 + 0x20) = r14d;
				E00007FF77FF739CC5360( *((char*)(_t301 + 0x45)), _t244, _t301 + 0x10, "05000000%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x00", _t247 + 0x28, 0x7ff739cc4c10);
				r8d =  *(_t301 - 0x68);
				r8d = r8d +  *((intOrPtr*)(_t301 - 0x6c));
				r9d =  *(_t301 - 0x64);
				 *(_t303 + 0x20) =  *(_t301 - 0x60);
				E00007FF77FF739CBEB80(_t301 + 0x40, _t301 + 0x10);
				_t274 = _t244;
				if (_t244 == 0) goto 0x39cc4fd3;
				 *((long long*)(_t274 + 0x100)) =  *((intOrPtr*)(_t303 + 0x70));
				asm("inc ecx");
				asm("movups [ecx+0x10c], xmm0");
				 *((long long*)(_t274 + 0xf0)) =  *((intOrPtr*)(_t301 - 0x78));
				 *((intOrPtr*)(_t274 + 0xf8)) =  *((intOrPtr*)(_t301 - 0x70));
				E00007FF77FF739CBEF80();
				return E00007FF77FF739CC6B50(1,  *((char*)(_t301 + 0x49)),  *(_t301 + 0x240) ^ _t303);
			}

0x7ff739cc4c30
0x7ff739cc4c30
0x7ff739cc4c37
0x7ff739cc4c3e
0x7ff739cc4c45
0x7ff739cc4c4f
0x7ff739cc4c56
0x7ff739cc4c61
0x7ff739cc4c65
0x7ff739cc4c68
0x7ff739cc4c6c
0x7ff739cc4c6f
0x7ff739cc4c73
0x7ff739cc4c7d
0x7ff739cc4c86
0x7ff739cc4c88
0x7ff739cc4c90
0x7ff739cc4cab
0x7ff739cc4cad
0x7ff739cc4cb3
0x7ff739cc4cbf
0x7ff739cc4cc2
0x7ff739cc4cca
0x7ff739cc4cd7
0x7ff739cc4cdc
0x7ff739cc4ced
0x7ff739cc4cf6
0x7ff739cc4cfb
0x7ff739cc4d00
0x7ff739cc4d0e
0x7ff739cc4d16
0x7ff739cc4d1f
0x7ff739cc4d2e
0x7ff739cc4d31
0x7ff739cc4d39
0x7ff739cc4d41
0x7ff739cc4d4d
0x7ff739cc4d51
0x7ff739cc4d5a
0x7ff739cc4d60
0x7ff739cc4d6c
0x7ff739cc4d77
0x7ff739cc4d7d
0x7ff739cc4d92
0x7ff739cc4d9f
0x7ff739cc4da8
0x7ff739cc4db1
0x7ff739cc4dbf
0x7ff739cc4dc7
0x7ff739cc4dd1
0x7ff739cc4dd7
0x7ff739cc4dd9
0x7ff739cc4de2
0x7ff739cc4dea
0x7ff739cc4df0
0x7ff739cc4df7
0x7ff739cc4dfb
0x7ff739cc4e0e
0x7ff739cc4e1c
0x7ff739cc4e21
0x7ff739cc4e3a
0x7ff739cc4e48
0x7ff739cc4e55
0x7ff739cc4e58
0x7ff739cc4e66
0x7ff739cc4e69
0x7ff739cc4e6d
0x7ff739cc4e70
0x7ff739cc4e77
0x7ff739cc4e7c
0x7ff739cc4e89
0x7ff739cc4e97
0x7ff739cc4ea4
0x7ff739cc4ea7
0x7ff739cc4eb5
0x7ff739cc4ec2
0x7ff739cc4ec9
0x7ff739cc4ed5
0x7ff739cc4ee3
0x7ff739cc4ef0
0x7ff739cc4ef3
0x7ff739cc4ef8
0x7ff739cc4efd
0x7ff739cc4f08
0x7ff739cc4f12
0x7ff739cc4f1c
0x7ff739cc4f21
0x7ff739cc4f2f
0x7ff739cc4f3a
0x7ff739cc4f48
0x7ff739cc4f56
0x7ff739cc4f63
0x7ff739cc4f6a
0x7ff739cc4f6f
0x7ff739cc4f74
0x7ff739cc4f83
0x7ff739cc4f89
0x7ff739cc4f8e
0x7ff739cc4f99
0x7ff739cc4fa2
0x7ff739cc4faf
0x7ff739cc4fb4
0x7ff739cc4fb4
0x7ff739cc4fc0
0x7ff739cc4fce
0x7ff739cc4fd8
0x7ff739cc4fdb
0x7ff739cc4fe2
0x7ff739cc4fe9
0x7ff739cc4ff5
0x7ff739cc4ffd
0x7ff739cc4fff
0x7ff739cc5007
0x7ff739cc500f
0x7ff739cc5016
0x7ff739cc501b
0x7ff739cc5026
0x7ff739cc502e
0x7ff739cc5032
0x7ff739cc5037
0x7ff739cc5045
0x7ff739cc504a
0x7ff739cc505b
0x7ff739cc5060
0x7ff739cc5065
0x7ff739cc506a
0x7ff739cc506e
0x7ff739cc5076
0x7ff739cc5081
0x7ff739cc5086
0x7ff739cc508b
0x7ff739cc508f
0x7ff739cc5093
0x7ff739cc5097
0x7ff739cc509c
0x7ff739cc50a1
0x7ff739cc50b0
0x7ff739cc50b4
0x7ff739cc50b8
0x7ff739cc50bc
0x7ff739cc50c1
0x7ff739cc50c7
0x7ff739cc50d7
0x7ff739cc50de
0x7ff739cc50e2
0x7ff739cc50ed
0x7ff739cc50f7
0x7ff739cc50fd
0x7ff739cc5141

APIs

GetRawInputDeviceList.USER32 ref: 00007FF739CC4CC2
GetRawInputDeviceList.USER32 ref: 00007FF739CC4CED
GetRawInputDeviceInfoA.USER32 ref: 00007FF739CC4D51
GetRawInputDeviceInfoA.USER32 ref: 00007FF739CC4D9F

Strings

, xrefs: 00007FF739CC4D31
Win32: Failed to create device, xrefs: 00007FF739CC4E10
Win32: Failed to enumerate device objects, xrefs: 00007FF739CC4F4A
Win32: Failed to query device capabilities, xrefs: 00007FF739CC4E8B
IG_, xrefs: 00007FF739CC4DAA
03000000%02x%02x0000%02x%02x000000000000, xrefs: 00007FF739CC501F
ID, xrefs: 00007FF739CC4FF7
05000000%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x00, xrefs: 00007FF739CC507A
Win32: Failed to convert joystick name to UTF-8, xrefs: 00007FF739CC4FC2
Win32: Failed to set device axis mode, xrefs: 00007FF739CC4ED7
Win32: Failed to set device data format, xrefs: 00007FF739CC4E3C
PIDV, xrefs: 00007FF739CC4FEE

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: DeviceInput$InfoList
String ID: $03000000%02x%02x0000%02x%02x000000000000$05000000%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x00$ID$IG_$PIDV$Win32: Failed to convert joystick name to UTF-8$Win32: Failed to create device$Win32: Failed to enumerate device objects$Win32: Failed to query device capabilities$Win32: Failed to set device axis mode$Win32: Failed to set device data format
API String ID: 3907109775-326256626
Opcode ID: f6e73abe3da0aef0b08487b3daa8c0e649e9dbadc1c12b06a72de865ad50697a
Instruction ID: 7238bfd3ed1f7b24708813b301cb0e9933ac607c33b32d1dd7363affa0407911
Opcode Fuzzy Hash: f6e73abe3da0aef0b08487b3daa8c0e649e9dbadc1c12b06a72de865ad50697a
Instruction Fuzzy Hash: E5E1C332B08A8196E710EF35D4402ADBBB2FB84B88F905135DA8E47B59DF3CD546DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE36AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1208
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E00007FF77FF739CE36AC(void* __edx, signed int __rcx, long long __r8, signed int __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r13;
				void* _t507;
				void* _t519;
				void* _t527;
				signed long long _t536;
				signed int _t557;
				intOrPtr _t562;
				signed long long _t588;
				signed int _t596;
				intOrPtr _t602;
				signed long long _t627;
				void* _t635;
				signed int _t659;
				intOrPtr _t663;
				signed int _t710;
				signed int _t718;
				intOrPtr _t720;
				signed int _t725;
				signed long long _t727;
				signed long long _t733;
				signed long long _t739;
				intOrPtr _t768;
				signed int _t793;
				signed int _t795;
				signed int _t798;
				signed int _t799;
				void* _t800;
				void* _t804;
				void* _t806;
				void* _t811;
				void* _t841;
				void* _t847;
				signed long long _t957;
				signed long long _t959;
				intOrPtr _t964;
				signed long long _t965;
				void* _t967;
				signed long long _t969;
				signed long long _t970;
				signed long long _t971;
				signed long long _t972;
				void* _t977;
				intOrPtr* _t978;
				signed long long _t989;
				long long _t1020;
				void* _t1036;
				signed long long _t1044;
				signed long long _t1045;
				long long _t1052;
				signed long long _t1056;
				long long _t1066;
				signed long long _t1070;
				signed long long _t1074;
				void* _t1075;
				signed long long _t1076;
				signed long long _t1081;
				signed long long _t1082;
				char* _t1083;
				void* _t1084;
				void* _t1088;
				void* _t1089;
				signed long long _t1090;
				signed long long _t1095;
				signed long long _t1097;
				signed long long _t1108;
				signed long long _t1109;
				signed long long _t1124;
				signed long long _t1125;
				signed long long _t1136;
				void* _t1138;
				long long _t1151;
				void* _t1152;

				_t1137 = __r9;
				_t1088 = _t1089 - 0x6d8;
				_t1090 = _t1089 - 0x7d8;
				_t957 =  *0x39d830d8; // 0x8accada1b9e9
				 *(_t1088 + 0x6c0) = _t957 ^ _t1090;
				 *(_t1090 + 0x38) = __rcx;
				 *((long long*)(_t1090 + 0x68)) = __r9;
				_t1151 = __r8;
				 *((long long*)(_t1090 + 0x78)) = __r8;
				E00007FF77FF739CE5CC0(_t800, _t1090 + 0x58, _t1138);
				r12d = 0;
				if (( *(_t1090 + 0x58) & 0x0000001f) != 0x1f) goto 0x39ce370f;
				 *((intOrPtr*)(_t1090 + 0x60)) = r12b;
				goto 0x39ce371e;
				_t507 = E00007FF77FF739CE5D2C(( *(_t1090 + 0x58) & 0x0000001f) - 0x1f, _t1090 + 0x58, _t1076, __r9);
				 *((char*)(_t1090 + 0x60)) = 1;
				_t959 =  *(_t1090 + 0x38);
				 *((long long*)(__r8 + 8)) = __r9;
				r9d = 0x7ff;
				_t13 = _t969 + 0xd; // 0x2d
				_t725 = _t13;
				_t667 =  <  ? _t725 : 0x20;
				 *((intOrPtr*)(__r8)) =  <  ? _t725 : 0x20;
				if (_t959 != 0) goto 0x39ce376b;
				if ((0xffffffff & _t959) != 0) goto 0x39ce376b;
				 *(__r8 + 4) = r12d;
				goto 0x39ce48aa;
				_t804 = (_t959 >> 0x00000034 & __r9) - __r9;
				if (_t804 == 0) goto 0x39ce3775;
				goto 0x39ce37b6;
				if (_t804 != 0) goto 0x39ce3784;
				goto 0x39ce37ae;
				if (_t959 >= 0) goto 0x39ce379f;
				_t806 = (_t959 & 0xffffffff) - 0;
				if (_t806 != 0) goto 0x39ce379f;
				goto 0x39ce37ae;
				 *(__r8 + 4) = 1;
				if (_t806 == 0) goto 0x39ce48bf;
				if (_t806 == 0) goto 0x39ce48a3;
				if (_t806 == 0) goto 0x39ce489a;
				if (0 == 1) goto 0x39ce4891;
				 *(_t1090 + 0x38) = _t959 & 0xffffffff;
				_t768 = __edx + 1;
				asm("movsd xmm0, [esp+0x38]");
				 *((intOrPtr*)(_t1090 + 0x50)) = _t768;
				asm("movsd [esp+0x48], xmm0");
				_t1044 =  *((intOrPtr*)(_t1090 + 0x48));
				_t1095 = _t1044 >> 0x34;
				asm("dec eax");
				_t1045 = _t1044 & 0xffffffff;
				_t989 =  ~(_t1095 & __r9);
				asm("sbb eax, eax");
				r8d = r8d & r9d;
				r15d = __r9 + 0;
				r15d = r15d + r8d;
				0x39ce5e40();
				E00007FF77FF739CE5D7C(_t507, _t1095);
				asm("cvttsd2si ecx, xmm0");
				 *((intOrPtr*)(_t1088 - 0x7c)) = _t768;
				asm("inc ebp");
				r13d = r13d & 0;
				 *((intOrPtr*)(_t1088 - 0x78)) = _t768;
				 *(_t1090 + 0x40) = r13d;
				asm("sbb edx, edx");
				_t727 =  ~_t725 + 1;
				 *(_t1088 - 0x80) = _t727;
				if (r15d - 0x434 < 0) goto 0x39ce3b0d;
				 *(_t1088 + 0x328) = 0x100000;
				 *((intOrPtr*)(_t1088 + 0x324)) = 0;
				 *(_t1088 + 0x320) = 2;
				if (_t768 == 0) goto 0x39ce39ea;
				r8d = r12d;
				if ( *((intOrPtr*)(_t1088 + 0x324 + _t989 * 4)) !=  *(_t1088 + _t989 * 4 - 0x7c)) goto 0x39ce39ea;
				r8d = r8d + 1;
				_t811 = r8d - 2;
				if (_t811 != 0) goto 0x39ce38ab;
				r11d = _t1152 - 0x432;
				 *(_t1090 + 0x38) = r12d;
				r8d = r11d;
				r11d = r11d & 0x0000001f;
				r8d = r8d >> 5;
				asm("bsr eax, [ebp+eax*4-0x7c]");
				r15d = 1;
				r15d =  !r15d;
				if (_t811 == 0) goto 0x39ce3905;
				goto 0x39ce3908;
				_t519 = _t1045 + _t1095;
				if (_t519 != 0x73) goto 0x39ce391a;
				if (r11d - 0x20 > 0) goto 0x39ce391d;
				r12d = r12d | 0xffffffff;
				if (_t519 - 0x73 > 0) goto 0x39ce39b6;
				if (r12b != 0) goto 0x39ce39b6;
				r14d = 0x72;
				r14d =  <  ? _t519 : r14d;
				r10d = r14d;
				if (r14d == r12d) goto 0x39ce3996;
				if (r10d - r8d < 0) goto 0x39ce3996;
				if (r10d - r8d - _t727 >= 0) goto 0x39ce3960;
				r9d =  *(_t1088 + 0x3fffffffffff84);
				goto 0x39ce3963;
				r9d = 0;
				if (0xfffffffffffff - _t727 >= 0) goto 0x39ce396d;
				goto 0x39ce396f;
				r9d = r9d & 0;
				r10d = r10d + r12d;
				r9d = r9d << r11d;
				 *(_t1088 + 0x3fffffffffff84) = (0 & r15d) >> 0x00000020 - r11d | r9d;
				if (r10d == r12d) goto 0x39ce3996;
				_t733 =  *(_t1088 - 0x80);
				goto 0x39ce3947;
				if (r8d == 0) goto 0x39ce39a9;
				 *(_t1088 + _t989 * 4 - 0x7c) =  *(_t1088 + _t989 * 4 - 0x7c) & 0x00000000;
				if (1 != r8d) goto 0x39ce399d;
				r14d =  >  ? __r8 + 1 : r14d;
				goto 0x39ce39b9;
				r14d = 0;
				 *(_t1088 + 0x328) =  *(_t1088 + 0x328) & 0x00000000;
				r15d = 1;
				 *(_t1088 + 0x150) = r15d;
				 *(_t1088 - 0x80) = r14d;
				 *(_t1088 + 0x320) = 1;
				 *(_t1088 + 0x154) = 4;
				goto 0x39ce3d0c;
				r11d = _t1152 - 0x433;
				 *(_t1090 + 0x38) = r12d;
				r8d = r11d;
				r11d = r11d & 0x0000001f;
				r8d = r8d >> 5;
				_t1081 = (_t1076 & 0x00000000) + _t1045 >> 0x20 << 0x20 << 0x20;
				asm("bsr eax, [ebp+eax*4-0x7c]");
				r15d = 1;
				r15d =  !r15d;
				if (r11d == 0x20) goto 0x39ce3a28;
				goto 0x39ce3a2b;
				_t527 = _t1045 + _t1095;
				if (_t527 != 0x73) goto 0x39ce3a3d;
				if (r11d - 0x20 > 0) goto 0x39ce3a40;
				r12d = r12d | 0xffffffff;
				if (_t527 - 0x73 > 0) goto 0x39ce3ad9;
				if (r12b != 0) goto 0x39ce3ad9;
				r14d = 0x72;
				r14d =  <  ? _t527 : r14d;
				r10d = r14d;
				if (r14d == r12d) goto 0x39ce3ab9;
				if (r10d - r8d < 0) goto 0x39ce3ab9;
				if (r10d - r8d - _t733 >= 0) goto 0x39ce3a83;
				r9d =  *(_t1088 + 0x3fffffffffff84);
				goto 0x39ce3a86;
				r9d = 0;
				if (0xfffffffffffff - _t733 >= 0) goto 0x39ce3a90;
				goto 0x39ce3a92;
				r9d = r9d & 0x00000001;
				r10d = r10d + r12d;
				r9d = r9d << r11d;
				 *(_t1088 + 0x3fffffffffff84) = (0 & r15d) >> 0x00000020 | r9d;
				if (r10d == r12d) goto 0x39ce3ab9;
				_t739 =  *(_t1088 - 0x80);
				goto 0x39ce3a6a;
				if (r8d == 0) goto 0x39ce3acc;
				 *(_t1088 + _t989 * 4 - 0x7c) =  *(_t1088 + _t989 * 4 - 0x7c) & 0x00000000;
				if (1 != r8d) goto 0x39ce3ac0;
				r14d =  >  ? __r8 + 1 : r14d;
				goto 0x39ce3adc;
				r14d = 0;
				 *(_t1088 + 0x328) =  *(_t1088 + 0x328) & 0x00000000;
				r15d = 1;
				 *(_t1088 + 0x150) = r15d;
				 *(_t1088 - 0x80) = r14d;
				 *(_t1088 + 0x320) = 1;
				 *(_t1088 + 0x154) = 2;
				goto 0x39ce3d0c;
				if (r15d == 0x36) goto 0x39ce3c40;
				 *(_t1088 + 0x328) = 0x100000;
				 *((intOrPtr*)(_t1088 + 0x324)) = 0;
				 *(_t1088 + 0x320) = 0x20;
				if (0 == 0) goto 0x39ce3c40;
				r8d = r12d;
				if ( *((intOrPtr*)(_t1088 + 0x324 + _t989 * 4)) !=  *(_t1088 + _t989 * 4 - 0x7c)) goto 0x39ce3c40;
				r8d = r8d + 1;
				_t841 = r8d - 0x20;
				if (_t841 != 0) goto 0x39ce3b3a;
				asm("bsr eax, edi");
				 *(_t1090 + 0x38) = r12d;
				if (_t841 == 0) goto 0x39ce3b64;
				goto 0x39ce3b67;
				r14d = _t739;
				r12d = r12d | 0xffffffff;
				_t536 = _t739;
				r10d = _t536;
				r8d = 0xfffffffffffff;
				if (_t536 - _t739 >= 0) goto 0x39ce3b84;
				r9d =  *(_t1088 + 0x3fffffffffff80);
				goto 0x39ce3b87;
				r9d = 0;
				if (r8d - _t739 >= 0) goto 0x39ce3b93;
				goto 0x39ce3b95;
				 *(_t1088 + 0x3fffffffffff80) = 0 >> 0x0000001e | r9d << 0x00000002;
				if (r8d == r12d) goto 0x39ce3bb2;
				goto 0x39ce3b72;
				r14d =  <  ? __r8 + 1 : r14d;
				 *(_t1088 - 0x80) = r14d;
				_t970 = _t969 << 2;
				E00007FF77FF739CC8BD0();
				 *(_t1088 + _t970 + 0x324) = 1 << sil;
				_t118 = _t1081 + 1; // 0x437
				r15d = _t118;
				r8d = r15d;
				_t1097 = _t970 << 2;
				 *(_t1088 + 0x320) = r15d;
				 *(_t1088 + 0x150) = r15d;
				if (_t1097 == 0) goto 0x39ce3d0c;
				_t847 = _t1097 - _t970;
				if (_t847 > 0) goto 0x39ce3ceb;
				E00007FF77FF739CC8520();
				goto 0x39ce3d05;
				 *(_t1090 + 0x38) = r12d;
				asm("bsr eax, [ebp+eax*4-0x7c]");
				if (_t847 == 0) goto 0x39ce3c53;
				goto 0x39ce3c56;
				r14d = 0;
				r12d = r12d | 0xffffffff;
				r10d = 0;
				r8d = 0xfffffffffffff;
				if (0 >= 0) goto 0x39ce3c73;
				r9d =  *(_t1088 + 0x3fffffffffff80);
				goto 0x39ce3c76;
				r9d = 0;
				if (r8d >= 0) goto 0x39ce3c82;
				goto 0x39ce3c84;
				 *(_t1088 + 0x3fffffffffff80) = 0 >> 0x0000001f | __r9 + __r9;
				if (r8d == r12d) goto 0x39ce3c9f;
				goto 0x39ce3c61;
				r14d =  <  ? __r8 + 1 : r14d;
				 *(_t1088 - 0x80) = r14d;
				_t971 = _t970 << 2;
				E00007FF77FF739CC8BD0();
				 *(_t1088 + _t971 + 0x324) = 1 << sil;
				goto 0x39ce3bf8;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CCCED8(0);
				 *0 = 0x22;
				E00007FF77FF739CCCD88();
				r15d =  *(_t1088 + 0x150);
				if (r13d < 0) goto 0x39ce420a;
				_t557 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t1090 + 0x38) = _t557;
				r12d = _t557;
				 *(_t1090 + 0x30) = _t557;
				if (_t557 == 0) goto 0x39ce410d;
				r13d = r12d;
				r13d =  >  ? 0x26 : r13d;
				 *(_t1090 + 0x44) = r13d;
				_t972 = _t971 << 2;
				 *(_t1088 + 0x320) = __r9 + _t1088 + 0x324;
				E00007FF77FF739CC8BD0();
				_t1086 = __r9 << 2;
				E00007FF77FF739CC8520();
				r10d =  *(_t1088 + 0x320);
				if (r10d - 1 > 0) goto 0x39ce3e69;
				_t562 =  *((intOrPtr*)(_t1088 + 0x324));
				if (_t562 != 0) goto 0x39ce3de0;
				r15d = 0;
				 *(_t1088 + 0x150) = r15d;
				goto 0x39ce40e0;
				if (_t562 == 1) goto 0x39ce40e0;
				if (r15d == 0) goto 0x39ce40e0;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x39ce3dfb;
				if (r8d == 0) goto 0x39ce3e5d;
				if ( *(_t1088 + 0x150) - 0x73 >= 0) goto 0x39ce3e4c;
				 *(_t1088 + 0x40000000000154) = r8d;
				r15d =  *(_t1088 + 0x150);
				r15d = r15d + 1;
				goto 0x39ce3dd4;
				r15d = 0;
				 *(_t1088 + 0x150) = r15d;
				goto 0x39ce40e2;
				r15d =  *(_t1088 + 0x150);
				goto 0x39ce40e0;
				if (r15d - 1 > 0) goto 0x39ce3f20;
				_t659 =  *(_t1088 + 0x154);
				r15d = r10d;
				 *(_t1088 + 0x150) = r10d;
				if (0 << 2 == 0) goto 0x39ce3ecf;
				if (0 << 2 - 0 > 0) goto 0x39ce3eae;
				E00007FF77FF739CC8520();
				goto 0x39ce3ec8;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CCCED8(0);
				 *0 = 0x22;
				E00007FF77FF739CCCD88();
				r15d =  *(_t1088 + 0x150);
				if (_t659 == 0) goto 0x39ce3dd1;
				if (_t659 == 1) goto 0x39ce40e0;
				if (r15d == 0) goto 0x39ce40e0;
				r8d = 0;
				r9d = 0;
				_t1108 = (_t1088 + 0x154) * _t972 + 0 >> 0x20;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x39ce3ef2;
				goto 0x39ce3e24;
				r12d = r15d;
				_t1150 =  >=  ? _t1088 + 0x154 : _t1088 + 0x324;
				r12d =  <  ? r10d : r12d;
				_t1052 =  >=  ? _t1088 + 0x324 : _t1088 + 0x154;
				 *((long long*)(_t1090 + 0x48)) = _t1052;
				r10d =  !=  ? r15d : r10d;
				r15d = 0;
				r9d = 0;
				 *(_t1088 + 0x4f0) = r15d;
				if (r12d == 0) goto 0x39ce4083;
				_t793 =  *(( >=  ? _t1088 + 0x154 : _t1088 + 0x324) + __r9 * 4);
				if (_t793 != 0) goto 0x39ce3f9f;
				if (r9d != r15d) goto 0x39ce4077;
				 *(_t1088 + 0x4f4 + __r9 * 4) =  *(_t1088 + 0x4f4 + __r9 * 4) & _t793;
				_t213 = _t1137 + 1; // 0x1
				r15d = _t213;
				 *(_t1088 + 0x4f0) = r15d;
				goto 0x39ce4077;
				r11d = 0;
				r8d = r9d;
				if (r10d == 0) goto 0x39ce4068;
				if (r8d == 0x73) goto 0x39ce4016;
				if (r8d != r15d) goto 0x39ce3fd3;
				 *(_t1088 + 0x4f4 + _t1081 * 4) =  *(_t1088 + 0x4f4 + _t1081 * 4) & 0x00000000;
				_t221 = _t1108 + 1; // 0x1
				 *(_t1088 + 0x4f0) = _t221;
				r8d = r8d + 1;
				 *(_t1088 + 0x4f4 + _t1081 * 4) =  *(_t1052 + 0x40000000000000);
				r15d =  *(_t1088 + 0x4f0);
				if (_t1108 + _t972 == r10d) goto 0x39ce4016;
				_t1056 =  *((intOrPtr*)(_t1090 + 0x48));
				goto 0x39ce3fb3;
				if (r11d == 0) goto 0x39ce4068;
				if (r8d == 0x73) goto 0x39ce41fe;
				if (r8d != r15d) goto 0x39ce403f;
				 *(_t1088 + 0x4f4 + _t1056 * 4) =  *(_t1088 + 0x4f4 + _t1056 * 4) & 0x00000000;
				_t241 = _t1108 + 1; // 0x1
				 *(_t1088 + 0x4f0) = _t241;
				r8d = r8d + 1;
				_t710 = r11d;
				 *(_t1088 + 0x4f4 + _t1056 * 4) = _t710;
				r15d =  *(_t1088 + 0x4f0);
				r11d = _t710;
				if (_t710 != 0) goto 0x39ce401b;
				if (r8d == 0x73) goto 0x39ce41fe;
				r9d = r9d + 1;
				if (r9d != r12d) goto 0x39ce3f72;
				r8d = r15d;
				_t1109 = _t1108 << 2;
				 *(_t1088 + 0x150) = r15d;
				if (_t1109 == 0) goto 0x39ce40d6;
				if (_t1109 - 0 > 0) goto 0x39ce40b5;
				E00007FF77FF739CC8520();
				goto 0x39ce40cf;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CCCED8(0);
				 *0 = 0x22;
				E00007FF77FF739CCCD88();
				r15d =  *(_t1088 + 0x150);
				r12d =  *(_t1090 + 0x30);
				r13d =  *(_t1090 + 0x44);
				if (1 == 0) goto 0x39ce41fe;
				r12d = r12d - r13d;
				 *(_t1090 + 0x30) = r12d;
				if (1 != 0) goto 0x39ce3d41;
				r13d =  *(_t1090 + 0x40);
				if (1 == 0) goto 0x39ce419e;
				_t588 =  *0x407FF739D714F8;
				if (_t588 == 0) goto 0x39ce41fe;
				if (_t588 == 1) goto 0x39ce419e;
				if (r15d == 0) goto 0x39ce419e;
				r8d = 0;
				r10d = _t588;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x39ce4142;
				if (r8d == 0) goto 0x39ce4197;
				if ( *(_t1088 + 0x150) - 0x73 >= 0) goto 0x39ce41fe;
				 *(_t1088 + 0x40000000000154) = r8d;
				r15d =  *(_t1088 + 0x150);
				r15d = r15d + 1;
				goto 0x39ce4201;
				r15d =  *(_t1088 + 0x150);
				_t1082 =  *((intOrPtr*)(_t1090 + 0x68));
				r12d = 0;
				if (r14d == 0) goto 0x39ce467c;
				r8d = r12d;
				r9d = r12d;
				r9d = r9d + 1;
				 *(_t1088 + 0x1ffdce71fff84) = r8d;
				if (r9d != r14d) goto 0x39ce41b8;
				if (r8d == 0) goto 0x39ce467c;
				if ( *(_t1088 - 0x80) - 0x73 >= 0) goto 0x39ce4659;
				 *(_t1088 + 0x3fffffffffff84) = r8d;
				 *(_t1088 - 0x80) =  *(_t1088 - 0x80) + 1;
				goto 0x39ce467c;
				r15d = 0;
				 *(_t1088 + 0x150) = r15d;
				goto 0x39ce419e;
				r13d =  ~r13d;
				_t596 =  *(_t1088 - 0x80) * r13d >> 0x20 >> 3;
				 *(_t1090 + 0x44) = _t596;
				r12d = _t596;
				 *(_t1090 + 0x30) = _t596;
				if (_t596 == 0) goto 0x39ce45c1;
				_t598 =  >  ? 0x26 : r12d;
				 *(_t1090 + 0x38) =  >  ? 0x26 : r12d;
				_t974 = _t1082 << 2;
				 *(_t1088 + 0x320) = (__r9 << 2) + 0x50000000000000;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CC8520();
				r10d =  *(_t1088 + 0x320);
				if (r10d - 1 > 0) goto 0x39ce433d;
				_t602 =  *((intOrPtr*)(_t1088 + 0x324));
				if (_t602 != 0) goto 0x39ce42cc;
				r14d = 0;
				 *(_t1088 - 0x80) = r14d;
				goto 0x39ce4597;
				if (_t602 == 1) goto 0x39ce4597;
				if (r14d == 0) goto 0x39ce4597;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x39ce42e7;
				if (r8d == 0) goto 0x39ce4334;
				if ( *(_t1088 - 0x80) - 0x73 >= 0) goto 0x39ce4326;
				 *(_t1088 + 0x3fffffffffff84) = r8d;
				r14d =  *(_t1088 - 0x80);
				r14d = r14d + 1;
				goto 0x39ce42c3;
				r14d = 0;
				 *(_t1088 - 0x80) = r14d;
				goto 0x39ce4599;
				r14d =  *(_t1088 - 0x80);
				goto 0x39ce4597;
				if (r14d - 1 > 0) goto 0x39ce43e2;
				_t663 =  *((intOrPtr*)(_t1088 - 0x7c));
				r14d = r10d;
				 *(_t1088 - 0x80) = r10d;
				if (0 << 2 == 0) goto 0x39ce4397;
				if (0 << 2 - 0 > 0) goto 0x39ce4379;
				E00007FF77FF739CC8520();
				goto 0x39ce4393;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CCCED8(0);
				 *0 = 0x22;
				E00007FF77FF739CCCD88();
				r14d =  *(_t1088 - 0x80);
				if (_t663 == 0) goto 0x39ce42c0;
				if (_t663 == 1) goto 0x39ce4597;
				if (r14d == 0) goto 0x39ce4597;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x39ce43ba;
				goto 0x39ce430a;
				r12d = r14d;
				_t1020 =  >=  ? _t1088 - 0x7c : _t1088 + 0x324;
				_t1124 = _t1088 + 0x324;
				r12d =  <  ? r10d : r12d;
				 *((long long*)(_t1090 + 0x70)) = _t1020;
				_t1066 =  >=  ? _t1124 : _t1088 - 0x7c;
				 *((long long*)(_t1090 + 0x48)) = _t1066;
				r10d =  !=  ? r14d : r10d;
				r14d = 0;
				r9d = 0;
				 *(_t1088 + 0x4f0) = r14d;
				if (r12d == 0) goto 0x39ce4548;
				_t795 =  *(_t1020 + __r9 * 4);
				if (_t795 != 0) goto 0x39ce445f;
				if (r9d != r14d) goto 0x39ce453c;
				 *(_t1088 + 0x4f4 + __r9 * 4) =  *(_t1088 + 0x4f4 + __r9 * 4) & _t795;
				_t369 = _t1137 + 1; // 0x1
				r14d = _t369;
				 *(_t1088 + 0x4f0) = r14d;
				goto 0x39ce453c;
				r11d = 0;
				r8d = r9d;
				if (r10d == 0) goto 0x39ce4528;
				if (r8d == 0x73) goto 0x39ce44d6;
				if (r8d != r14d) goto 0x39ce4493;
				 *(_t1088 + 0x4f4 + _t1082 * 4) =  *(_t1088 + 0x4f4 + _t1082 * 4) & 0x00000000;
				_t377 = _t1124 + 1; // 0x1
				 *(_t1088 + 0x4f0) = _t377;
				r8d = r8d + 1;
				 *(_t1088 + 0x4f4 + _t1082 * 4) =  *(_t1066 + 0x40000000000000);
				r14d =  *(_t1088 + 0x4f0);
				if ((_t1082 << 2) + _t1124 == r10d) goto 0x39ce44d6;
				_t1070 =  *((intOrPtr*)(_t1090 + 0x48));
				goto 0x39ce4473;
				if (r11d == 0) goto 0x39ce4528;
				if (r8d == 0x73) goto 0x39ce4648;
				if (r8d != r14d) goto 0x39ce44ff;
				 *(_t1088 + 0x4f4 + _t1070 * 4) =  *(_t1088 + 0x4f4 + _t1070 * 4) & 0x00000000;
				_t397 = _t1124 + 1; // 0x1
				 *(_t1088 + 0x4f0) = _t397;
				_t718 =  *(_t1088 + 0x4f4 + _t1070 * 4);
				r8d = r8d + 1;
				 *(_t1088 + 0x4f4 + _t1070 * 4) = _t718;
				r14d =  *(_t1088 + 0x4f0);
				r11d = _t718;
				if (_t718 != 0) goto 0x39ce44db;
				if (r8d == 0x73) goto 0x39ce4648;
				r9d = r9d + 1;
				if (r9d != r12d) goto 0x39ce4433;
				r8d = r14d;
				_t1125 = _t1124 << 2;
				 *(_t1088 - 0x80) = r14d;
				if (_t1125 == 0) goto 0x39ce4592;
				if (_t1125 - 0 > 0) goto 0x39ce4574;
				E00007FF77FF739CC8520();
				goto 0x39ce458e;
				E00007FF77FF739CC8BD0();
				E00007FF77FF739CCCED8(0);
				 *0 = 0x22;
				E00007FF77FF739CCCD88();
				r14d =  *(_t1088 - 0x80);
				r12d =  *(_t1090 + 0x30);
				if (1 == 0) goto 0x39ce4648;
				r12d = r12d -  *(_t1090 + 0x38);
				 *(_t1090 + 0x30) = r12d;
				if (1 != 0) goto 0x39ce4234;
				r13d = r13d - 0xa0000000000000;
				if (1 == 0) goto 0x39ce419e;
				_t627 =  *0x407FF739D714F8;
				if (_t627 == 0) goto 0x39ce4648;
				if (_t627 == 1) goto 0x39ce419e;
				if (r14d == 0) goto 0x39ce419e;
				r8d = 0;
				r10d = _t627;
				r9d = 0;
				_t720 =  *((intOrPtr*)(_t1088 + __r9 * 4 - 0x7c));
				 *((intOrPtr*)(_t1088 + __r9 * 4 - 0x7c)) = _t720;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x39ce45f9;
				if (r8d == 0) goto 0x39ce463f;
				if ( *(_t1088 - 0x80) - 0x73 >= 0) goto 0x39ce4648;
				 *(_t1088 + 0x3fffffffffff84) = r8d;
				r14d =  *(_t1088 - 0x80);
				r14d = r14d + 1;
				 *(_t1088 - 0x80) = r14d;
				goto 0x39ce419e;
				r14d =  *(_t1088 - 0x80);
				goto 0x39ce419e;
				 *(_t1088 - 0x80) =  *(_t1088 - 0x80) & 0x00000000;
				_t1083 =  *((intOrPtr*)(_t1090 + 0x68));
				r12d = 0;
				goto 0x39ce467c;
				r9d = 0;
				 *(_t1088 + 0x320) = r12d;
				 *(_t1088 - 0x80) = r12d;
				E00007FF77FF739CCD5E4(0, _t1083, _t1088 - 0x7c, 0x7ff739c80000, _t1086 << 2, _t1088 + 0x324, __r9);
				_t1074 = _t1088 + 0x150;
				if (E00007FF77FF739CCD140(_t720, 0, _t1088 - 0x80, _t1074, _t1082 << 2,  >=  ? _t1088 + 0x154 : _t1088 + 0x324) != 0xa) goto 0x39ce4729;
				 *_t1083 = 0x31;
				if (r15d == 0) goto 0x39ce4739;
				r8d = r12d;
				r9d = r12d;
				r9d = r9d + 1;
				 *(_t1088 + 0x154 + _t1074 * 4) = r8d;
				if (r9d != r15d) goto 0x39ce46b1;
				if (r8d == 0) goto 0x39ce4739;
				if ( *(_t1088 + 0x150) - 0x73 >= 0) goto 0x39ce46fe;
				 *(_t1088 + 0x40000000000154) = r8d;
				 *(_t1088 + 0x150) =  *(_t1088 + 0x150) + 1;
				goto 0x39ce4739;
				r9d = 0;
				 *(_t1088 + 0x320) = r12d;
				 *(_t1088 + 0x150) = r12d;
				_t635 = E00007FF77FF739CCD5E4(0, _t1083 + 1, _t1088 + 0x154, _t1074, _t1086 << 2, _t1088 + 0x324, _t1137);
				goto 0x39ce4739;
				if (_t635 != 0) goto 0x39ce4731;
				_t798 =  *(_t1090 + 0x40) + 1 - 1;
				goto 0x39ce4739;
				_t977 = _t1083 + 1;
				 *_t1083 = 1;
				_t964 =  *((intOrPtr*)(_t1090 + 0x78));
				 *(_t964 + 4) = _t798;
				if (_t798 < 0) goto 0x39ce4753;
				if ( *((intOrPtr*)(_t1090 + 0x50)) - 0x7fffffff > 0) goto 0x39ce4753;
				_t965 =  <  ?  *((intOrPtr*)(_t1088 + 0x740)) - 1 : _t964;
				_t1084 = _t1083 + _t965;
				if (_t977 == _t1084) goto 0x39ce485a;
				r14d = 9;
				_t799 = _t798 | 0xffffffff;
				r10d =  *(_t1088 - 0x80);
				if (r10d == 0) goto 0x39ce485a;
				r8d = r12d;
				r9d = r12d;
				r9d = r9d + 1;
				 *((intOrPtr*)(_t1088 + _t1074 * 4 - 0x7c)) = _t720;
				if (r9d != r10d) goto 0x39ce478e;
				if (r8d == 0) goto 0x39ce47f0;
				if ( *(_t1088 - 0x80) - 0x73 >= 0) goto 0x39ce47cd;
				 *(_t1088 + _t965 * 4 - 0x7c) = r8d;
				 *(_t1088 - 0x80) =  *(_t1088 - 0x80) + 1;
				goto 0x39ce47f0;
				r9d = 0;
				 *(_t1088 + 0x320) = r12d;
				 *(_t1088 - 0x80) = r12d;
				E00007FF77FF739CCD5E4(_t965, _t977, _t1088 - 0x7c, _t1074, _t1086 << 2, _t1088 + 0x324, _t1137);
				_t1075 = _t1088 + 0x150;
				_t1036 = _t1088 - 0x80;
				E00007FF77FF739CCD140(_t720, _t965, _t1036, _t1075, _t974,  >=  ? _t1088 + 0x154 : _t1088 + 0x324);
				r10d = r8d;
				_t1136 = _t965;
				r10d = r10d -  ~r9d;
				r9d = 8;
				r8b = r8b - _t1036 + _t1075 + _t1036 + _t1075;
				_t499 = _t1136 + 0x30; // 0x30
				r8d = 0xcccccccd * r8d >> 0x20 >> 3;
				if (r10d - r9d < 0) goto 0x39ce4839;
				 *((char*)(_t965 + _t977)) = _t499;
				r9d = r9d + _t799;
				if (r9d != _t799) goto 0x39ce480f;
				_t967 = _t1084 - _t977;
				_t968 =  >  ? _t1151 : _t967;
				_t978 = _t977 + ( >  ? _t1151 : _t967);
				if (_t978 != _t1084) goto 0x39ce477b;
				 *_t978 = r12b;
				if ( *((intOrPtr*)(_t1090 + 0x60)) == r12b) goto 0x39ce486e;
				return E00007FF77FF739CC6B50(E00007FF77FF739CE5CE0( *((intOrPtr*)(_t1090 + 0x60)) - r12b, _t1090 + 0x58, _t1084, _t1086 << 2, _t974), _t499,  *(_t1088 + 0x6c0) ^ _t1090);
			}

0x7ff739ce36ac
0x7ff739ce36b9
0x7ff739ce36c1
0x7ff739ce36c8
0x7ff739ce36d2
0x7ff739ce36d9
0x7ff739ce36e6
0x7ff739ce36eb
0x7ff739ce36ee
0x7ff739ce36f5
0x7ff739ce36fe
0x7ff739ce3706
0x7ff739ce3708
0x7ff739ce370d
0x7ff739ce3714
0x7ff739ce3719
0x7ff739ce371e
0x7ff739ce372b
0x7ff739ce3731
0x7ff739ce3741
0x7ff739ce3741
0x7ff739ce3744
0x7ff739ce374e
0x7ff739ce3754
0x7ff739ce3759
0x7ff739ce375b
0x7ff739ce3766
0x7ff739ce376b
0x7ff739ce376e
0x7ff739ce3773
0x7ff739ce377b
0x7ff739ce3782
0x7ff739ce3787
0x7ff739ce3793
0x7ff739ce3796
0x7ff739ce379d
0x7ff739ce37ae
0x7ff739ce37b9
0x7ff739ce37c2
0x7ff739ce37cb
0x7ff739ce37d4
0x7ff739ce37ec
0x7ff739ce37f1
0x7ff739ce37f3
0x7ff739ce37f9
0x7ff739ce37fd
0x7ff739ce3803
0x7ff739ce380b
0x7ff739ce3825
0x7ff739ce3828
0x7ff739ce3831
0x7ff739ce3834
0x7ff739ce3836
0x7ff739ce3839
0x7ff739ce383d
0x7ff739ce3840
0x7ff739ce3845
0x7ff739ce384a
0x7ff739ce384e
0x7ff739ce385c
0x7ff739ce3863
0x7ff739ce3866
0x7ff739ce386b
0x7ff739ce3872
0x7ff739ce3876
0x7ff739ce3878
0x7ff739ce3882
0x7ff739ce388a
0x7ff739ce3894
0x7ff739ce389a
0x7ff739ce38a2
0x7ff739ce38a8
0x7ff739ce38b9
0x7ff739ce38bf
0x7ff739ce38c2
0x7ff739ce38c5
0x7ff739ce38c7
0x7ff739ce38ce
0x7ff739ce38d3
0x7ff739ce38d9
0x7ff739ce38dd
0x7ff739ce38f4
0x7ff739ce38f9
0x7ff739ce38fc
0x7ff739ce38ff
0x7ff739ce3903
0x7ff739ce390a
0x7ff739ce3911
0x7ff739ce3918
0x7ff739ce391d
0x7ff739ce3924
0x7ff739ce392c
0x7ff739ce3932
0x7ff739ce393b
0x7ff739ce393f
0x7ff739ce3945
0x7ff739ce394a
0x7ff739ce3957
0x7ff739ce3959
0x7ff739ce395e
0x7ff739ce3960
0x7ff739ce3965
0x7ff739ce396b
0x7ff739ce3977
0x7ff739ce397c
0x7ff739ce3982
0x7ff739ce3988
0x7ff739ce398f
0x7ff739ce3991
0x7ff739ce3994
0x7ff739ce399b
0x7ff739ce399d
0x7ff739ce39a7
0x7ff739ce39b0
0x7ff739ce39b4
0x7ff739ce39b6
0x7ff739ce39b9
0x7ff739ce39c0
0x7ff739ce39c6
0x7ff739ce39cd
0x7ff739ce39d1
0x7ff739ce39db
0x7ff739ce39e5
0x7ff739ce39ea
0x7ff739ce39f1
0x7ff739ce39f6
0x7ff739ce39fc
0x7ff739ce3a00
0x7ff739ce3a10
0x7ff739ce3a17
0x7ff739ce3a1c
0x7ff739ce3a1f
0x7ff739ce3a22
0x7ff739ce3a26
0x7ff739ce3a2d
0x7ff739ce3a34
0x7ff739ce3a3b
0x7ff739ce3a40
0x7ff739ce3a47
0x7ff739ce3a4f
0x7ff739ce3a55
0x7ff739ce3a5e
0x7ff739ce3a62
0x7ff739ce3a68
0x7ff739ce3a6d
0x7ff739ce3a7a
0x7ff739ce3a7c
0x7ff739ce3a81
0x7ff739ce3a83
0x7ff739ce3a88
0x7ff739ce3a8e
0x7ff739ce3a9a
0x7ff739ce3a9f
0x7ff739ce3aa5
0x7ff739ce3aab
0x7ff739ce3ab2
0x7ff739ce3ab4
0x7ff739ce3ab7
0x7ff739ce3abe
0x7ff739ce3ac0
0x7ff739ce3aca
0x7ff739ce3ad3
0x7ff739ce3ad7
0x7ff739ce3ad9
0x7ff739ce3adc
0x7ff739ce3ae3
0x7ff739ce3ae9
0x7ff739ce3af0
0x7ff739ce3af4
0x7ff739ce3afe
0x7ff739ce3b08
0x7ff739ce3b11
0x7ff739ce3b19
0x7ff739ce3b23
0x7ff739ce3b29
0x7ff739ce3b31
0x7ff739ce3b37
0x7ff739ce3b48
0x7ff739ce3b4e
0x7ff739ce3b51
0x7ff739ce3b54
0x7ff739ce3b56
0x7ff739ce3b59
0x7ff739ce3b5e
0x7ff739ce3b62
0x7ff739ce3b69
0x7ff739ce3b6c
0x7ff739ce3b70
0x7ff739ce3b72
0x7ff739ce3b75
0x7ff739ce3b7b
0x7ff739ce3b7d
0x7ff739ce3b82
0x7ff739ce3b84
0x7ff739ce3b8a
0x7ff739ce3b91
0x7ff739ce3ba3
0x7ff739ce3bab
0x7ff739ce3bb0
0x7ff739ce3bc4
0x7ff739ce3bcd
0x7ff739ce3bd8
0x7ff739ce3bdf
0x7ff739ce3bf1
0x7ff739ce3bf8
0x7ff739ce3bf8
0x7ff739ce3bfc
0x7ff739ce3bff
0x7ff739ce3c03
0x7ff739ce3c0a
0x7ff739ce3c14
0x7ff739ce3c26
0x7ff739ce3c29
0x7ff739ce3c36
0x7ff739ce3c3b
0x7ff739ce3c43
0x7ff739ce3c48
0x7ff739ce3c4d
0x7ff739ce3c51
0x7ff739ce3c58
0x7ff739ce3c5b
0x7ff739ce3c61
0x7ff739ce3c64
0x7ff739ce3c6a
0x7ff739ce3c6c
0x7ff739ce3c71
0x7ff739ce3c73
0x7ff739ce3c79
0x7ff739ce3c80
0x7ff739ce3c90
0x7ff739ce3c98
0x7ff739ce3c9d
0x7ff739ce3cb2
0x7ff739ce3cbb
0x7ff739ce3cc6
0x7ff739ce3ccd
0x7ff739ce3cdf
0x7ff739ce3ce6
0x7ff739ce3cf0
0x7ff739ce3cf5
0x7ff739ce3cfa
0x7ff739ce3d00
0x7ff739ce3d05
0x7ff739ce3d14
0x7ff739ce3d26
0x7ff739ce3d29
0x7ff739ce3d2d
0x7ff739ce3d30
0x7ff739ce3d36
0x7ff739ce3d44
0x7ff739ce3d47
0x7ff739ce3d4b
0x7ff739ce3d6a
0x7ff739ce3d7b
0x7ff739ce3d81
0x7ff739ce3d8d
0x7ff739ce3db1
0x7ff739ce3db6
0x7ff739ce3dc1
0x7ff739ce3dc7
0x7ff739ce3dcf
0x7ff739ce3dd1
0x7ff739ce3dd4
0x7ff739ce3ddb
0x7ff739ce3de3
0x7ff739ce3dec
0x7ff739ce3df2
0x7ff739ce3df8
0x7ff739ce3e1c
0x7ff739ce3e22
0x7ff739ce3e27
0x7ff739ce3e30
0x7ff739ce3e38
0x7ff739ce3e40
0x7ff739ce3e47
0x7ff739ce3e4a
0x7ff739ce3e4c
0x7ff739ce3e4f
0x7ff739ce3e58
0x7ff739ce3e5d
0x7ff739ce3e64
0x7ff739ce3e6d
0x7ff739ce3e73
0x7ff739ce3e80
0x7ff739ce3e83
0x7ff739ce3e8d
0x7ff739ce3e9e
0x7ff739ce3ea7
0x7ff739ce3eac
0x7ff739ce3eb3
0x7ff739ce3eb8
0x7ff739ce3ebd
0x7ff739ce3ec3
0x7ff739ce3ec8
0x7ff739ce3ed1
0x7ff739ce3eda
0x7ff739ce3ee3
0x7ff739ce3ee9
0x7ff739ce3eef
0x7ff739ce3f0f
0x7ff739ce3f13
0x7ff739ce3f19
0x7ff739ce3f1b
0x7ff739ce3f2a
0x7ff739ce3f34
0x7ff739ce3f3f
0x7ff739ce3f4a
0x7ff739ce3f53
0x7ff739ce3f58
0x7ff739ce3f5c
0x7ff739ce3f5f
0x7ff739ce3f62
0x7ff739ce3f6c
0x7ff739ce3f72
0x7ff739ce3f7c
0x7ff739ce3f81
0x7ff739ce3f87
0x7ff739ce3f8f
0x7ff739ce3f8f
0x7ff739ce3f93
0x7ff739ce3f9a
0x7ff739ce3f9f
0x7ff739ce3fa2
0x7ff739ce3fa8
0x7ff739ce3fb7
0x7ff739ce3fbf
0x7ff739ce3fc1
0x7ff739ce3fc9
0x7ff739ce3fcd
0x7ff739ce3fd7
0x7ff739ce3ff8
0x7ff739ce3fff
0x7ff739ce400d
0x7ff739ce400f
0x7ff739ce4014
0x7ff739ce4019
0x7ff739ce401f
0x7ff739ce402b
0x7ff739ce402d
0x7ff739ce4035
0x7ff739ce4039
0x7ff739ce4046
0x7ff739ce4049
0x7ff739ce404f
0x7ff739ce4056
0x7ff739ce4061
0x7ff739ce4066
0x7ff739ce406c
0x7ff739ce4077
0x7ff739ce407d
0x7ff739ce4083
0x7ff739ce4086
0x7ff739ce408a
0x7ff739ce4094
0x7ff739ce40a5
0x7ff739ce40ae
0x7ff739ce40b3
0x7ff739ce40ba
0x7ff739ce40bf
0x7ff739ce40c4
0x7ff739ce40ca
0x7ff739ce40cf
0x7ff739ce40d6
0x7ff739ce40db
0x7ff739ce40e4
0x7ff739ce40ea
0x7ff739ce40f4
0x7ff739ce40fe
0x7ff739ce4108
0x7ff739ce4117
0x7ff739ce4120
0x7ff739ce4129
0x7ff739ce4132
0x7ff739ce4137
0x7ff739ce4139
0x7ff739ce413c
0x7ff739ce413f
0x7ff739ce4163
0x7ff739ce4169
0x7ff739ce416e
0x7ff739ce4177
0x7ff739ce4183
0x7ff739ce418b
0x7ff739ce4192
0x7ff739ce4195
0x7ff739ce4197
0x7ff739ce419e
0x7ff739ce41a3
0x7ff739ce41ac
0x7ff739ce41b2
0x7ff739ce41b5
0x7ff739ce41bb
0x7ff739ce41cd
0x7ff739ce41d9
0x7ff739ce41de
0x7ff739ce41e8
0x7ff739ce41f1
0x7ff739ce41f6
0x7ff739ce41f9
0x7ff739ce41fe
0x7ff739ce4201
0x7ff739ce4208
0x7ff739ce420a
0x7ff739ce4219
0x7ff739ce421c
0x7ff739ce4220
0x7ff739ce4223
0x7ff739ce4229
0x7ff739ce423a
0x7ff739ce423d
0x7ff739ce4257
0x7ff739ce426a
0x7ff739ce4270
0x7ff739ce42a0
0x7ff739ce42a5
0x7ff739ce42b0
0x7ff739ce42b6
0x7ff739ce42be
0x7ff739ce42c0
0x7ff739ce42c3
0x7ff739ce42c7
0x7ff739ce42cf
0x7ff739ce42d8
0x7ff739ce42de
0x7ff739ce42e4
0x7ff739ce4302
0x7ff739ce4308
0x7ff739ce430d
0x7ff739ce4313
0x7ff739ce4318
0x7ff739ce431d
0x7ff739ce4321
0x7ff739ce4324
0x7ff739ce4326
0x7ff739ce4329
0x7ff739ce432f
0x7ff739ce4334
0x7ff739ce4338
0x7ff739ce4341
0x7ff739ce4347
0x7ff739ce4351
0x7ff739ce4354
0x7ff739ce435b
0x7ff739ce4369
0x7ff739ce4372
0x7ff739ce4377
0x7ff739ce437e
0x7ff739ce4383
0x7ff739ce4388
0x7ff739ce438e
0x7ff739ce4393
0x7ff739ce4399
0x7ff739ce43a2
0x7ff739ce43ab
0x7ff739ce43b1
0x7ff739ce43b7
0x7ff739ce43d5
0x7ff739ce43db
0x7ff739ce43dd
0x7ff739ce43e9
0x7ff739ce43f3
0x7ff739ce43f7
0x7ff739ce43fe
0x7ff739ce4402
0x7ff739ce440e
0x7ff739ce4414
0x7ff739ce4419
0x7ff739ce441d
0x7ff739ce4420
0x7ff739ce4423
0x7ff739ce442d
0x7ff739ce4433
0x7ff739ce443c
0x7ff739ce4441
0x7ff739ce4447
0x7ff739ce444f
0x7ff739ce444f
0x7ff739ce4453
0x7ff739ce445a
0x7ff739ce445f
0x7ff739ce4462
0x7ff739ce4468
0x7ff739ce4477
0x7ff739ce447f
0x7ff739ce4481
0x7ff739ce4489
0x7ff739ce448d
0x7ff739ce4497
0x7ff739ce44b8
0x7ff739ce44bf
0x7ff739ce44cd
0x7ff739ce44cf
0x7ff739ce44d4
0x7ff739ce44d9
0x7ff739ce44df
0x7ff739ce44eb
0x7ff739ce44ed
0x7ff739ce44f5
0x7ff739ce44f9
0x7ff739ce44ff
0x7ff739ce4506
0x7ff739ce450f
0x7ff739ce4516
0x7ff739ce4521
0x7ff739ce4526
0x7ff739ce452c
0x7ff739ce453c
0x7ff739ce4542
0x7ff739ce4548
0x7ff739ce454b
0x7ff739ce454f
0x7ff739ce4556
0x7ff739ce4564
0x7ff739ce456d
0x7ff739ce4572
0x7ff739ce4579
0x7ff739ce457e
0x7ff739ce4583
0x7ff739ce4589
0x7ff739ce458e
0x7ff739ce4592
0x7ff739ce459b
0x7ff739ce45a1
0x7ff739ce45ad
0x7ff739ce45b7
0x7ff739ce45c6
0x7ff739ce45c9
0x7ff739ce45d3
0x7ff739ce45dc
0x7ff739ce45e1
0x7ff739ce45ea
0x7ff739ce45f0
0x7ff739ce45f3
0x7ff739ce45f6
0x7ff739ce45f9
0x7ff739ce460b
0x7ff739ce4614
0x7ff739ce461a
0x7ff739ce461f
0x7ff739ce4625
0x7ff739ce462a
0x7ff739ce462f
0x7ff739ce4633
0x7ff739ce4636
0x7ff739ce463a
0x7ff739ce463f
0x7ff739ce4643
0x7ff739ce4648
0x7ff739ce464c
0x7ff739ce4651
0x7ff739ce4657
0x7ff739ce4659
0x7ff739ce465c
0x7ff739ce466a
0x7ff739ce4677
0x7ff739ce467c
0x7ff739ce4693
0x7ff739ce469b
0x7ff739ce46a5
0x7ff739ce46ab
0x7ff739ce46ae
0x7ff739ce46b4
0x7ff739ce46c9
0x7ff739ce46d8
0x7ff739ce46dd
0x7ff739ce46e6
0x7ff739ce46ee
0x7ff739ce46f6
0x7ff739ce46fc
0x7ff739ce46fe
0x7ff739ce4701
0x7ff739ce470f
0x7ff739ce4722
0x7ff739ce4727
0x7ff739ce472b
0x7ff739ce472d
0x7ff739ce472f
0x7ff739ce4733
0x7ff739ce4737
0x7ff739ce4739
0x7ff739ce4742
0x7ff739ce4747
0x7ff739ce474f
0x7ff739ce4762
0x7ff739ce4766
0x7ff739ce476c
0x7ff739ce4772
0x7ff739ce4778
0x7ff739ce477b
0x7ff739ce4782
0x7ff739ce4788
0x7ff739ce478b
0x7ff739ce4791
0x7ff739ce47a8
0x7ff739ce47b3
0x7ff739ce47b8
0x7ff739ce47be
0x7ff739ce47c3
0x7ff739ce47c8
0x7ff739ce47cb
0x7ff739ce47cd
0x7ff739ce47d0
0x7ff739ce47de
0x7ff739ce47eb
0x7ff739ce47f0
0x7ff739ce47f7
0x7ff739ce47fb
0x7ff739ce4800
0x7ff739ce4803
0x7ff739ce4806
0x7ff739ce4809
0x7ff739ce4824
0x7ff739ce4827
0x7ff739ce482b
0x7ff739ce4831
0x7ff739ce4836
0x7ff739ce4839
0x7ff739ce483f
0x7ff739ce4844
0x7ff739ce484a
0x7ff739ce484e
0x7ff739ce4854
0x7ff739ce485a
0x7ff739ce4862
0x7ff739ce4890

APIs

fegetenv.LIBCMT ref: 00007FF739CE36F5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE3D00
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE3EC3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE40CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE438E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE4589
memcpy_s.LIBCPMT ref: 00007FF739CE4677
memcpy_s.LIBCPMT ref: 00007FF739CE4722
memcpy_s.LIBCPMT ref: 00007FF739CE47EB

Strings

1#IND, xrefs: 00007FF739CE4891
1#QNAN, xrefs: 00007FF739CE48A3
1#SNAN, xrefs: 00007FF739CE489A
1#INF, xrefs: 00007FF739CE48BF

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: fca0e562e9e15603af03b6e27d759be691a563fb95d99ee9af36a5cf707214e8
Instruction ID: 49c4b3a0e038ad322cbc51c17338b1117104417c7497517c3b009f49b695c8f7
Opcode Fuzzy Hash: fca0e562e9e15603af03b6e27d759be691a563fb95d99ee9af36a5cf707214e8
Instruction Fuzzy Hash: 23B2F472E182829BE7259E75D4407FDB7B2FB48789F906135DA0B57B84DB38E900EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC15A0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CBFAB0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF739CC15D7), ref: 00007FF739CBFAE5

EnumDisplaySettingsW.USER32 ref: 00007FF739CC1630
CreateDCW.GDI32 ref: 00007FF739CC1646

Part of subcall function 00007FF739CBFD40: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDB3
Part of subcall function 00007FF739CBFD40: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDC2
Part of subcall function 00007FF739CBFD40: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDD1
Part of subcall function 00007FF739CBFD40: RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFDE2

GetDeviceCaps.GDI32 ref: 00007FF739CC166A
GetDeviceCaps.GDI32 ref: 00007FF739CC167B
GetDeviceCaps.GDI32 ref: 00007FF739CC16AA
GetDeviceCaps.GDI32 ref: 00007FF739CC16DF
DeleteDC.GDI32 ref: 00007FF739CC1700
WideCharToMultiByte.KERNEL32 ref: 00007FF739CC1792
WideCharToMultiByte.KERNEL32 ref: 00007FF739CC17FE
EnumDisplayMonitors.USER32 ref: 00007FF739CC1843

Strings

, xrefs: 00007FF739CC17E8
DISPLAY, xrefs: 00007FF739CC1639

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CapsDevice$ByteCharConditionMaskMultiWide$DisplayEnum$CreateDeleteInfoMonitorsSettingsVerifyVersion
String ID: $DISPLAY
API String ID: 2931716912-3074206054
Opcode ID: 003df35f5adfbe1ba27007e2fa3b1b71770f73f1cb2e1e379afd2fa997e78d6b
Instruction ID: b4c09199fd24b9cbb284d08765a88cdee091f346a120e5b9c69dbf599138cbe4
Opcode Fuzzy Hash: 003df35f5adfbe1ba27007e2fa3b1b71770f73f1cb2e1e379afd2fa997e78d6b
Instruction Fuzzy Hash: C161A372A08A8196E721DF22E4547EAB3B2FB88B84F844135DA8E17B54EF3CD445DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE0658 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

TranslateName.LIBCMT ref: 00007FF739CE06C5
TranslateName.LIBCMT ref: 00007FF739CE0700
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF739CD5CEC), ref: 00007FF739CE0745
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF739CD5CEC), ref: 00007FF739CE076D

Strings

utf8, xrefs: 00007FF739CE0851

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: aceb53ba850a0aa104f2f5188a62bb4ec46045bf13d2158e341261e65184212b
Instruction ID: af6764c875568c637e05881d3c3dffbd3c6a0b57e2187385d0be3b2a19b01397
Opcode Fuzzy Hash: aceb53ba850a0aa104f2f5188a62bb4ec46045bf13d2158e341261e65184212b
Instruction Fuzzy Hash: 06917932E0C742A2FB64FF3194112A9A2B6FB44B81FC44131DA4E47686DF3CE951E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE108C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF739CD5CE5), ref: 00007FF739CE11E3
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF739CE11FC
ProcessCodePage.LIBCMT ref: 00007FF739CE1226
IsValidCodePage.KERNEL32 ref: 00007FF739CE1238
IsValidLocale.KERNEL32 ref: 00007FF739CE124E
GetLocaleInfoW.KERNEL32 ref: 00007FF739CE12AA
GetLocaleInfoW.KERNEL32 ref: 00007FF739CE12C6

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: 1d4bf47ae231a4ee700d3952a5d5f306dbba80a13a1e1485f6eed50f8bdaeace
Instruction ID: 38ad6fbbb038e519b74d5797fd1161dd8cf8a01c8d9ae2446afb09ed5fd9fbc7
Opcode Fuzzy Hash: 1d4bf47ae231a4ee700d3952a5d5f306dbba80a13a1e1485f6eed50f8bdaeace
Instruction Fuzzy Hash: 6A715922F18642AAFB11AF70D8516BEB2B2BF44749F844135CA1E53686EF3CA455F360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6D60 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF739CC6D7C
RtlCaptureContext.KERNEL32 ref: 00007FF739CC6DA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF739CC6DC3
RtlVirtualUnwind.KERNEL32 ref: 00007FF739CC6E04
IsDebuggerPresent.KERNEL32 ref: 00007FF739CC6E58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF739CC6E79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF739CC6E84

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7d0b6e7a7f7dfebdd5d7c942e2c8fe65d3814bb21ecac594fed4ae4115783204
Instruction ID: defa1f530d479506c216b3d193e842ef7de5c7ce2b6485d5c19c53a09ba04ebd
Opcode Fuzzy Hash: 7d0b6e7a7f7dfebdd5d7c942e2c8fe65d3814bb21ecac594fed4ae4115783204
Instruction Fuzzy Hash: EC313072608B8195EB60AF70E8503EA7771FB84744F84443ADA8E47A99DF38D549DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC31E0 Relevance: 10.5, APIs: 7, Instructions: 49keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00007FF739CC31F4
GetKeyState.USER32 ref: 00007FF739CC3205
GetKeyState.USER32 ref: 00007FF739CC3220
GetKeyState.USER32 ref: 00007FF739CC3239
GetKeyState.USER32 ref: 00007FF739CC3247
GetKeyState.USER32 ref: 00007FF739CC325D
GetKeyState.USER32 ref: 00007FF739CC3272

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: a23f62ef7c8a0b370de0dd8f5c81347d758617228c4f1c15f3fd31a142edb6fc
Instruction ID: e6743c031217f9225fe1d75ec24e21c1ab8bbf33708eaa7cb280679064a9fb35
Opcode Fuzzy Hash: a23f62ef7c8a0b370de0dd8f5c81347d758617228c4f1c15f3fd31a142edb6fc
Instruction Fuzzy Hash: 4E016176E04B5553FB082B61A8A03797272FBC4B52F854478DE8B23390CE7C984676B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCCB74 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF739CCCBED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF739CCCC05
RtlVirtualUnwind.KERNEL32 ref: 00007FF739CCCC40
IsDebuggerPresent.KERNEL32 ref: 00007FF739CCCC79
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF739CCCC83
UnhandledExceptionFilter.KERNEL32 ref: 00007FF739CCCC8E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5e01dc71bfc560a3fefad802f7766588dfccd59f379dde6ae71a323ab51a21a7
Instruction ID: bc68955c40f8ec24c0c803c0f8d09f10ed2c912bc7ff7bf2f83980f2043b63b0
Opcode Fuzzy Hash: 5e01dc71bfc560a3fefad802f7766588dfccd59f379dde6ae71a323ab51a21a7
Instruction Fuzzy Hash: A1318132618F8196EB60DF35E8502AEB7B1FB84755F900136EA8D43B99DF3CC5469B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD8504 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 00007FF739CD8573
WriteFile.KERNEL32 ref: 00007FF739CD881D
WriteFile.KERNEL32 ref: 00007FF739CD886F
GetLastError.KERNEL32 ref: 00007FF739CD89B1
GetLastError.KERNEL32 ref: 00007FF739CD89C3

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 4b132c94b2897b12c36b38dd0b7e6f5be107ec47b5c7e1dc2ba7b2ccd8c74df6
Instruction ID: 10dce92f35075f729637fd93d002c442a455f4a085a3cec2783d7d0f28dd396b
Opcode Fuzzy Hash: 4b132c94b2897b12c36b38dd0b7e6f5be107ec47b5c7e1dc2ba7b2ccd8c74df6
Instruction Fuzzy Hash: 3ED1E273B08A81AAE711DF74D5401EDB7B2FB44B98B940136DE8E47BA9DE38E116D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC1080 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 00007FF739CC111C
EnumDisplayDevicesW.USER32 ref: 00007FF739CC1181
EnumDisplayMonitors.USER32 ref: 00007FF739CC1210
EnumDisplayDevicesW.USER32 ref: 00007FF739CC1280
EnumDisplayDevicesW.USER32 ref: 00007FF739CC1338

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: DisplayEnum$Devices$Monitors
String ID:
API String ID: 1432082543-0
Opcode ID: 3caa1640e10026ccfe25d1a170fbd6dce769566d3495b69305adbc7a48976e25
Instruction ID: a3405fe748b8355e8f61e7b0e4c084d8b41ec54618e1593477ffbabd96d454a8
Opcode Fuzzy Hash: 3caa1640e10026ccfe25d1a170fbd6dce769566d3495b69305adbc7a48976e25
Instruction Fuzzy Hash: 4A81B765A0C68261F775AF22A4107BBAAB2FF84744F846135DD8E42685DF3CE503EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBFB90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF739CBFBDB
FormatMessageW.KERNEL32 ref: 00007FF739CBFC10
WideCharToMultiByte.KERNEL32 ref: 00007FF739CBFC4F

Strings

%s: %s, xrefs: 00007FF739CBFC5D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: %s: %s
API String ID: 1653872744-3740598653
Opcode ID: cebd72e04c220dd515101dc4bb9e86700e3997b09168ccdb637093c38b911448
Instruction ID: 01f415888d7f36dc12432d514a098593782dfa07f4f6832e0bdd15d70cefad24
Opcode Fuzzy Hash: cebd72e04c220dd515101dc4bb9e86700e3997b09168ccdb637093c38b911448
Instruction Fuzzy Hash: 9621A172618A8192E720EF21F4507AAB672FB88344F944136EB8D43B99CF3CC1069B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAAF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAB31
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF739CD5EBF), ref: 00007FF739CDAB5F

Strings

GetLocaleInfoEx, xrefs: 00007FF739CDAB14, 00007FF739CDAB25

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 7f73a96da5bc58cf4c55b8a9d1b5cedb8b15eae4e83b280ab2222118bf962ad1
Instruction ID: bb2f4f5fcfec72a0c467dd2835402f30f0fd4ef5ec9b577f826e40c0a0aabc8e
Opcode Fuzzy Hash: 7f73a96da5bc58cf4c55b8a9d1b5cedb8b15eae4e83b280ab2222118bf962ad1
Instruction Fuzzy Hash: 16016D26B08B41A2E701AF66B4410AAF673FF94BC0F984035DE4D07B99CE3CD942A390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCD140 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF739CCD1A6
memcpy_s.LIBCPMT ref: 00007FF739CCD1D1

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 3c01bc3cfaabc0848e057379f965f684204250ad0697696e4cf5be0a3dfe7d28
Instruction ID: 8c288e094512bece7eceb490ced9af5d65c44f973a67bc9edd192d0b6d8ab3fa
Opcode Fuzzy Hash: 3c01bc3cfaabc0848e057379f965f684204250ad0697696e4cf5be0a3dfe7d28
Instruction Fuzzy Hash: EFC1D473B1828697D724DF69E05466AFBB2F784788F849135DB8A43744DA3CF802DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE0B0C Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

GetLocaleInfoW.KERNEL32 ref: 00007FF739CE0B78

Part of subcall function 00007FF739CDCAD4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CDCAF1

GetLocaleInfoW.KERNEL32 ref: 00007FF739CE0BC1

Part of subcall function 00007FF739CDCAD4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CDCB4A

GetLocaleInfoW.KERNEL32 ref: 00007FF739CE0C8C

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
String ID:
API String ID: 3644580040-0
Opcode ID: e20b69ae3b86d3d0d441511c57647be6661957071d572af1a6077074e4c9ca30
Instruction ID: 156d9d49ec1e5799ec3310c03065361e3bdec74cd77e5604357b64510dc6444a
Opcode Fuzzy Hash: e20b69ae3b86d3d0d441511c57647be6661957071d572af1a6077074e4c9ca30
Instruction Fuzzy Hash: 5A618E32E08646A6EB34EF25E5401B9B7B2FB44742F908135C79F83691DE3CE951E790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD97BC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD9820

Strings

gfffffff, xrefs: 00007FF739CD9ABD

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: bdaaec7a9a5bb17207b0583f102de7e6eb8492ba3e6d57968f4719cacfeae12e
Instruction ID: 1c48f9f4c5fa8a537894a9113a0bf99bb5ce2b9602ccc08fa05ca18be01e0707
Opcode Fuzzy Hash: bdaaec7a9a5bb17207b0583f102de7e6eb8492ba3e6d57968f4719cacfeae12e
Instruction Fuzzy Hash: 7591686BB0A3C596EB11EF3A94403BDE7B6AB51B84F458032CA4D47395EE3DE902D311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDA054 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CDA085

Part of subcall function 00007FF739CCCDD8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF739CCCD85), ref: 00007FF739CCCDE1
Part of subcall function 00007FF739CCCDD8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF739CCCD85), ref: 00007FF739CCCE06

Strings

-, xrefs: 00007FF739CDA260

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 49aa4f593c5d8cd55dd28db2e3c23343db94bacfae65c031bf94b3cfa1c653a8
Instruction ID: 5c1653cda0b84c9adc8afb14cb59dca1623a7d9eb1b2cf86b4d4ea173ecd6d86
Opcode Fuzzy Hash: 49aa4f593c5d8cd55dd28db2e3c23343db94bacfae65c031bf94b3cfa1c653a8
Instruction Fuzzy Hash: 3881D223A0878595FA64AE39A50077AF6B2FB997D0F844235DA9D43BD9DE3CE4009710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDCE6C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CDCE9C

Part of subcall function 00007FF739CCCDD8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF739CCCD85), ref: 00007FF739CCCDE1
Part of subcall function 00007FF739CCCDD8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF739CCCD85), ref: 00007FF739CCCE06

Strings

*?, xrefs: 00007FF739CDCEC3

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: 7fbdc28fea9a2793212ac24c61bbf86df00e4b3a5903a8daa4b1bec39a393b63
Instruction ID: c26a0fe280403180272163804b228ee539b355d85df7b365620a46eddb01b219
Opcode Fuzzy Hash: 7fbdc28fea9a2793212ac24c61bbf86df00e4b3a5903a8daa4b1bec39a393b63
Instruction Fuzzy Hash: 0251DF63B14695A5EB10EFB698104B9A7B2AB44BD8BC44936EE0D07B85DF3CD4429360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAB7C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAB9F

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF739CDAB98

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: try_get_function
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2742660187-595813830
Opcode ID: 40fe724b05e151adcb1b20ad06cbcb93f9aa388c4a05bdb7120ed14bd6088b8a
Instruction ID: cf318dc5c1e496f390989af439d4cecaa003c33eea72df074f0ee5decbbf5482
Opcode Fuzzy Hash: 40fe724b05e151adcb1b20ad06cbcb93f9aa388c4a05bdb7120ed14bd6088b8a
Instruction Fuzzy Hash: 70E08651E19906F1FE056FA5A4122B0F333AF18741FC40032C91D062A1DE3CE985E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDC55C Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF739CDC7AB
RaiseException.KERNEL32 ref: 00007FF739CDC7BC

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 0c7cc15ba213292a0fb95d4baab63a484f4a38f40f58be3e414b4674e2b70eb9
Instruction ID: dc053677843e015ba891a62ff30b9f90f4ead30380258eac6e46fc5ddac35535
Opcode Fuzzy Hash: 0c7cc15ba213292a0fb95d4baab63a484f4a38f40f58be3e414b4674e2b70eb9
Instruction Fuzzy Hash: F9B17C77A04B848BEB15DF39C88236CB7B1F784B48F558922DA5D837A4CB39D852D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD197C Relevance: 3.2, APIs: 2, Instructions: 208COMMONLIBRARYCODE

Download Yara Rule

APIs

_Wcsftime.LIBCMT ref: 00007FF739CD1A2E
_Wcsftime.LIBCMT ref: 00007FF739CD19CF

Part of subcall function 00007FF739CD601C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD6047

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Wcsftime$_invalid_parameter_noinfo
String ID:
API String ID: 4239037671-0
Opcode ID: 23f9244a54a897f01c7060c70a661c7cb76589d897752f50aa57e400ef9ef01e
Instruction ID: 8a0d17dcd496f57bf65ea70c5071c2d96d6aae059cec8b16da5bc97967e57092
Opcode Fuzzy Hash: 23f9244a54a897f01c7060c70a661c7cb76589d897752f50aa57e400ef9ef01e
Instruction Fuzzy Hash: 0681E373A04A41A6EB24AE39C4813BEA7B2FB44B98F844632DE1E877D5CF38D441D350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD1DD4 Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF739CD1F1C

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 9009e0b22040db2fd2366a0fe8b9ba2d9f605059bd629f84f645f6608b9c57a9
Instruction ID: 4d47986e1b9f42b58153d2d82f7f450c6be5c11a21c416575ce213e9dc8d33a4
Opcode Fuzzy Hash: 9009e0b22040db2fd2366a0fe8b9ba2d9f605059bd629f84f645f6608b9c57a9
Instruction Fuzzy Hash: 4F12BB23A08BC196E751DF3894442FEB7B5FB58748F859235EB8C82692EF38E185D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDEB64 Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dc93668d165944c481d832bb9c9d87521f1902626f4fd4245b59388269b20f
Instruction ID: 04a4bb6429d0a533cee432c865137b45ef9d878b85ef47499334bb20271d7f62
Opcode Fuzzy Hash: 00dc93668d165944c481d832bb9c9d87521f1902626f4fd4245b59388269b20f
Instruction Fuzzy Hash: F2E18C23A04B8296E720EF61E4406EE77B5FB98B88F814631DE5D53796EF38E245D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE1AD0 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF739CE1B34

Part of subcall function 00007FF739CD530C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD5320

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 85ee848707a0c68b7ee11a14ab09dc2472ec109073e350b6519107de1ce7951f
Instruction ID: c9b69885b10c077ce3754280b39476121bf6520448b91e1a4a7214aaf651a1dd
Opcode Fuzzy Hash: 85ee848707a0c68b7ee11a14ab09dc2472ec109073e350b6519107de1ce7951f
Instruction Fuzzy Hash: 7071F836E0828266F774AE39848027AE2B3AF40361FD40635DA5F876D5DE7CE851B720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDD078 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b946bf694bc4bff0ea559fb9d27d4b9fb1fdfe44dd0ce3d0ed8f8d44f9730cd
Instruction ID: 02ce476ae35c7bd9e328bc228328583cf1815cc19f1ec5bd2d818babc8ff96c5
Opcode Fuzzy Hash: 1b946bf694bc4bff0ea559fb9d27d4b9fb1fdfe44dd0ce3d0ed8f8d44f9730cd
Instruction Fuzzy Hash: A551F123F08691A5F720AF76A9101AEBBB2AB44BD4F904234EE9C47E85CF3CD542D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE0D58 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

GetLocaleInfoW.KERNEL32 ref: 00007FF739CE0DC0

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 664bc09a71b8255941ff0ac20851ad82556c08487716faafd30a9bdf3df4213f
Instruction ID: f0dc30700047af9ddd29eaba54f4fba7a969defc26095a2a509405cba4540e07
Opcode Fuzzy Hash: 664bc09a71b8255941ff0ac20851ad82556c08487716faafd30a9bdf3df4213f
Instruction Fuzzy Hash: A1317532E0C682A6EB64EF35D4413AEB2B2FB44781F844139DA8E83745DF3CE551A750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE09A4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF739CE118F,?,00000000,00000092,?,?,00000000,?,00007FF739CD5CE5), ref: 00007FF739CE0A42

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8a421a8fecfac3c210c6e2fb235cff22ae0a58ed75363f0f3e95db244025157b
Instruction ID: eb3ab1ba022828db800c3b5653bbc517e76cc2ad1ee2966e631ca2e9128673f1
Opcode Fuzzy Hash: 8a421a8fecfac3c210c6e2fb235cff22ae0a58ed75363f0f3e95db244025157b
Instruction Fuzzy Hash: 5D11E767E1C6459AEB14DF25D0406ADB7B2F750FA1F848135C65A433C0DA38D6D1E790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE0F60 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

GetLocaleInfoW.KERNEL32(?,?,?,00007FF739CE0D09), ref: 00007FF739CE0F97

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 479e7f5b8e330f39fc9b6ca23880652ef9e9ad54cd971a4d5fe81d15f7161388
Instruction ID: eb22939463df836ae444c16e521becde1ff76ef316a14a2055f884ad7b1aac74
Opcode Fuzzy Hash: 479e7f5b8e330f39fc9b6ca23880652ef9e9ad54cd971a4d5fe81d15f7161388
Instruction Fuzzy Hash: E8113A22E1C156A2E764EF369001679A372EB40765F940235E72F036C4CE3DD8A1B390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE0A74 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF739CD7188: GetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7197
Part of subcall function 00007FF739CD7188: SetLastError.KERNEL32(?,?,?,00007FF739CCD0C7,?,?,00000000,00007FF739CDB6F8), ref: 00007FF739CD7235

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF739CE114B,?,00000000,00000092,?,?,00000000,?,00007FF739CD5CE5), ref: 00007FF739CE0AF2

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 642fc3a8862f9deeb53f6e00cf84ce6db81454dd65df4ae041651667e89db893
Instruction ID: 58d45fbba281c14ee7f1fb1395b51f96471e81b6e1f9bd8412648a455bea2ea8
Opcode Fuzzy Hash: 642fc3a8862f9deeb53f6e00cf84ce6db81454dd65df4ae041651667e89db893
Instruction Fuzzy Hash: 7D01F572F0C2869AE710AF25E4407B9B2B3EB407A5F848231C66A572C4CF789980F750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDA654 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF739CDA9B9,?,?,?,?,?,?,?,?,00000000,00007FF739CDFFF0), ref: 00007FF739CDA6A3

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a09491fd34d3b7c1f966940e3604538867cbea06eff74889c2ff2bccf457454f
Instruction ID: de87beddd3cbcb95091ffcb37c9e6da25e153d37af8274c0315e535b7cda8e38
Opcode Fuzzy Hash: a09491fd34d3b7c1f966940e3604538867cbea06eff74889c2ff2bccf457454f
Instruction Fuzzy Hash: 40F06D72B18B4193E704EF29E8411A9B3B2EB88780F848135EA4D83366CF3CD551A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCEEF4 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF739CCF08D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 792c9db8fd442290b49b9662d080509b94e146d3cbba5330794a207da8253a0b
Instruction ID: 48adeb603a9978852a83f5f4f80e11822e652c9e3f1a2a44bfae4d87e98057fc
Opcode Fuzzy Hash: 792c9db8fd442290b49b9662d080509b94e146d3cbba5330794a207da8253a0b
Instruction Fuzzy Hash: 8961D212A0C64266FA646F3950003B9EFB39F42B48FC42132DDC91739DCE6DE847AB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDBDC4 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF739CDBE69

Part of subcall function 00007FF739CDB084: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF739CD7361,?,?,00008ACCADA1B9E9,00007FF739CCCEE1,?,?,?,?,00007FF739CDB132,?,?,00000000), ref: 00007FF739CDB0D9

Part of subcall function 00007FF739CD7430: RtlDeleteBoundaryDescriptor.NTDLL(?,?,0B33A42583480000,00007FF739CDF428,?,?,?,00007FF739CDF7AB,?,?,00008ACCADA1B9E9,00007FF739CDFCF0,?,?,00007FF739CD4FEA,00007FF739CDFC23), ref: 00007FF739CD7446
Part of subcall function 00007FF739CD7430: GetLastError.KERNEL32(?,?,0B33A42583480000,00007FF739CDF428,?,?,?,00007FF739CDF7AB,?,?,00008ACCADA1B9E9,00007FF739CDFCF0,?,?,00007FF739CD4FEA,00007FF739CDFC23), ref: 00007FF739CD7458

Part of subcall function 00007FF739CE48E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE490E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$AllocateBoundaryDeleteDescriptorHeap_invalid_parameter_noinfo
String ID:
API String ID: 4255177923-0
Opcode ID: f8168297aef9c88f658184d5aaa62aa071e258a7c8f477c7200dd435624e7c03
Instruction ID: 3189a767b43338fb0788efd5209bfa88cda8dfccb423c198f7c752be72c70049
Opcode Fuzzy Hash: f8168297aef9c88f658184d5aaa62aa071e258a7c8f477c7200dd435624e7c03
Instruction Fuzzy Hash: 46419422F0964351FA60BE36A55167AE6F27F85BC0FC44535EE9D47B81DE3CE401A620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDE2EC Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF739CDE2F0

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 930ee8c6a81b77e9cf88896d329b3e62b1f168b9e79422aa60e5729f54af1aa4
Instruction ID: f21f762970cd922e099585fa67cc7b4f9087ac18b16c9d36ec1b898b54d779ef
Opcode Fuzzy Hash: 930ee8c6a81b77e9cf88896d329b3e62b1f168b9e79422aa60e5729f54af1aa4
Instruction Fuzzy Hash: 7FB09220E1BA02D2EA083F256C42214B2B67F48701FC44138C04D42321DF2C20A57720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD2438 Relevance: .6, Instructions: 626COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b1b25cfb2c7a4ce73a35449066f5a3b57f2f710efc3eae90201ed970baa9b1
Instruction ID: 31b3c59d02ac9e7dd2905899d581af2270e650caa9037dc4da5a4fc2e9a8cd0c
Opcode Fuzzy Hash: b4b1b25cfb2c7a4ce73a35449066f5a3b57f2f710efc3eae90201ed970baa9b1
Instruction Fuzzy Hash: 97623F22D39E86A5E653AF35A912535F376FF553C1F808333EA0E66650DF3CE442A620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD5B34 Relevance: .3, Instructions: 307COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 3827717455-0
Opcode ID: ff0a83ad3cab01762035816433837df46ca30b1d79086703253cb03cd84a6ae5
Instruction ID: ad9542f3a3448a8132fd1e4d84c917f758d5283f73600a4de98ace8225b5e295
Opcode Fuzzy Hash: ff0a83ad3cab01762035816433837df46ca30b1d79086703253cb03cd84a6ae5
Instruction Fuzzy Hash: AAC1C467A087C2A5EB60AF7195103BAA7B2FB94788FC04035DE4D47A8ADF3CD545E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE00B4 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
String ID:
API String ID: 959782435-0
Opcode ID: 814db8cf35e5d42e587c686734611564929a673ae4ae94c1822595c4cf6c2452
Instruction ID: 612d980e0165af73be20c180195314aa82ff56d0c54159a3b9fe1bc5d4875ba7
Opcode Fuzzy Hash: 814db8cf35e5d42e587c686734611564929a673ae4ae94c1822595c4cf6c2452
Instruction Fuzzy Hash: 13B1F522E0C646A2EB64EF31D5116B9B3B2EB44B89F804131DA5E476C5DF3CE541F7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD4C6C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: BoundaryDeleteDescriptorErrorLast
String ID:
API String ID: 2050971199-0
Opcode ID: 6d46568e3c1df61006c0e766108dfbbbd438c9345f302ea0b9ac6e0acc76b998
Instruction ID: eefeb3db218e8b814fadbbb5e8c50b0330a26e9d72489a170bdbb6d724936e56
Opcode Fuzzy Hash: 6d46568e3c1df61006c0e766108dfbbbd438c9345f302ea0b9ac6e0acc76b998
Instruction Fuzzy Hash: 0841D323728A5492EF04DF3AD9151A9F3B2AB48FD4B899136EE4D87B58DF3CD0459300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDB430 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a885a3ea0688eef3c447f2d4950da36731ca7a80aa47536aeaa56d2d5ff9dd63
Instruction ID: cfdb81501bf2e64fa01958698f418498692ae1cf7c95524d28273f7d0a1adb6c
Opcode Fuzzy Hash: a885a3ea0688eef3c447f2d4950da36731ca7a80aa47536aeaa56d2d5ff9dd63
Instruction Fuzzy Hash: 08F068B2B282559AEBA4EF3CA443629B7E2E708380F908039D5DD83B04D63C90509F24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6F44 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624222d9b87b4f252a1eae4fe19be4a7a7c09af63cf1901e1983ae149288acb3
Instruction ID: fbe07e6d4687a346ad29a94045ea0efdc4a8744efef74d2d80c813160a0c3c8c
Opcode Fuzzy Hash: 624222d9b87b4f252a1eae4fe19be4a7a7c09af63cf1901e1983ae149288acb3
Instruction Fuzzy Hash: CCA00121948C02A0E604AF20AA54130A732BB94301B811431C08E451A19E2CA905B661

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAEB0 Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF739CDAEB0(void* __edi, void* __esp, void* __eflags, void* __rcx, long long __rdi, long long _a8) {
				void* _v4;
				int _t13;
				void* _t38;
				void* _t55;

				E00007FF77FF739CDA6D0(0, _t38, "AreFileApisANSI", _t55, 0x39d74aa8, 0x39d74aac);
				E00007FF77FF739CDA6D0(1, _t38, "CompareStringEx", _t55, 0x39d74ac0, "CompareStringEx");
				E00007FF77FF739CDA6D0(2, _t38, "EnumSystemLocalesEx", _t55, 0x39d74ad8, "EnumSystemLocalesEx");
				E00007FF77FF739CDA6D0(8, _t38, "GetDateFormatEx", _t55, 0x39d74b18, "GetDateFormatEx");
				E00007FF77FF739CDA6D0(0xb, _t38, "GetLocaleInfoEx", _t55, 0x39d74b30, "GetLocaleInfoEx");
				E00007FF77FF739CDA6D0(0xe, _t38, "GetTimeFormatEx", _t55, 0x39d74b70, "GetTimeFormatEx");
				E00007FF77FF739CDA6D0(0xf, _t38, "GetUserDefaultLocaleName", _t55, 0x39d74b88, "GetUserDefaultLocaleName");
				E00007FF77FF739CDA6D0(0x13, _t38, "IsValidLocaleName", _t55, 0x39d74bb8, "IsValidLocaleName");
				E00007FF77FF739CDA6D0(0x14, _t38, "LCMapStringEx", _t55, 0x39d74bd8, "LCMapStringEx");
				_t13 = E00007FF77FF739CDA6D0(0x15, _t38, "LCIDToLocaleName", _t55, 0x39d74bf0, "LCIDToLocaleName");
				goto E00007FF77FF739CDA6D0;
				asm("int3");
				asm("int3");
				_a8 = __rdi;
				asm("dec eax");
				memset(__edi, _t13, 0x16 << 0);
				return 1;
			}

0x7ff739cdaecb
0x7ff739cdaeea
0x7ff739cdaf09
0x7ff739cdaf28
0x7ff739cdaf47
0x7ff739cdaf66
0x7ff739cdaf85
0x7ff739cdafa4
0x7ff739cdafc3
0x7ff739cdafe2
0x7ff739cdb005
0x7ff739cdb00a
0x7ff739cdb00b
0x7ff739cdb00c
0x7ff739cdb029
0x7ff739cdb032
0x7ff739cdb03c

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAECB
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAEEA

Part of subcall function 00007FF739CDA6D0: GetProcAddress.KERNEL32(?,?,00000006,00007FF739CDAAD2,?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1), ref: 00007FF739CDA828

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAF09

Part of subcall function 00007FF739CDA6D0: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF739CDAAD2,?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1), ref: 00007FF739CDA773
Part of subcall function 00007FF739CDA6D0: GetLastError.KERNEL32(?,?,00000006,00007FF739CDAAD2,?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1), ref: 00007FF739CDA781
Part of subcall function 00007FF739CDA6D0: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF739CDAAD2,?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1), ref: 00007FF739CDA7C3

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAF28

Part of subcall function 00007FF739CDA6D0: FreeLibrary.KERNEL32(?,?,00000006,00007FF739CDAAD2,?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1), ref: 00007FF739CDA7FC

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAF47
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAF66
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAF85
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAFA4
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAFC3
try_get_function.LIBVCRUNTIME ref: 00007FF739CDAFE2

Strings

LCIDToLocaleName, xrefs: 00007FF739CDAFC8, 00007FF739CDAFDB
LocaleNameToLCID, xrefs: 00007FF739CDAFE7, 00007FF739CDAFFA
EnumSystemLocalesEx, xrefs: 00007FF739CDAEEF, 00007FF739CDAF02
LCMapStringEx, xrefs: 00007FF739CDAFA9, 00007FF739CDAFBC
GetUserDefaultLocaleName, xrefs: 00007FF739CDAF6B, 00007FF739CDAF7E
GetDateFormatEx, xrefs: 00007FF739CDAF0E, 00007FF739CDAF21
GetTimeFormatEx, xrefs: 00007FF739CDAF4C, 00007FF739CDAF5F
AreFileApisANSI, xrefs: 00007FF739CDAEC4
GetLocaleInfoEx, xrefs: 00007FF739CDAF2D, 00007FF739CDAF40
IsValidLocaleName, xrefs: 00007FF739CDAF8A, 00007FF739CDAF9D
CompareStringEx, xrefs: 00007FF739CDAED0, 00007FF739CDAEE3

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: ee47d4c7914acba16260231c55cc4c4359673417597f83d4d957aab5cc980962
Instruction ID: 704acbe430cc37907fc0c8eb065ce508c6a2f9bad9e9b2daf1c6793a936b293f
Opcode Fuzzy Hash: ee47d4c7914acba16260231c55cc4c4359673417597f83d4d957aab5cc980962
Instruction Fuzzy Hash: DD315165928A47F1FA06FF64E8526E0B333EB04344FC24037D18D121A59E3CEA4AF361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC03B0 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 102
keyboardCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00007FF77FF739CC03B0(long long __rbx, long long __rdi, long long __rsi) {
				int _t44;
				signed long long _t68;
				int _t80;
				void* _t83;
				signed long long _t84;
				BYTE* _t92;
				int _t96;
				int _t98;
				int _t103;

				 *((long long*)(_t83 + 0x10)) = __rbx;
				 *((long long*)(_t83 + 0x18)) = __rsi;
				_t84 = _t83 - 0x1b0;
				_t68 =  *0x39d830d8; // 0x8accada1b9e9
				 *(_t83 - 0xb0 + 0xa0) = _t68 ^ _t84;
				r8d = 0x100;
				E00007FF77FF739CC8BD0();
				r8d = 0x6d1;
				E00007FF77FF739CC8BD0();
				 *((long long*)(_t84 + 0x1e0)) = __rdi;
				r13d = 0;
				if ( *0x39d85e38 == 0xffffffff) goto 0x39cc0555;
				if (0x20 - 0x140 < 0) goto 0x39cc04d0;
				if (0x20 - 0x14e > 0) goto 0x39cc04d0;
				 *((intOrPtr*)(_t84 + 0x40)) = 0x60;
				 *((intOrPtr*)(_t84 + 0x44)) = 0x61;
				 *((intOrPtr*)(_t84 + 0x48)) = 0x62;
				 *((intOrPtr*)(_t84 + 0x4c)) = 0x63;
				 *((intOrPtr*)(_t84 + 0x50)) = 0x64;
				 *((intOrPtr*)(_t84 + 0x54)) = 0x65;
				 *((intOrPtr*)(_t84 + 0x58)) = 0x66;
				 *((intOrPtr*)(_t84 + 0x5c)) = 0x67;
				 *((intOrPtr*)(_t84 + 0x60)) = 0x68;
				 *((intOrPtr*)(_t84 + 0x64)) = 0x69;
				 *((intOrPtr*)(_t84 + 0x68)) = 0x6e;
				 *((intOrPtr*)(_t84 + 0x6c)) = 0x6f;
				 *((intOrPtr*)(_t84 + 0x70)) = 0x6a;
				 *((intOrPtr*)(_t84 + 0x74)) = 0x6d;
				 *((intOrPtr*)(_t84 + 0x78)) = 0x6b;
				goto 0x39cc04df;
				MapVirtualKeyW(_t103);
				 *((intOrPtr*)(_t84 + 0x28)) = r13d;
				 *((intOrPtr*)(_t84 + 0x20)) = 0x10;
				if (ToUnicode(_t98, _t96, _t92) != 0xffffffff) goto 0x39cc0522;
				 *((intOrPtr*)(_t84 + 0x28)) = r13d;
				 *((intOrPtr*)(_t84 + 0x20)) = 0x10;
				if (ToUnicode(_t80, ??, ??, ??, ??) - 1 < 0) goto 0x39cc0555;
				 *(_t84 + 0x38) = _t96;
				 *(_t84 + 0x30) = _t96;
				r9d = 1;
				 *((intOrPtr*)(_t84 + 0x28)) = 5;
				 *((long long*)(_t84 + 0x20)) = 0x39d86152;
				_t44 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				if (0x21 - 0x15c <= 0) goto 0x39cc0432;
				return E00007FF77FF739CC6B50(_t44, 0xfde9,  *(_t83 - 0xb0 + 0xa0) ^ _t84);
			}

0x7ff739cc03b0
0x7ff739cc03b5
0x7ff739cc03cb
0x7ff739cc03d2
0x7ff739cc03dc
0x7ff739cc03e9
0x7ff739cc03ef
0x7ff739cc03fd
0x7ff739cc0403
0x7ff739cc040d
0x7ff739cc0423
0x7ff739cc0439
0x7ff739cc0445
0x7ff739cc0451
0x7ff739cc0453
0x7ff739cc045b
0x7ff739cc0463
0x7ff739cc046b
0x7ff739cc0473
0x7ff739cc047b
0x7ff739cc0483
0x7ff739cc048b
0x7ff739cc0493
0x7ff739cc049b
0x7ff739cc04a3
0x7ff739cc04ab
0x7ff739cc04b3
0x7ff739cc04bb
0x7ff739cc04c3
0x7ff739cc04ce
0x7ff739cc04d7
0x7ff739cc04df
0x7ff739cc04ec
0x7ff739cc0501
0x7ff739cc0503
0x7ff739cc0510
0x7ff739cc0525
0x7ff739cc0527
0x7ff739cc0530
0x7ff739cc0535
0x7ff739cc053b
0x7ff739cc054a
0x7ff739cc054f
0x7ff739cc0569
0x7ff739cc05a2

APIs

MapVirtualKeyW.USER32 ref: 00007FF739CC04D7
ToUnicode.USER32 ref: 00007FF739CC04F8
ToUnicode.USER32 ref: 00007FF739CC051C
WideCharToMultiByte.KERNEL32 ref: 00007FF739CC054F

Strings

b, xrefs: 00007FF739CC0463
`, xrefs: 00007FF739CC0453
n, xrefs: 00007FF739CC04A3
f, xrefs: 00007FF739CC0483
g, xrefs: 00007FF739CC048B
h, xrefs: 00007FF739CC0493
k, xrefs: 00007FF739CC04C3
e, xrefs: 00007FF739CC047B
d, xrefs: 00007FF739CC0473
m, xrefs: 00007FF739CC04BB
c, xrefs: 00007FF739CC046B
a, xrefs: 00007FF739CC045B
i, xrefs: 00007FF739CC049B
o, xrefs: 00007FF739CC04AB
j, xrefs: 00007FF739CC04B3

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Unicode$ByteCharMultiVirtualWide
String ID: `$a$b$c$d$e$f$g$h$i$j$k$m$n$o
API String ID: 4148918737-2028020120
Opcode ID: 256a9e672cacaa79bfe46b357a00232667d17f45f9ad6cabdf60b8551c0f37d2
Instruction ID: eab78a74228adf722a5648692061ab5aa6eb302f70ac608e78449c73b13b4a95
Opcode Fuzzy Hash: 256a9e672cacaa79bfe46b357a00232667d17f45f9ad6cabdf60b8551c0f37d2
Instruction Fuzzy Hash: 04418E72A18740A6E320DF20E44439FBBB2F784718F900125EA8D07A98CF7ED55ADF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC25F0 Relevance: 21.3, APIs: 14, Instructions: 264COMMON

Download Yara Rule

APIs

GetDpiForWindow.USER32 ref: 00007FF739CC26BF
AdjustWindowRectExForDpi.USER32 ref: 00007FF739CC26D5
SetWindowPos.USER32 ref: 00007FF739CC2757

Part of subcall function 00007FF739CC2C50: SetThreadExecutionState.KERNEL32 ref: 00007FF739CC2C67
Part of subcall function 00007FF739CC2C50: SystemParametersInfoW.USER32 ref: 00007FF739CC2C8F
Part of subcall function 00007FF739CC2C50: SystemParametersInfoW.USER32 ref: 00007FF739CC2CA0

Part of subcall function 00007FF739CC3140: GetMonitorInfoW.USER32 ref: 00007FF739CC3183
Part of subcall function 00007FF739CC3140: SetWindowPos.USER32 ref: 00007FF739CC31BF

GetWindowLongW.USER32 ref: 00007FF739CC27AD
SetWindowLongW.USER32 ref: 00007FF739CC27F7
GetMonitorInfoW.USER32 ref: 00007FF739CC2819
SetWindowPos.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00007FF739CC284D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Window$Info$LongMonitorParametersSystem$AdjustExecutionRectStateThread
String ID:
API String ID: 1786379111-0
Opcode ID: fcee42252e15ac79c8f8b0a62055d707779743cfb6f3f99a59736666311a5002
Instruction ID: 866ca155cd5e4fb352b4108242134b342610a2bc5180ec1ad049c2c47274f7ef
Opcode Fuzzy Hash: fcee42252e15ac79c8f8b0a62055d707779743cfb6f3f99a59736666311a5002
Instruction Fuzzy Hash: 5FC1AC32B082419BEB64AF75D59036CB6B1FB48748F805135DE4E53AA4CF3CE855EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC1400 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CC0BD0: EnumDisplaySettingsW.USER32 ref: 00007FF739CC0C24

ChangeDisplaySettingsExW.USER32 ref: 00007FF739CC14DB

Strings

Invalid flags, xrefs: 00007FF739CC1513
Failed to write to registry, xrefs: 00007FF739CC154B
Graphics mode not supported, xrefs: 00007FF739CC1521
The system uses DualView, xrefs: 00007FF739CC1505
Win32: Failed to set video mode: %s, xrefs: 00007FF739CC1562
Invalid parameter, xrefs: 00007FF739CC152F
Unknown error, xrefs: 00007FF739CC14F9
Graphics mode failed, xrefs: 00007FF739CC153D
Computer restart required, xrefs: 00007FF739CC1557

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: DisplaySettings$ChangeEnum
String ID: Computer restart required$Failed to write to registry$Graphics mode failed$Graphics mode not supported$Invalid flags$Invalid parameter$The system uses DualView$Unknown error$Win32: Failed to set video mode: %s
API String ID: 1333101904-2112259362
Opcode ID: 3ac518c952b6e5b191105663621dc596ba716aec520c499abe03c5400a76b139
Instruction ID: 600c41268314f3f9170d86ad86835a989c0e9e3157b133ddeab2d0634b049134
Opcode Fuzzy Hash: 3ac518c952b6e5b191105663621dc596ba716aec520c499abe03c5400a76b139
Instruction Fuzzy Hash: 5F41B171918682A2E660EF22E4407EAB7B2FB44350FD05232D69E836C4DF3CE455EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2B30 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 55registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF739CC2B82
GetModuleHandleW.KERNEL32 ref: 00007FF739CC2B9B
LoadImageW.USER32 ref: 00007FF739CC2BBE
LoadImageW.USER32 ref: 00007FF739CC2BE8
RegisterClassExW.USER32 ref: 00007FF739CC2BF8

Strings

GLFW30, xrefs: 00007FF739CC2B8F
#, xrefs: 00007FF739CC2B7A
Win32: Failed to register window class, xrefs: 00007FF739CC2C03
P, xrefs: 00007FF739CC2B3B
GLFW_ICON, xrefs: 00007FF739CC2BB7

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Load$Image$ClassCursorHandleModuleRegister
String ID: #$GLFW30$GLFW_ICON$P$Win32: Failed to register window class
API String ID: 3866263799-113273589
Opcode ID: 2b0a5cd9938dba765774209787f0cca975b8e363227543e9a10029a05618c83f
Instruction ID: a2b98a137e4d5d712329fe64b89eb33561a75294369e4df0ee10d3c7320262c5
Opcode Fuzzy Hash: 2b0a5cd9938dba765774209787f0cca975b8e363227543e9a10029a05618c83f
Instruction Fuzzy Hash: 2A216B32928B8192E7509F20F45132AF7B1FB88345FD04139E6CE42B58EF7CD1589B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE74E0 Relevance: 16.9, APIs: 11, Instructions: 370COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE753D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE75AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE761D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE768D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE76FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE776D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE77DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE7869
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE78E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE7969
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739CE79E9

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 746f2cac3224c3f6bb5256c53801f6dba4eaf9b7de7c58fb4a70a86715a9f344
Instruction ID: 19c7fce2b688ec84367aa12bc59563541fb7f9ad1dcecd682812de5c130b21f5
Opcode Fuzzy Hash: 746f2cac3224c3f6bb5256c53801f6dba4eaf9b7de7c58fb4a70a86715a9f344
Instruction Fuzzy Hash: 50C15B90E2D686A0FE05BF39E946379E233AF45BE5FD04731D56D022E6DE1CA0C5B224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2F30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF739CC2F50
ScreenToClient.USER32 ref: 00007FF739CC2F62
SetCursor.USER32 ref: 00007FF739CC2FA2
LoadCursorW.USER32 ref: 00007FF739CC2FB8
SetCursor.USER32 ref: 00007FF739CC2FC1
RegisterRawInputDevices.USER32 ref: 00007FF739CC3010

Strings

Win32: Failed to register raw input device, xrefs: 00007FF739CC301A

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Cursor$ClientDevicesInputLoadRegisterScreen
String ID: Win32: Failed to register raw input device
API String ID: 1305090692-3523228969
Opcode ID: c2f604192a00893441f91f1de6cdd4a8817e9fe0e1f887510bc0f3ea248acca0
Instruction ID: c65e54c6637f0c383861fb40ef3c2e8ef525f66e84a2a0471d69a680c59572b9
Opcode Fuzzy Hash: c2f604192a00893441f91f1de6cdd4a8817e9fe0e1f887510bc0f3ea248acca0
Instruction Fuzzy Hash: 1321B431A08B46A1EB01AF30E450279F372FF84B85F845135EA4E066A5CF3DE446E750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC9EC0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF739CC9F1D

Part of subcall function 00007FF739CCC214: __GetUnwindTryBlock.LIBCMT ref: 00007FF739CCC257
Part of subcall function 00007FF739CCC214: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF739CCC27C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF739CC9FF5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF739CCA24A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF739CCA356

Strings

csm, xrefs: 00007FF739CC9F37
csm, xrefs: 00007FF739CCA018
csm, xrefs: 00007FF739CC9F9E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 27748219adec5a4d565cfbfff52e97fe0acfdaa60eee0a089269169b9202abc4
Instruction ID: 728ca992e691b3085b038bfae2bdd5f4fb01e74fdaffddba844ef2576fcc4f1f
Opcode Fuzzy Hash: 27748219adec5a4d565cfbfff52e97fe0acfdaa60eee0a089269169b9202abc4
Instruction Fuzzy Hash: DDE1B372A0874196FB20AF75D4442ADBBB1FB49788F841135EE8D57B96CF38E482DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC381C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 00007FF739CC4308

Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCDF
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCEE
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCFD
Part of subcall function 00007FF739CBFC90: RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFD0E

GetDpiForWindow.USER32 ref: 00007FF739CC383D
AdjustWindowRectExForDpi.USER32 ref: 00007FF739CC3890
AdjustWindowRectEx.USER32 ref: 00007FF739CC3898
MonitorFromWindow.USER32 ref: 00007FF739CC38FA
GetMonitorInfoW.USER32 ref: 00007FF739CC391F

Strings

(, xrefs: 00007FF739CC3914

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Window$ConditionMask$AdjustInfoMonitorRect$FromProcVerifyVersion
String ID: (
API String ID: 3794753354-3887548279
Opcode ID: 0d08f120231f254d20723e55a7b59fda0683c8efef6f67081974c1392d66e6d1
Instruction ID: 6cde202ca6cc4e2409ac142842bf6df65f092ae4397832f40fcca70f39358cfc
Opcode Fuzzy Hash: 0d08f120231f254d20723e55a7b59fda0683c8efef6f67081974c1392d66e6d1
Instruction Fuzzy Hash: B6419E32E042419FE364DFB9E44036DB7B2FB44718F805236DE4AA6A84DE3CE446DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC02C0 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

UnregisterDeviceNotification.USER32 ref: 00007FF739CC02D0
DestroyWindow.USER32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC02E2
SystemParametersInfoW.USER32 ref: 00007FF739CC02FF
FreeLibrary.KERNEL32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC033D
FreeLibrary.KERNEL32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC034F
FreeLibrary.KERNEL32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC0361
FreeLibrary.KERNEL32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC0373
FreeLibrary.KERNEL32(?,?,?,?,00007FF739CBE7DE,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC0385

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: FreeLibrary$DestroyDeviceInfoNotificationParametersSystemUnregisterWindow
String ID:
API String ID: 4127398244-0
Opcode ID: 3af1d21eb0bb8f00c2d0d5d161bef78ced57c5eef3c189ddd076fde6f7cee703
Instruction ID: 58b19d92619f3b39bfcf5a0c216a8553e4e373df05cac89cde910998c99df2bc
Opcode Fuzzy Hash: 3af1d21eb0bb8f00c2d0d5d161bef78ced57c5eef3c189ddd076fde6f7cee703
Instruction Fuzzy Hash: D321ED24E5EA06F5FE04FF719866234F672BF84B52FC41531C84E52662CE1CB902B671

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE304C Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE3482

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b8876b146a0dd2159645d5a801210abe1d734e0e2b5a9409c44ea64fb20763ae
Instruction ID: 6c1119791db69d12788878ab820b5b35af0fd815c4473c33575234c9744ac9cf
Opcode Fuzzy Hash: b8876b146a0dd2159645d5a801210abe1d734e0e2b5a9409c44ea64fb20763ae
Instruction Fuzzy Hash: 80C1D322E0C686A1E6626F25944027DFA72FB85B81FC52135D98F03792CE7CF846F760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCC75C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF739CCCA0E,?,?,?,00007FF739CCC700,?,?,00000001,00007FF739CC9371), ref: 00007FF739CCC7E1
GetLastError.KERNEL32(?,?,?,00007FF739CCCA0E,?,?,?,00007FF739CCC700,?,?,00000001,00007FF739CC9371), ref: 00007FF739CCC7EF
LoadLibraryExW.KERNEL32(?,?,?,00007FF739CCCA0E,?,?,?,00007FF739CCC700,?,?,00000001,00007FF739CC9371), ref: 00007FF739CCC819
FreeLibrary.KERNEL32(?,?,?,00007FF739CCCA0E,?,?,?,00007FF739CCC700,?,?,00000001,00007FF739CC9371), ref: 00007FF739CCC85F
GetProcAddress.KERNEL32(?,?,?,00007FF739CCCA0E,?,?,?,00007FF739CCC700,?,?,00000001,00007FF739CC9371), ref: 00007FF739CCC86B

Strings

api-ms-, xrefs: 00007FF739CCC801

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 80e122c1517e9d56216cb50d760bd727917aca71ef8a2bc2915187e309d1ae53
Instruction ID: 41a3e6b3a18cb928fc93fd9224c7ee2f82e1b6069a754a51168961f019332c98
Opcode Fuzzy Hash: 80e122c1517e9d56216cb50d760bd727917aca71ef8a2bc2915187e309d1ae53
Instruction Fuzzy Hash: 97311221E1A702E2EE11FF22A840536A7B6BF08F64F891934DD9D16780DF3CE801E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE5C00 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,00000000,00007FF739CE2A5E), ref: 00007FF739CE5C31
GetLastError.KERNEL32(?,00000000,00007FF739CE2A5E), ref: 00007FF739CE5C3D
CloseHandle.KERNEL32(?,00000000,00007FF739CE2A5E), ref: 00007FF739CE5C55
CreateFileW.KERNEL32 ref: 00007FF739CE5C80
WriteConsoleW.KERNEL32 ref: 00007FF739CE5C9F

Strings

CONOUT$, xrefs: 00007FF739CE5C61

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 6579eae0f7e0c80b70a12399cf2c2c5abbbf634f945d1ba5270f1513971657da
Instruction ID: 56d26e1b74c4843ded3cfa8175607d6ef4c736cf3e9dd75eeecbf10f7f8aa45f
Opcode Fuzzy Hash: 6579eae0f7e0c80b70a12399cf2c2c5abbbf634f945d1ba5270f1513971657da
Instruction Fuzzy Hash: 60119321B18E8196E750AF62E855329F7B6FB88FE5F800234EA1E87795DF3CD4049750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC6060 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF739CC60D2
MultiByteToWideChar.KERNEL32 ref: 00007FF739CC617A
LCMapStringEx.KERNEL32 ref: 00007FF739CC61B1
LCMapStringEx.KERNEL32 ref: 00007FF739CC620A
LCMapStringEx.KERNEL32 ref: 00007FF739CC62B7
WideCharToMultiByte.KERNEL32 ref: 00007FF739CC62F9

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 7c38958ae06f5ef2402babd565d4181b62d867ae31e0a9f85c230880cc384d4c
Instruction ID: 749f106baabe2b3c20d9506e5c94de225e1f01fad31ff49c93ca5bc5968e4d05
Opcode Fuzzy Hash: 7c38958ae06f5ef2402babd565d4181b62d867ae31e0a9f85c230880cc384d4c
Instruction Fuzzy Hash: B781A572A0474696EB20AF61D640379AAF2FF447A8F881235EA9D57BC4DF3CD4069B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C822D0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF739C822E5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF739C8230A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF739C82334
std::_Facet_Register.LIBCPMT ref: 00007FF739C823AB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF739C823C5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF739C823D8

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0a9f2b95ce9d8f155ee33930d056ec64c37ef3c238b9b1fa5f0d8cc6e27726cd
Instruction ID: 1209000c9f118eed81d4627ca287080d4a04a1b4a8fe1035475cbbc4d6aab322
Opcode Fuzzy Hash: 0a9f2b95ce9d8f155ee33930d056ec64c37ef3c238b9b1fa5f0d8cc6e27726cd
Instruction Fuzzy Hash: 0B31AE21A5CA86A1EA05BF22D4541B9F776EF48BB0FC81131DA4D472D6DE3CE442A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCA398 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF739CCA536
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF739CCA859

Strings

csm, xrefs: 00007FF739CCA55D
csm, xrefs: 00007FF739CCA47D
csm, xrefs: 00007FF739CCA4DF

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 1d349cf17dc0299ca045e9b14ea901ea8c8cef2e2a101a36b2660e30a1c478d4
Instruction ID: 182b8e440ba47d82f819d353f62c68da7601579572d930a671b7203af1f272de
Opcode Fuzzy Hash: 1d349cf17dc0299ca045e9b14ea901ea8c8cef2e2a101a36b2660e30a1c478d4
Instruction Fuzzy Hash: 6AE1A3729086829AF710AF38D4883BDBBB2FB44748F945135DACD57696CF38E486DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2E90 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?,?,?,?,?,?,00000000,00007FF739CC253E,?,?,00000000,00007FF739CBF28C,?,?,00000000,00007FF739CBE73C), ref: 00007FF739CC2EB1
WindowFromPoint.USER32(?,?,?,?,?,?,00000000,00007FF739CC253E,?,?,00000000,00007FF739CBF28C,?,?,00000000,00007FF739CBE73C), ref: 00007FF739CC2EC7
GetClientRect.USER32 ref: 00007FF739CC2EDA
ClientToScreen.USER32 ref: 00007FF739CC2EEC
ClientToScreen.USER32 ref: 00007FF739CC2EFE
PtInRect.USER32 ref: 00007FF739CC2F0E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Client$RectScreen$CursorFromPointWindow
String ID:
API String ID: 3638364385-0
Opcode ID: f76d4b5ab5769b8a1d5556a1f682c16c7477128e2e08ae4c687b38609cc177a9
Instruction ID: 39b9b3340ac92fdc856d36b808173bb8e56dae672d9b6f6d6d16e0740a5507dc
Opcode Fuzzy Hash: f76d4b5ab5769b8a1d5556a1f682c16c7477128e2e08ae4c687b38609cc177a9
Instruction Fuzzy Hash: 6E118621A18A4291DB51AF21E950079B372FB88FD5FC41031E98F47668DF3CD545EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC9170 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF739CC919B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF739CC9230
RtlUnwindEx.KERNEL32 ref: 00007FF739CC927F

Strings

f, xrefs: 00007FF739CC91AE
csm, xrefs: 00007FF739CC9216

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c956270e5e75b1406440b9605611ada995cf7cab332135a871939f15098f3043
Instruction ID: f97e89f26c42087a887dd62678b4ae0456b8fe55509356da883b0cd055d7703f
Opcode Fuzzy Hash: c956270e5e75b1406440b9605611ada995cf7cab332135a871939f15098f3043
Instruction Fuzzy Hash: 2D51F832A19602A6DB14EF25E404A6DFBB6FB44B84F959030DD9A47784DF38ED43DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C83C40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF739C83CC0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF739C83D08
_Getctype.LIBCPMT ref: 00007FF739C83D25
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF739C83DC0

Strings

bad locale name, xrefs: 00007FF739C83DE8

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 37b24dc187511f9d8c50d9ab3c820f93ce5054b56bd5b896fe2fad3aa36a0144
Instruction ID: a5323ba19bec5b3ec1a25f3593f41ef051c1e2ff24c761c7827438cbb3151b40
Opcode Fuzzy Hash: 37b24dc187511f9d8c50d9ab3c820f93ce5054b56bd5b896fe2fad3aa36a0144
Instruction Fuzzy Hash: A8519F22B5DB41A9FB11EF70D4502ADB3B6AF40B48F845835DE8D13A89CF38E516E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC3B7B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118windowkeyboardtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC31F4
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC3205
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC3220
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC3239
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC3247
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC325D
Part of subcall function 00007FF739CC31E0: GetKeyState.USER32 ref: 00007FF739CC3272

MapVirtualKeyW.USER32 ref: 00007FF739CC3BAE
GetMessageTime.USER32 ref: 00007FF739CC3C13
PeekMessageW.USER32 ref: 00007FF739CC3C2D
DefWindowProcW.USER32 ref: 00007FF739CC4308

Strings

E, xrefs: 00007FF739CC3BCE

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: State$Message$PeekProcTimeVirtualWindow
String ID: E
API String ID: 776232839-3568589458
Opcode ID: 3087213c0bf794ada5c0a97a606096feac0605e6e9c925fad5792e2de349719f
Instruction ID: d5a7d92631b8ae1973ab6f11d7e7e1f6f9e063bb26d6391f4748f042bf34bcc9
Opcode Fuzzy Hash: 3087213c0bf794ada5c0a97a606096feac0605e6e9c925fad5792e2de349719f
Instruction Fuzzy Hash: BE41CE31F085429BFB20AF75A4507BD6AB2BB48789F802135DE8A577C5DE3C9442EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC0EA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00007FF739CC1038
SetDeviceGammaRamp.GDI32 ref: 00007FF739CC1049
DeleteDC.GDI32 ref: 00007FF739CC1052

Strings

Win32: Gamma ramp size must be 256, xrefs: 00007FF739CC0EC8
DISPLAY, xrefs: 00007FF739CC1031

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CreateDeleteDeviceGammaRamp
String ID: DISPLAY$Win32: Gamma ramp size must be 256
API String ID: 790129706-1165277357
Opcode ID: 393227a744a2fd6068a294b32f3c15d7af3df41d6275f7d3125d5f430cf725b4
Instruction ID: a1ca9c581e6747d2f9ec030f623400b03c9954ab876c8cdfc2cbffe54d32ca07
Opcode Fuzzy Hash: 393227a744a2fd6068a294b32f3c15d7af3df41d6275f7d3125d5f430cf725b4
Instruction Fuzzy Hash: 1951F716E19BC581EA11DF2CD6193BC6370F7A9B88F65A325DF8C12213EF25A2D9D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC3040 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52registryCOMMON

Download Yara Rule

APIs

RegisterRawInputDevices.USER32 ref: 00007FF739CC3075
ClientToScreen.USER32 ref: 00007FF739CC30D2
SetCursorPos.USER32 ref: 00007FF739CC30E0
LoadCursorW.USER32 ref: 00007FF739CC310F

Part of subcall function 00007FF739CBFB90: GetLastError.KERNEL32 ref: 00007FF739CBFBDB
Part of subcall function 00007FF739CBFB90: FormatMessageW.KERNEL32 ref: 00007FF739CBFC10
Part of subcall function 00007FF739CBFB90: WideCharToMultiByte.KERNEL32 ref: 00007FF739CBFC4F

Strings

Win32: Failed to remove raw input device, xrefs: 00007FF739CC307F

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Cursor$ByteCharClientDevicesErrorFormatInputLastLoadMessageMultiRegisterScreenWide
String ID: Win32: Failed to remove raw input device
API String ID: 628836682-53561655
Opcode ID: 57fa9460ff3e87e1bfa137c48fd01e915ff265d7ed5e202e4e3343235ced6b14
Instruction ID: 164cb0981e1cf46251fd771569352e926ec6f5e8f35e343eb608197b01884982
Opcode Fuzzy Hash: 57fa9460ff3e87e1bfa137c48fd01e915ff265d7ed5e202e4e3343235ced6b14
Instruction Fuzzy Hash: BD219276A1C60196E755AF30E46137AF3B2FB88B09F840435DA4E46658CF3DE445EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

RemovePropW.USER32 ref: 00007FF739CC22B4
DestroyWindow.USER32(?,?,00000000,00007FF739CBEB30,?,?,00000000,00007FF739CBE71C,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC22C1
DestroyIcon.USER32(?,?,00000000,00007FF739CBEB30,?,?,00000000,00007FF739CBE71C,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC22DA
DestroyIcon.USER32(?,?,00000000,00007FF739CBEB30,?,?,00000000,00007FF739CBE71C,?,?,?,?,00007FF739CBE6DC), ref: 00007FF739CC22EC

Part of subcall function 00007FF739CC32D0: SetThreadExecutionState.KERNEL32 ref: 00007FF739CC32F4
Part of subcall function 00007FF739CC32D0: SystemParametersInfoW.USER32 ref: 00007FF739CC331D

Strings

GLFW, xrefs: 00007FF739CC22AD

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Destroy$Icon$ExecutionInfoParametersPropRemoveStateSystemThreadWindow
String ID: GLFW
API String ID: 1815938153-220981224
Opcode ID: df072145ec3cb0bbce167e466810c0063b0ab9bfdd94869edefe918b57f825ea
Instruction ID: 4ffa5d36b6a83d3d55c2aeb6bb68bbc8a7f25e755befe3d114469af2b08549af
Opcode Fuzzy Hash: df072145ec3cb0bbce167e466810c0063b0ab9bfdd94869edefe918b57f825ea
Instruction Fuzzy Hash: A2015B21A09B46A1EF45AF71E891378B3B6FF48F95F8C5435C94E06765CE3CE442A620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD4540 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF739CD455C
GetProcAddress.KERNEL32 ref: 00007FF739CD4572
FreeLibrary.KERNEL32 ref: 00007FF739CD458F

Strings

CorExitProcess, xrefs: 00007FF739CD456B
mscoree.dll, xrefs: 00007FF739CD4553

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b6d762ac0b012c3fe5d72ad9a3639368b8856cb342460f434e8939f033bf257d
Instruction ID: 19078bf91c7d2ce0fcc215bae3bfcf521079edc829957de0e2d345eceb70a300
Opcode Fuzzy Hash: b6d762ac0b012c3fe5d72ad9a3639368b8856cb342460f434e8939f033bf257d
Instruction Fuzzy Hash: 01F03A62E29646A1EB54AF20E480378E372AF88741FC41439D50F455A4DE3CD488F360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC9790 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF739CC98B3
__AdjustPointer.LIBCMT ref: 00007FF739CC98FE

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d825f48dea577d5a90ab2e924f74496608a7c1384c70d85fa8ad637be010af57
Instruction ID: 7aa7dda111f795a7c4e718d010ecf44120a3d3a03cb69a6f3e766d68b1c7acb3
Opcode Fuzzy Hash: d825f48dea577d5a90ab2e924f74496608a7c1384c70d85fa8ad637be010af57
Instruction Fuzzy Hash: 94B1B922E09642A1EB65FF35944013DEBB2EF44B84F85A435DECD07795DE2CD843AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2310 Relevance: 7.6, APIs: 5, Instructions: 115COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF739CC2364
SetRect.USER32 ref: 00007FF739CC2383

Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCDF
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCEE
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCFD
Part of subcall function 00007FF739CBFC90: RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFD0E

GetDpiForWindow.USER32 ref: 00007FF739CC23E0
AdjustWindowRectExForDpi.USER32 ref: 00007FF739CC23F7
AdjustWindowRectEx.USER32 ref: 00007FF739CC2445

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Rect$ConditionMaskWindow$Adjust$ClientInfoVerifyVersion
String ID:
API String ID: 2961500858-0
Opcode ID: 552427f5a4076393b288427043aefbb6ccbb851601efa5b1ac54d40f950ba7be
Instruction ID: 9c56f0f8d27a8285dde1aeb79969e6fe15c2bc56419621eae92852f8551ad050
Opcode Fuzzy Hash: 552427f5a4076393b288427043aefbb6ccbb851601efa5b1ac54d40f950ba7be
Instruction Fuzzy Hash: EF518F32718742ABEB60EF25E45072AB7B1FB48744F845035EA8E87B58CF3CD4429B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC41E2 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DragQueryFileW.SHELL32 ref: 00007FF739CC41F0
DragQueryPoint.SHELL32 ref: 00007FF739CC4214
DragQueryFileW.SHELL32 ref: 00007FF739CC425E
DragQueryFileW.SHELL32 ref: 00007FF739CC4283

Part of subcall function 00007FF739CBFAB0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF739CC15D7), ref: 00007FF739CBFAE5

DragFinish.SHELL32 ref: 00007FF739CC42EC

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Drag$Query$File$ByteCharFinishMultiPointWide
String ID:
API String ID: 2870031500-0
Opcode ID: 139d758f49e8211658b5a35d2f9b0de15fe1bfdfbb77347247059a745f2d3942
Instruction ID: a9510428737d55676d0c020814239a9688e9370050ab409ff0f9ec2e6c030949
Opcode Fuzzy Hash: 139d758f49e8211658b5a35d2f9b0de15fe1bfdfbb77347247059a745f2d3942
Instruction Fuzzy Hash: 3931A321F096425AF701FFB194116BEB772BB85BD4F809531DE0F63B4ACE389406A750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE4BC0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF739CE4BE8
_set_statfp.LIBCMT ref: 00007FF739CE4C03
_set_statfp.LIBCMT ref: 00007FF739CE4C1F
_set_statfp.LIBCMT ref: 00007FF739CE4C5B

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 81707765467665a64026fe50aca45b235a01160f10b463acd2fa1bd67648dc38
Instruction ID: 55a493a238d94fd2af94eb8ecd97219ddfe63c6a0a5e796f8eb72104b55bdef6
Opcode Fuzzy Hash: 81707765467665a64026fe50aca45b235a01160f10b463acd2fa1bd67648dc38
Instruction Fuzzy Hash: E411E322E4CA9321F668BD78E5823F9A0736F55776FC40630EA7F072DA8E1CA8417125

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD7CBC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD7F62

Part of subcall function 00007FF739CE190C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1929

Strings

UTF-8, xrefs: 00007FF739CD7EE5
ccs, xrefs: 00007FF739CD7EAE
UTF-16LEUNICODE, xrefs: 00007FF739CD7F06

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 765d2b851b3fe89b8fdad15e491785742e3832cdecd169bf7a169785e41db606
Instruction ID: 098ff1825728b0e6050849a9e7b0da0b9af6c5ffda115688cc5ceb26382dfafe
Opcode Fuzzy Hash: 765d2b851b3fe89b8fdad15e491785742e3832cdecd169bf7a169785e41db606
Instruction Fuzzy Hash: 1481A1B3D0C242A9F775AE3CC244238EAB39F11B88FD55435C94E86A95DB3DAC01B761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCAAB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF739CCAB20
_CallSETranslator.LIBVCRUNTIME ref: 00007FF739CCAB6B

Strings

RCC, xrefs: 00007FF739CCAB3C
MOC, xrefs: 00007FF739CCAB34

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 3c626d7a97cafbbad6b8c08fc4748eec2d5243c384ebdef893a4fde067a45408
Instruction ID: 6ad7499f2b64e1cc9b49aa6587b4dcc569ede54a1936cee3cef4c1c32eb062bd
Opcode Fuzzy Hash: 3c626d7a97cafbbad6b8c08fc4748eec2d5243c384ebdef893a4fde067a45408
Instruction Fuzzy Hash: 5391E073A08B829AE710DF74E4542ADBBB2F704788F545139EA8D57B54DF38D192DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCEA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCEA8D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CCEC59

Strings

*, xrefs: 00007FF739CCEB8D
, xrefs: 00007FF739CCEBE2

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: dea924dcd5f7616679a874c203ac1c923b6f58dcd7703d7370670d5fa7a90785
Instruction ID: 80bd335f1a70255ed1fa5ed48f56b05dc231054a8e0b8334875e498d606eecac
Opcode Fuzzy Hash: dea924dcd5f7616679a874c203ac1c923b6f58dcd7703d7370670d5fa7a90785
Instruction Fuzzy Hash: 4E61437290C6429AE764AE38805527CBFB2EB07B19F943135C68A431D5CF28DC82EF25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCA894 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF739CCA8E0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF739CCA92F

Strings

RCC, xrefs: 00007FF739CCA8FD
MOC, xrefs: 00007FF739CCA8F4

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 62565ff6f76f4329084405539a57fb056105bbc4edb143fbfec4e935c06c12fe
Instruction ID: 966864892cf3a2daf01f21e9df97d18d28dce0639e61255c92201d07c87642d4
Opcode Fuzzy Hash: 62565ff6f76f4329084405539a57fb056105bbc4edb143fbfec4e935c06c12fe
Instruction Fuzzy Hash: 6F616A33A08A859AEB10DF65D0453ADBBB1FB44B88F445225EE8D17B98CB38E546DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCB024 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF739CCB04C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF739CCB134

Strings

csm, xrefs: 00007FF739CCB06E
csm, xrefs: 00007FF739CCB186

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 0bda89c1c474226a29a6159f1c8001ccca3156b417f1938975b9ec5068ee005c
Instruction ID: 78b29307042caff85a8e44a12a656b49f9b203f7d3cbaf70bb189d83e93371db
Opcode Fuzzy Hash: 0bda89c1c474226a29a6159f1c8001ccca3156b417f1938975b9ec5068ee005c
Instruction Fuzzy Hash: A751C43294824396EB24AFA29440378BBB2FB44B84F946135DADC47B95CF3CE452DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C81030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF739C8103B
GetProcAddress.KERNEL32 ref: 00007FF739C8104B

Strings

RtlAdjustPrivilege, xrefs: 00007FF739C81044
ntdll.dll, xrefs: 00007FF739C81034

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-64178277
Opcode ID: 44610894ece071f3450c6f0e06a7f2209c201c748daf7f016e0df0c2fe412239
Instruction ID: 155cb491b90ee4a14561a397aae618d422d7a833de1e867c7162d295c825f3b3
Opcode Fuzzy Hash: 44610894ece071f3450c6f0e06a7f2209c201c748daf7f016e0df0c2fe412239
Instruction Fuzzy Hash: 12D09224E4AA42A1E604BF21EC81064B272BB44712BC00531C40E11220EE3CAA9AF3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CE1D64 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1DA5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1E25
_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CE1E79
_get_daylight.LIBCMT ref: 00007FF739CE1ED1

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 3fdf1a0d571e053fe8fa19e5d548205560761c24186fb861f9ab51dd56bbd728
Instruction ID: afac0632d43e053f493b6a86001a65ab9648bd65c514fa2f5f0d6eed1741365d
Opcode Fuzzy Hash: 3fdf1a0d571e053fe8fa19e5d548205560761c24186fb861f9ab51dd56bbd728
Instruction Fuzzy Hash: 7F51C032E08242A2F3697D38840937FE9B2AF41795F994534F94F472D6CA2CA860B761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC2A00 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCDF
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCEE
Part of subcall function 00007FF739CBFC90: VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCFD
Part of subcall function 00007FF739CBFC90: RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFD0E

GetDpiForWindow.USER32 ref: 00007FF739CC2A83
AdjustWindowRectExForDpi.USER32 ref: 00007FF739CC2A9A
AdjustWindowRectEx.USER32 ref: 00007FF739CC2AE8
SetWindowPos.USER32 ref: 00007FF739CC2B13

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Window$ConditionMask$AdjustRect$InfoVerifyVersion
String ID:
API String ID: 402204090-0
Opcode ID: b034f9cacb0b9f34c6233249cbdafb291a4917715b997a95ecfa28b0de6c3a29
Instruction ID: 08434e3ebe1acab14e41ba4027f705667ef89bd6ba722cf6004eb9f830a9c6db
Opcode Fuzzy Hash: b034f9cacb0b9f34c6233249cbdafb291a4917715b997a95ecfa28b0de6c3a29
Instruction Fuzzy Hash: B031C031B08641A7EB74AF21A55032ABAB1FB88B45F905031DF8E47A54DF3CE9519F20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBFD40 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDB3
VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDC2
VerSetConditionMask.KERNEL32 ref: 00007FF739CBFDD1
RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFDE2

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 429d319824c7e070642cdb34a65a07d366f67fe1f4ef6a4e95e1f907020daee3
Instruction ID: 588a67cdda6f8cdf68d270a4702e400be85b4e2ff8577bca4bbd558202b99701
Opcode Fuzzy Hash: 429d319824c7e070642cdb34a65a07d366f67fe1f4ef6a4e95e1f907020daee3
Instruction Fuzzy Hash: FA113A32A0968196D730DF32E9513EAB3B1FB88745F805235DA8E87B54EF3CD1199B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBFC90 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCDF
VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCEE
VerSetConditionMask.KERNEL32 ref: 00007FF739CBFCFD
RtlVerifyVersionInfo.NTDLL ref: 00007FF739CBFD0E

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: eeb1df69a67e7593011410af4fe5e9b54c1d1657c523b51506144c4d32310c13
Instruction ID: 8dfcc28ab0c6673818f1a0116e4cc765259f038f9595773024751f4c569727d5
Opcode Fuzzy Hash: eeb1df69a67e7593011410af4fe5e9b54c1d1657c523b51506144c4d32310c13
Instruction Fuzzy Hash: 01016136A1878196E720EF31E8553AAB3B1FB88B05F844135DA4E4B794DF3CD1099B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC3350 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF739CC3379
ClientToScreen.USER32 ref: 00007FF739CC338B
ClientToScreen.USER32 ref: 00007FF739CC339D
ClipCursor.USER32 ref: 00007FF739CC33A8

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Client$Screen$ClipCursorRect
String ID:
API String ID: 327882252-0
Opcode ID: f4c1c9174649328522895ec1cf2d3faa729afaf4cfce29e680d23fe495a814db
Instruction ID: 0e1a7c7b4d4ce2cbf00f0226b83ce458536e65ed2f2f5c1f5d6e76087a9b1d8b
Opcode Fuzzy Hash: f4c1c9174649328522895ec1cf2d3faa729afaf4cfce29e680d23fe495a814db
Instruction Fuzzy Hash: 13F0F462A28E4692EF11AF25E865079B331FF88B45F841131E94F07624DE2CD646D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCB25C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF739CCB286

Strings

csm, xrefs: 00007FF739CCB2AB
csm, xrefs: 00007FF739CCB41A

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 1ac15d1d0a54add5732d1d2cae4e67889ae12a3e21d487a8c7d1b98f3638d132
Instruction ID: a0c243998bdde0e060afac2235c72ce2d5227399c52dc558e6d4c781593ccdce
Opcode Fuzzy Hash: 1ac15d1d0a54add5732d1d2cae4e67889ae12a3e21d487a8c7d1b98f3638d132
Instruction Fuzzy Hash: 3271E2329086C2A6DB20AF75904067DFFB2FB05B85F44A136DA8C47A85CF3CE452DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD9C08 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF739CD9C4B

Strings

gfff, xrefs: 00007FF739CD9D6D
e+000, xrefs: 00007FF739CD9CF0

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 119e03e3d6cdb3dee1b91ee2165f7cc9f414b0440d8de11754203a7774f60ead
Instruction ID: a3665c807de38714cf1e67163c292e8d47ace7a00f11455b3d7b99960812c8b3
Opcode Fuzzy Hash: 119e03e3d6cdb3dee1b91ee2165f7cc9f414b0440d8de11754203a7774f60ead
Instruction Fuzzy Hash: 2E514767B183C656E721AF359840369FBB2EB81B90F889231C79847BD6CF2CE841D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CCB8F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF739CCB99A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF739CCB9C6

Strings

csm, xrefs: 00007FF739CCBAC6

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: b393df5c8bc8244175b64eb3df6bac1f8fe666e8b5a5f27488fdac3918bfff30
Instruction ID: 3eb384ee68266735b52e7538b9b5cf043afc0070ab1add62b9bb19bd3d7ad955
Opcode Fuzzy Hash: b393df5c8bc8244175b64eb3df6bac1f8fe666e8b5a5f27488fdac3918bfff30
Instruction Fuzzy Hash: 3E513E3261978296D720EF26A44426EBBB5FB88B90F542134EBCD07B55CF38D452DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CD8BF4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,?,00007FF739CD9049), ref: 00007FF739CD8D0B
GetLastError.KERNEL32(00000000,00000000,?,00000000,?,00007FF739CD9049), ref: 00007FF739CD8D2D

Strings

U, xrefs: 00007FF739CD8CB7

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: d4bc8ca20eb49a5b01ba9bd2b68cf0c157e35c7aed703e70d4e19256e0568c2e
Instruction ID: d8b61d117f4486516dcf07cead9ccc821a93418810e113c9e2b7c4ace69528d0
Opcode Fuzzy Hash: d4bc8ca20eb49a5b01ba9bd2b68cf0c157e35c7aed703e70d4e19256e0568c2e
Instruction Fuzzy Hash: 5541B363A19A46A6EB20AF25E4443A9B7B2FB98784F804031EE4D87798DF3CD441D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDB2A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FF739CDB416

Strings

", xrefs: 00007FF739CDB3C1
powf, xrefs: 00007FF739CDB40F

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: 80357ba98e11a9aa478f8630a8e9599de279360b627e52533e91df0c10b6a963
Instruction ID: 442a327bde4a8773312241f5d512b3edf50dc424a090a887de0d6e03e21f83a5
Opcode Fuzzy Hash: 80357ba98e11a9aa478f8630a8e9599de279360b627e52533e91df0c10b6a963
Instruction Fuzzy Hash: 66411E73D28681DAD370DF22E4847BAB6B0F799388F502326F749029A4CF7DD551AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDB180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF739CDB292

Strings

", xrefs: 00007FF739CDB26B
pow, xrefs: 00007FF739CDB281

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 244e0eee8b56cbd68100b2b60dfad2724f7e682842a492b595bc85b065f3f130
Instruction ID: 15915ffee444d8e0df220837cb26c68cf98cc0db2cae025f9adff90ada3fc171
Opcode Fuzzy Hash: 244e0eee8b56cbd68100b2b60dfad2724f7e682842a492b595bc85b065f3f130
Instruction Fuzzy Hash: 67315E73D1CA8596E760DF20F44476EFAB1FBDA384F601326F68906A55CBBDD181AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CBFAB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF739CC15D7), ref: 00007FF739CBFAE5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF739CC15D7), ref: 00007FF739CBFB4D

Part of subcall function 00007FF739CBFB90: GetLastError.KERNEL32 ref: 00007FF739CBFBDB
Part of subcall function 00007FF739CBFB90: FormatMessageW.KERNEL32 ref: 00007FF739CBFC10
Part of subcall function 00007FF739CBFB90: WideCharToMultiByte.KERNEL32 ref: 00007FF739CBFC4F

Strings

Win32: Failed to convert string to UTF-8, xrefs: 00007FF739CBFAF2, 00007FF739CBFB57

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFormatLastMessage
String ID: Win32: Failed to convert string to UTF-8
API String ID: 3944349251-2776438994
Opcode ID: 40fd7b7cdbf2bc7b87696dcc1fbffc06279e54faf433a152b6e64725cd394338
Instruction ID: 4bf4d4d25acc80a423208c9b1c2a299f46300104f91d17f18338dfe2e0b46a24
Opcode Fuzzy Hash: 40fd7b7cdbf2bc7b87696dcc1fbffc06279e54faf433a152b6e64725cd394338
Instruction Fuzzy Hash: 6B21A131A08B8195E350EF66B85006AF7B2FB84BD0FC84135EA8E43B99DF3CD550AB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAD54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAD8D
LCMapStringW.KERNEL32 ref: 00007FF739CDAE15

Strings

LCMapStringEx, xrefs: 00007FF739CDAD70, 00007FF739CDAD81

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: d40070dcae1d23937b40427719efcaa05d4d26c73cefc6ba482b271d3e48e0c1
Instruction ID: 3d4ad91fafff7462bbf966c24d39e505a880ce8234363436e87d0d8a05d1b672
Opcode Fuzzy Hash: d40070dcae1d23937b40427719efcaa05d4d26c73cefc6ba482b271d3e48e0c1
Instruction Fuzzy Hash: 34112936A08B8196D7609F56B4402AAB7B2FBC8BC0F944136EACD83B19DF3CD4509B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739C83FC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF739C83FCB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF739C84032

Strings

string too long, xrefs: 00007FF739C83FC4

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Xinvalid_argument_invalid_parameter_noinfo_noreturnstd::_
String ID: string too long
API String ID: 1132134225-2556327735
Opcode ID: 5b2190d3ee7e29c2ec33caa50643c83f319f03fad1a7018b49602b95dc8e8757
Instruction ID: cbc96d34ad7274a83e1c9bcec07f649aefe3b0b2c0498b258fdd2bbcc99ebeb0
Opcode Fuzzy Hash: 5b2190d3ee7e29c2ec33caa50643c83f319f03fad1a7018b49602b95dc8e8757
Instruction Fuzzy Hash: A1E06DA1E2E503B0F809BB3098863BD95735F687A0FD00B34E27D016D2EE0CA4826B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC7614 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF739C83F2F), ref: 00007FF739CC7658
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF739C83F2F), ref: 00007FF739CC769E

Strings

csm, xrefs: 00007FF739CC768B

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7b46b8f324e57b4910620f0caa7e8228f833dcc9c0f6d6cc932d327ab33c52c6
Instruction ID: 52f38d86240342bf49b70739030a99c25c7bb7006c251b1108e6ec6e1da38d83
Opcode Fuzzy Hash: 7b46b8f324e57b4910620f0caa7e8228f833dcc9c0f6d6cc932d327ab33c52c6
Instruction Fuzzy Hash: C0114F72A08B4192EB509F29E440269BBB2FB88B84F584230EFCD47764DF3CD551DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CC3140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 00007FF739CC3183
SetWindowPos.USER32 ref: 00007FF739CC31BF

Strings

(, xrefs: 00007FF739CC3158

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: InfoMonitorWindow
String ID: (
API String ID: 1000336858-3887548279
Opcode ID: 98033777b4d7f8f772021d6ef62dc3912a3f2af7b865bc2e4849d49f6b6d525c
Instruction ID: b2286956ded784848569564ea6d565c54ac2615ad7ff5c13907195aab55671ca
Opcode Fuzzy Hash: 98033777b4d7f8f772021d6ef62dc3912a3f2af7b865bc2e4849d49f6b6d525c
Instruction Fuzzy Hash: 86017C72A286808AD700CF25E45416AF770F7C9BA4F600325EA9C47AA8DB3DD4848F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDABC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDABED
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF739CDFEDC), ref: 00007FF739CDAC04

Strings

GetUserDefaultLocaleName, xrefs: 00007FF739CDABD0, 00007FF739CDABDA

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 3053f714f302b3b93c437ddab2a0bb83ac4a2c0628910f9eb5592084d4df2296
Instruction ID: cc44fd9736e9c0ce244bdf5b5fa94f4e1193b4bf7cadaec62702ec16aba6d6ec
Opcode Fuzzy Hash: 3053f714f302b3b93c437ddab2a0bb83ac4a2c0628910f9eb5592084d4df2296
Instruction Fuzzy Hash: 0BF05E21B18642A2FB55BF69F6416B9A273BF88780FC44036D90E06655DE3CE845E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAC28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAC59
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0000022547A82A38,00007FF739CD7C86,?,?,?,00007FF739CD7B7E,?,?,00000080,00007FF739CCE0D9), ref: 00007FF739CDAC73

Strings

InitializeCriticalSectionEx, xrefs: 00007FF739CDAC4D

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 41148a255deed3f099d9b59750151888df09d292735b3848e26d1491e9f6b49d
Instruction ID: 28c32ee836611c3291d6f6c67cdfc2669f07c7ef8df7e4a0cb38e8c16ad811a4
Opcode Fuzzy Hash: 41148a255deed3f099d9b59750151888df09d292735b3848e26d1491e9f6b49d
Instruction Fuzzy Hash: 15F05E26E18B41A2FA45AF65F4414B6B273BF88B90FC84035E94E13B55CF3CE985E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF739CDAAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF739CDAACD
TlsSetValue.KERNEL32(?,?,00008ACCADA1B9E9,00007FF739CD734E,?,?,00008ACCADA1B9E9,00007FF739CCCEE1,?,?,?,?,00007FF739CDB132,?,?,00000000), ref: 00007FF739CDAAE4

Strings

FlsSetValue, xrefs: 00007FF739CDAABA

Memory Dump Source

Source File: 00000000.00000002.296929301.00007FF739C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF739C80000, based on PE: true

Associated: 00000000.00000002.296919947.00007FF739C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.296976063.00007FF739CE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297065975.00007FF739D82000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297076142.00007FF739D89000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff739c80000_4a9OE5cKJo.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 394a72498a06d0591151de0a82450a6e6af41c416f27c72c24d6ea0b6deb5b07
Instruction ID: 00e413705437bc07edbcea59fd139531cf91f1dc1c5909bffde3a9a5ce1b252e
Opcode Fuzzy Hash: 394a72498a06d0591151de0a82450a6e6af41c416f27c72c24d6ea0b6deb5b07
Instruction Fuzzy Hash: EFE06D62F18602A2FB056F65F4015BAB233BF48780FD84032D91E06294CE3CEA84A760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bReporter.exePID: 7080, Parent PID: 7064COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	40%
Signature Coverage:	2%
Total number of Nodes:	150
Total number of Limit Nodes:	10

Executed Functions

Function 00401190 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 209
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401190(void* __ebx, void* __edi, void* __esi, void* __esp, void* __rbx, void* __rcx, intOrPtr __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r9, void* __r12, void* __r13, void* __r14, void* __r15) {
				void* _v116;
				void* _v120;
				char _v168;
				int _t33;
				void* _t34;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t42;
				void* _t46;
				signed int _t47;
				signed int _t48;
				void* _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				intOrPtr* _t77;
				long long _t78;
				intOrPtr* _t79;
				signed short* _t80;
				intOrPtr* _t81;
				long long _t82;
				long long* _t84;
				signed long long _t88;
				signed long long _t93;
				signed long long _t97;
				signed long long _t101;
				signed long long _t102;
				intOrPtr _t109;
				long long* _t110;
				signed long long _t111;
				intOrPtr _t117;
				intOrPtr* _t118;
				long long* _t119;
				signed long long _t123;
				void* _t128;
				signed short* _t129;
				signed long long _t138;
				void* _t140;
				void* _t142;
				intOrPtr _t143;
				signed long long _t148;
				void* _t151;
				void* _t152;

				_t152 = __r15;
				_t151 = __r14;
				_t146 = __r13;
				_t140 = __r9;
				_t109 = __rdx;
				_t52 = __esi;
				_t46 = __ebx;
				_push(__r13);
				_push(__r12);
				_push(__rbp);
				_push(__rdi);
				_push(__rsi);
				_push(__rbx);
				_t123 =  *0x420160; // 0x424220
				_t97 = 0xd;
				asm("push cs");
				_t138 =  &_v168;
				_t34 = memset(__edi, _t33, _t47 << 0);
				_t54 = __esp + 0xc;
				_t51 = __edi + _t47;
				_t48 = 0;
				if(r9d != 0) {
					_t97 = _t138;
					GetStartupInfoW(??);
				}
				_t93 =  *0x420080; // 0x4241d0
				_t117 =  *((intOrPtr*)( *[gs:0x30] + 8));
				_t142 = Sleep;
				while(1) {
					asm("lock dec eax");
					if(0 == 0) {
						break;
					}
					if(_t117 == 0) {
						_t118 =  *0x420090; // 0x4241d8
						_t128 = 0x1;
						 *_t118 =  *_t118 + _t97;
						asm("std");
						asm("invalid");
					} else {
						_t97 = 0x3e8;
						continue;
					}
				}
				_t118 =  *0x420090; // 0x4241d8
				_t128 = 0;
				if( *_t118 == 1) {
					_t27 = _t93 + 0x1f88307;
					 *_t27 =  *((intOrPtr*)(_t93 + 0x1f88307)) + _t48;
					if( *_t27 != 0) {
						L9:
						if(_t128 == 0) {
							L43:
							 *_t93 = 0;
						}
						L10:
						_t77 =  *0x420000; // 0x41f5a0
						_t78 =  *_t77;
						if(_t78 != 0) {
							r8d = 0;
							_t109 = 0x2;
						}
						E00409970(_t34, _t46, _t48, _t78, _t93, _t109, _t118, _t123, _t140, _t142, _t146, _t151, _t152);
						_t36 = SetUnhandledExceptionFilter(??);
						_t110 =  *0x420070; // 0x424260
						 *_t110 = _t78;
						_t38 = E00409780(E004092E0(_t36, 0x401000));
						_t79 =  *0x420020; // 0x400000
						 *0x424010 = _t79;
						E004094A0(_t38);
						_t101 = 0;
						_t80 =  *_t79;
						if(_t80 != 0) {
							while(1) {
								_t111 =  *_t80 & 0x0000ffff;
								if(_t49 <= 0x20) {
									goto L14;
								}
								r8d = _t48;
								r8d = r8d ^ 0x00000001;
								_t48 =  ==  ? r8d : _t48;
								L17:
								_t80 =  &(_t80[1]);
								continue;
								L14:
								if(_t49 == 0) {
									L20:
									_t110 = _t111 - 1;
									if(_t49 > 0x1f) {
										L23:
										 *0x424008 = _t80;
										goto L24;
									}
									asm("o16 nop [cs:eax+eax]");
									do {
										_t93 = _t80[1] & 0x0000ffff;
										_t80 =  &(_t80[1]);
										_t110 = _t93 - 1;
									} while (_t49 <= 0x1f);
									goto L23;
								}
								_t101 = _t101 & 0x00000001;
								if(_t101 == 0) {
									goto L20;
								}
								_t101 = 0x1;
								goto L17;
							}
						} else {
							L24:
							r8d =  *_t123;
							if(r8d == 0) {
								_t143 =  *0x424038;
								_t11 = _t143 + 1; // 0x7ffd614c3ca1
								r13d = _t11;
								_t148 = r13d << 3;
								_t102 = _t148;
								malloc(??);
								_t119 =  *0x424030;
								_t129 = _t80;
								if(r12d <= 0) {
									L35:
									 *_t80 = 0;
									 *0x424030 = _t129;
									E00409570(_t102, _t138);
									_t81 =  *0x420030; // 0x4256f4
									_t82 =  *_t81;
									 *_t82 =  *0x424028;
									_t112 =  *0x424030; // executed
									_t42 = E00407AD0(_t48,  *0x424030,  *0x424028); // executed
									 *0x424024 = _t82;
									if( *0x424020 == 0) {
										exit();
										asm("o16 nop [eax+eax]");
										_t84 =  *0x420160; // 0x424220
										 *_t84 = 1;
										return E00401190(_t46, _t51, _t52, _t54, _t93, _t82, _t112, _t119, _t123, _t129, _t140, _t143, _t148, _t151, _t152);
									} else {
										if( *0x42401c == 0) {
											L00409280();
											return _t42;
										} else {
											return _t42;
										}
									}
								}
								_t123 = 0;
								asm("o16 nop [eax+eax]");
								do {
									_t88 =  *((intOrPtr*)(_t119 + _t123 * 8));
									if( *_t88 == 0) {
										_t93 = 0x2;
										 *_t119 =  *_t119 - 1;
										goto L33;
									}
									r8d = 1;
									do {
										_t138 = _t138 + 1;
									} while ( *((short*)(_t88 + _t138 * 2 - 2)) != 0);
									_t93 = _t138 + _t138;
									L33:
									malloc();
									_t138 = _t93;
									 *(_t129 + _t123 * 8) = _t88;
									_t102 = _t88;
									_t123 = _t123 + 1;
									memcpy(??, ??, ??);
								} while (_t143 != _t123);
								_t23 = _t148 - 8; // -8
								_t80 = _t129 + _t23;
								goto L35;
							}
							_t80 = 0xa;
							 *_t118 =  *_t118 + _t101;
							 *0xa =  *0xa + 0xa;
							 *((intOrPtr*)(_t101 + 0x14cda05)) =  *((intOrPtr*)(_t101 + 0x14cda05)) + _t48;
						}
					}
					L42:
					_t109 =  *0x4200d0; // 0x427010
					L00409270(); // executed
					 *_t118 = 2;
					if(_t128 != 0) {
						goto L10;
					}
					goto L43;
				}
				if( *_t118 == 0) {
					_t109 =  *0x4200f0; // 0x427030
					 *_t118 = 1;
					L00409270();
				} else {
					 *0x42401c = 1;
				}
				if( *_t118 == 1) {
					goto L42;
				} else {
					goto L9;
				}
			}

0x00401190
0x00401190
0x00401190
0x00401190
0x00401190
0x00401190
0x00401190
0x00401190
0x00401192
0x00401194
0x00401195
0x00401196
0x00401197
0x0040119f
0x004011a6
0x004011af
0x004011b0
0x004011b8
0x004011b8
0x004011b8
0x004011b8
0x004011be
0x0040148b
0x0040148e
0x0040148e
0x004011cd
0x004011d4
0x004011da
0x004011f9
0x004011fc
0x00401204
0x00000000
0x00000000
0x004011eb
0x00401434
0x0040143b
0x00401444
0x00401448
0x00401449
0x004011f1
0x004011f1
0x00000000
0x004011f1
0x004011eb
0x00401206
0x0040120d
0x00401214
0x00401454
0x00401454
0x0040145a
0x00401239
0x0040123b
0x00401481
0x00401483
0x00401483
0x00401241
0x00401241
0x00401248
0x0040124e
0x00401250
0x00401253
0x00401253
0x0040125c
0x00401268
0x0040126e
0x0040127c
0x00401284
0x00401289
0x00401290
0x00401297
0x0040129c
0x0040129e
0x004012a4
0x004012c3
0x004012c3
0x004012ca
0x00000000
0x00000000
0x004012cc
0x004012cf
0x004012d7
0x004012bf
0x004012bf
0x00000000
0x004012b0
0x004012b3
0x004012dd
0x004012dd
0x004012e4
0x00401301
0x00401301
0x00000000
0x00401301
0x004012e6
0x004012f0
0x004012f0
0x004012f4
0x004012f8
0x004012fb
0x00000000
0x004012f0
0x004012b5
0x004012b8
0x00000000
0x00000000
0x004012ba
0x00000000
0x004012ba
0x004012a6
0x00401308
0x00401308
0x0040130e
0x00401326
0x0040132d
0x0040132d
0x00401335
0x00401339
0x0040133c
0x00401341
0x00401348
0x0040134e
0x004013ab
0x004013ab
0x004013b2
0x004013b9
0x004013be
0x004013d2
0x004013d5
0x004013d8
0x004013df
0x004013ea
0x004013f2
0x004014d4
0x004014da
0x004014e4
0x004014eb
0x004014fc
0x004013f8
0x00401400
0x00401499
0x004014b3
0x00401406
0x00401415
0x00401415
0x00401400
0x004013f2
0x00401350
0x00401352
0x00401358
0x00401358
0x00401360
0x00401420
0x00401429
0x00000000
0x00401429
0x00401366
0x00401370
0x00401370
0x00401374
0x0040137d
0x00401381
0x00401384
0x00401389
0x0040138c
0x00401395
0x00401398
0x0040139c
0x004013a1
0x004013a6
0x004013a6
0x00000000
0x004013a6
0x00401310
0x00401319
0x0040131d
0x0040131f
0x0040131f
0x004012a4
0x00401460
0x00401460
0x0040146e
0x00401473
0x0040147b
0x00000000
0x00000000
0x00000000
0x0040147b
0x0040121e
0x004014b4
0x004014c2
0x004014c8
0x00401224
0x00401224
0x00401224
0x00401233
0x00000000
0x00000000
0x00000000
0x00000000

APIs

Sleep.KERNEL32 ref: 004011F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00401268
malloc.MSVCRT ref: 0040133C
malloc.MSVCRT ref: 00401384
memcpy.MSVCRT ref: 0040139C
GetStartupInfoW.KERNEL32 ref: 0040148E

Strings

`BB, xrefs: 0040126E
0pB, xrefs: 004014B4
BB, xrefs: 0040119F, 004014E4

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
String ID: BB$0pB$`BB
API String ID: 772431862-1181020995
Opcode ID: 38015976cb09cd11ad34a48d63c92b1229232705b8ee252726c048b9d100ba9e
Instruction ID: 04cb549e0474e4be109dcf6d943baecd97e3c77fe01e65db1e17dca3bdd3f765
Opcode Fuzzy Hash: 38015976cb09cd11ad34a48d63c92b1229232705b8ee252726c048b9d100ba9e
Instruction Fuzzy Hash: 68818DB270170485EB25DF56E850B6A37A1F789B84F84803BEF09677A2DB3CC891C748

Uniqueness

Uniqueness Score: -1.00%

Function 040A0716 Relevance: 19.3, APIs: 7, Strings: 3, Instructions: 1823COMMON

Download Yara Rule

Strings

o, xrefs: 040A0BBC
e, xrefs: 040A08C6
y, xrefs: 040A08B2

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID:
String ID: e$o$y
API String ID: 0-872455156
Opcode ID: 37ba36260c6dc4331a6f698ba0a7c451673a61aaba07607eb23c441f7c34c136
Instruction ID: bbc5821000b50a19475e9bb05d7f7e6dc2d57d8c3e5fe7ee6be46c0ee2339a6f
Opcode Fuzzy Hash: 37ba36260c6dc4331a6f698ba0a7c451673a61aaba07607eb23c441f7c34c136
Instruction Fuzzy Hash: 9AC2A030628A4C8FDB69EF68C8887EA73E1FB99304F14461DD48AD7291DF34E595CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0241592A Relevance: 3.4, APIs: 2, Instructions: 406
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0241599F
LoadLibraryA.KERNEL32 ref: 02415AA4

Memory Dump Source

Source File: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Offset: 023AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23af000_bReporter.jbxd

Yara matches

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: fe28ec89fccc7c30a97a41b99cb39f37780980cf65fc522e14c47b80859a8ba4
Instruction ID: 11a355ea6858b4754014624ec6fbe59d45483008dfd43a5e5072daac7e39c448
Opcode Fuzzy Hash: fe28ec89fccc7c30a97a41b99cb39f37780980cf65fc522e14c47b80859a8ba4
Instruction Fuzzy Hash: 44C16130214A084BDB69EF29C8D57EBB3D6FBC9705F94452EC48BC7245EB20E946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02416182 Relevance: 1.8, APIs: 1, Instructions: 500
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 024161FF

Memory Dump Source

Source File: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Offset: 023AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23af000_bReporter.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f79c8a23afe56d11b94332f0aa4a683b06ab6a29ecf11af3662490c09a5fc48f
Instruction ID: 90e2f7ac67c168de9e8d3dccc33ee30a39a9fd8fe2e61889edc76d654b4212cd
Opcode Fuzzy Hash: f79c8a23afe56d11b94332f0aa4a683b06ab6a29ecf11af3662490c09a5fc48f
Instruction Fuzzy Hash: B9E1C530618F098BDB28EF29D8856B6B3E5FB44315F15462ED89BC7255EF34E842CB81

Uniqueness

Uniqueness Score: -1.00%

Function 040AA8D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 040AA936

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f0ee922a743b7d96a5a25618478022a0099b4373d23e49d29d8ca8a71e09c114
Instruction ID: 30994fd3db260c44bc89488cef0da62230ad294effe46c997989528740b64504
Opcode Fuzzy Hash: f0ee922a743b7d96a5a25618478022a0099b4373d23e49d29d8ca8a71e09c114
Instruction Fuzzy Hash: 5F11CC71228B484FE745EF28C4487EA77D0FB69309F4006AEE08DC71A1DB74D545CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00407AD0 Relevance: 59.7, APIs: 18, Strings: 16, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00407AD0(signed int __ecx, signed long long __rdx, signed long long __r8) {
				unsigned long long _v80;
				long long _v84;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r12;
				void* __r13;
				void* _t25;
				signed int _t26;
				void* _t27;
				int _t33;
				signed int _t38;
				signed char _t41;
				signed int _t43;
				void* _t58;
				unsigned long long _t63;
				signed long long _t67;
				void* _t70;
				signed long long _t103;
				void* _t112;
				void* _t113;
				intOrPtr* _t114;
				void* _t120;
				unsigned long long _t121;
				short* _t122;
				signed long long _t123;

				_t116 = __r8;
				_t38 = __ecx;
				_t63 =  *0x416040;
				_t123 = __rdx;
				_v80 = _t63;
				r12d = __ecx;
				_t70 =  <  ?  *0x8B49D0FF01C67506 : 0x1;
				_t26 = _t25 + bpl;
				0x49407abb();
				 *0x424108 = _t63;
				__imp___wgetenv();
				_v84 = 0;
				_t121 = _t63;
				if(_t63 == 0) {
					L3:
					r8d = 3;
					_t102 = L"wim";
					L00409178();
					r13d = _t26;
					if(_t63 == 0) {
						_t102 = L"wimlib-imagex";
						L00409198();
						__eflags = _t63;
						if(__eflags == 0) {
							goto L4;
						}
						_t67 = 0x41d4d0;
						_t102 = L"append";
						while(1) {
							_t63 =  *0x424108;
							L00409198();
							__eflags = _t63;
							if(_t63 == 0) {
								break;
							}
							r13d = r13d + 1;
							__eflags = r13d - 0xd;
							if(__eflags == 0) {
								goto L4;
							}
							_t102 =  *_t67;
							_t67 = _t67 + 0x10;
							__eflags = _t67;
						}
						 *0x416020 = r13d;
						L28:
						__eflags = r12d - 1;
						if(__eflags > 0) {
							L10:
							_t113 = 0x1;
							do {
								_t67 = _t43 << 3;
								_t114 = _t123 + _t67;
								_t122 =  *_t114;
								if( *_t122 != 0x2d ||  *((short*)(_t122 + 2)) != 0x2d) {
									L11:
									_t113 = _t113 + 1;
								} else {
									_t112 = _t122 + 4;
									L00409198();
									if(_t63 == 0) {
										_t63 = _v80;
										if(__eflags == 0) {
											 *_t63();
											_t26 = E00403B00(_t63, _t67, _t63, _t112, _t113, _t116, 0x41d4c0, _t120);
										} else {
											 *_t63();
											_t38 = r13d;
											_t26 = E00403630(_t38, _t63, _t63, _t116, 0x41d4c0, _t120, _t121);
										}
										L47:
										__eflags = 0;
										exit(??);
										L48:
										L00409198();
										__eflags = _t63;
										if(__eflags == 0) {
											L43:
											_v84 = 0x20;
											goto L3;
										}
										_t63 = _v80;
										asm("adc eax, 0x1095a");
										_t26 = E004033B0(_t116, 0x41d4c0);
										goto L3;
									}
									L00409198();
									if(_t63 == 0) {
										L004090E8(); // executed
										_t63 = _v80;
										 *_t63();
										_t116 = _t67;
										_t26 = E00401650(_t67, 0x41d4c0);
										goto L47;
									}
									_t103 = L"quiet";
									L00409198();
									if(_t63 == 0) {
										r8d = r12d;
										_t103 = _t123 + _t67 + 8;
										 *0x424178 = 0;
										r8d = r8d - _t43;
										r12d = r12d - 1;
										_t116 = r8d << 3;
										L004091B8();
										goto L12;
									}
									if( *((short*)(_t122 + 4)) != 0) {
										goto L11;
									}
									asm("o16 nop [eax+eax]");
									break;
								}
								L12:
							} while (r12d > _t43);
							_t58 = r13d - 0xffffffff;
							if(_t58 == 0) {
								_t102 =  *(_t123 + 8);
								_t27 = E004024D0(L"Unrecognized command: `%ls\'\n",  *(_t123 + 8), _t116, 0x41d4c0);
								L53:
								dil = 0;
								asm("ror byte [eax-0x77], 1");
								_t63 = _t63 >> 0xa;
								 *_t67 =  *_t67 & _t41;
								 *_t63 =  *_t63 + _t27;
								__eflags =  *_t63;
								L54:
								_t27 = E004024D0(L"No command specified!\n", _t102, _t116, 0x41d4c0);
								goto L53;
							}
							L21:
							 *((intOrPtr*)(_t67 - 0x17dbdbb4)) =  *((intOrPtr*)(_t67 - 0x17dbdbb4)) + _t38;
							if (_t58 >= 0) goto 0x407c6f;
							 *_t63 =  *_t63 + _t26;
							r14d = _t26;
							if(_t63 != 0) {
								L24:
								if(r14d > 0) {
									L004090F8();
									_t117 = _t63;
									E004024D0(L"Exiting with error code %d:\n       %ls.", _t103, _t63, 0x41d4c0);
									__eflags = r14d - 0x2e;
									if(r14d == 0x2e) {
										__imp___errno();
										_t64 =  *_t63;
										__eflags =  *_t63;
										if(__eflags != 0) {
											E004031C0(__eflags, _t64, L"errno", _t103, _t117, 0x41d4c0);
										}
									}
								}
								L25:
								L004090D8();
								return r14d;
							}
							r8d = r13d;
							_t103 = _t123;
							 *((intOrPtr*)(0x41d4c0 + (r13d << 4) + 8))();
							_t63 = _v80;
							 *_t63();
							_t33 = ferror(??);
							_t60 = _t63;
							if(_t63 == 0) {
								dil = 0;
								asm("ror byte [eax-0x77], 1");
								_t63 = _t63 >> 0xd4;
								asm("adc al, 0x0");
								 *((intOrPtr*)(_t114 + 0x53850fc0)) =  *((intOrPtr*)(_t114 + 0x53850fc0)) + _t33;
								asm("invalid");
								asm("invalid");
							}
							E004031C0(_t60, _t63, L"error writing to standard output", _t103, _t116, 0x41d4c0);
							if(r14d == 0) {
								r14d = 0xffffffff;
								goto L25;
							}
							goto L24;
						}
						goto L21;
					}
					L4:
					if(r12d <= 1) {
						goto L54;
					} else {
						_t67 = 0x41d4d0;
						_t103 = L"append";
						r13d = 0;
						while(1) {
							L00409198();
							if(_t63 == 0) {
								break;
							}
							r13d = r13d + 1;
							if(r13d != 0xd) {
								_t103 =  *_t67;
								_t67 = _t67 + 0x10;
								__eflags = _t67;
								continue;
							} else {
								r13d = 0xffffffff;
								goto L10;
							}
						}
						r12d = r12d - 1;
						_t123 = _t123 + 8;
						__eflags = _t123;
						goto L28;
					}
				}
				L00409198();
				if(_t63 != 0) {
					L00409198();
					__eflags = _t63;
					if(__eflags == 0) {
						goto L2;
					}
					L00409198();
					__eflags = _t63;
					if(__eflags != 0) {
						goto L48;
					}
					goto L43;
				}
				L2:
				_v84 = 0x10;
				goto L3;
			}

0x00407ad0
0x00407ad0
0x00407ae0
0x00407ae7
0x00407aea
0x00407aef
0x00407afb
0x00407b02
0x00407b04
0x00407b0f
0x00407b16
0x00407b1c
0x00407b24
0x00407b2a
0x00407b4b
0x00407b52
0x00407b58
0x00407b5f
0x00407b64
0x00407b69
0x00407da7
0x00407dae
0x00407db3
0x00407db5
0x00000000
0x00000000
0x00407dbb
0x00407dc2
0x00407de5
0x00407de5
0x00407df0
0x00407df5
0x00407df7
0x00000000
0x00000000
0x00407dd0
0x00407dd4
0x00407dd8
0x00000000
0x00000000
0x00407dde
0x00407de1
0x00407de1
0x00407de1
0x00407df9
0x00407d18
0x00407d18
0x00407d1c
0x00407bb8
0x00407bb8
0x00407bc8
0x00407bcb
0x00407bcf
0x00407bd3
0x00407bdc
0x00407bc0
0x00407bc0
0x00407be6
0x00407be6
0x00407bf4
0x00407bfb
0x00407e3c
0x00407e4a
0x00407ebb
0x00407ec0
0x00407e4c
0x00407e4c
0x00407e4e
0x00407e54
0x00407e54
0x00407e81
0x00407e81
0x00407e83
0x00407e88
0x00407e92
0x00407e97
0x00407e99
0x00407e2f
0x00407e2f
0x00000000
0x00407e2f
0x00407e9b
0x00407ea9
0x00407eb1
0x00000000
0x00407eb1
0x00407c0b
0x00407c12
0x00407e5b
0x00407e69
0x00407e6d
0x00407e6f
0x00407e7c
0x00000000
0x00407e7c
0x00407c18
0x00407c22
0x00407c29
0x00407ce0
0x00407ce3
0x00407ceb
0x00407cf6
0x00407cf9
0x00407d00
0x00407d04
0x00000000
0x00407d04
0x00407c35
0x00000000
0x00000000
0x00407c37
0x00000000
0x00407c37
0x00407bc3
0x00407bc3
0x00407c40
0x00407c44
0x00407ed2
0x00407edd
0x00407ee2
0x00407eeb
0x00407eed
0x00407ef0
0x00407efc
0x00407efe
0x00407efe
0x00407f00
0x00407f07
0x00000000
0x00407f07
0x00407c4a
0x00407c53
0x00407c59
0x00407c5b
0x00407c5d
0x00407c62
0x00407cb4
0x00407cb7
0x00407d5b
0x00407d6a
0x00407d6d
0x00407d72
0x00407d76
0x00407d7c
0x00407d82
0x00407d84
0x00407d86
0x00407d93
0x00407d93
0x00407d86
0x00407d76
0x00407cbd
0x00407cbd
0x00407cd5
0x00407cd5
0x00407c6e
0x00407c71
0x00407c7b
0x00407c89
0x00407c8d
0x00407c92
0x00407c97
0x00407c99
0x00407d39
0x00407d3b
0x00407d3e
0x00407d41
0x00407d43
0x00407d49
0x00407d4b
0x00407d4b
0x00407ca6
0x00407cae
0x00407ec7
0x00000000
0x00407ec7
0x00000000
0x00407cae
0x00000000
0x00407d22
0x00407b6f
0x00407b73
0x00000000
0x00407b79
0x00407b79
0x00407b80
0x00407b87
0x00407b97
0x00407b9b
0x00407ba2
0x00000000
0x00000000
0x00407ba8
0x00407bb0
0x00407b90
0x00407b93
0x00407b93
0x00000000
0x00407bb2
0x00407bb2
0x00000000
0x00407bb2
0x00407bb0
0x00407d10
0x00407d14
0x00407d14
0x00000000
0x00407d14
0x00407b73
0x00407b36
0x00407b3d
0x00407e0f
0x00407e14
0x00407e16
0x00000000
0x00000000
0x00407e26
0x00407e2b
0x00407e2d
0x00000000
0x00000000
0x00000000
0x00407e2d
0x00407b43
0x00407b43
0x00000000

APIs

_wgetenv.MSVCRT ref: 00407B16
wcscmp.MSVCRT ref: 00407B36
wcsncmp.MSVCRT ref: 00407B5F
wcscmp.MSVCRT ref: 00407B9B
wcscmp.MSVCRT ref: 00407BF4
wcscmp.MSVCRT ref: 00407C0B
wcscmp.MSVCRT ref: 00407C22
wimlib_add_image_multisource.LIBWIM-15 ref: 00407C4F
wimlib_add_image_multisource.LIBWIM-15 ref: 00407C58
ferror.MSVCRT ref: 00407C92
wimlib_add_image_multisource.LIBWIM-15 ref: 00407CBD
wcscmp.MSVCRT ref: 00407E0F
wcscmp.MSVCRT ref: 00407E26

Strings

Unrecognized command: `%ls', xrefs: 00407ED6
append, xrefs: 00407B80, 00407DC2
wimlib-imagex 1.13.4 (using wimlib %ls)Copyright (C) 2012-2021 Eric BiggersLicense GPLv3+; GNU GPL version 3 or later <http://gn, xrefs: 00407E72
yes, xrefs: 00407E1C
WARNING: Ignoring unknown setting of WIMLIB_IMAGEX_IGNORE_CASE, xrefs: 00407EA7
quiet, xrefs: 00407C18
wimlib-imagex, xrefs: 00407DA7
WIMLIB_IMAGEX_IGNORE_CASE, xrefs: 00407B08
wim, xrefs: 00407B58
Exiting with error code %d: %ls., xrefs: 00407D63
version, xrefs: 00407C01
errno, xrefs: 00407D8C
No command specified!, xrefs: 00407F00
, xrefs: 00407E2F
error writing to standard output, xrefs: 00407C9F
help, xrefs: 00407BEA

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wcscmp$wimlib_add_image_multisource$_wgetenvferrorwcsncmp
String ID: $Exiting with error code %d: %ls.$No command specified!$Unrecognized command: `%ls'$WARNING: Ignoring unknown setting of WIMLIB_IMAGEX_IGNORE_CASE$WIMLIB_IMAGEX_IGNORE_CASE$append$errno$error writing to standard output$help$quiet$version$wim$wimlib-imagex$wimlib-imagex 1.13.4 (using wimlib %ls)Copyright (C) 2012-2021 Eric BiggersLicense GPLv3+; GNU GPL version 3 or later <http://gn$yes
API String ID: 3614735478-3904026371
Opcode ID: 15c662463b53c77f58d0a4082813601e3907aa32a5d7c0f7a694bfb0a244d763
Instruction ID: ff44718508ce0649e9f990faaadb8875705e224b93ddf986c4cf46110e52e09e
Opcode Fuzzy Hash: 15c662463b53c77f58d0a4082813601e3907aa32a5d7c0f7a694bfb0a244d763
Instruction Fuzzy Hash: 2991C771B0860180EA14EB22E8553AA2764FB8479CF44503BDE0E677E5EF7CE985C34E

Uniqueness

Uniqueness Score: -1.00%

Function 02414BEA Relevance: 7.6, APIs: 5, Instructions: 125
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02414C04
VirtualProtect.KERNEL32 ref: 02414C5C
VirtualProtect.KERNEL32 ref: 02414C85
VirtualProtect.KERNEL32 ref: 02414CC2
VirtualProtect.KERNEL32 ref: 02414CE6

Memory Dump Source

Source File: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Offset: 023AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23af000_bReporter.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 1e619bdf4bf7d8a1f72fe11a15149652bafd81afc1c25810297ea3c6b5571fd2
Instruction ID: 39fe3218f4c2e1dfe4ab7a7032d08be6d199c11ed633228d5e6df8bb3cd23ae9
Opcode Fuzzy Hash: 1e619bdf4bf7d8a1f72fe11a15149652bafd81afc1c25810297ea3c6b5571fd2
Instruction Fuzzy Hash: 9431E73130CA184FDB08EA6CE8552AAB7D5FBC8760B01116AED4BC3249EF64DD428BD1

Uniqueness

Uniqueness Score: -1.00%

Function 02414ADF Relevance: 7.6, APIs: 5, Instructions: 115
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02414AEC
VirtualProtect.KERNEL32 ref: 02414B44
VirtualProtect.KERNEL32 ref: 02414B6D
VirtualProtect.KERNEL32 ref: 02414BAA
VirtualProtect.KERNEL32 ref: 02414BCE

Memory Dump Source

Source File: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Offset: 023AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23af000_bReporter.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: cb0b48a04ba6d100bcb83f194f8859affeb3638fd54d705697e528f09cea4154
Instruction ID: 0f95714c826246dbef3819704ade4e4418dfe96a3aaeb3210be39ee9d7dd73d9
Opcode Fuzzy Hash: cb0b48a04ba6d100bcb83f194f8859affeb3638fd54d705697e528f09cea4154
Instruction Fuzzy Hash: 9B31A53530CA084F9B58EA6CD89536A73D6FBD8321B0002AADD4FC7285DE64DD5687C1

Uniqueness

Uniqueness Score: -1.00%

Function 040AA480 Relevance: 6.2, APIs: 4, Instructions: 212
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostname.WS2_32 ref: 040AA52D
gethostbyname.WS2_32 ref: 040AA58B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 040AA69F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 040AA6A5

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$gethostbynamegethostname
String ID:
API String ID: 2067056451-0
Opcode ID: dc4753650f7071aa8680986263f06eb7f16eb4ca3fdd3767a205333cb17a99b7
Instruction ID: e56c0ea9538634301fc70ef64b73eb87ead9ff91edec432ff77a9499f0f16946
Opcode Fuzzy Hash: dc4753650f7071aa8680986263f06eb7f16eb4ca3fdd3767a205333cb17a99b7
Instruction Fuzzy Hash: 8D51E830628E488FD7A4EF68C88879A77D1FB99319F504B6DE08AD7190CB34D441CF42

Uniqueness

Uniqueness Score: -1.00%

Function 040AA720 Relevance: 1.6, APIs: 1, Instructions: 82
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostname.WS2_32 ref: 040AA7A0

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: gethostname
String ID:
API String ID: 144339138-0
Opcode ID: be99039dbe071a3069742d9559582be3b698ec99848f99023ab3a30cdb4c572c
Instruction ID: e7910f03f99faa8198a506424c524590bbb296925ff8ea59616b0b5367601b0d
Opcode Fuzzy Hash: be99039dbe071a3069742d9559582be3b698ec99848f99023ab3a30cdb4c572c
Instruction Fuzzy Hash: CB21A570224B484FE7A9DF38C888BBA36E0FB59305F50466AD45AD72E6DF349845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 040AA9D0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 040AAA24

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: d65498d66351f69c7b2f13640577373e47cbd9f2c78fd8868ae2898f6ffac4c3
Instruction ID: d10842211d169e9e79798ea1ddf670fbab9dd67878680dc64639caa9d6d5a255
Opcode Fuzzy Hash: d65498d66351f69c7b2f13640577373e47cbd9f2c78fd8868ae2898f6ffac4c3
Instruction Fuzzy Hash: F601D134208A448FEF58EB65C95876BF7F4FB85341F00082DE88AC6190DBB8D605CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02414AD2 Relevance: 1.5, APIs: 1, Instructions: 35
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02414AEC
VirtualProtect.KERNEL32 ref: 02414B44
VirtualProtect.KERNEL32 ref: 02414B6D
VirtualProtect.KERNEL32 ref: 02414BAA
VirtualProtect.KERNEL32 ref: 02414BCE

Memory Dump Source

Source File: 00000001.00000002.616003436.00000000023AF000.00000040.00000020.00020000.00000000.sdmp, Offset: 023AF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23af000_bReporter.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: a05d82cf2160f7b723d1ef197a06b56b459da6475b9e72f135a9153381544cfe
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: 4DE0203120CA0D1FF758D59DD84A7B276D8D785376F00007FF549C2201E046D8924391

Uniqueness

Uniqueness Score: -1.00%

Function 040AA990 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 040AA9AF

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 316bb0c3a8a49ea694236808b0027a2f6ca78a1ce9228b4f91f615e04a34737d
Instruction ID: a576f2cb61458bc73cb16240e167db852caa6e10aad89f22dcf75fe818d11007
Opcode Fuzzy Hash: 316bb0c3a8a49ea694236808b0027a2f6ca78a1ce9228b4f91f615e04a34737d
Instruction Fuzzy Hash: D5E08661C4878447E70497208A541B673F1FBF6209F50670EF8C8A1051EF6956D48246

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 040986F0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B85
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B8B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B91
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04098B97

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bc8bf945b23a225c0df79873cb59277c8907ef4427313e96b9d2052687f1ff13
Instruction ID: 05f6e1d4c5a66b8f40b086d08d129f2b067643b03f530b137af16f8769492367
Opcode Fuzzy Hash: bc8bf945b23a225c0df79873cb59277c8907ef4427313e96b9d2052687f1ff13
Instruction Fuzzy Hash: DFE19631528E4C8FDF54FF28C888BDA77E1FB99314F548A1AE449D7264DA74E980C781

Uniqueness

Uniqueness Score: -1.00%

Function 004051B0 Relevance: 105.5, APIs: 25, Strings: 35, Instructions: 468
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E004051B0(void* __ecx, void* __rax, void* __rdx) {
				signed short _t133;
				signed int _t146;
				signed char _t153;
				signed short _t154;
				signed short _t166;
				void* _t167;
				signed int _t171;
				void* _t175;
				intOrPtr* _t176;
				signed long long _t177;
				signed long long _t179;
				void* _t190;
				void* _t191;
				signed char* _t192;
				signed long long _t193;
				char* _t195;
				void* _t196;
				signed int _t247;
				char* _t274;
				signed long long _t285;
				void* _t313;
				signed char* _t314;
				signed int _t316;
				long long* _t318;
				signed int* _t319;
				signed int* _t320;
				void* _t321;
				void* _t322;
				void* _t325;
				void* _t334;

				_t175 = __rax;
				_t167 = __ecx;
				_t322 = _t321 - 0x2d8;
				_t320 = _t322 + 0x80;
				r12d = 0;
				r13d = 1;
				 *((long long*)(_t320 - 0x20)) = 0;
				_t190 = _t196;
				 *(_t320 - 0x18) = 0;
				 *((long long*)(_t320 - 0x40)) = 0;
				 *((long long*)(_t320 - 0x38)) = 0;
				 *((char*)(_t320 - 0x3a)) = 0;
				 *((char*)(_t320 - 0x39)) = 0;
				 *((char*)(_t320 - 0x3c)) = 0;
				 *((char*)(_t320 - 0x3b)) = 0;
				asm("o16 nop [cs:eax+eax]");
				 *((long long*)(_t322 + 0x20)) = 0;
				_t133 = E00408FE0();
				if(_t175 == 0xffffffff) {
					_t176 =  *0x4201c0; // 0x416038
					_t177 =  *_t176;
					_t191 = _t190 - _t177;
					_t316 = __rdx + _t177 * 8;
					__eflags = _t191 - 1 - 3;
					if(_t191 - 1 > 3) {
						L4:
						asm("invalid");
						 *0x416040();
						asm("invalid");
						L5:
						free();
						return r15d;
					}
					_t313 =  *_t316;
					__eflags = _t191 - 1;
					if(_t191 == 1) {
						_t179 = L"all";
						 *(_t320 - 0x48) = _t179;
						L13:
						 *((long long*)(_t322 + 0x20)) = 0;
						_t33 = _t320 - 0x28; // -39
						_t325 = _t33;
						L004090A8();
						r15d = _t133;
						__eflags = _t179;
						if(_t179 != 0) {
							goto L5;
						}
						_t36 = _t320 - 0x10; // -15
						_t192 = _t36;
						L004090E0();
						_t274 =  *(_t320 - 0x48);
						L00409068();
						r14d = _t133;
						__eflags = _t179;
						if(_t179 == 0) {
							_t274 = "0";
							L00409198();
							__eflags = _t179;
							if(_t179 != 0) {
								_t275 = _t313;
								E00403BB0( *(_t320 - 0x48), _t313, 0x401890);
								__eflags =  *((char*)(_t320 - 0x3b));
								if( *((char*)(_t320 - 0x3b)) != 0) {
									E004024D0(L"If you would like to set the boot index to 0, specify image \"0\" with the --boot flag.", _t275, _t325, 0x401890);
								}
								r15d = 0x12;
								L18:
								L00409108();
								goto L5;
							}
							__eflags =  *((char*)(_t320 - 0x3b));
							if( *((char*)(_t320 - 0x3b)) != 0) {
								L16:
								r10d =  *_t320;
								__eflags = r10d;
								if(r10d != 0) {
									L20:
									__eflags = r14d - 0xffffffff;
									if(r14d == 0xffffffff) {
										__eflags =  *_t320 - 1;
										if( *_t320 <= 1) {
											__eflags =  *(_t320 - 0x18);
											if( *(_t320 - 0x18) == 0) {
												__eflags =  *((char*)(_t320 - 0x3b));
												if( *((char*)(_t320 - 0x3b)) == 0) {
													L24:
													__eflags = r14d - 0xffffffff;
													if(r14d != 0xffffffff) {
														L37:
														__eflags =  *((char*)(_t320 - 0x3c));
														if( *((char*)(_t320 - 0x3c)) != 0) {
															L00409090();
														}
														__eflags =  *((char*)(_t320 - 0x39));
														if( *((char*)(_t320 - 0x39)) != 0) {
															__eflags = _t166 - 1;
															if(_t166 != 1) {
																 *_t179 =  *_t179 + _t179;
																__eflags =  *_t179;
																r9d = _t166 & 0x0000ffff;
																r8d = _t171;
																_t133 = E00401650(_t325, 0x401890);
															}
															r9d = 0;
															_t325 = 0x403460;
															__eflags = 0;
															L004090B8();
														}
														__eflags =  *((char*)(_t320 - 0x3a));
														if( *((char*)(_t320 - 0x3a)) != 0) {
															 *_t179 =  *_t179 + _t179;
															L00409110();
															__eflags = _t179;
															if(_t179 == 0) {
																goto L43;
															}
															r15d = _t133;
															goto L18;
														} else {
															L43:
															__eflags =  *((long long*)(_t320 - 0x38));
															if( *((long long*)(_t320 - 0x38)) == 0) {
																L47:
																__eflags = r13b;
																if(r13b != 0) {
																	L00409098();
																}
																goto L18;
															}
															__imp___wfopen();
															__eflags = _t179;
															if(__eflags == 0) {
																r15d = 0xffffffff;
																E004031C0(__eflags, _t179, L"Failed to open the file \"%ls\" for writing",  *((intOrPtr*)(_t320 - 0x38)), _t325, 0x401890);
																goto L18;
															}
															L00409110();
															_t193 = _t179;
															fclose(??);
															__eflags = _t179;
															if(_t179 != 0) {
																r15d = 0xffffffff;
																E004024D0(L"Failed to close the file \"%ls\"",  *((intOrPtr*)(_t320 - 0x38)), _t325, 0x401890);
																goto L18;
															}
															__eflags = _t193;
															if(_t193 != 0) {
																r15d = _t166;
																goto L18;
															}
															goto L47;
														}
													}
													__eflags = r13b;
													if(r13b == 0) {
														goto L37;
													}
													_t318 = __imp___putws;
													 *_t318();
													 *_t318();
													_t314 = _t192;
													E004023A0(_t179, L"Path:           %ls\n", _t313, _t325, 0x401890);
													_t319 = _t320;
													_t195 = L"%02hhx";
													E004023A0(_t179, L"GUID:           0x", _t313, _t325, 0x401890);
													do {
														_t285 =  *_t314 & 0x000000ff;
														_t314 =  &(_t314[1]);
														E004023A0(_t179, _t195, _t285, _t325, 0x401890);
														__eflags = _t314 - _t319;
													} while (_t314 != _t319);
													_t146 =  *0x416040();
													asm("pushfd");
													__eflags = _t146;
													 *((intOrPtr*)(_t195 - 0x72b7f7ab)) =  *((intOrPtr*)(_t195 - 0x72b7f7ab)) + _t167;
													_t180 = _t179 | 0x00014b9a;
													E004023A0(_t179 | 0x00014b9a, 0xa, _t285, _t325, 0x401890);
													E004023A0(_t179 | 0x00014b9a, L"Image Count:    %d\n",  *_t320, _t325, 0x401890);
													L00409100();
													E004023A0(_t179 | 0x00014b9a, L"Compression:    %ls\n", _t179 | 0x00014b9a, _t325, 0x401890);
													E004023A0(_t180, L"Chunk Size:     %u bytes\n", _t320[3], _t325, 0x401890);
													r8d = _t320[4] & 0x0000ffff;
													E004023A0(_t180, L"Part Number:    %d/%d\n", _t320[4] & 0x0000ffff, _t325, 0x401890);
													E004023A0(_t180, L"Boot Index:     %d\n", _t320[1], _t325, 0x401890);
													_t153 = E004023A0(_t180, L"Size:           %llu bytes\n", _t320[6], _t325, 0x401890);
													r8d = 0;
													_t320[0x14] = r8w;
													__eflags = _t320[8] & 0x00000002;
													if((_t320[8] & 0x00000002) != 0) {
														L004091A8();
													}
													__eflags = _t153 & 0x00000001;
													if((_t153 & 0x00000001) != 0) {
														L004091A8();
													}
													__eflags = _t153 & 0x00000008;
													if((_t153 & 0x00000008) != 0) {
														L004091A8();
													}
													__eflags = _t320[8] & 0x00000001;
													if((_t320[8] & 0x00000001) != 0) {
														L004091A8();
													}
													__eflags = _t153;
													if(_t153 < 0) {
														L004091A8();
														_t179 = _t320[8] & 0x000000ff;
													}
													__eflags = _t153 & 0x00000010;
													if((_t153 & 0x00000010) != 0) {
														L004091A8();
													}
													L004091A0();
													_t68 =  &(_t320[0x15]); // 0x55
													__eflags = _t179 - _t68;
													if(_t179 >= _t68) {
														__eflags =  *((short*)(_t179 - 2)) - 0x20;
														if( *((short*)(_t179 - 2)) == 0x20) {
															__eflags =  *((short*)(_t179 - 4)) - 0x2c;
															if( *((short*)(_t179 - 4)) == 0x2c) {
																 *((short*)(_t179 - 4)) = 0;
															}
														}
													}
													_t133 = E004023A0(_t179, L"Attributes:     %ls\n\n", _t334, _t325, 0x401890);
													goto L37;
												}
												_t316 = 0x1;
												 *_t179 =  *_t179 + _t133;
												L59:
												_t247 =  *0x424178;
												__eflags = _t316 - _t320[1];
												if(_t316 == _t320[1]) {
													__eflags = _t247;
													if(_t247 != 0) {
														r8d = r14d;
														E00401650(_t325, 0x401890);
													}
													L67:
													_t98 = _t320 - 0x20; // -31
													_t99 =  &(_t320[0x14]); // 0x51
													_t332 = _t99;
													r8d = r14d;
													_t154 = E004030A0(_t179, _t98,  *((intOrPtr*)(_t320 - 0x28)), _t99);
													r15d = _t154;
													__eflags = _t179;
													if(_t179 != 0) {
														L57:
														goto L18;
													}
													__eflags = _t320[0x14];
													if(_t320[0x14] != 0) {
														L64:
														r8d = 1;
														L004090A0();
														r15d = _t154;
														goto L57;
													}
													__eflags = r12b & 0x00000001;
													if((r12b & 0x00000001) == 0) {
														__eflags = r12b & 0x00000002;
														if((r12b & 0x00000002) == 0) {
															L72:
															__eflags =  *0x424178;
															if( *0x424178 != 0) {
																E00401650(_t313, _t332);
															}
															goto L57;
														}
														__eflags = _t320[8] & 0x00000001;
														if((_t320[8] & 0x00000001) == 0) {
															goto L72;
														}
														goto L64;
													}
													__eflags = _t320[8] & 0x00000001;
													if((_t320[8] & 0x00000001) == 0) {
														goto L64;
													}
													__eflags = r12b & 0x00000002;
													if((r12b & 0x00000002) != 0) {
														goto L64;
													}
													goto L72;
												}
												__eflags = _t247;
												if(_t247 != 0) {
													r8d = r14d;
													_t133 = E00401650(_t325, 0x401890);
												}
												r8d = 4;
												_t320[1] = _t316;
												L00409028();
												r15d = _t133;
												__eflags = _t179;
												if(_t179 != 0) {
													goto L57;
												} else {
													_t93 = _t320 - 0x20; // -31
													_t94 =  &(_t320[0x14]); // 0x51
													r8d = r14d;
													_t154 = E004030A0(_t179, _t93,  *((intOrPtr*)(_t320 - 0x28)), _t94);
													r15d = _t154;
													__eflags = _t179;
													if(_t179 != 0) {
														goto L57;
													}
													goto L64;
												}
											}
											r14d = 1;
											L66:
											__eflags =  *((char*)(_t320 - 0x3b));
											if( *((char*)(_t320 - 0x3b)) != 0) {
												L58:
												goto L59;
											}
											goto L67;
										}
										__eflags =  *((char*)(_t320 - 0x3b));
										if( *((char*)(_t320 - 0x3b)) != 0) {
											r15d = 0x12;
											E004024D0(L"Cannot specify the --boot flag without specifying a specific image in a multi-image WIM", _t274, _t325, 0x401890);
											goto L18;
										}
										r9d =  *(_t320 - 0x18);
										__eflags = r9d;
										if(r9d == 0) {
											goto L24;
										}
										r15d = 0x12;
										E004024D0(L"Can\'t change image properties without specifying a specific image in a multi-image WIM", _t274, _t325, 0x401890);
										goto L18;
									}
									__eflags =  *(_t320 - 0x18);
									if( *(_t320 - 0x18) != 0) {
										__eflags = r14d;
										if(r14d == 0) {
											L56:
											r15d = 0xffffffff;
											E004024D0(L"Cannot change image properties when using image 0", _t274, _t325, 0x401890);
											goto L57;
										}
										goto L66;
									}
									__eflags =  *((char*)(_t320 - 0x3b));
									if( *((char*)(_t320 - 0x3b)) != 0) {
										goto L58;
									}
									__eflags = r14d;
									if(r14d == 0) {
										L90:
										r15d = 0x12;
										E004024D0(L"\"%ls\" is not a valid image in \"%ls\"",  *(_t320 - 0x48), _t313, 0x401890);
										goto L18;
									}
									goto L24;
								}
								r15d = 0x12;
								E004024D0(L"--boot is meaningless on a WIM with no images", _t274, _t325, 0x401890);
								goto L18;
							}
							__eflags =  *(_t320 - 0x18);
							if( *(_t320 - 0x18) == 0) {
								goto L90;
							}
							goto L56;
						}
						__eflags =  *((char*)(_t320 - 0x3b));
						if( *((char*)(_t320 - 0x3b)) == 0) {
							goto L20;
						}
						goto L16;
					}
					_t179 =  *((intOrPtr*)(_t316 + 8));
					 *(_t320 - 0x48) = _t179;
					__eflags = _t191 - 2;
					if(_t191 == 2) {
						goto L13;
					}
					L00409180();
					_t179 = _t179 + _t179 + 0x0000001b & 0xfffffff0;
					E0040A470(_t133);
					_t322 = _t322 - _t179;
					_t24 = _t320 - 0x20; // -31
					_t337 = _t24;
					E0040A630(_t322 + 0x30, L"NAME=%ls",  *((intOrPtr*)(_t316 + 0x10)), 0x41e020);
					_t133 = E00402550(_t171, _t179, _t24, _t322 + 0x30);
					r15d = _t133;
					__eflags = _t179;
					if(_t179 != 0) {
						goto L5;
					}
					__eflags = _t191 - 4;
					if(_t191 != 4) {
						goto L13;
					}
					L00409180();
					_t179 = _t179 + _t179 + 0x00000029 & 0xfffffff0;
					E0040A470(_t133);
					_t322 = _t322 - _t179;
					E0040A630(_t322 + 0x30, L"DESCRIPTION=%ls",  *((intOrPtr*)(_t316 + 0x18)), 0x41e020);
					_t133 = E00402550(_t171, _t179, _t337, _t322 + 0x30);
					r15d = _t133;
					__eflags = _t179;
					if(_t179 != 0) {
						goto L5;
					} else {
						asm("o16 nop [eax+eax]");
						goto L13;
					}
				} else {
					if(_t175 > 0x3e) {
						goto L4;
					} else {
						goto __rax;
					}
				}
			}

0x004051b0
0x004051b0
0x004051bc
0x004051c3
0x004051d2
0x004051d5
0x004051e2
0x004051ea
0x004051ef
0x004051f7
0x004051fe
0x00405206
0x0040520a
0x0040520e
0x00405212
0x00405216
0x00405220
0x0040523c
0x00405244
0x00405320
0x00405327
0x0040532a
0x0040532c
0x00405333
0x00405336
0x00405260
0x00405269
0x0040526b
0x0040527c
0x0040527e
0x00405282
0x0040529d
0x0040529d
0x0040533c
0x0040533f
0x00405342
0x004054a0
0x004054a7
0x004053f8
0x004053f8
0x00405404
0x00405404
0x00405412
0x00405417
0x0040541a
0x0040541c
0x00000000
0x00000000
0x00405426
0x00405426
0x0040542d
0x00405432
0x0040543a
0x0040543f
0x00405442
0x00405444
0x00405754
0x0040575b
0x00405760
0x00405762
0x004058af
0x004058b2
0x004058b7
0x004058bb
0x004059a0
0x004059a0
0x004058c5
0x00405470
0x00405470
0x00000000
0x00405470
0x00405768
0x0040576c
0x00405450
0x00405450
0x00405454
0x00405457
0x004054b0
0x004054b0
0x004054b4
0x0040570f
0x00405713
0x00405898
0x0040589a
0x00405946
0x0040594a
0x004054d8
0x004054d8
0x004054dc
0x00405645
0x00405645
0x00405649
0x004058dd
0x004058dd
0x0040564f
0x00405653
0x00405659
0x0040565d
0x0040566c
0x0040566c
0x0040566e
0x0040567c
0x0040567f
0x0040567f
0x00405688
0x0040568b
0x00405692
0x00405694
0x00405694
0x00405699
0x0040569d
0x00405909
0x00405912
0x00405917
0x00405919
0x00000000
0x00000000
0x00405923
0x00000000
0x004056a3
0x004056a3
0x004056a3
0x004056a8
0x004056f5
0x004056f5
0x004056f8
0x00405701
0x00405706
0x00000000
0x004056f8
0x004056b9
0x004056c2
0x004056c5
0x004059dc
0x004059e2
0x00000000
0x004059e7
0x004056d2
0x004056da
0x004056dc
0x004056e1
0x004056e3
0x004059bd
0x004059c3
0x00000000
0x004059c8
0x004056ed
0x004056ef
0x004059aa
0x00000000
0x004059aa
0x00000000
0x004056ef
0x0040569d
0x004054e2
0x004054e5
0x00000000
0x00000000
0x004054eb
0x004054f9
0x00405502
0x0040550e
0x00405511
0x0040551d
0x00405520
0x00405527
0x0040552c
0x0040552c
0x0040552f
0x00405536
0x0040553b
0x0040553b
0x00405549
0x00405558
0x00405559
0x0040555b
0x00405561
0x00405566
0x00405575
0x0040557d
0x0040558c
0x0040559b
0x004055a0
0x004055b0
0x004055bf
0x004055cf
0x004055d4
0x004055d7
0x004055dc
0x004055e0
0x00405a26
0x00405a26
0x004055ea
0x004055ec
0x00405a0e
0x00405a13
0x004055f2
0x004055f4
0x004059fa
0x004059fa
0x004055fa
0x004055fe
0x00405a52
0x00405a52
0x00405608
0x0040560a
0x00405a3a
0x00405a3f
0x00405a3f
0x00405610
0x00405612
0x00405a66
0x00405a66
0x0040561d
0x00405622
0x00405626
0x00405629
0x0040562b
0x00405630
0x00405a70
0x00405a75
0x00405a7b
0x00405a7b
0x00405a75
0x00405630
0x00405640
0x00000000
0x00405640
0x00405950
0x00405959
0x0040579b
0x0040579b
0x004057a2
0x004057a5
0x0040587f
0x00405882
0x00405884
0x0040588e
0x0040588e
0x00405820
0x00405824
0x00405828
0x00405828
0x0040582c
0x0040582f
0x00405834
0x00405837
0x00405839
0x0040578f
0x00000000
0x0040578f
0x0040583f
0x00405843
0x004057f6
0x004057fa
0x00405803
0x00405808
0x00000000
0x00405808
0x00405845
0x00405849
0x004058e7
0x004058eb
0x0040585b
0x00405862
0x00405865
0x00405875
0x00405875
0x00000000
0x00405865
0x004058f1
0x004058f5
0x00000000
0x00000000
0x00000000
0x004058fb
0x0040584f
0x00405853
0x00000000
0x00000000
0x00405855
0x00405859
0x00000000
0x00000000
0x00000000
0x00405859
0x004057ab
0x004057ae
0x004057b0
0x004057ba
0x004057ba
0x004057c3
0x004057cc
0x004057cf
0x004057d4
0x004057d7
0x004057d9
0x00000000
0x004057db
0x004057df
0x004057e3
0x004057e7
0x004057ea
0x004057ef
0x004057f2
0x004057f4
0x00000000
0x00000000
0x00000000
0x004057f4
0x004057d9
0x004058a0
0x00405816
0x00405816
0x0040581a
0x00405798
0x00000000
0x00405798
0x00000000
0x0040581a
0x00405719
0x0040571d
0x00405932
0x00405938
0x00000000
0x0040593d
0x00405723
0x00405727
0x0040572a
0x00000000
0x00000000
0x00405737
0x0040573d
0x00000000
0x00405742
0x004054bd
0x004054bf
0x0040580d
0x00405810
0x0040577d
0x00405784
0x0040578a
0x00000000
0x0040578a
0x00000000
0x00405810
0x004054c5
0x004054c9
0x00000000
0x00000000
0x004054cf
0x004054d2
0x00405960
0x0040596e
0x00405974
0x00000000
0x00405979
0x00000000
0x004054d2
0x00405460
0x00405466
0x00000000
0x0040546f
0x00405775
0x00405777
0x00000000
0x00000000
0x00000000
0x00405777
0x0040544a
0x0040544e
0x00000000
0x00000000
0x00000000
0x0040544e
0x00405348
0x0040534c
0x00405350
0x00405353
0x00000000
0x00000000
0x0040535d
0x00405367
0x0040536b
0x0040537b
0x0040537e
0x0040537e
0x0040538a
0x00405395
0x0040539a
0x0040539d
0x0040539f
0x00000000
0x00000000
0x004053a5
0x004053a8
0x00000000
0x00000000
0x004053ae
0x004053b8
0x004053bc
0x004053cc
0x004053d7
0x004053e2
0x004053e7
0x004053ea
0x004053ec
0x00000000
0x004053f2
0x004053f2
0x00000000
0x004053f2
0x0040524a
0x0040524d
0x00000000
0x00405251
0x00405258
0x00405258
0x0040524d

APIs

free.MSVCRT ref: 00405282
wcslen.MSVCRT ref: 0040535D
wcslen.MSVCRT ref: 004053AE
wimlib_add_image_multisource.LIBWIM-15 ref: 00405412
wimlib_add_image_multisource.LIBWIM-15 ref: 0040542D
wimlib_add_image_multisource.LIBWIM-15 ref: 0040543A
wimlib_add_image_multisource.LIBWIM-15 ref: 00405470

Strings

Path: %ls, xrefs: 00405507
all, xrefs: 004054A0
GUID: 0x, xrefs: 00405516
Attributes: %ls, xrefs: 00405639
Part Number: %d/%d, xrefs: 004055A9
WIM Information:, xrefs: 004054F2
Boot Index: %d, xrefs: 004055B8
Relative path junction, , xrefs: 004059F0
Marking image %d as bootable., xrefs: 004057B3
--boot is meaningless on a WIM with no images, xrefs: 00405459
8`A, xrefs: 00405320
Cannot specify the --boot flag without specifying a specific image in a multi-image WIM, xrefs: 0040592B
"%ls" is not a valid image in "%ls", xrefs: 00405964
Chunk Size: %u bytes, xrefs: 00405594
If you would like to set the boot index to 0, specify image "0" with the --boot flag., xrefs: 00405999
Compression: %ls, xrefs: 00405582
Pipable, , xrefs: 00405A1C
Image %d is already marked as bootable., xrefs: 00405887
Readonly, , xrefs: 00405A5C
Image Count: %d, xrefs: 0040556E
Can't change image properties without specifying a specific image in a multi-image WIM, xrefs: 00405730
Size: %llu bytes, xrefs: 004055C8
Cannot change image properties when using image 0, xrefs: 0040577D
DESCRIPTION=%ls, xrefs: 004053C1
%02hhx, xrefs: 00405520
Resource only, , xrefs: 00405A48
Warning: Only showing the blobs for part %d of a %d-part WIM., xrefs: 00405672
Integrity info, , xrefs: 00405A04
----------------, xrefs: 004054FB
Version: %u, xrefs: 0040555F
Metadata only, , xrefs: 00405A30
Failed to close the file "%ls", xrefs: 004059B6
The file "%ls" was not modified because nothing needed to be done., xrefs: 0040586E
Failed to open the file "%ls" for writing, xrefs: 004059D5
NAME=%ls, xrefs: 00405370

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$wcslen$free
String ID: "%ls" is not a valid image in "%ls"$%02hhx$----------------$--boot is meaningless on a WIM with no images$8`A$Attributes: %ls$Boot Index: %d$Can't change image properties without specifying a specific image in a multi-image WIM$Cannot change image properties when using image 0$Cannot specify the --boot flag without specifying a specific image in a multi-image WIM$Chunk Size: %u bytes$Compression: %ls$DESCRIPTION=%ls$Failed to close the file "%ls"$Failed to open the file "%ls" for writing$GUID: 0x$If you would like to set the boot index to 0, specify image "0" with the --boot flag.$Image %d is already marked as bootable.$Image Count: %d$Integrity info, $Marking image %d as bootable.$Metadata only, $NAME=%ls$Part Number: %d/%d$Path: %ls$Pipable, $Readonly, $Relative path junction, $Resource only, $Size: %llu bytes$The file "%ls" was not modified because nothing needed to be done.$Version: %u$WIM Information:$Warning: Only showing the blobs for part %d of a %d-part WIM.$all
API String ID: 1016351787-91234022
Opcode ID: b6211759eb43bb335f75545e9ae3b53865fb3919a9b3b8bd58be2b9369086f26
Instruction ID: 88a3f0e4424c65e5f5a1b5e274b89d5711ada9b55dba5f1d41207f9abf58df46
Opcode Fuzzy Hash: b6211759eb43bb335f75545e9ae3b53865fb3919a9b3b8bd58be2b9369086f26
Instruction Fuzzy Hash: 7012AC72700A4199EB10EB62D8583EF2760E7847ACF84512BDE0A777D9DB7CC885CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 70.4, APIs: 30, Strings: 10, Instructions: 363
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00406CA0(void* __ecx, signed long long __rax, void* __rdx) {
				intOrPtr _v132;
				char _v168;
				signed long long _v228;
				short _v230;
				short _v232;
				void* _v236;
				signed int _v244;
				void* _v264;
				signed short _v322;
				char _v328;
				signed int _v336;
				long long _v344;
				char _v352;
				char _v360;
				long long _v368;
				long long _v376;
				signed long long _v384;
				void* _v388;
				long long _v392;
				long long _v396;
				signed int _v400;
				intOrPtr _v416;
				long long _v424;
				signed int _t113;
				signed int _t115;
				signed int _t116;
				signed int _t128;
				void* _t129;
				signed long long _t138;
				intOrPtr* _t139;
				signed long long _t140;
				signed int _t141;
				signed int _t142;
				signed int _t145;
				void* _t148;
				long long* _t149;
				void* _t152;
				void* _t154;
				intOrPtr _t172;
				intOrPtr* _t221;
				void* _t222;
				void* _t223;
				signed long long _t224;
				signed long long _t226;
				intOrPtr _t230;
				intOrPtr _t233;

				_t138 = __rax;
				_t129 = __ecx;
				r14d = 0xffffffff;
				_t226 = 0x8;
				 *__rax =  *__rax + __rax;
				_v344 = 0;
				_t222 = _t152;
				_v336 = 0;
				_v392 = 0xffffffff;
				_v396 = 0xffffffff;
				_v400 = 0;
				_v388 = 0;
				_v424 = 0;
				_t113 = E00408FE0();
				if(_t138 == 0xffffffff) {
					_t139 =  *0x4201c0; // 0x416038
					_t140 =  *_t139;
					_t223 = _t222 - _t140;
					_t138 = __rdx + _t140 * 8;
					_t154 = _t223;
					__eflags = _t223 - 3 - 2;
					if(_t223 - 3 > 2) {
						L4:
						 *_t138 =  *_t138 + _t113;
						asm("ror al, 1");
						asm("invalid");
						r15d = 0xffffffff;
						L6:
						free();
						return r15d;
					}
					_t149 =  *((intOrPtr*)(_t138 + 8));
					_t221 =  *_t138;
					_t224 =  *((intOrPtr*)(_t138 + 0x10));
					_v376 = _t149;
					__eflags = _t154 - 3;
					if(_t154 == 3) {
						_v368 = 0;
						_v384 = 0;
					} else {
						_v384 = 0;
						_t149 =  *((intOrPtr*)(_t138 + 0x18));
						_v368 = _t149;
						__eflags = _t154 - 5;
						if(_t154 == 5) {
							_t138 =  *((intOrPtr*)(_t138 + 0x20));
							_v384 = _t138;
						}
					}
					_v424 = 0;
					_t229 =  &_v360;
					_t232 = 0x401890;
					L004090A8();
					r15d = _t113;
					__eflags = _t138;
					if(_t138 != 0) {
						goto L6;
					} else {
						L004090E0();
						_t200 = "-";
						L00409198();
						__eflags = _t138;
						if(_t138 != 0) {
							_t149 = __imp___errno;
							_t115 =  *_t149();
							 *_t138 = 2;
							__eflags = _t224;
							if(_t224 == 0) {
								goto L16;
							}
							_t200 =  &_v328;
							__imp___wstat64();
							__eflags = _t138;
							if(_t138 != 0) {
								goto L16;
							}
							_t138 = _v322 & 0xf000;
							_t138 - 0x8000 = _t138 - 0x3000;
							_t116 = _t115 & 0xffffff00 | _t138 != 0x00003000;
							_t128 = _t128 & _t116;
							__eflags = _t128;
							if(_t128 != 0) {
								r15d = 0xffffffff;
								E004024D0(L"\"%ls\" is not a regular file or block device", _t224,  &_v360, 0x401890);
								goto L47;
							}
							_t232 = 0x401890;
							_t229 =  &_v352;
							_v424 = 0;
							L004090A8();
							r15d = _t116;
							__eflags = _t138;
							if(_t138 != 0) {
								goto L47;
							}
							__eflags = _t226 - 0xffffffff;
							if(_t226 == 0xffffffff) {
								goto L33;
							}
							L004090E0();
							__eflags = _v132 - _t226;
							if(_v132 != _t226) {
								r15d = 0xffffffff;
								E004024D0(L"Cannot specify a compression type that is not the same as that used in the destination WIM",  &_v168, _t230, _t233);
								goto L46;
							}
							goto L33;
						} else {
							r12d = r12d | 0x00000004;
							__eflags =  *0x424178;
							if( *0x424178 != 0) {
								 *_t138 =  *_t138 + _t113;
								__eflags =  *_t138;
								 *0x424178 = _t138;
							}
							asm("adc [eax], al");
							_t28 = _t138 - 0x75;
							 *_t28 =  *(_t138 - 0x75) + _t129;
							__eflags =  *_t28;
							asm("sbb eax, 0x1e6c5");
							 *_t149();
							 *_t138 = 2;
							L16:
							_t116 =  *_t149();
							__eflags =  *_t138 - 2;
							if(__eflags != 0) {
								r15d = 0xffffffff;
								E004031C0(__eflags, _t138, L"Cannot stat file \"%ls\"", _t224, _t229, _t232);
								L47:
								L00409108();
								goto L6;
							}
							__eflags = r12d & 0x00008000;
							if((r12d & 0x00008000) != 0) {
								r15d = 0xffffffff;
								E004024D0(L"\'--unsafe-compact\' is only valid when exporting to an existing WIM file!", _t200, _t229, _t232);
								goto L47;
							}
							__eflags = _t226 - 0xffffffff;
							if(_t226 == 0xffffffff) {
								__eflags = r12d & 0x00001000;
								if((r12d & 0x00001000) != 0) {
									_t128 = _t128 + bpl;
									asm("ror byte [ebx+0x48442444], 0x8b");
									L54:
									L00409148();
									r15d = _t116;
									__eflags = _t138;
									if(_t138 != 0) {
										goto L47;
									}
									r8d = 0;
									L00409070();
									L22:
									 *_t138 =  *_t138 + _t116;
									 *_t221 =  *_t221 + _t129;
									__eflags = _t224 & _t226;
									 *_t138 =  *_t138 + _t116;
									_t39 = _t138 - 0x75;
									 *_t39 =  *(_t138 - 0x75) + _t129;
									__eflags =  *_t39;
								}
								__eflags = r13b & 0x00000010;
								if((r13b & 0x00000010) != 0) {
									 *0x1D50E7FFFFFF8A =  *0x1D50E7FFFFFF8A + _t116;
									__eflags =  *0x1D50E7FFFFFF8A;
									 *((long long*)(_t226 - 0x617af040)) = 0x48fffffe;
								}
								_t226 = _v228;
								goto L54;
							}
							L00409148();
							r15d = _t116;
							__eflags = _t138;
							if(_t138 != 0) {
								goto L47;
							}
							r8d = 0;
							L00409070();
							__eflags = r13b & 0x00000010;
							if((r13b & 0x00000010) == 0) {
								goto L22;
							}
							__eflags = _t226 - 1;
							if(_t226 == 1) {
								_t138 = _t138 & 0xe900001c;
								asm("cmp ch, 0xff");
								asm("invalid");
								L33:
								__eflags = r14d - 0xffffffff;
								if(r14d != 0xffffffff) {
									L00409050();
									r15d = _t116;
									__eflags = _t138;
									if(_t138 == 0) {
										goto L34;
									}
									L46:
									L00409108();
									goto L47;
								}
								L34:
								__eflags = _v392 - 0xffffffff;
								if(_v392 == 0xffffffff) {
									L36:
									__eflags = _v396 - 0xffffffff;
									if(_v396 == 0xffffffff) {
										L38:
										_t202 = _v376;
										L00409068();
										r14d = _t116;
										__eflags = _t138;
										if(_t138 == 0) {
											_t202 = _t221;
											_t116 = E00403BB0(_v376, _t221, _t232);
											r15d = _t116;
											__eflags = _t138;
											if(_t138 != 0) {
												goto L46;
											}
											r8d = _v336;
											__eflags = r8d;
											if(r8d == 0) {
												L42:
												_t142 = _v384;
												_v416 = r13d;
												_t233 = _v368;
												_t230 = _v352;
												_v424 = _t142;
												L00409138();
												r15d = _t116;
												__eflags = _t142;
												if(_t142 != 0) {
													__eflags = _t142 - 0x37;
													if(_t142 == 0x37) {
														__eflags = _v230 - 1;
														if(_v230 <= 1) {
															E004024D0(L"If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.", _t202, _t230, _t233);
														} else {
															__eflags = _v336;
															if(_v336 != 0) {
																E004024D0(L"Perhaps the \'--ref\' argument did not specify all other parts of the split WIM?", _t202, _t230, _t233);
															} else {
																E004024D0(L"\"%ls\" is part of a split WIM. Use --ref to specify the other parts.", _t221, _t230, _t233);
															}
														}
													} else {
														__eflags = _t142 - 0x24;
														if(_t142 == 0x24) {
															__eflags = _v232 - 1;
															if(_v232 != 1) {
																E004024D0(L"\"%ls\" is not the first part of the split WIM.\n       You must specify the first part.", _t221, _t230, _t233);
															}
														}
													}
												} else {
													_t172 = _v352;
													__eflags = _t128;
													if(_t128 == 0) {
														r8d = _v400;
														L004090A0();
														r15d = _t116;
													} else {
														r9d = r12d;
														r8d = 0xffffffff;
														_v424 = _v400;
														__eflags = _t224;
														if(_t224 == 0) {
															 *((intOrPtr*)(_t172 - 0x77)) =  *((intOrPtr*)(_t172 - 0x77)) + _t116;
															asm("invalid");
															asm("std");
															asm("std");
															asm("invalid");
														} else {
															L00409008();
															r15d = _t116;
														}
													}
												}
												goto L46;
											}
											_t145 = _v388;
											_t202 = _v344;
											r9d = 1;
											_v424 = _t145;
											L00409088();
											r15d = _t116;
											__eflags = _t145;
											if(_t145 == 0) {
												goto L42;
											}
											goto L46;
										}
										r8d = _v336;
										__eflags = r8d;
										if(r8d != 0) {
											_t141 = _v388;
											_t202 = _v344;
											r9d = 1;
											_v424 = _t141;
											L00409088();
											r15d = _t116;
											__eflags = _t141;
											if(_t141 == 0) {
												goto L40;
											}
											goto L46;
										}
										L40:
										__eflags = r14d - 0xffffffff;
										if(r14d != 0xffffffff) {
											goto L42;
										}
										__eflags = r13b & 0x00000001;
										if((r13b & 0x00000001) != 0) {
											__eflags = _v244;
											if(_v244 != 0) {
												goto L42;
											}
											r15d = r15d | 0xffffffff;
											E004024D0(L"--boot specified for all-images export, but source WIM has no bootable image.", _t202, _t229, _t232);
											goto L46;
										}
										goto L42;
									}
									L00409040();
									r15d = _t116;
									__eflags = _t138;
									if(_t138 != 0) {
										goto L46;
									}
									goto L38;
								}
								L00409038();
								r15d = _t116;
								__eflags = _t138;
								if(_t138 != 0) {
									goto L46;
								}
								goto L36;
							}
							goto L22;
						}
					}
				} else {
					if(_t138 > 0x3d) {
						goto L4;
					} else {
						_t138 =  *((intOrPtr*)(_t148 + _t138 * 4)) + _t148;
						goto __rax;
					}
				}
			}

0x00406ca0
0x00406ca0
0x00406cb3
0x00406cc2
0x00406ccb
0x00406cce
0x00406cd7
0x00406cdc
0x00406ce5
0x00406ced
0x00406cf5
0x00406cfd
0x00406d08
0x00406d24
0x00406d2c
0x00406f70
0x00406f77
0x00406f7a
0x00406f7c
0x00406f83
0x00406f85
0x00406f88
0x00406d48
0x00406d51
0x00406d5c
0x00406d5e
0x00406d60
0x00406d66
0x00406d6b
0x00406d86
0x00406d86
0x00406f8e
0x00406f92
0x00406f95
0x00406f99
0x00406f9e
0x00406fa1
0x004070f0
0x004070f9
0x00406fa7
0x00406fa7
0x00406fb0
0x00406fb4
0x00406fb9
0x00406fbc
0x00406fbe
0x00406fc2
0x00406fc2
0x00406fbc
0x00406fc7
0x00406fd4
0x00406fdc
0x00406fe3
0x00406fe8
0x00406feb
0x00406fed
0x00000000
0x00406ff3
0x00407000
0x00407005
0x0040700f
0x00407014
0x00407016
0x00407107
0x0040710e
0x00407110
0x00407116
0x00407119
0x00000000
0x00000000
0x0040711f
0x0040712a
0x00407130
0x00407132
0x00000000
0x00000000
0x00407140
0x0040714d
0x00407152
0x00407157
0x00407157
0x00407159
0x004072e5
0x004072eb
0x00000000
0x004072eb
0x00407163
0x0040716a
0x00407172
0x0040717e
0x00407183
0x00407186
0x00407188
0x00000000
0x00000000
0x0040718e
0x00407191
0x00000000
0x00000000
0x004071a0
0x004071a5
0x004071ac
0x004074a1
0x004074a7
0x00000000
0x004074a7
0x00000000
0x0040701c
0x0040701c
0x00407020
0x00407028
0x00407033
0x00407033
0x00407035
0x00407035
0x00407045
0x00407047
0x00407047
0x00407047
0x0040704a
0x0040704f
0x00407051
0x00407057
0x00407057
0x00407059
0x0040705c
0x004072ce
0x004072d4
0x004072a1
0x004072a6
0x00000000
0x004072a6
0x00407062
0x00407069
0x004072b7
0x004072bd
0x00000000
0x004072bd
0x0040706f
0x00407072
0x004072f2
0x004072f9
0x0040734b
0x0040734d
0x0040730e
0x00407313
0x00407318
0x0040731b
0x0040731d
0x00000000
0x00000000
0x00407324
0x0040732e
0x004070b2
0x004070bb
0x004070bd
0x004070bf
0x004070c1
0x004070c3
0x004070c3
0x004070c3
0x004070c3
0x004072fb
0x004072ff
0x004073f7
0x004073f7
0x004073fa
0x004073fa
0x00407305
0x00000000
0x0040730c
0x0040707f
0x00407084
0x00407087
0x00407089
0x00000000
0x00000000
0x00407094
0x0040709e
0x004070a3
0x004070a7
0x00000000
0x00000000
0x004070a9
0x004070ac
0x00407427
0x0040742c
0x0040742e
0x004071b2
0x004071b2
0x004071b6
0x004070d6
0x004070db
0x004070de
0x004070e0
0x00000000
0x00000000
0x00407297
0x0040729c
0x00000000
0x0040729c
0x004071bc
0x004071bc
0x004071c1
0x004071dc
0x004071dc
0x004071e1
0x004071fc
0x004071fc
0x00407206
0x0040720b
0x0040720e
0x00407210
0x00407435
0x00407438
0x0040743d
0x00407440
0x00407442
0x00000000
0x00000000
0x00407448
0x0040744d
0x00407450
0x00407234
0x00407234
0x00407239
0x00407241
0x00407246
0x0040724b
0x00407255
0x0040725a
0x0040725d
0x0040725f
0x0040737b
0x0040737e
0x004074c2
0x004074cb
0x004074ef
0x004074cd
0x004074cd
0x004074d2
0x00407500
0x004074d4
0x004074de
0x004074de
0x004074d2
0x00407384
0x00407384
0x00407387
0x0040738d
0x00407396
0x004073a6
0x004073a6
0x00407396
0x00407387
0x00407265
0x00407265
0x0040726a
0x0040726c
0x004073b0
0x004073b8
0x004073bd
0x00407272
0x00407276
0x00407279
0x0040727f
0x00407283
0x00407286
0x00407491
0x00407494
0x00407496
0x00407497
0x00407498
0x0040728c
0x0040728f
0x00407294
0x00407294
0x00407286
0x0040726c
0x00000000
0x0040725f
0x00407456
0x0040745a
0x0040745f
0x0040746a
0x0040746e
0x00407473
0x00407476
0x00407478
0x00000000
0x00000000
0x00000000
0x0040747e
0x00407216
0x0040721b
0x0040721e
0x0040734e
0x00407352
0x00407357
0x00407362
0x00407366
0x0040736b
0x0040736e
0x00407370
0x00000000
0x00000000
0x00000000
0x00407376
0x00407224
0x00407224
0x00407228
0x00000000
0x00000000
0x0040722a
0x0040722e
0x004073cc
0x004073ce
0x00000000
0x00000000
0x004073db
0x004073df
0x00000000
0x004073df
0x00000000
0x0040722e
0x004071ec
0x004071f1
0x004071f4
0x004071f6
0x00000000
0x00000000
0x00000000
0x004071f6
0x004071cc
0x004071d1
0x004071d4
0x004071d6
0x00000000
0x00000000
0x00000000
0x004071d6
0x00000000
0x004070ac
0x00407016
0x00406d32
0x00406d35
0x00000000
0x00406d39
0x00406d3d
0x00406d40
0x00406d40
0x00406d35

APIs

free.MSVCRT ref: 00406D6B
wimlib_add_image_multisource.LIBWIM-15 ref: 00406FE3
wimlib_add_image_multisource.LIBWIM-15 ref: 00407000
wcscmp.MSVCRT ref: 0040700F
_errno.MSVCRT ref: 0040704F
_errno.MSVCRT ref: 00407057
wimlib_add_image_multisource.LIBWIM-15 ref: 0040707F
wimlib_add_image_multisource.LIBWIM-15 ref: 0040709E
wimlib_add_image_multisource.LIBWIM-15 ref: 004070D6
wimlib_add_image_multisource.LIBWIM-15 ref: 0040729C
wimlib_add_image_multisource.LIBWIM-15 ref: 004072A6

Strings

"%ls" is not a regular file or block device, xrefs: 004072DE
Cannot stat file "%ls", xrefs: 004072C7
8`A, xrefs: 00406F70
"%ls" is not the first part of the split WIM. You must specify the first part., xrefs: 0040739F
Perhaps the '--ref' argument did not specify all other parts of the split WIM?, xrefs: 004074F9
If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based., xrefs: 004074E8
Cannot specify a compression type that is not the same as that used in the destination WIM, xrefs: 0040749A
--boot specified for all-images export, but source WIM has no bootable image., xrefs: 004073D4
"%ls" is part of a split WIM. Use --ref to specify the other parts., xrefs: 004074D7
'--unsafe-compact' is only valid when exporting to an existing WIM file!, xrefs: 004072B0

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$_errno$freewcscmp
String ID: "%ls" is not a regular file or block device$"%ls" is not the first part of the split WIM. You must specify the first part.$"%ls" is part of a split WIM. Use --ref to specify the other parts.$'--unsafe-compact' is only valid when exporting to an existing WIM file!$--boot specified for all-images export, but source WIM has no bootable image.$8`A$Cannot specify a compression type that is not the same as that used in the destination WIM$Cannot stat file "%ls"$If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.$Perhaps the '--ref' argument did not specify all other parts of the split WIM?
API String ID: 3600674920-2224219681
Opcode ID: 70445b96d3605e6459c0d5cd5b8331f62739a27eaba7c8fde9e255afc73f8482
Instruction ID: 002dd784966e38ee53cbf4488f4dee12bebdf03fd4dd1950f77b0a0e3cc0869f
Opcode Fuzzy Hash: 70445b96d3605e6459c0d5cd5b8331f62739a27eaba7c8fde9e255afc73f8482
Instruction Fuzzy Hash: 21E12A71608B4181EB20AB26E84036F7760F7857A4F50423BEE5A67BE5DF3CD845CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00402780 Relevance: 54.5, APIs: 14, Strings: 17, Instructions: 287
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402780(void* __ebx, void* __ecx, long long __rax, void* __rcx, long long __rdx, long long __r8, char _a16, long long _a24) {
				void* _v80;
				void* _v88;
				void* _v96;
				void* _v104;
				void* _v112;
				void* _v120;
				long long _v128;
				long long _v136;
				void* _v144;
				void* _v152;
				void* _v168;
				void* _t116;
				void* _t117;
				long long _t124;

				_t124 = __rax;
				_a16 = __rdx;
				_a24 = __r8;
				_t117 = E004025C0(_t116, __rcx,  &_a16);
				_v136 = _t124;
				if(_t124 < 0) {
					_v128 = 0;
					return _t117;
				} else {
					__rdx = 0x28;
					 *__rax =  *__rax + __al;
				}
			}

0x00402780
0x00402793
0x004027a6
0x004027ae
0x004027b3
0x004027bb
0x00402b29
0x004028c4
0x004027c1
0x004027c1
0x004027ca
0x004027ca

APIs

calloc.MSVCRT ref: 004027CF

Strings

Unknown update command "%ls" on line %zu, xrefs: 00402B7A
--recursive, xrefs: 00402AE1
--no-replace, xrefs: 00402C09
Unrecognized option "%ls" to update command "%ls" on line %zu, xrefs: 004029C2
--noacls, xrefs: 00402B8E
out of memory, xrefs: 00402897
--verbose, xrefs: 00402A9E
--force, xrefs: 00402A73
--strict-acls, xrefs: 00402BAB
Not enough arguments to update command "%ls" on line %zu, xrefs: 00402AD0
add, xrefs: 0040290D
delete, xrefs: 00402A01
--dereference, xrefs: 00402BE1
--unix-data, xrefs: 00402B01
Unexpected argument "%ls" in update command on line %zu (The "%ls" command only takes %zu nonoption arguments!), xrefs: 00402A5A
rename, xrefs: 00402A29
--no-acls, xrefs: 00402B48

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: calloc
String ID: --dereference$--force$--no-acls$--no-replace$--noacls$--recursive$--strict-acls$--unix-data$--verbose$Not enough arguments to update command "%ls" on line %zu$Unexpected argument "%ls" in update command on line %zu (The "%ls" command only takes %zu nonoption arguments!)$Unknown update command "%ls" on line %zu$Unrecognized option "%ls" to update command "%ls" on line %zu$add$delete$out of memory$rename
API String ID: 2635317215-602251839
Opcode ID: 37925039b4cdec35214b79f0126d7de88d58a953e78bf41a8606e6467021410d
Instruction ID: 0b38c8cb8558b4f77ac3d4a7ad918d7a13d2e88639abad55f6d817ede89e1084
Opcode Fuzzy Hash: 37925039b4cdec35214b79f0126d7de88d58a953e78bf41a8606e6467021410d
Instruction Fuzzy Hash: 82B16172308B8181EA509F16E54875BB764F7857C4F504127EE8A6BBE9DFBCC885C708

Uniqueness

Uniqueness Score: -1.00%

Function 00402E70 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00402E70(void* __eax, void* __edx, intOrPtr* __rax, void* __rcx) {
				void* _v48;
				void* _t22;
				intOrPtr* _t32;

				asm("push ss");
				_t32 =  *((intOrPtr*)(__rax));
				 *((intOrPtr*)(_t32 - 0x7b)) =  *((intOrPtr*)(_t32 - 0x7b)) + _t22;
				asm("ror byte [edi], 0x84");
				asm("int 0x0");
				 *_t32 =  *_t32 + __eax;
			}

0x00402e86
0x00402e87
0x00402e89
0x00402e8c
0x00402e8f
0x00402e91

APIs

wcschr.MSVCRT ref: 00402E85
wcstoul.MSVCRT ref: 00402EAA
_wcsicmp.MSVCRT ref: 00402EE7
wimlib_add_image_multisource.LIBWIM-15 ref: 00402EFA
_wcsicmp.MSVCRT ref: 00402F1A
_wcsicmp.MSVCRT ref: 00402F2B
_wcsicmp.MSVCRT ref: 00402F3C
_wcsicmp.MSVCRT ref: 00402F71
_wcsicmp.MSVCRT ref: 00403021
_wcsicmp.MSVCRT ref: 00403032
fputws.MSVCRT ref: 00403068

Strings

maximum, xrefs: 00402EDD, 00402F67
lzx, xrefs: 00402F10, 00402F90
recovery, xrefs: 00402FD5
Invalid compression type "%ls"!, xrefs: 00403043
max, xrefs: 00402F21, 00402FA1
Compression level must be a positive integer! e.g. --compress=lzx:80, xrefs: 00403000
lzms, xrefs: 00403017
Available compression types: none xpress (alias: "fast") lzx (alias: "maximum") (default for capture) lzms (, xrefs: 0040305E
Warning: use of '--compress=recovery' is discouraged because it behaves differently from DISM. Instead, you typically want to , xrefs: 0040307D
xpress, xrefs: 00402FC0
none, xrefs: 00403028
fast, xrefs: 00402F32

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: _wcsicmp$fputwswcschrwcstoulwimlib_add_image_multisource
String ID: Available compression types: none xpress (alias: "fast") lzx (alias: "maximum") (default for capture) lzms ($Compression level must be a positive integer! e.g. --compress=lzx:80$Invalid compression type "%ls"!$Warning: use of '--compress=recovery' is discouraged because it behaves differently from DISM. Instead, you typically want to $fast$lzms$lzx$max$maximum$none$recovery$xpress
API String ID: 460991057-1681143936
Opcode ID: 64073d8e03de2dfd0af20601232ccf15e4a4d612e4c8a2a5d73f609ad90e38c8
Instruction ID: 0e1996f8404ea9924bc50b81a661de5b9007a7278e6f3d7a97eb52b48c7c0307
Opcode Fuzzy Hash: 64073d8e03de2dfd0af20601232ccf15e4a4d612e4c8a2a5d73f609ad90e38c8
Instruction Fuzzy Hash: 3041D66130064250EE14DB26FD183A72765BB557D8F94902BDD1AAB3E4EFBCCA86D308

Uniqueness

Uniqueness Score: -1.00%

Function 00405A90 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00405A90(short __ecx, void* __rax, void* __rcx, char* __rdx, void* __r8, void* __r9) {
				signed int _v66;
				char _v264;
				char _v312;
				long long _v320;
				void* _v344;
				signed int _t51;
				signed int _t52;
				void* _t68;
				short _t74;
				signed int _t75;
				void* _t79;
				long long _t89;
				signed long long _t93;
				intOrPtr _t95;
				intOrPtr* _t96;
				intOrPtr* _t97;
				signed long long _t98;
				intOrPtr _t153;
				char* _t155;
				long long* _t156;
				char* _t157;
				char* _t159;
				signed long long _t160;
				void* _t161;
				char* _t163;
				void* _t164;
				void* _t170;
				char* _t176;
				void* _t177;

				_t171 = __r9;
				_t165 = __r8;
				_t84 = __rax;
				_t74 = __ecx;
				_t177 = __rcx;
				if( *__rdx != 0) {
					E004023A0(__rax, L"----------------------------------------------------------------------------\n", __rdx, __r8, __r9);
					E004023A0(__rax, L"Full Path           = \"%ls\"\n",  *((intOrPtr*)(_t177 + 0x10)), _t165, __r9);
					_t132 =  *((intOrPtr*)(_t177 + 8));
					if( *((intOrPtr*)(_t177 + 8)) != 0) {
						E004023A0(__rax, L"Short Name          = \"%ls\"\n", _t132, _t165, __r9);
					}
					_t75 =  *(_t177 + 0x30);
					_t96 = 0x41d6c8;
					_t155 = L"    FILE_ATTRIBUTE_%ls is set\n";
					_t51 = E004023A0(_t84, L"Attributes          = 0x%08x\n", _t132, _t165, _t171);
					while(1) {
						_t51 = _t51 &  *(_t177 + 0x30);
						if(_t51 == 0) {
							goto L6;
						}
						_t153 =  *_t96;
						_t96 = _t96 + 0x10;
						_t51 = E004023A0(_t95, _t155, _t153, _t165, _t171);
						if(_t96 != 0x41d7b8) {
							L7:
							_t95 =  *((intOrPtr*)(_t96 - 8));
							continue;
						}
						L10:
						if( *((intOrPtr*)(_t177 + 0x20)) != 0) {
							L004080D0();
						}
						_t159 =  &_v312;
						_t97 =  &_v264;
						_t156 =  *0x416060;
						_v320 =  *((intOrPtr*)(_t177 + 0x48));
						_t52 =  *_t156();
						 *_t97 =  *_t97 + sil;
						asm("ror byte [ecx-0x77], 0xd8");
						_v66 = _t52;
						E004023A0( *((intOrPtr*)(_t177 + 0x48)), L"%-20ls= %ls\n", L"Creation Time", L"%a %b %d %H:%M:%S %Y UTC", _t159);
						_v320 =  *(_t177 + 0x58);
						 *_t156();
						 *_t97 =  *_t97 + sil;
						asm("ror byte [ecx-0x77], cl");
						_v66 = _t75;
						E004023A0( *(_t177 + 0x58) | 0x00014cec, _t97, L"Last Write Time", L"%a %b %d %H:%M:%S %Y UTC", _t159);
						_t89 =  *((intOrPtr*)(_t177 + 0x68));
						_v320 = _t89;
						 *_t156();
						_t174 = _t159;
						 *_t97 =  *_t97 + sil;
						_t164 = _t161;
						_t169 = _t97;
						 *((short*)(_t164 + 0x136)) = _t74;
						E004023A0(_t89, L"%-20ls= %ls\n", L"Last Access Time", _t97, _t159);
						if(( *(_t177 + 0x31) & 0x00000004) != 0) {
							E004023A0(_t89, L"Reparse Tag         = 0x%x\n", L"Last Access Time", _t169, _t174);
						}
						_t142 =  *((intOrPtr*)(_t177 + 0x40));
						E004023A0(_t89, L"Link Group ID       = 0x%016llx\n",  *((intOrPtr*)(_t177 + 0x40)), _t169, _t174);
						E004023A0(_t89, L"Link Count          = %u\n",  *((intOrPtr*)(_t177 + 0x40)), _t169, _t174);
						r9d =  *((intOrPtr*)(_t177 + 0x80));
						if(r9d != 0) {
							r8d =  *((intOrPtr*)(_t177 + 0x7c));
							 *((long long*)(_t164 + 0x20)) = _t89;
							E004023A0(_t89, L"UNIX Data           = uid:%u gid:%u mode:0%o rdev:0x%x\n", _t142, _t169, _t174);
						}
						_t170 = _t177 + 0x88;
						if(( *(_t177 + 0x90) ^  *0x41bf68 |  *(_t177 + 0x88) ^  *0x41bf60) != 0) {
							E004033E0(_t170);
							E004033E0(_t177 + 0x98);
							E004033E0(_t177 + 0xa8);
							E004033E0(_t177 + 0xb8);
						}
						_t160 = 0;
						_t163 = L"\tUnnamed data stream:\n";
						_t157 = L"\tReparse point stream:\n";
						_t176 = L"\tRaw encrypted data stream:\n";
						do {
							_t98 = _t160;
							_t93 = _t98 << 7;
							_t150 =  *((intOrPtr*)(_t177 + _t93 + 0xf8));
							if( *((intOrPtr*)(_t177 + _t93 + 0xf8)) != 0) {
								E004023A0(_t93, L"\tNamed data stream \"%ls\":\n", _t150, _t170, _t174);
							} else {
								if((spl & 0x00000040) != 0) {
									E004023A0(_t93, _t176, _t150, _t170, _t174);
								} else {
									if((spl & 0x00000004) == 0) {
										E004023A0(_t93, _t163, _t150, _t170, _t174);
									} else {
										E004023A0(_t93, _t157, _t150, _t170, _t174);
									}
								}
							}
							_t32 = _t98 + 2; // 0x2
							_t160 = _t160 + 1;
							_t68 = E00403460(_t74, _t93, (_t32 << 7) + _t177, 0, _t170, _t174);
						} while (_t79 <=  *((intOrPtr*)(_t177 + 0x3c)));
						goto L2;
						L6:
						_t96 = _t96 + 0x10;
						if(_t96 == 0x41d7b8) {
							goto L10;
						}
						goto L7;
					}
				} else {
					_t68 = E004023A0(__rax, L"%ls\n",  *((intOrPtr*)(__rcx + 0x10)), __r8, __r9);
					L2:
					return _t68;
				}
			}

0x00405a90
0x00405a90
0x00405a90
0x00405a90
0x00405aa2
0x00405aa5
0x00405ad7
0x00405ae7
0x00405aec
0x00405af3
0x00405afc
0x00405afc
0x00405b01
0x00405b0c
0x00405b1a
0x00405b21
0x00405b3c
0x00405b3c
0x00405b40
0x00000000
0x00000000
0x00405b42
0x00405b48
0x00405b4c
0x00405b54
0x00405b39
0x00405b39
0x00000000
0x00405b39
0x00405b56
0x00405b5d
0x00405b63
0x00405b63
0x00405b6c
0x00405b71
0x00405b76
0x00405b88
0x00405b8d
0x00405ba5
0x00405ba7
0x00405bb9
0x00405bc1
0x00405bd0
0x00405bd5
0x00405bed
0x00405bef
0x00405bfa
0x00405c09
0x00405c0e
0x00405c18
0x00405c1d
0x00405c29
0x00405c35
0x00405c37
0x00405c38
0x00405c42
0x00405c51
0x00405c5b
0x00405de3
0x00405de3
0x00405c61
0x00405c6c
0x00405c7c
0x00405c81
0x00405c8b
0x00405dc2
0x00405dc6
0x00405dca
0x00405dca
0x00405c9f
0x00405cb7
0x00405d6a
0x00405d7d
0x00405d90
0x00405da3
0x00405da3
0x00405cbd
0x00405cbf
0x00405cc6
0x00405ccd
0x00405d0b
0x00405d0b
0x00405d10
0x00405d14
0x00405d1f
0x00405ce7
0x00405d21
0x00405d28
0x00405d53
0x00405d2a
0x00405d2d
0x00405d43
0x00405d2f
0x00405d32
0x00405d32
0x00405d2d
0x00405d28
0x00405cec
0x00405cf2
0x00405cfc
0x00405d01
0x00000000
0x00405b30
0x00405b30
0x00405b37
0x00000000
0x00000000
0x00000000
0x00405b37
0x00405aa7
0x00405ab2
0x00405ab7
0x00405ac8
0x00405ac8

APIs

wcsftime.MSVCRT ref: 00405BA1
wcsftime.MSVCRT ref: 00405BE9
wcsftime.MSVCRT ref: 00405C31

Strings

UNIX Data = uid:%u gid:%u mode:0%o rdev:0x%x, xrefs: 00405DBB
Birth Volume ID, xrefs: 00405D76
%ls, xrefs: 00405AAB
Birth Object ID, xrefs: 00405D89
Reparse point stream:, xrefs: 00405CC6
Last Access Time, xrefs: 00405C3B
----------------------------------------------------------------------------, xrefs: 00405AD0
Link Count = %u, xrefs: 00405C75
Unnamed data stream:, xrefs: 00405CBF
Creation Time, xrefs: 00405BAB
Object ID, xrefs: 00405D63
Named data stream "%ls":, xrefs: 00405CE0
Domain ID, xrefs: 00405D9C
Reparse Tag = 0x%x, xrefs: 00405DDC
Raw encrypted data stream:, xrefs: 00405CCD
Short Name = "%ls", xrefs: 00405AF5
Attributes = 0x%08x, xrefs: 00405B05
Link Group ID = 0x%016llx, xrefs: 00405C65
%a %b %d %H:%M:%S %Y UTC, xrefs: 00405B92, 00405BDA, 00405C1F
%-20ls= %ls, xrefs: 00405BB2, 00405BF3, 00405C4A
Full Path = "%ls", xrefs: 00405AE0
FILE_ATTRIBUTE_%ls is set, xrefs: 00405B1A
Last Write Time, xrefs: 00405C02

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wcsftime
String ID: Named data stream "%ls":$Raw encrypted data stream:$Reparse point stream:$Unnamed data stream:$ FILE_ATTRIBUTE_%ls is set$%-20ls= %ls$%a %b %d %H:%M:%S %Y UTC$%ls$----------------------------------------------------------------------------$Attributes = 0x%08x$Birth Object ID$Birth Volume ID$Creation Time$Domain ID$Full Path = "%ls"$Last Access Time$Last Write Time$Link Count = %u$Link Group ID = 0x%016llx$Object ID$Reparse Tag = 0x%x$Short Name = "%ls"$UNIX Data = uid:%u gid:%u mode:0%o rdev:0x%x
API String ID: 2902305603-2407676844
Opcode ID: a2ea38f65d45ec3a439eb7b4af610e3436febe92c180c813618b6eee624da672
Instruction ID: 6fedbc05f0e744cfc5631b63d3cad02f25b5a7c514b64c1241e7966fe8af6274
Opcode Fuzzy Hash: a2ea38f65d45ec3a439eb7b4af610e3436febe92c180c813618b6eee624da672
Instruction Fuzzy Hash: 1B81B7B1311A85A1EE44EB26E9887DB2369FB407C8F854037DE0D676A4DE3CC586C749

Uniqueness

Uniqueness Score: -1.00%

Function 00407510 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00407510(void* __ecx, void* __rdx) {
				short _v134;
				short _v136;
				char _v168;
				long long _v176;
				long long _v184;
				long long _v192;
				char _v200;
				signed int _v204;
				long long _v224;
				signed long long _v240;
				signed int _v248;
				signed long long _t52;
				void* _t67;
				long long _t74;
				intOrPtr* _t75;
				signed long long _t76;
				long long _t77;
				signed long long _t84;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t120;
				intOrPtr _t126;
				intOrPtr* _t144;
				void* _t148;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr _t157;

				_t74 = "\\";
				_v204 = 0xc0200;
				_t88 = _t92;
				_v184 = 0;
				_v176 = 0;
				_v192 = _t74;
				_v248 = 0;
				_t52 = E00408FE0();
				r14d = _t52;
				if(_t74 == 0xffffffff) {
					_t75 =  *0x4201c0; // 0x416038
					_t76 =  *_t75;
					_t89 = _t88 - _t76;
					_t144 = __rdx + _t76 * 8;
					if(_t89 <= 1) {
						L4:
						asm("invalid");
						 *0x416040();
						asm("invalid");
						dil = dil >> 0xff;
						L5:
						free();
						return r14d;
					}
					if((_v204 & 0x000c0000) == 0) {
						E004024D0(L"Can\'t combine --no-globs and --nullglob!", __rdx, 0x41717e, 0x41e2c0);
						goto L5;
					}
					_t77 =  *_t144;
					_t157 =  *((intOrPtr*)(_t144 + 8));
					_v248 = 0;
					_v224 = _t77;
					L004090A8();
					r14d = _t52;
					if(_t77 != 0) {
						goto L5;
					}
					_t126 = _t157;
					L00409068();
					r13d = _t52;
					if(_t77 == 0) {
						_t52 = E00403BB0(_t157, _v224, 0x401890);
						r14d = _t52;
						if(_t77 != 0) {
							L36:
							L27:
							L00409108();
							goto L5;
						}
						L11:
						r8d = _v176;
						if(r8d != 0) {
							_v248 = r12d;
							r9d = 1;
							L00409088();
							r14d = _t52;
							if(_t77 == 0) {
								goto L12;
							}
							goto L36;
						}
						L12:
						_t90 = _t89 - 2;
						if(_t90 != 0) {
							_t144 = _t144 + 0x10;
						} else {
							_v204 = _v204 & 0xfffbffff;
							_t90 = 0x1;
						}
						do {
							if(_t90 <= 0) {
								L19:
								_t25 =  *_t144 + 2; // 0x1
								_t153 = _t25;
								L00409198();
								if( *_t144 == 0) {
									r12d = 0;
									__imp___putws();
								}
								_t152 = _t153;
								_t148 = 0x41b824;
								_t90 = _t90 - 1;
								_t144 = _t144 + 8;
								_v248 = _v204;
								L00409120();
								r14d = _t52;
								L21:
								if(_t90 == 0) {
									if(r14d != 0) {
										break;
									}
									if( *0x424178 == 0) {
										goto L36;
									}
									E00401650(_t148, _t152);
									goto L27;
								}
								goto L22;
							}
							_t154 = _t144;
							_t120 = _t67;
							_t84 = 0;
							while(1) {
								r15d = _t52;
								if( *((short*)( *_t154)) == 0x40) {
									break;
								}
								_t24 = _t84 + 1; // 0x1
								r15d = _t24;
								_t84 = _t84 + 1;
								_t154 = _t154 + 8;
								if(_t84 == _t120) {
									_t84 = r15d;
									_t154 = _t144 + _t84 * 8;
									L29:
									_v248 = _t84;
									_t152 = _t144;
									_t148 = 0x41b824;
									_t67 = _t67 - r15d;
									_t144 = _t154;
									_v240 = _v204 | 0x00200000;
									L00409118();
									r14d = _t52;
									goto L21;
								}
							}
							if(_t84 != 0) {
								goto L29;
							}
							goto L19;
							L22:
						} while (r14d == 0);
						if(r14d == 0x31) {
							if((_v204 & 0x000c0000) == 0xc0000) {
								asm("adc eax, 0x13e7b");
								E00401650(_t148, _t152);
							}
							if( *0x416020 == 0xffffffff) {
								_t149 =  *0x424108;
								_t152 = L"dir";
								E0040A630(0x4240a0, L"%ls %ls",  *0x424108, L"dir");
							} else {
								_t149 = L"dir";
								E0040A630(0x4240a0, L"wim%ls", L"dir", _t152);
							}
							E00401650(_t149, _t152);
							goto L27;
						}
						if(r14d == 0x37) {
							L004090E0();
							if(_v134 <= 1) {
								E004024D0(L"If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.",  &_v168, _t148, _t152);
							} else {
								if(_v176 != 0) {
									E004024D0(L"Perhaps the \'--ref\' argument did not specify all other parts of the split WIM?",  &_v168, _t148, _t152);
								} else {
									E004024D0(L"\"%ls\" is part of a split WIM. Use --ref to specify the other parts.", _v224, _t148, _t152);
								}
							}
							goto L36;
						}
						if(r14d == 0x24) {
							L004090E0();
							if(_v136 != 1) {
								E004024D0(L"\"%ls\" is not the first part of the split WIM.\n       You must specify the first part.", _v224, _t148, _t152);
							}
							goto L36;
						}
						goto L27;
					}
					if(_t77 == 0xffffffff) {
						r14d = 0x12;
						E004024D0(L"Cannot specify all images for this action!", _t126,  &_v200, 0x401890);
						goto L27;
					}
					goto L11;
				} else {
					if(_t74 > 0x3a) {
						goto L4;
					} else {
						goto __rax;
					}
				}
			}

0x00407523
0x00407547
0x0040754f
0x00407554
0x0040755d
0x00407566
0x00407570
0x0040758c
0x00407591
0x00407597
0x00407710
0x00407717
0x0040771a
0x0040771c
0x00407724
0x004075b0
0x004075b9
0x004075bb
0x004075ca
0x004075cb
0x004075ce
0x004075d3
0x004075ee
0x004075ee
0x00407732
0x00407a57
0x00000000
0x00407a57
0x00407738
0x0040773b
0x00407747
0x0040775a
0x0040775f
0x00407764
0x00407769
0x00000000
0x00000000
0x00407774
0x00407777
0x0040777c
0x00407781
0x00407950
0x00407955
0x0040795a
0x0040793e
0x00407878
0x00407878
0x00000000
0x00407878
0x00407790
0x00407790
0x00407798
0x00407919
0x00407923
0x0040792e
0x00407933
0x00407938
0x00000000
0x00000000
0x00000000
0x00407938
0x0040779e
0x0040779e
0x004077a1
0x004078e5
0x004077a7
0x004077a7
0x004077af
0x004077b8
0x004077c0
0x004077c2
0x004077fa
0x00407804
0x00407804
0x0040780b
0x00407812
0x004078d7
0x004078da
0x004078da
0x00407821
0x00407824
0x0040782a
0x0040782d
0x00407831
0x00407835
0x0040783a
0x0040783d
0x0040783f
0x004078f1
0x00000000
0x00000000
0x00407901
0x00000000
0x00000000
0x0040790a
0x00000000
0x0040790f
0x00000000
0x0040783f
0x004077c4
0x004077c7
0x004077ca
0x004077e5
0x004077e9
0x004077f0
0x00000000
0x00000000
0x004077d0
0x004077d0
0x004077d4
0x004077d8
0x004077df
0x00407898
0x0040789b
0x0040789f
0x004078a3
0x004078a8
0x004078ab
0x004078b3
0x004078b6
0x004078bb
0x004078c2
0x004078c7
0x00000000
0x004078c7
0x004077df
0x004077f4
0x00000000
0x00000000
0x00000000
0x00407845
0x00407845
0x00407852
0x00407976
0x00407a90
0x00407a98
0x00407a98
0x00407983
0x00407a61
0x00407a68
0x00407a7d
0x00407989
0x00407989
0x0040799e
0x0040799e
0x004079bb
0x00000000
0x004079c0
0x00407861
0x004079eb
0x004079f9
0x00407aba
0x004079ff
0x00407a05
0x00407aa9
0x00407a0b
0x00407a17
0x00407a17
0x00407a05
0x00000000
0x004079f9
0x0040786b
0x00407a26
0x00407a34
0x00407a46
0x00407a46
0x00000000
0x00407a34
0x00000000
0x0040786b
0x0040778a
0x004079d1
0x004079d7
0x00000000
0x004079dc
0x00000000
0x0040759d
0x004075a4
0x00000000
0x004075a6
0x004075ad
0x004075ad
0x004075a4

APIs

free.MSVCRT ref: 004075D3
wimlib_add_image_multisource.LIBWIM-15 ref: 0040775F
wimlib_add_image_multisource.LIBWIM-15 ref: 00407777
wcscmp.MSVCRT ref: 0040780B
wimlib_add_image_multisource.LIBWIM-15 ref: 00407835
wimlib_add_image_multisource.LIBWIM-15 ref: 00407878

Strings

Cannot specify all images for this action!, xrefs: 004079CA
Reading pathlist file from standard input..., xrefs: 004078D0
Done extracting files., xrefs: 00407903
Note: You can use the '--nullglob' option to ignore missing files., xrefs: 00407A8E
Perhaps the '--ref' argument did not specify all other parts of the split WIM?, xrefs: 00407AA2
If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based., xrefs: 00407AB3
wim%ls, xrefs: 00407990
"%ls" is part of a split WIM. Use --ref to specify the other parts., xrefs: 00407A10
dir, xrefs: 00407989, 00407A68
8`A, xrefs: 00407710
"%ls" is not the first part of the split WIM. You must specify the first part., xrefs: 00407A3F
Can't combine --no-globs and --nullglob!, xrefs: 00407A50
%ls %ls, xrefs: 00407A6F
Note: You can use `%ls' to see what files and directories are in the WIM image., xrefs: 004079B1

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$freewcscmp
String ID: "%ls" is not the first part of the split WIM. You must specify the first part.$"%ls" is part of a split WIM. Use --ref to specify the other parts.$%ls %ls$8`A$Can't combine --no-globs and --nullglob!$Cannot specify all images for this action!$Done extracting files.$If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.$Note: You can use `%ls' to see what files and directories are in the WIM image.$Note: You can use the '--nullglob' option to ignore missing files.$Perhaps the '--ref' argument did not specify all other parts of the split WIM?$Reading pathlist file from standard input...$dir$wim%ls
API String ID: 2185311064-1946456860
Opcode ID: 44fd3a11541b01dce2cbbbce06196e5f1d44d50af26e4622d9e05b64f2b51ba8
Instruction ID: 7189937cf0ab187ef8f922c126a49e3a56d9e9a994ffb4d52cea50f5dfe6db86
Opcode Fuzzy Hash: 44fd3a11541b01dce2cbbbce06196e5f1d44d50af26e4622d9e05b64f2b51ba8
Instruction Fuzzy Hash: 0FA1037270864181EB10EF26E8443AA7760F784798F90803BEA4E673E5DF7CD446C74A

Uniqueness

Uniqueness Score: -1.00%

Function 004066E0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004066E0(void* __ecx, void* __edx, void* __rax, void* __rdx) {
				long long _v136;
				long long _v144;
				long long _v152;
				long long _v160;
				long long _v168;
				char _v176;
				char _v184;
				char _v192;
				long long _v200;
				char _v208;
				long long _v224;
				long long _v232;
				long long _v240;
				long long _v264;
				void* _t71;
				void* _t76;
				void* _t77;
				void* _t82;
				intOrPtr* _t83;
				long long _t84;
				intOrPtr* _t87;
				void* _t91;
				void* _t92;
				void* _t94;
				long long _t109;
				char* _t110;
				void* _t117;
				signed long long _t126;
				intOrPtr _t137;
				long long _t149;
				signed long long _t161;
				long long _t162;
				long long _t163;
				long long _t164;

				_t82 = __rax;
				_t77 = __ecx;
				r15d = 0;
				r14d = 0;
				r13d = 0;
				_t148 = 0x41b3cc;
				_v176 = 0;
				_t91 = _t94;
				_v240 = 0;
				_v232 = 4;
				asm("o16 nop [eax+eax]");
				_v264 = 0;
				_t160 = 0x41d9a0;
				_t71 = E00408FE0();
				if(_t82 == 0xffffffff) {
					_t83 =  *0x4201c0; // 0x416038
					_t126 =  *_t83;
					_t92 = _t91 - _t126;
					_t162 = __rdx + _t126 * 8;
					_t84 = _t92 - 1;
					if(_t84 > 1) {
						goto L5;
					}
					_t148 =  *_t162;
					_v264 = 0;
					_t160 = 0x401890;
					_v224 = _t162;
					L004090A8();
					if(_t84 != 0) {
						goto L6;
					}
					_t163 = _v224;
					if(_t92 == 2) {
						_v232 = _t163;
						L00409068();
						_t163 = _v232;
						if(_t84 == 0) {
							_t71 = E00403BB0( *((intOrPtr*)(_t163 + 8)), _t148, 0x401890);
							if(_t84 == 0) {
								L12:
								_t149 = _v176;
								if(_t149 == 0) {
									if(_v240 == 0) {
										L00409158();
										if(_t84 != 0) {
											__imp___putws();
											 *_t84 =  *_t84 + _t71;
											_t149 = _t84;
											E0040A630(0x4240a0, L"wim%ls", L"update", _t160);
											E00401650(0x4240a0, _t160);
										}
										E00403260(_t84,  &_v168);
										_t109 = _t84;
										if(_t84 == 0) {
											_v200 = 0;
											asm("invalid");
											L26:
											L00409108();
											goto L6;
										}
										E004023F0(_t84, _t109, _v168,  &_v192);
										_v200 = _t84;
										if(_t84 == 0) {
											goto ( *((intOrPtr*)(_t149 + 0xf)));
											goto L26;
										}
										_t110 =  &_v200;
										_t71 = E00402780(_t76, _t77, _t84, _t110, _v192,  &_v184);
										_t148 = _t84;
										if(_t84 != 0) {
											L14:
											_t161 = _v184;
											if(_t161 == 0) {
												L21:
												_v264 = 1;
												L00409018();
												if(_t84 != 0) {
													L24:
													free();
													L25:
													free();
													goto L26;
												}
												if(_v240 != 0) {
													L29:
													r9d = 1;
													_v264 = 1;
													_v168 = 0;
													_v160 = _v240;
													_t84 = L"/Windows/System32/WimBootCompress.ini";
													_v152 = _t84;
													_v144 = 0;
													_v136 = 0;
													L00409018();
													if(_t84 == 0) {
														goto L23;
													}
													goto L24;
												}
												L23:
												r8d = r14d;
												L004090A0();
												goto L24;
											}
											_t87 = _t148;
											_t117 = _t148 + (_t161 + _t161 * 4) * 8;
											while(1) {
												L19:
												_t137 =  *_t87;
												if(_t137 == 0) {
													break;
												}
												if(_t137 == 1) {
													 *(_t87 + 0x10) =  *(_t87 + 0x10) | r13d;
												}
												_t84 = _t87 + 0x28;
												if(_t84 == _t117) {
													goto L21;
												}
											}
											 *(_t87 + 0x20) =  *(_t87 + 0x20) | 0x00000884;
											_t87 = _t87 + 0x28;
											 *((long long*)(_t87 - 0x10)) = _t164;
											if(_t87 != _t117) {
												goto L19;
											}
											goto L21;
										}
										L38:
										 *((long long*)(_t110 - 0x75)) =  *((long long*)(_t110 - 0x75)) - 1;
										goto L25;
									}
									_v264 = 1;
									r9d = 0;
									r8d = 0;
									_v200 = 0;
									_v184 = 0;
									L00409018();
									if(_t84 != 0) {
										goto L24;
									}
									goto L29;
								}
								_v200 = 0;
								L00409180();
								_t110 =  &_v176;
								_t71 = E00402780(_t76, _t77, _t84, _t110, _t84,  &_v184);
								_t148 = _t84;
								if(_t84 == 0) {
									goto L38;
								}
								goto L14;
							}
							goto L26;
						}
						if(_t84 != 0xffffffff) {
							goto L12;
						}
						asm("invalid");
						asm("invalid");
						goto L26;
					}
					L004090E0();
					r8d = _v152;
					if(r8d != 1) {
						_t71 = E004024D0(L"\"%ls\" contains %d images; Please select one.", _t148,  &_v208, 0x401890);
						L00409108();
						goto L5;
					}
					goto L12;
				} else {
					if(_t82 - 3 > 0x39) {
						L5:
						asm("invalid");
						asm("adc eax, 0xf8a8");
						asm("invalid");
						L6:
						free();
						return _t71;
					}
					goto __rax;
				}
			}

0x004066e0
0x004066e0
0x004066f3
0x004066f6
0x004066f9
0x00406705
0x0040670b
0x00406714
0x00406719
0x00406722
0x0040672a
0x00406730
0x00406739
0x0040674c
0x00406754
0x00406940
0x00406947
0x0040694a
0x0040694c
0x00406950
0x00406956
0x00000000
0x00000000
0x0040695c
0x00406968
0x00406971
0x00406978
0x00406980
0x00406989
0x00000000
0x00000000
0x00406997
0x0040699c
0x00406b56
0x00406b5b
0x00406b60
0x00406b69
0x00406c19
0x00406c22
0x004069c6
0x004069c6
0x004069ce
0x00406aa6
0x00406ba6
0x00406bad
0x00406c34
0x00406c43
0x00406c53
0x00406c5d
0x00406c73
0x00406c73
0x00406bb7
0x00406bbc
0x00406bc2
0x00406c7d
0x00406c8f
0x00406a91
0x00406a96
0x00000000
0x00406a96
0x00406bd5
0x00406bda
0x00406be2
0x00406c99
0x00000000
0x00406c99
0x00406bed
0x00406bf7
0x00406bfc
0x00406c02
0x00406a03
0x00406a03
0x00406a0b
0x00406a48
0x00406a48
0x00406a5a
0x00406a63
0x00406a7f
0x00406a82
0x00406a87
0x00406a8c
0x00000000
0x00406a8c
0x00406a70
0x00406ae3
0x00406ae8
0x00406af0
0x00406b00
0x00406b0b
0x00406b13
0x00406b1a
0x00406b22
0x00406b2e
0x00406b39
0x00406b47
0x00000000
0x00000000
0x00000000
0x00406b4d
0x00406a72
0x00406a72
0x00406a78
0x00000000
0x00406a7d
0x00406a11
0x00406a14
0x00406a32
0x00406a32
0x00406a32
0x00406a36
0x00000000
0x00000000
0x00406a23
0x00406a25
0x00406a25
0x00406a29
0x00406a30
0x00000000
0x00000000
0x00406a30
0x00406a38
0x00406a3b
0x00406a3f
0x00406a46
0x00000000
0x00000000
0x00000000
0x00406a46
0x00406c08
0x00406c11
0x00000000
0x00406c11
0x00406aac
0x00406ab4
0x00406ab7
0x00406abc
0x00406aca
0x00406ad3
0x00406ae1
0x00000000
0x00000000
0x00000000
0x00406ae1
0x004069d4
0x004069e0
0x004069e5
0x004069f2
0x004069f7
0x004069fd
0x00000000
0x00000000
0x00000000
0x004069fd
0x00000000
0x00406c28
0x00406b72
0x00000000
0x00000000
0x00406b88
0x00406b8c
0x00000000
0x00406b8c
0x004069aa
0x004069af
0x004069bb
0x00406775
0x0040677f
0x00000000
0x0040677f
0x00000000
0x0040675a
0x00406760
0x00406788
0x00406791
0x00406793
0x004067a3
0x004067a5
0x004067aa
0x004067c4
0x004067c4
0x00406769
0x00406769

APIs

free.MSVCRT ref: 004067AA
wimlib_add_image_multisource.LIBWIM-15 ref: 00406980
wimlib_add_image_multisource.LIBWIM-15 ref: 004069AA
wcslen.MSVCRT ref: 004069E0
wimlib_add_image_multisource.LIBWIM-15 ref: 00406A5A
wimlib_add_image_multisource.LIBWIM-15 ref: 00406A78
free.MSVCRT ref: 00406A82
free.MSVCRT ref: 00406A8C
wimlib_add_image_multisource.LIBWIM-15 ref: 00406A96

Strings

Cannot specify all images for this action!, xrefs: 00406B78
8`A, xrefs: 00406940
Some uncommon options are not listed;See %ls.pdf in the doc directory for more details., xrefs: 00406C69
/Windows/System32/WimBootCompress.ini, xrefs: 00406B13
wim%ls, xrefs: 00406C4C
update, xrefs: 00406C45
"%ls" contains %d images; Please select one., xrefs: 0040676B
Reading update commands from standard input..., xrefs: 00406C2D

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$free$wcslen
String ID: "%ls" contains %d images; Please select one.$/Windows/System32/WimBootCompress.ini$8`A$Cannot specify all images for this action!$Reading update commands from standard input...$Some uncommon options are not listed;See %ls.pdf in the doc directory for more details.$update$wim%ls
API String ID: 2446247102-2767876732
Opcode ID: ccb5319d891cb4380bfc23315296452613700f627b5a4912244ccfc1fd075ce4
Instruction ID: 7e3f1bc8a46ca9745f0129ab02a4bb36e088f0e0425f346822cb4a0234ac646f
Opcode Fuzzy Hash: ccb5319d891cb4380bfc23315296452613700f627b5a4912244ccfc1fd075ce4
Instruction Fuzzy Hash: 67A1B172304A8182EB20EB15E45039B6760F7C5798F51413BEE8A677D9DF7CC94ACB48

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF0 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 182COMMON

Download Yara Rule

APIs

wimlib_add_image_multisource.LIBWIM-15 ref: 0040607B
wimlib_add_image_multisource.LIBWIM-15 ref: 004060B5
wimlib_add_image_multisource.LIBWIM-15 ref: 004060DA
_wstat64.MSVCRT ref: 004060FB
wimlib_add_image_multisource.LIBWIM-15 ref: 00406143
_wstat64.MSVCRT ref: 00406158
fputws.MSVCRT ref: 004061A8
wimlib_add_image_multisource.LIBWIM-15 ref: 004061DD

Strings

%lld KiB, xrefs: 004061C1
Space saved: , xrefs: 0040619E, 00406252
"%ls" optimized size: , xrefs: 0040616A, 0040622B
8`A, xrefs: 00406040
@, xrefs: 00405E1A
"%ls" original size: , xrefs: 0040610D, 00406203
Optimization of "%ls" failed., xrefs: 00406272
%llu KiB, xrefs: 00406126, 00406183
Unknown, xrefs: 0040620F, 00406237, 00406261

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$_wstat64$fputws
String ID: "%ls" optimized size: $"%ls" original size: $%lld KiB$%llu KiB$8`A$@$Optimization of "%ls" failed.$Space saved: $Unknown
API String ID: 4201218009-1591724075
Opcode ID: 69de60b603370e71c812634086c3519631db66244f19b4ac6a028aea6afaca81
Instruction ID: 40d2f62137930401acd4276341f6e4df3fe24ac29b4dd5eeb264ccf7580196a1
Opcode Fuzzy Hash: 69de60b603370e71c812634086c3519631db66244f19b4ac6a028aea6afaca81
Instruction Fuzzy Hash: 0C61B3B1301A0191DA10EB2AE9543AA6361A7857F4F844337DE3A6B3E6EF3DC855C349

Uniqueness

Uniqueness Score: -1.00%

Function 00406290 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00406290(void* __ecx, void* __rax, void* __rdx) {
				short _v134;
				short _v136;
				intOrPtr _v152;
				void* _v168;
				long long _v176;
				long long _v184;
				long long _v192;
				long long _v196;
				long long _v208;
				long long _v216;
				void* _t47;
				void* _t63;
				intOrPtr* _t64;
				signed long long _t65;
				intOrPtr _t66;
				void* _t72;
				void* _t73;
				intOrPtr _t74;
				void* _t75;
				long long _t85;
				long long _t88;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr* _t119;
				intOrPtr _t123;
				intOrPtr _t125;
				intOrPtr _t126;

				_t63 = __rax;
				r12d = 0;
				_v196 = 0;
				_t72 = _t75;
				_v184 = 0;
				_v176 = 0;
				_v216 = 0;
				_t124 = 0x41ee20;
				_t122 = 0x41717e;
				_t47 = E00408FE0();
				if(_t63 == 0xffffffff) {
					_t64 =  *0x4201c0; // 0x416038
					_t65 =  *_t64;
					_t73 = _t72 - _t65;
					_t119 = __rdx + _t65 * 8;
					_t66 = _t73 - 2;
					if(_t66 > 1) {
						goto L5;
					}
					_t125 =  *_t119;
					L00409198();
					if(_t66 != 0) {
						_v216 = 0;
						_t124 = 0x401890;
						_t122 =  &_v192;
						L004090A8();
						r13d = _t47;
						if(_t66 != 0) {
							goto L6;
						}
						L004090E0();
						if(_t73 == 3) {
							_t126 =  *((intOrPtr*)(_t119 + 8));
							_t109 = _t126;
							L00409068();
							_t74 = _t66;
							if(_t66 == 0) {
								_t109 = _t125;
								_t47 = E00403BB0(_t126, _t125, 0x401890);
								r13d = _t47;
								if(_t66 == 0) {
									goto L39;
								}
								L31:
								L16:
								L00409108();
								goto L6;
							}
							L39:
							_t117 =  *((intOrPtr*)(_t119 + 0x10));
							L21:
							r8d = _v176;
							_t85 = _v192;
							if(r8d == 0) {
								L24:
								if(_t85 == 0) {
									L12:
									L004080C0();
									r9d = _v196;
									_t123 = _t117;
									_t110 = _t126;
									_v208 = 0;
									_v216 = 0x401890;
									L00409128();
									r13d = _t47;
									L13:
									if(r13d != 0) {
										_t88 = _v192;
										if(r13d == 0x37) {
											if(_t88 == 0) {
												E004024D0(L"If you are applying an image from a split pipable WIM,\n       make sure you have concatenated together all parts.", _t110, _t123, _t124);
											} else {
												if(_v134 <= 1) {
													E004024D0(L"If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.", _t110, _t123, _t124);
												} else {
													if(_v176 != 0) {
														E004024D0(L"Perhaps the \'--ref\' argument did not specify all other parts of the split WIM?", _t110, _t123, _t124);
													} else {
														E004024D0(L"\"%ls\" is part of a split WIM. Use --ref to specify the other parts.", _t125, _t123, _t124);
													}
												}
											}
											goto L16;
										}
										if(r13d != 0x24 || _t88 == 0 || _v136 == 1) {
											goto L16;
										} else {
											E004024D0(L"\"%ls\" is not the first part of the split WIM.\n       You must specify the first part.", _t125, _t123, _t124);
											goto L31;
										}
									}
									if( *0x424178 == 0) {
										goto L31;
									}
									E00401650(_t123, _t124);
									goto L16;
								}
								r9d = _v196;
								_t123 = _t117;
								_t110 = _t74;
								L00409130();
								r13d = _t47;
								goto L13;
							}
							if(_t85 == 0) {
								L36:
								r13d = 0xffffffff;
								E004024D0(L"Can\'t specify --ref when applying from stdin!", _t109, _t122, _t124);
								goto L16;
							}
							_v216 = r12d;
							r9d = 1;
							L00409088();
							_t85 = _v192;
							r13d = _t47;
							if(_t66 != 0) {
								goto L16;
							}
							goto L24;
						}
						r8d = _v152;
						if(r8d != 1) {
							E004024D0(L"\"%ls\" contains %d images; Please select one (or all).", _t125,  &_v192, 0x401890);
							L00409108();
							goto L5;
						}
						_t117 =  *((intOrPtr*)(_t119 + 8));
						r15d = 0;
						_t74 = 0x1;
						goto L21;
					}
					_t117 =  *((intOrPtr*)(_t119 + 8));
					r15d = 0;
					if(_t73 != 2) {
						_t126 = _t117;
						_t117 =  *((intOrPtr*)(_t119 + 0x10));
					}
					_v192 = 0;
					_t109 = _v176;
					if(_v176 != 0) {
						goto L36;
					} else {
						goto L12;
					}
				} else {
					if(_t63 - 3 <= 0x3a) {
						goto __rax;
					}
					L5:
					asm("invalid");
					 *0x416040();
					asm("loop 0xffffffd4");
					asm("invalid");
					L6:
					free();
					return r13d;
				}
			}

0x00406290
0x004062aa
0x004062b4
0x004062bc
0x004062c1
0x004062ca
0x004062d8
0x004062e1
0x004062ed
0x004062f4
0x004062fc
0x00406440
0x00406447
0x0040644a
0x0040644c
0x00406450
0x00406456
0x00000000
0x00000000
0x0040645c
0x00406469
0x00406470
0x00406513
0x0040651c
0x00406529
0x0040652e
0x00406533
0x00406538
0x00000000
0x00000000
0x00406548
0x00406550
0x00406675
0x0040667e
0x00406681
0x00406686
0x0040668a
0x004066c1
0x004066c7
0x004066cc
0x004066d1
0x00000000
0x00000000
0x00406607
0x004064f9
0x004064f9
0x00000000
0x004064f9
0x0040668c
0x0040668c
0x00406571
0x00406571
0x00406576
0x0040657e
0x004065ae
0x004065b1
0x0040649e
0x004064a0
0x004064a5
0x004064aa
0x004064ad
0x004064b9
0x004064c2
0x004064c7
0x004064cc
0x004064cf
0x004064d2
0x004065ce
0x004065d7
0x00406614
0x00406666
0x00406616
0x0040661c
0x004066b2
0x00406622
0x00406628
0x0040669c
0x0040662a
0x00406634
0x00406639
0x00406628
0x0040661c
0x00000000
0x00406614
0x004065dd
0x00000000
0x004065f8
0x00406602
0x00000000
0x00406602
0x004065dd
0x004064e2
0x00000000
0x00000000
0x004064ef
0x00000000
0x004064f4
0x004065b7
0x004065bc
0x004065bf
0x004065c1
0x004065c6
0x00000000
0x004065c6
0x00406583
0x00406643
0x0040664a
0x00406650
0x00000000
0x00406655
0x00406589
0x00406593
0x00406599
0x0040659e
0x004065a3
0x004065a8
0x00000000
0x00000000
0x00000000
0x004065a8
0x00406556
0x0040655f
0x0040631d
0x00406327
0x00000000
0x00406327
0x00406565
0x00406569
0x0040656c
0x00000000
0x0040656c
0x00406476
0x0040647a
0x00406480
0x00406482
0x00406485
0x00406485
0x00406489
0x00406492
0x00406498
0x00000000
0x00000000
0x00000000
0x00000000
0x00406302
0x00406308
0x00406311
0x00406311
0x00406330
0x00406339
0x0040633b
0x0040634a
0x0040634c
0x0040634e
0x00406353
0x0040636e
0x0040636e

APIs

free.MSVCRT ref: 00406353
wcscmp.MSVCRT ref: 00406469
wimlib_add_image_multisource.LIBWIM-15 ref: 004064C7
wimlib_add_image_multisource.LIBWIM-15 ref: 004064F9

Strings

"%ls" contains %d images; Please select one (or all)., xrefs: 00406313
Can't specify --ref when applying from stdin!, xrefs: 00406643
8`A, xrefs: 00406440
"%ls" is not the first part of the split WIM. You must specify the first part., xrefs: 004065FB
Perhaps the '--ref' argument did not specify all other parts of the split WIM?, xrefs: 00406695
If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based., xrefs: 004066AB
If you are applying an image from a split pipable WIM, make sure you have concatenated together all parts., xrefs: 0040665F
"%ls" is part of a split WIM. Use --ref to specify the other parts., xrefs: 0040662A
Done applying WIM image., xrefs: 004064E8

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$freewcscmp
String ID: "%ls" contains %d images; Please select one (or all).$"%ls" is not the first part of the split WIM. You must specify the first part.$"%ls" is part of a split WIM. Use --ref to specify the other parts.$8`A$Can't specify --ref when applying from stdin!$Done applying WIM image.$If this is a delta WIM, use the --ref argument to specify the WIM(s) on which it is based.$If you are applying an image from a split pipable WIM, make sure you have concatenated together all parts.$Perhaps the '--ref' argument did not specify all other parts of the split WIM?
API String ID: 2185311064-383427211
Opcode ID: 65cf2f736e134467be7fabb9f8acdc2f766d0bad7f0e927e69c988d4b1608ed3
Instruction ID: 4e4d2f4ac0e0cd7c861715299ef40271c42ba309713b072af7949f0486573b08
Opcode Fuzzy Hash: 65cf2f736e134467be7fabb9f8acdc2f766d0bad7f0e927e69c988d4b1608ed3
Instruction Fuzzy Hash: 0671BD71314A4181DA20DB22E85036B6760FB847C8F81543BEE4B6BBE9CF7DC8958748

Uniqueness

Uniqueness Score: -1.00%

Function 00403460 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00403460(signed char __ecx, void* __rax, intOrPtr* __rcx, void* __rdx, intOrPtr __r8, intOrPtr __r9) {
				void* _t39;
				signed char _t45;
				signed char _t48;
				intOrPtr* _t52;
				signed long long _t53;
				signed char* _t54;
				signed long long _t75;
				void* _t84;
				intOrPtr* _t86;

				_t88 = __r9;
				_t87 = __r8;
				_t48 = __ecx;
				_t86 = __rcx;
				E004023A0(__rax, L"Hash              = 0x", __rdx, __r8, __r9);
				_t54 = _t86 + 0x18;
				_t84 = _t86 + 0x2c;
				asm("o16 nop [cs:eax+eax]");
				do {
					_t75 =  *_t54 & 0x000000ff;
					_t54 =  &(_t54[1]);
					_t39 = E004023A0(__rax, L"%02hhx", _t75, _t87, __r9);
				} while (_t54 != _t84);
				_t52 = __rax -  *0x1;
				dil = dil + dil;
				 *0x901D8B480000000B =  *0x901D8B480000000B >> _t48;
				L004091F8();
				if(( *(_t86 + 0x34) & 0x00000010) == 0) {
					E004023A0(_t52, L"Uncompressed size = %llu bytes\n",  *_t86, _t87, __r9);
					if(( *(_t86 + 0x34) & 0x00000020) != 0) {
						_t88 =  *((intOrPtr*)(_t86 + 0x38));
						_t87 =  *((intOrPtr*)(_t86 + 0x40));
						E004023A0(_t52, L"Solid resource    = %llu => %llu bytes @ offset %llu\n",  *((intOrPtr*)(_t86 + 0x48)),  *((intOrPtr*)(_t86 + 0x40)),  *((intOrPtr*)(_t86 + 0x38)));
						E004023A0(_t52, L"Solid offset      = %llu bytes\n",  *((intOrPtr*)(_t86 + 0x10)),  *((intOrPtr*)(_t86 + 0x40)),  *((intOrPtr*)(_t86 + 0x38)));
					} else {
						E004023A0(_t52, L"Compressed size   = %llu bytes\n",  *((intOrPtr*)(_t86 + 8)), _t87, _t88);
						E004023A0(_t52, L"Offset in WIM     = %llu bytes\n",  *((intOrPtr*)(_t86 + 0x10)), _t87, _t88);
					}
					E004023A0(_t52, L"Part Number       = %u\n",  *((intOrPtr*)(_t86 + 0x2c)), _t87, _t88);
					_t81 =  *((intOrPtr*)(_t86 + 0x30));
					E004023A0(_t52, L"Reference Count   = %u\n",  *((intOrPtr*)(_t86 + 0x30)), _t87, _t88);
					_t45 = E004023A0(_t52, L"Flags             = ",  *((intOrPtr*)(_t86 + 0x30)), _t87, _t88);
					_t53 =  *(_t86 + 0x34) & 0x000000ff;
					if((_t45 & 0x00000001) != 0) {
						_t45 = E004023A0(_t53, L"WIM_RESHDR_FLAG_COMPRESSED  ", _t81, _t87, _t88);
						_t53 =  *(_t86 + 0x34) & 0x000000ff;
					}
					if((_t45 & 0x00000002) != 0) {
						_t45 = E004023A0(_t53, L"WIM_RESHDR_FLAG_METADATA  ", _t81, _t87, _t88);
						_t53 =  *(_t86 + 0x34) & 0x000000ff;
					}
					if((_t45 & 0x00000004) != 0) {
						_t45 = E004023A0(_t53, L"WIM_RESHDR_FLAG_FREE  ", _t81, _t87, _t88);
						_t53 =  *(_t86 + 0x34) & 0x000000ff;
					}
					if((_t45 & 0x00000008) != 0) {
						_t45 = E004023A0(_t53, L"WIM_RESHDR_FLAG_SPANNED  ", _t81, _t87, _t88);
						_t53 =  *(_t86 + 0x34) & 0x000000ff;
					}
					if((_t45 & 0x00000020) != 0) {
						_t45 = E004023A0(_t53, L"WIM_RESHDR_FLAG_SOLID  ", _t81, _t87, _t88);
					}
					 *_t53 =  *_t53 + _t45;
					 *((intOrPtr*)(_t53 - 0x77)) =  *((intOrPtr*)(_t53 - 0x77)) + _t48;
					return _t45;
					_pop(__rsp);
					 *__rax =  *__rax + __al;
				}
				 *_t52 =  *_t52 + _t39;
				 *((intOrPtr*)(_t52 - 0x77)) =  *((intOrPtr*)(_t52 - 0x77)) + _t48;
				return _t39;
				 *__rax =  *__rax + __al;
				__rax = 0;
				return __eax;
			}

0x00403460
0x00403460
0x00403460
0x0040346f
0x00403479
0x0040347e
0x00403482
0x00403486
0x00403490
0x00403490
0x00403493
0x0040349a
0x0040349f
0x004034ad
0x004034af
0x004034b1
0x004034ba
0x004034c3
0x004034f3
0x004034fc
0x00403594
0x0040359f
0x004035a3
0x004035b3
0x00403502
0x0040350d
0x0040351d
0x0040351d
0x0040352c
0x00403531
0x0040353b
0x00403547
0x0040354c
0x00403552
0x0040361f
0x00403624
0x00403624
0x0040355a
0x00403607
0x0040360c
0x0040360c
0x00403562
0x004035ef
0x004035f4
0x004035f4
0x0040356a
0x004035d7
0x004035dc
0x004035dc
0x0040356e
0x004035c7
0x004035c7
0x00403579
0x0040357b
0x0040357e
0x00403581
0x00403582
0x00403582
0x004034ce
0x004034d0
0x004034d3
0x004034d7
0x004034d9
0x004034e3

APIs

fputwc.MSVCRT ref: 004034BA
fputwc.MSVCRT ref: 004034D4

Strings

Offset in WIM = %llu bytes, xrefs: 00403516
Uncompressed size = %llu bytes, xrefs: 004034EC
, xrefs: 004034F8
WIM_RESHDR_FLAG_COMPRESSED , xrefs: 00403618
Compressed size = %llu bytes, xrefs: 00403506
%02hhx, xrefs: 00403468
WIM_RESHDR_FLAG_METADATA , xrefs: 00403600
Solid resource = %llu => %llu bytes @ offset %llu, xrefs: 00403598
WIM_RESHDR_FLAG_FREE , xrefs: 004035E8
WIM_RESHDR_FLAG_SOLID , xrefs: 004035C0
Flags = , xrefs: 00403540
Hash = 0x, xrefs: 00403472
Solid offset = %llu bytes, xrefs: 004035AC
Reference Count = %u, xrefs: 00403534
WIM_RESHDR_FLAG_SPANNED , xrefs: 004035D0
Part Number = %u, xrefs: 00403525

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fputwc
String ID: $%02hhx$Compressed size = %llu bytes$Flags = $Hash = 0x$Offset in WIM = %llu bytes$Part Number = %u$Reference Count = %u$Solid offset = %llu bytes$Solid resource = %llu => %llu bytes @ offset %llu$Uncompressed size = %llu bytes$WIM_RESHDR_FLAG_COMPRESSED $WIM_RESHDR_FLAG_FREE $WIM_RESHDR_FLAG_METADATA $WIM_RESHDR_FLAG_SOLID $WIM_RESHDR_FLAG_SPANNED
API String ID: 761389786-1431644030
Opcode ID: 4751f3257954c7c2b875fecf179c57a326d94cb9013498906e198f32a0fe153d
Instruction ID: 0da95b2e0da90e93d5c7dd8ac88121edd22b615af9933b2e7969dfe1a90a10f1
Opcode Fuzzy Hash: 4751f3257954c7c2b875fecf179c57a326d94cb9013498906e198f32a0fe153d
Instruction Fuzzy Hash: C6418B71211550A5DB04EF32DD543E92B24EB9138DF84003BEE0E6B6E5DE7CCA86C348

Uniqueness

Uniqueness Score: -1.00%

Function 00404D40 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 155
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00404D40(void* __ecx, void* __esi, signed long long __rax, void* __rcx, intOrPtr* __rdx) {
				short _v136;
				intOrPtr _v152;
				void* _v168;
				long long _v176;
				long long _v184;
				char _v192;
				char _v193;
				long long _v208;
				long long _v216;
				char _t32;
				char _t43;
				void* _t44;
				void* _t46;
				signed long long _t48;
				intOrPtr* _t49;
				void* _t52;
				intOrPtr* _t72;
				intOrPtr* _t84;
				intOrPtr* _t85;
				intOrPtr* _t87;
				intOrPtr _t90;
				intOrPtr _t93;
				char* _t94;

				_t48 = __rax;
				_t44 = __esi;
				_t85 =  *0x4201b0; // 0x424188
				 *_t87 =  *_t87 + __rax;
				_v193 = 0;
				_t52 = __rcx;
				_t84 = __rdx;
				_t94 =  &_v184;
				_v192 = 0;
				_v184 = 0;
				_v176 = 0;
				while(1) {
					_v216 = 0;
					_t72 = _t84;
					_t32 = E00408FE0();
					if(_t48 == 0xffffffff) {
						break;
					}
					_t46 = _t48 - 0x24;
					if(_t46 == 0) {
						_t93 =  *_t85;
						continue;
					}
					if(_t46 > 0) {
						if(_t48 != 0x2b) {
							L12:
							asm("invalid");
							 *0x416040();
							asm("jmp dword 0xfb0:0xebffffe7");
							asm("out 0xff, eax");
							asm("invalid");
							L10:
							free();
							return r14d;
						}
						r14d = E00402550(_t44, _t48, _t94,  *_t85);
						if(_t48 == 0) {
							continue;
						}
						goto L10;
					}
					if(_t48 != 0xf) {
						if(_t48 != 0x23) {
							goto L12;
						} else {
							continue;
						}
					}
					_v193 = 1;
				}
				_t49 =  *0x4201c0; // 0x416038
				_t48 =  *_t49;
				_t52 = _t52 - _t48;
				_t84 = _t84 + _t48 * 8;
				if(_t52 <= 0) {
					E004024D0(L"Must specify a WIM file", _t72, 0x41717e, 0x41e7e0);
					goto L12;
				}
				if(_t52 > 2) {
					E004024D0(L"Too many arguments", _t72, 0x41717e, 0x41e7e0);
					goto L12;
				}
				_t94 =  *_t84;
				_v216 = 0;
				L004090A8();
				r14d = _t32;
				if(_t48 != 0) {
					goto L10;
				}
				if(_t52 == 2) {
					L00409068();
					r15d = _t32;
					if(_t48 != 0) {
						L20:
						r8d = _v176;
						if(r8d == 0) {
							L23:
							r9d = _t43;
							_t90 = _t93;
							_v208 =  &_v193;
							_v216 = E00405A90;
							L004090C0();
							r14d = _t32;
							if(E00405A90 == 0x24) {
								L004090E0();
								if(_v136 != 1) {
									E004024D0(L"\"%ls\" is not the first part of the split WIM.\n       You must specify the first part.", _t94, _t90, 0x401890);
								}
							}
							L24:
							L00409108();
							goto L10;
						}
						_v216 = 0;
						r9d = 1;
						L00409088();
						r14d = _t32;
						if(_t48 != 0) {
							goto L24;
						}
						goto L23;
					}
					_t32 = E00403BB0( *((intOrPtr*)(_t84 + 8)), _t94, 0x401890);
					r15d = _t32;
					r14d = _t32;
					if(_t48 == 0) {
						goto L20;
					}
					goto L24;
				}
				L004090E0();
				r8d = _v152;
				if(r8d != 1) {
					E004024D0(L"\"%ls\" contains %d images; Please select one (or all).", _t94,  &_v192, 0x401890);
					L00409108();
					goto L12;
				}
				r15d = 1;
				goto L20;
			}

0x00404d40
0x00404d40
0x00404d53
0x00404d63
0x00404d66
0x00404d6b
0x00404d6d
0x00404d70
0x00404d75
0x00404d7e
0x00404d87
0x00404da3
0x00404da3
0x00404db3
0x00404dbf
0x00404dc7
0x00000000
0x00000000
0x00404dcd
0x00404dd0
0x00404e50
0x00000000
0x00404e50
0x00404dd2
0x00404de3
0x00404e28
0x00404e31
0x00404e33
0x00404e42
0x00404e43
0x00404e45
0x00404df8
0x00404dfd
0x00404e18
0x00404e18
0x00404df1
0x00404df6
0x00000000
0x00000000
0x00000000
0x00404df6
0x00404dd7
0x00404d9b
0x00000000
0x00404da1
0x00000000
0x00404da1
0x00404d9b
0x00404dd9
0x00404dd9
0x00404e60
0x00404e67
0x00404e6a
0x00404e6c
0x00404e72
0x00404fc5
0x00000000
0x00404fc5
0x00404e7b
0x00404e20
0x00000000
0x00404e20
0x00404e7d
0x00404e8e
0x00404e9a
0x00404e9f
0x00404ea4
0x00000000
0x00000000
0x00404eb2
0x00404f49
0x00404f4e
0x00404f53
0x00404ed7
0x00404ed7
0x00404ee4
0x00404f0a
0x00404f0f
0x00404f12
0x00404f18
0x00404f24
0x00404f29
0x00404f2e
0x00404f34
0x00404f82
0x00404f8d
0x00404f99
0x00404f99
0x00404f8d
0x00404f36
0x00404f3b
0x00000000
0x00404f3b
0x00404ee6
0x00404ef3
0x00404ef9
0x00404efe
0x00404f03
0x00000000
0x00000000
0x00000000
0x00404f05
0x00404f5c
0x00404f61
0x00404f64
0x00404f69
0x00000000
0x00000000
0x00000000
0x00404f6f
0x00404ebd
0x00404ec2
0x00404ecb
0x00404faa
0x00404fb4
0x00000000
0x00404fb4
0x00404ed1
0x00000000

APIs

free.MSVCRT ref: 00404DFD
wimlib_add_image_multisource.LIBWIM-15 ref: 00404E9A
wimlib_add_image_multisource.LIBWIM-15 ref: 00404EBD
wimlib_add_image_multisource.LIBWIM-15 ref: 00404EF9
wimlib_add_image_multisource.LIBWIM-15 ref: 00404F29
wimlib_add_image_multisource.LIBWIM-15 ref: 00404F3B

Strings

"%ls" contains %d images; Please select one (or all)., xrefs: 00404FA3
Must specify a WIM file, xrefs: 00404FBE
Too many arguments, xrefs: 00404E19
8`A, xrefs: 00404E60
"%ls" is not the first part of the split WIM. You must specify the first part., xrefs: 00404F92

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$free
String ID: "%ls" contains %d images; Please select one (or all).$"%ls" is not the first part of the split WIM. You must specify the first part.$8`A$Must specify a WIM file$Too many arguments
API String ID: 4253307414-1440947552
Opcode ID: 1ec3a305309757c5d5792feafa8c62440c360dab95b875b7fefcc0a3161fe9d1
Instruction ID: ba33f6bb5eef38001b29ea87e4992bcbafc59f1eae6751a4b3d6877ad06e2319
Opcode Fuzzy Hash: 1ec3a305309757c5d5792feafa8c62440c360dab95b875b7fefcc0a3161fe9d1
Instruction Fuzzy Hash: 6451A0B2214A4191EB20AB26E45436B6760F7C5788F904037FF4AA77E5DF7DC885C709

Uniqueness

Uniqueness Score: -1.00%

Function 00404FD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00404FD0(void* __ecx, long long __rax, void* __rcx, void* __rdx) {
				char _v80;
				long long _v92;
				long long _v120;
				void* _t18;
				void* _t22;
				void* _t29;
				long long _t32;
				intOrPtr* _t33;
				signed long long _t34;
				void* _t36;
				void* _t37;
				void* _t53;
				void* _t59;
				char* _t62;
				void* _t65;
				intOrPtr _t66;

				_t32 = __rax;
				r12d = 0;
				r13d = 4;
				_t36 = __rcx;
				_t59 = __rdx;
				while(1) {
					_t53 = _t59;
					_v120 = 0;
					_t18 = E00408FE0();
					if(_t32 == 0xffffffff) {
						break;
					}
					_t29 = _t32 - 0x2e;
					if(_t29 == 0) {
						r12b = r12b | 0x00000080;
						continue;
					}
					if(_t29 > 0) {
						if(_t32 != 0x39) {
							L13:
							 *_t32 =  *_t32 + _t32;
							return  *0xb8ffffe5;
						} else {
							r12d = r12d | 0x00008000;
							continue;
						}
					}
					if(_t32 == 3) {
						r13d = 5;
						L6:
						r12d = r12d | 0x00000001;
						continue;
					}
					if(_t32 != 0x15) {
						goto L13;
					}
					goto L6;
				}
				_t33 =  *0x4201c0; // 0x416038
				_t34 =  *_t33;
				_t37 = _t36 - _t34;
				_t32 = _t59 + _t34 * 8;
				if(_t37 != 2) {
					if(_t37 <= 0) {
						E004024D0(L"Must specify a WIM file", _t53, 0x41717e, 0x41e8a0);
						L12:
						E004024D0(L"Must specify an image", _t53, 0x41717e, 0x41e8a0);
						goto L13;
					}
					if(_t37 != 1) {
						goto L13;
					}
					goto L12;
				}
				_t65 =  *_t32;
				_t66 =  *((intOrPtr*)(_t32 + 8));
				_t62 =  &_v80;
				_v120 = 0;
				L004090A8();
				if(_t32 != 0) {
					return _t18;
				}
				L00409068();
				r13d = _t18;
				if(_t32 == 0) {
					_t22 = E00403BB0(_t66, _t65, 0x401890);
					if(_t32 == 0) {
						goto L19;
					}
					L21:
					_v92 = _t32;
					L00409108();
					return _t22;
				}
				L19:
				L00409140();
				if(_t32 != 0) {
					_v92 = _t32;
					_t22 = E004024D0(L"Failed to delete image from \"%ls\"", _t65, _t62, 0x401890);
					_t32 = _v92;
				} else {
					r8d = 0;
					L004090A0();
					if(_t32 != 0) {
						_v92 = _t32;
						_t22 = E004024D0(L"Failed to write the file \"%ls\" with image deleted", _t65, _t62, 0x401890);
						_t32 = _v92;
					}
				}
				goto L21;
			}

0x00404fd0
0x00404fe0
0x00404fe3
0x00404ff7
0x00404ff9
0x00404ffc
0x00405002
0x00405007
0x00405010
0x00405018
0x00000000
0x00000000
0x0040501e
0x00405021
0x004050b0
0x00000000
0x004050b0
0x00405027
0x00405043
0x00405078
0x00405081
0x00000000
0x00405045
0x00405045
0x00000000
0x00405045
0x00405043
0x0040502c
0x00405050
0x00405033
0x00405033
0x00000000
0x00405033
0x00405031
0x00000000
0x00000000
0x00000000
0x00405031
0x004050c0
0x004050c7
0x004050ca
0x004050cc
0x004050d3
0x0040505a
0x0040519a
0x00405065
0x0040506c
0x00000000
0x0040506c
0x00405063
0x00000000
0x00000000
0x00000000
0x00405063
0x004050d5
0x004050d8
0x004050dc
0x004050e4
0x004050f7
0x004050fe
0x004050a5
0x004050a5
0x00405108
0x0040510d
0x00405112
0x00405188
0x0040518f
0x00000000
0x00000000
0x00405139
0x0040513e
0x00405142
0x00000000
0x00405147
0x00405114
0x0040511c
0x00405123
0x00405173
0x00405177
0x0040517c
0x00405125
0x0040512a
0x00405130
0x00405137
0x0040515a
0x0040515e
0x00405163
0x00405163
0x00405137
0x00000000

APIs

wimlib_add_image_multisource.LIBWIM-15 ref: 004050F7
wimlib_add_image_multisource.LIBWIM-15 ref: 00405108
wimlib_add_image_multisource.LIBWIM-15 ref: 0040511C
wimlib_add_image_multisource.LIBWIM-15 ref: 00405130
wimlib_add_image_multisource.LIBWIM-15 ref: 00405142

Strings

Must specify a WIM file, xrefs: 00405193
Failed to delete image from "%ls", xrefs: 0040516C
8`A, xrefs: 004050C0
Must specify an image, xrefs: 00405065
Failed to write the file "%ls" with image deleted, xrefs: 00405153

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource
String ID: 8`A$Failed to delete image from "%ls"$Failed to write the file "%ls" with image deleted$Must specify a WIM file$Must specify an image
API String ID: 1578821148-18479086
Opcode ID: 2971e145c90e24b00dbd623a9b8c1d3e514a5f4b19ad6254d732a4f122a741a1
Instruction ID: 60b2f983705e0bf16d07f19b4c2d2645d6c82a5b982d977b935392a5743dfa20
Opcode Fuzzy Hash: 2971e145c90e24b00dbd623a9b8c1d3e514a5f4b19ad6254d732a4f122a741a1
Instruction Fuzzy Hash: F9412371604A0181DB10AB26A85436F6760FB85798F904037EF4AAB3E5DF7DC946CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004036B0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E004036B0(void* __ecx, void* __esi, void* __rdx) {
				long long _v64;
				char _v72;
				char _v80;
				long long _v104;
				void* _t18;
				void* _t30;
				intOrPtr* _t35;
				intOrPtr* _t36;
				signed long long _t37;
				void* _t41;
				void* _t42;
				void* _t43;
				signed long long _t61;
				intOrPtr* _t62;
				void* _t69;
				intOrPtr _t77;

				_t30 = __esi;
				r13d = 1;
				_v72 = 0;
				_t41 = _t43;
				_t69 = __rdx;
				_v64 = 0;
				while(1) {
					_v104 = 0;
					_t18 = E00408FE0();
					if(_t35 == 0xffffffff) {
						break;
					}
					if(_t35 == 0x1a) {
						r13d = 0;
						continue;
					}
					if(_t35 != 0x2b) {
						L8:
						asm("invalid");
						 *0x416040();
						asm("invalid");
						L5:
						free();
						return r12d;
					}
					_t35 =  *0x4201b0; // 0x424188
					r12d = E00402550(_t30, _t35,  &_v72,  *_t35);
					if(_t35 == 0) {
						continue;
					}
					goto L5;
				}
				_t36 =  *0x4201c0; // 0x416038
				_t61 =  *_t36;
				_t37 = _t61;
				_t62 = _t69 + _t61 * 8;
				_t42 = _t41 - _t37;
				if(_t42 != 1) {
					if(_t42 != 0) {
						E004024D0(L"At most one WIM file can be specified!", _t62, 0x41717e, 0x41d7e0);
					} else {
						E004024D0(L"Must specify a WIM file!", _t62, 0x41717e, 0x41d7e0);
					}
					goto L8;
				}
				_t77 =  *_t62;
				_v104 = 0;
				L004090A8();
				r12d = _t18;
				if(_t37 != 0) {
					goto L5;
				}
				_v104 = r13d;
				r8d = _v64;
				r9d = 1;
				L00409088();
				r12d = _t18;
				if(_t37 == 0) {
					L00409010();
					r12d = _t18;
					if(_t37 != 0) {
						 *_t37 =  *_t37 + _t37;
						E004024D0(0xa, 0,  &_v80, 0x401890);
						if(r12d == 0x37 && _v64 == 0 &&  *0x424178 != 0) {
							E00401650( &_v80, 0x401890);
						}
					} else {
						if( *0x424178 != 0) {
							E00401650(_t77, 0x401890);
							asm("o16 nop [eax+eax]");
						}
					}
				}
				L00409108();
				goto L5;
			}

0x004036b0
0x004036be
0x004036d2
0x004036db
0x004036dd
0x004036e0
0x004036e9
0x004036f4
0x004036fd
0x00403705
0x00000000
0x00000000
0x0040370e
0x00403780
0x00000000
0x00403780
0x00403713
0x00403760
0x00403769
0x0040376b
0x0040377c
0x00403730
0x00403735
0x0040374b
0x0040374b
0x00403715
0x00403729
0x0040372e
0x00000000
0x00000000
0x00000000
0x0040372e
0x00403790
0x00403797
0x0040379a
0x0040379d
0x004037a1
0x004037a6
0x0040374e
0x00403895
0x00403754
0x0040375b
0x0040375b
0x00000000
0x0040374e
0x004037a8
0x004037ba
0x004037c6
0x004037cb
0x004037d0
0x00000000
0x00000000
0x004037d6
0x004037db
0x004037e0
0x004037f0
0x004037f5
0x004037fa
0x00403803
0x00403808
0x0040380d
0x00403848
0x00403861
0x0040386a
0x00403887
0x00403887
0x0040380f
0x00403819
0x00403825
0x0040382a
0x0040382a
0x00403819
0x0040380d
0x00403835
0x00000000

APIs

free.MSVCRT ref: 00403735
wimlib_add_image_multisource.LIBWIM-15 ref: 00403835

Strings

Note: if this WIM file is not standalone, use the --ref option to specify the other parts., xrefs: 00403880
At most one WIM file can be specified!, xrefs: 0040388E
"%ls" failed verification!, xrefs: 0040385A
8`A, xrefs: 00403790
"%ls" was successfully verified., xrefs: 0040381E
Must specify a WIM file!, xrefs: 00403754

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: freewimlib_add_image_multisource
String ID: "%ls" was successfully verified.$"%ls" failed verification!$8`A$At most one WIM file can be specified!$Must specify a WIM file!$Note: if this WIM file is not standalone, use the --ref option to specify the other parts.
API String ID: 2585769228-660379883
Opcode ID: d3916768ce4856acb949d10cfd2901a9648d8e5eb63190c8a141ad8b5c23d8a5
Instruction ID: 4c0aa2923cd759b3be3c92cfff7a75938cef0058e69e0185cfac1da487bc76d3
Opcode Fuzzy Hash: d3916768ce4856acb949d10cfd2901a9648d8e5eb63190c8a141ad8b5c23d8a5
Instruction Fuzzy Hash: 4941C5B1310A4191EB10AF26E85436B6765FB84BC8F40913BEE4A673E5DF7DC985C308

Uniqueness

Uniqueness Score: -1.00%

Function 00402D50 Relevance: 13.5, APIs: 4, Strings: 5, Instructions: 46COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00402D6C
_wcsicmp.MSVCRT ref: 00402D9A
_wcsicmp.MSVCRT ref: 00402DB3
_wcsicmp.MSVCRT ref: 00402DCC

Strings

xpress16k, xrefs: 00402DA9
xpress4k, xrefs: 00402D65
lzx, xrefs: 00402DC2
xpress8k, xrefs: 00402D90
"%ls" is not a recognized System Compression format. The options are: --compact=xpress4k --compact=xpress8k --compact, xrefs: 00402DDC

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: _wcsicmp
String ID: "%ls" is not a recognized System Compression format. The options are: --compact=xpress4k --compact=xpress8k --compact$lzx$xpress16k$xpress4k$xpress8k
API String ID: 2081463915-2434718225
Opcode ID: 0cf7f0bf64ed6b5f163de66a1cb4750f4dba3682dd85f03fe96b2c63eac4803d
Instruction ID: 9eeb8270561d7a6b3e3defea4f6f7e51640eacd7ee5208fcd6f573a2017308f7
Opcode Fuzzy Hash: 0cf7f0bf64ed6b5f163de66a1cb4750f4dba3682dd85f03fe96b2c63eac4803d
Instruction Fuzzy Hash: 1901866432492484FA25D73AF944FD266516F487D5F849123AD199B7D4FA7CCC82C708

Uniqueness

Uniqueness Score: -1.00%

Function 00409790 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00409790(void* __ebx, void* __eflags, void* __rbx, void* __rcx, void* __rdx, void* __rdi, void* __rsi, long long __r8, long long __r9, void* __r12, intOrPtr __r13, signed long long __r14, void* __r15) {
				void* _t58;
				int _t59;
				void* _t60;
				int _t61;
				void* _t64;
				void* _t70;
				void* _t71;
				signed long long _t72;
				signed long long _t84;
				signed long long _t85;
				signed long long _t86;
				void* _t92;
				signed long long _t96;
				long long* _t100;
				long long* _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr* _t108;
				signed long long _t110;
				signed long long _t111;
				intOrPtr* _t112;
				signed long long _t114;
				signed long long _t117;
				signed long long _t121;
				long long _t128;
				signed long long _t130;
				void* _t141;
				signed long long _t145;
				signed long long _t147;
				signed long long _t148;
				signed long long _t154;
				signed long long _t157;
				intOrPtr _t168;
				void* _t171;
				signed long long _t172;
				signed long long _t175;
				intOrPtr* _t178;
				void* _t185;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t189;
				void* _t191;
				signed long long _t199;
				signed long long _t203;
				intOrPtr _t204;
				intOrPtr _t208;
				signed long long _t210;
				intOrPtr _t212;
				void* _t213;
				void* _t215;
				void* _t218;

				_t213 = __r15;
				_t210 = __r14;
				_t208 = __r13;
				_t70 = __ebx;
				_push(__r12);
				_push(__rbx);
				_t186 = _t185 - 0x38;
				_pop(_t84);
				 *((long long*)(_t186 + 0x60)) = __r8;
				 *((long long*)(_t186 + 0x68)) = __r9;
				 *(_t186 + 0x28) = _t84;
				_t59 = E004092B0(_t58, _t71, _t84, 0x2);
				r8d = 0x1b;
				_pop(_t171);
				 *_t84 =  *_t84 + _t84;
				_t199 = _t84;
				L00414EB8();
				_t110 =  *(_t186 + 0x28);
				 *0xFFE5F687FFFFFFEC =  *((long long*)(0xffe5f687ffffffec)) - 1;
				_t121 = _t84;
				_t195 = _t110;
				L00414E80();
				L00414ED0();
				_t85 = _t84;
				asm("o16 nop [eax+eax]");
				_push(__rcx);
				_push(__rsi);
				_push(_t110);
				_t187 = _t186 - 0x50;
				_t111 =  *0x424234;
				_t203 = _t121;
				if(_t111 <= 0) {
					L14:
					_t111 = 0;
					goto L6;
				} else {
					_t141 = 0;
					_t108 =  *0x424238 + 0x18;
					asm("o16 nop [eax+eax]");
					do {
						_t168 =  *_t108;
						if(_t168 > _t203) {
							goto L5;
						} else {
							_t195 =  *((intOrPtr*)(_t108 + 8));
							r8d =  *(_t195 + 8);
							if(_t203 < _t168 + _t195) {
								L11:
								return _t59;
							} else {
								goto L5;
							}
						}
						goto L55;
						L5:
						_t141 = _t141 + 1;
						_t108 = _t108 + 0x28;
					} while (_t141 != _t111);
					L6:
					_t60 = E0040A1B0(_t85, _t203);
					_t175 = _t85;
					if(_t85 == 0) {
						L16:
						_t61 = E00409790(_t70, __eflags, _t111, "Address %p has no image-section", _t203, _t171, _t175, _t195, _t199, _t203, _t208, _t210, _t213);
						_t86 = _t85;
						asm("o16 nop [cs:eax+eax]");
						_push(_t213);
						_push(_t210);
						_push(_t208);
						_push(_t203);
						_push(_t171);
						_push(_t175);
						_push(_t111);
						_t188 = _t187 - 0x38;
						_t172 =  *0x424230;
						__eflags = _t172;
						if(_t172 == 0) {
							 *0x424230 = 1;
							E0040A230();
							_t61 = E0040A470(_t86);
							_t204 =  *0x41ffd0; // 0x4208f0
							_t112 =  *0x41ffe0; // 0x4208f0
							 *0x424234 = 0;
							_t189 = _t188 - (0x0000000f + (_t86 + _t86 * 0x00000004) * 0x00000008 & 0xfffffff0);
							 *0x424238 = _t189 + 0x20;
							_t92 = _t204 - _t112;
							__eflags = _t92 - 7;
							if(_t92 <= 7) {
								goto L18;
							} else {
								_t145 =  *_t112;
								__eflags = _t92 - 0xb;
								if(_t92 > 0xb) {
									__eflags = _t145;
									if(_t145 != 0) {
										goto L47;
									} else {
										_t47 = _t112 + 4; // 0x0
										_t96 =  *_t47;
										_t48 = _t112 + 8; // 0x0
										__eflags = _t96 |  *_t48;
										if((_t96 |  *_t48) != 0) {
											goto L23;
										} else {
											_t49 = _t112 + 0xc; // 0x0
											_t145 =  *_t49;
											_t112 = _t112 + 0xc;
											goto L21;
										}
									}
								} else {
									L21:
									__eflags = _t145;
									if(_t145 != 0) {
										L47:
										__eflags = _t112 - _t204;
										if(_t112 < _t204) {
											_t212 =  *0x420020; // 0x400000
											do {
												_t50 = _t112 + 4; // 0x0
												r13d =  *_t112;
												_t112 = _t112 + 8;
												_t178 =  *_t50 + _t212;
												r13d = r13d +  *_t178;
												L1();
												 *_t178 = r13d;
												__eflags = _t112 - _t204;
											} while (_t112 < _t204);
											goto L35;
										}
										goto L18;
									} else {
										_t40 = _t112 + 4; // 0x0
										_t96 =  *_t40;
										L23:
										__eflags = _t96;
										if(_t96 != 0) {
											goto L47;
										} else {
											_t41 = _t112 + 8; // 0x0
											_t147 =  *_t41;
											__eflags = _t147 - 1;
											if(__eflags != 0) {
												L52:
												_t128 = "  Unknown pseudo relocation protocol version %d.\n";
												_t64 = E00409790(_t70, __eflags, _t112, _t128, _t147, _t172, _t175, _t195, _t199, _t204, _t208, _t210, _t213);
												_t191 = _t189 - 0x58;
												_t100 =  *0x424240;
												__eflags = _t100;
												if(_t100 != 0) {
													asm("movsd xmm0, [esp+0x80]");
													 *((long long*)(_t191 + 0x20)) = _t128;
													 *(_t191 + 0x28) = _t147;
													asm("movsd [esp+0x30], xmm2");
													asm("movsd [esp+0x38], xmm3");
													asm("movsd [esp+0x40], xmm0");
													_t64 =  *_t100();
												}
												return _t64;
											} else {
												_t112 = _t112 + 0xc;
												__eflags = _t112 - _t204;
												if(_t112 < _t204) {
													_t208 =  *0x420020; // 0x400000
													_t210 = 0;
													goto L29;
													do {
														while(1) {
															L29:
															_t42 = _t112 + 4; // 0x302e322e30
															_t43 = _t112 + 8; // 0x30
															_t147 =  *_t43 & 0x000000ff;
															_t96 =  *_t112 + _t208;
															_t175 =  *_t42 + _t208;
															_t213 =  *_t96;
															__eflags = _t147 - 0x20;
															if(__eflags == 0) {
																break;
															}
															if(__eflags > 0) {
																__eflags = _t147 - 0x40;
																if(__eflags != 0) {
																	goto L51;
																} else {
																	L1();
																	 *_t175 = _t213 +  *_t175 - _t96;
																	goto L28;
																}
															} else {
																__eflags = _t147 - 8;
																if(_t147 == 8) {
																	_t154 =  *_t175 & 0x000000ff;
																	_t195 = _t154 | 0xffffff00;
																	__eflags = _t72;
																	_t155 =  <  ? _t154 | 0xffffff00 : _t154;
																	_t156 = ( <  ? _t154 | 0xffffff00 : _t154) - _t96;
																	_t217 = _t213 + ( <  ? _t154 | 0xffffff00 : _t154) - _t96;
																	__eflags = _t213 + ( <  ? _t154 | 0xffffff00 : _t154) - _t96;
																	L1();
																	 *_t175 = r15b;
																	goto L28;
																} else {
																	__eflags = _t147 - 0x10;
																	if(__eflags != 0) {
																		L51:
																		E00409790(_t70, __eflags, _t112, "  Unknown pseudo relocation bit size %d.\n", _t147, _t172, _t175, _t195, _t199, _t204, _t208, _t210, _t213);
																		goto L52;
																	} else {
																		_t157 =  *_t175 & 0x0000ffff;
																		_t195 = _t157 | 0xffff0000;
																		__eflags = _t72;
																		_t158 =  <  ? _t157 | 0xffff0000 : _t157;
																		_t112 = _t112 + 0xc;
																		_t159 = ( <  ? _t157 | 0xffff0000 : _t157) - _t96;
																		_t218 = _t213 + ( <  ? _t157 | 0xffff0000 : _t157) - _t96;
																		L1();
																		 *_t175 = r15w;
																		__eflags = _t112 - _t204;
																		if(_t112 < _t204) {
																			continue;
																		} else {
																			goto L35;
																		}
																	}
																}
															}
															goto L55;
														}
														_t148 =  *_t175;
														_t130 = _t148;
														__eflags = _t130;
														_t150 =  >=  ? _t130 : _t148 | _t210;
														_t151 = ( >=  ? _t130 : _t148 | _t210) - _t96;
														_t215 = _t213 + ( >=  ? _t130 : _t148 | _t210) - _t96;
														L1();
														 *_t175 = r15d;
														L28:
														_t112 = _t112 + 0xc;
														__eflags = _t112 - _t204;
													} while (_t112 < _t204);
													L35:
													__eflags =  *0x424234;
													if( *0x424234 > 0) {
														_t114 = 0;
														__eflags = 0;
														do {
															r8d =  *( *0x424238 + _t114);
															__eflags = r8d;
															if(r8d != 0) {
																_t61 = VirtualProtect();
															}
															_t172 = _t172 + 1;
															_t114 = _t114 + 0x28;
															__eflags = _t172 -  *0x424234;
														} while (_t172 <  *0x424234);
													}
												}
												goto L18;
											}
										}
									}
								}
							}
						} else {
							L18:
							return _t61;
						}
					} else {
						_t111 = _t111 + _t111 * 4 << 3;
						_t104 =  *0x424238 + _t111;
						 *(_t104 + 0x20) = _t175;
						 *_t104 = 0;
						E0040A2E0(_t60, _t195);
						r8d = 0x30;
						_t105 =  *0x424238;
						 *((long long*)(_t105 + _t111 + 0x18)) =  *((intOrPtr*)(_t175 + 0xc)) + _t104;
						_t59 = VirtualQuery(??, ??, ??);
						if(_t105 == 0) {
							_t85 =  *0x424238;
							_t195 =  *((intOrPtr*)(_t85 + _t111 + 0x18));
							E00409790(_t70, __eflags, _t111, "  VirtualQuery failed for %d bytes at address %p",  *((intOrPtr*)(_t175 + 8)), _t171, _t175,  *((intOrPtr*)(_t85 + _t111 + 0x18)), _t199, _t203, _t208, _t210, _t213);
							goto L16;
						} else {
							_t106 =  *((intOrPtr*)(_t187 + 0x44));
							if((_t106 - 0x00000040 & 0xffffffbf) == 0 || (_t106 - 0x00000004 & 0xfffffffb) == 0) {
								L10:
								 *0x424234 =  *0x424234 + 1;
								goto L11;
							} else {
								__eflags = _t106 - 2;
								r8d = 4;
								_t85 = 0x40;
								_t117 = _t111 +  *0x424238;
								 *((long long*)(_t117 + 8)) =  *((intOrPtr*)(_t187 + 0x20));
								_t199 = _t117;
								 *((long long*)(_t117 + 0x10)) =  *((intOrPtr*)(_t187 + 0x38));
								_t59 = VirtualProtect(??, ??, ??, ??);
								__eflags = 0x40;
								if(0x40 != 0) {
									goto L10;
								} else {
									GetLastError();
									E00409790(_t70, 0x40, _t117, "  VirtualProtect failed with code 0x%x", 0x40, _t171, _t175, _t195, _t199, _t203, _t208, _t210, _t213);
									goto L14;
								}
							}
						}
					}
				}
				L55:
			}

0x00409790
0x00409790
0x00409790
0x00409790
0x00409790
0x00409792
0x00409793
0x004097a8
0x004097a9
0x004097ae
0x004097b3
0x004097b8
0x004097bd
0x004097cc
0x004097cd
0x004097cf
0x004097d2
0x004097d7
0x004097e5
0x004097e9
0x004097ec
0x004097ef
0x004097f4
0x004097f9
0x004097fa
0x00409800
0x00409802
0x00409803
0x00409804
0x00409808
0x0040980f
0x00409814
0x00409930
0x00409930
0x00000000
0x0040981a
0x00409821
0x00409823
0x00409827
0x00409830
0x00409830
0x00409836
0x00000000
0x00409838
0x00409838
0x0040983c
0x00409846
0x004098d3
0x004098db
0x00000000
0x00000000
0x00000000
0x00409846
0x00000000
0x0040984c
0x0040984c
0x0040984f
0x00409853
0x00409857
0x0040985a
0x0040985f
0x00409865
0x00409952
0x0040995c
0x00409961
0x00409962
0x00409971
0x00409973
0x00409975
0x00409977
0x00409979
0x0040997a
0x0040997b
0x0040997c
0x00409988
0x0040998e
0x00409990
0x004099a8
0x004099b2
0x004099c9
0x004099ce
0x004099d5
0x004099dc
0x004099e6
0x004099ee
0x004099f8
0x004099fb
0x004099ff
0x00000000
0x00409a01
0x00409a01
0x00409a03
0x00409a07
0x00409b38
0x00409b3a
0x00000000
0x00409b3c
0x00409b3c
0x00409b3c
0x00409b41
0x00409b41
0x00409b44
0x00000000
0x00409b4a
0x00409b4a
0x00409b4a
0x00409b4d
0x00000000
0x00409b4d
0x00409b44
0x00409a0d
0x00409a0d
0x00409a0d
0x00409a0f
0x00409bb0
0x00409bb0
0x00409bb3
0x00409bb9
0x00409bc0
0x00409bc0
0x00409bc3
0x00409bc6
0x00409bca
0x00409bcd
0x00409bd3
0x00409bd8
0x00409bdb
0x00409bdb
0x00000000
0x00409be0
0x00000000
0x00409a15
0x00409a15
0x00409a15
0x00409a18
0x00409a18
0x00409a1a
0x00000000
0x00409a20
0x00409a20
0x00409a20
0x00409a23
0x00409a26
0x00409bf1
0x00409bf1
0x00409bf8
0x00409c00
0x00409c04
0x00409c0b
0x00409c0e
0x00409c10
0x00409c19
0x00409c22
0x00409c27
0x00409c2d
0x00409c33
0x00409c39
0x00409c3b
0x00409c40
0x00409a2c
0x00409a2c
0x00409a30
0x00409a33
0x00409a39
0x00409a40
0x00409a4a
0x00409a7d
0x00409a7d
0x00409a7d
0x00409a7f
0x00409a82
0x00409a82
0x00409a86
0x00409a89
0x00409a8c
0x00409a8f
0x00409a92
0x00000000
0x00000000
0x00409a98
0x00409b60
0x00409b63
0x00000000
0x00409b69
0x00409b75
0x00409b7a
0x00000000
0x00409b7a
0x00409a9e
0x00409a9e
0x00409aa1
0x00409a50
0x00409a59
0x00409a60
0x00409a62
0x00409a66
0x00409a69
0x00409a69
0x00409a6c
0x00409a71
0x00000000
0x00409aa3
0x00409aa3
0x00409aa6
0x00409be5
0x00409bec
0x00000000
0x00409aac
0x00409aac
0x00409ab5
0x00409abc
0x00409abf
0x00409ac3
0x00409ac7
0x00409aca
0x00409acd
0x00409ad2
0x00409ad6
0x00409ad9
0x00000000
0x00000000
0x00000000
0x00000000
0x00409ad9
0x00409aa6
0x00409aa1
0x00000000
0x00409a98
0x00409b88
0x00409b8a
0x00409b90
0x00409b92
0x00409b99
0x00409b9c
0x00409b9f
0x00409ba4
0x00409a74
0x00409a74
0x00409a78
0x00409a78
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af5
0x00409af5
0x00409b00
0x00409b0a
0x00409b0d
0x00409b10
0x00409b1d
0x00409b1d
0x00409b1f
0x00409b22
0x00409b26
0x00409b26
0x00409b2e
0x00409ae8
0x00000000
0x00409a33
0x00409a26
0x00409a1a
0x00409a0f
0x00409a07
0x00409992
0x00409992
0x004099a2
0x004099a2
0x0040986b
0x00409876
0x0040987a
0x0040987d
0x00409881
0x00409887
0x00409894
0x0040989d
0x004098a4
0x004098a9
0x004098b2
0x00409937
0x00409948
0x0040994d
0x00000000
0x004098b8
0x004098b8
0x004098c2
0x004098cc
0x004098cc
0x00000000
0x004098e0
0x004098e0
0x004098ed
0x004098f3
0x004098fc
0x00409903
0x00409907
0x0040990a
0x0040990e
0x00409914
0x00409916
0x00000000
0x00409918
0x00409918
0x00409927
0x00000000
0x00409927
0x00409916
0x004098c2
0x004098b2
0x00409865
0x00000000

APIs

VirtualQuery.KERNEL32 ref: 004098A9

Strings

VirtualProtect failed with code 0x%x, xrefs: 0040991E
Mingw-w64 runtime failure:, xrefs: 004097C8
VirtualQuery failed for %d bytes at address %p, xrefs: 00409941
Address %p has no image-section, xrefs: 00409800, 00409955

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 0daa08e627f663a73a63859cdc661da97dbe882279bd02199a707486a349577c
Instruction ID: 6ca0c93d34be3a9fe0f20fd0aecc3e7c7cbd3bbfbd2e8e23a9aaf0efa858993e
Opcode Fuzzy Hash: 0daa08e627f663a73a63859cdc661da97dbe882279bd02199a707486a349577c
Instruction Fuzzy Hash: 635193B2711B4181DB10AF52E84179A77A0F789B98F88813AEF4D17395DB3CC946C748

Uniqueness

Uniqueness Score: -1.00%

Function 04098D20 Relevance: 12.4, APIs: 8, Instructions: 377COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409906A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04099070
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04099076
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409907C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04099082
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04099088
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409908E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04099094

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 81295606ededc7508276f80509d52cb69c040a7621a29d65a924176669704457
Instruction ID: 3a890218ec5972eed85ff492ce6c55d4b9a354d56236587c3bca38061810e52f
Opcode Fuzzy Hash: 81295606ededc7508276f80509d52cb69c040a7621a29d65a924176669704457
Instruction Fuzzy Hash: C3A19330568D4C4FDF48EB6CC898B9DB7E1FB9A318F608A19E059E32A5C675A8C0D741

Uniqueness

Uniqueness Score: -1.00%

Function 0040D250 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040D250(void* __edx, void* __rax, long long __rcx, intOrPtr* __r8) {
				long long _v40;
				intOrPtr _t43;
				short _t44;
				intOrPtr _t46;
				signed long long _t53;
				intOrPtr _t54;
				signed long long _t56;
				intOrPtr* _t58;
				void* _t65;
				signed long long _t76;
				long long _t79;
				void* _t80;
				intOrPtr _t83;

				_t43 =  *((intOrPtr*)(__r8 + 0x10));
				_t79 = __rcx;
				_t80 = _t65;
				_t58 = __r8;
				if(__rax >= 0) {
					_t80 =  >  ? __rax : _t80;
				}
				_t53 =  *((intOrPtr*)(_t58 + 8));
				r8d =  *((intOrPtr*)(_t58 + 0xc));
				if((_t53 & 0x00006000) == 0x6000) {
					if(r8d <= _t46) {
						r8d = _t46;
						L00414ED8();
					} else {
						_v40 = _t79;
						r9d = _t46;
						if((spl & 0x00000004) != 0) {
							L00414ED8();
						} else {
							L00414ED8();
						}
					}
					if(_t53 > 0) {
						 *((intOrPtr*)(_t58 + 0x24)) =  *((intOrPtr*)(_t58 + 0x24)) + _t53;
					}
					 *((long long*)(_t58 + 0xc)) = 0xffffffff;
					return _t43;
				} else {
					if(r8d > _t46) {
						r8d = r8d - _t46;
						 *((intOrPtr*)(_t58 + 0xc)) = r8d;
						if((spl & 0x00000004) != 0) {
							if(_t80 > 0) {
								goto L9;
							}
							r8d = r8d - 1;
							 *((intOrPtr*)(_t58 + 0xc)) = r8d;
							goto L21;
						}
						r8d = r8d - 1;
						 *((intOrPtr*)(_t58 + 0xc)) = r8d;
						do {
							 *((long long*)(_t58 + 0x508d0c43)) =  *((long long*)(_t58 + 0x508d0c43)) - 1;
							 *((long long*)(0xfffaa3e7c0850c73)) =  *((long long*)(0xfffaa3e7c0850c73)) - 1;
						} while ( *0xFFFAA3E7C0850C73 != 0);
						goto L5;
					} else {
						 *((long long*)(_t58 + 0xc)) = 0xffffffff;
						L5:
						if(_t80 > 0) {
							L9:
							while(_t44 != 0) {
								_t79 = _t79 + 2;
								if((sil & 0x00000040) != 0) {
									L12:
									_t83 =  *_t58;
									sil = sil & 0x00000020;
									if(sil == 0) {
										_t76 =  *((intOrPtr*)(_t58 + 0x24));
										 *((short*)(_t83 + _t76 * 2)) = _t44;
										_t56 = _t76;
									} else {
										L004091F8();
										_t56 =  *((intOrPtr*)(_t58 + 0x24));
									}
									L8:
									 *((long long*)(_t58 + 0x24)) = _t56 + 1;
									_t80 = _t80 - 1;
									if(_t80 == 0) {
										break;
									}
									continue;
								}
								_t56 =  *((intOrPtr*)(_t58 + 0x24));
								if( *((intOrPtr*)(_t58 + 0x28)) <= _t56) {
									goto L8;
								}
								goto L12;
							}
							L20:
							_t53 =  *((intOrPtr*)(_t58 + 0xc));
							 *((long long*)(_t58 + 0xc)) = _t53 - 1;
							if(_t53 <= 0) {
								return _t43;
							}
							L21:
							if((sil & 0x00000040) != 0) {
								L23:
								sil = sil & 0x00000020;
								if(sil == 0) {
									_push(_t53);
									_t54 =  *((intOrPtr*)(_t58 + 0x24));
								} else {
									 *((long long*)(_t58 - 0x3c14dbbd)) =  *((long long*)(_t58 - 0x3c14dbbd)) - 1;
								}
								L19:
								 *((long long*)(_t58 + 0x24)) = _t54 + 1;
								goto L20;
							}
							_t54 =  *((intOrPtr*)(_t58 + 0x24));
							if( *((intOrPtr*)(_t58 + 0x28)) <= _t54) {
								goto L19;
							}
							goto L23;
						}
						 *((long long*)(_t58 + 0xc)) = 0xfffffffe;
						return _t43;
					}
				}
			}

0x0040d257
0x0040d25b
0x0040d25e
0x0040d260
0x0040d265
0x0040d269
0x0040d269
0x0040d26c
0x0040d26f
0x0040d281
0x0040d386
0x0040d3d5
0x0040d3df
0x0040d388
0x0040d388
0x0040d38d
0x0040d393
0x0040d3ed
0x0040d395
0x0040d39c
0x0040d39c
0x0040d393
0x0040d3a3
0x0040d3a5
0x0040d3a5
0x0040d3a8
0x00000000
0x0040d287
0x0040d28a
0x0040d2f0
0x0040d2f3
0x0040d2fa
0x0040d3c2
0x00000000
0x00000000
0x0040d3c8
0x0040d3cc
0x00000000
0x0040d3cc
0x0040d300
0x0040d304
0x0040d310
0x0040d31c
0x0040d322
0x0040d322
0x00000000
0x0040d28c
0x0040d28c
0x0040d293
0x0040d295
0x00000000
0x0040d2bb
0x0040d2ca
0x0040d2d1
0x0040d2db
0x0040d2db
0x0040d2de
0x0040d2e1
0x0040d2a0
0x0040d2a4
0x0040d2a9
0x0040d2e3
0x0040d2e6
0x0040d2eb
0x0040d2eb
0x0040d2ac
0x0040d2af
0x0040d2b2
0x0040d2b5
0x00000000
0x00000000
0x00000000
0x0040d2b5
0x0040d2d3
0x0040d2d9
0x00000000
0x00000000
0x00000000
0x0040d2d9
0x0040d347
0x0040d347
0x0040d34d
0x0040d352
0x0040d3b6
0x0040d3b6
0x0040d354
0x0040d35a
0x0040d364
0x0040d367
0x0040d36a
0x0040d33d
0x0040d33e
0x0040d36c
0x0040d378
0x0040d378
0x0040d341
0x0040d344
0x00000000
0x0040d344
0x0040d35c
0x0040d362
0x00000000
0x00000000
0x00000000
0x0040d362
0x0040d3f4
0x00000000
0x0040d3f4
0x0040d28a

Strings

%-*.*s, xrefs: 0040D3E6
%*.*s, xrefs: 0040D395
%.*s, xrefs: 0040D3D8

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 7a797622adb1d086b96de76755a23541eeaaf9f5380c40fde809bd6ca33bccf8
Instruction ID: 76f92c1356cd3d06a3b6374b5dc6b6f222f2859e34eda59daedd7dff03e92bd2
Opcode Fuzzy Hash: 7a797622adb1d086b96de76755a23541eeaaf9f5380c40fde809bd6ca33bccf8
Instruction Fuzzy Hash: 2D418CB2B1065186D7209FA9C54475E77A1EB44FA8F14C23ADE08AB7C8C73DD849CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040CE20(void* __edx, void* __rax, char* __rcx, void* __r8) {
				char _v72;
				char _v80;
				long long _v104;
				intOrPtr _t27;
				char _t29;
				signed int _t31;
				signed long long _t40;
				signed int _t41;
				void* _t42;
				signed int _t51;
				signed int _t62;
				char* _t63;
				long long* _t64;
				char* _t69;

				_t27 =  *((intOrPtr*)(__r8 + 0x10));
				_t63 = __rcx;
				_t62 = _t51;
				_t42 = __r8;
				if(__rax >= 0) {
					_t62 =  >  ? __rax : _t62;
				}
				_t40 =  *((intOrPtr*)(_t42 + 8));
				r8d =  *(_t42 + 0xc);
				if((_t40 & 0x00006000) == 0x6000) {
					__eflags = r8d - _t31;
					if(r8d <= _t31) {
						r8d = _t31;
						L00414ED8();
					} else {
						_v104 = _t63;
						r9d = _t31;
						__eflags = spl & 0x00000004;
						if((spl & 0x00000004) != 0) {
							L00414ED8();
						} else {
							L00414ED8();
						}
					}
					__eflags = _t40;
					if(_t40 > 0) {
						_t24 = _t42 + 0x24;
						 *_t24 =  *(_t42 + 0x24) + _t40;
						__eflags =  *_t24;
					}
					 *(_t42 + 0xc) = 0xffffffff;
					return _t27;
				} else {
					if(r8d > _t31) {
						r8d = r8d - _t31;
						 *(_t42 + 0xc) = r8d;
						__eflags = spl & 0x00000004;
						if((spl & 0x00000004) == 0) {
							r8d = r8d - 1;
							__eflags = r8d;
							 *(_t42 + 0xc) = r8d;
							do {
								 *(_t42 + 0x508d0c43) =  *(_t42 + 0x508d0c43) - 1;
								 *0xFFFEB3E7C0850C73 =  *0xFFFEB3E7C0850C73 - 1;
								__eflags =  *0xFFFEB3E7C0850C73;
							} while ( *0xFFFEB3E7C0850C73 != 0);
						}
						goto L5;
						L18:
						return _t27;
						goto L27;
					} else {
						 *(_t42 + 0xc) = 0xffffffff;
					}
					L5:
					_t64 =  &_v80;
					_t69 =  &_v72;
					if(_t62 > 0) {
						while(1) {
							 *_t64 = 0;
							_t62 = _t62 - 1;
							strlen(??);
							_t27 = E00415070(_t69, _t63, _t40, _t64);
							__eflags = _t40;
							if(__eflags == 0) {
								goto L17;
							}
							if(__eflags < 0) {
								_t29 =  *_t63;
								_t40 = 0x1;
							}
							_t63 = _t63 + _t40;
							_t27 = E0040CDC0(_t29, _t42);
							__eflags = _t62;
							if(_t62 != 0) {
								continue;
							}
							goto L17;
						}
					} else {
						while(1) {
							L17:
							_t41 =  *(_t42 + 0xc);
							 *(_t42 + 0xc) = _t41 - 1;
							if(_t41 <= 0) {
								goto L18;
							}
							_t16 = _t42 + 0x508d0c43;
							 *_t16 =  *(_t42 + 0x508d0c43) - 1;
							__eflags =  *_t16;
						}
						goto L18;
					}
					goto L17;
				}
				L27:
			}

0x0040ce2a
0x0040ce2e
0x0040ce31
0x0040ce33
0x0040ce38
0x0040ce3c
0x0040ce3c
0x0040ce3f
0x0040ce42
0x0040ce54
0x0040cf4b
0x0040cf4e
0x0040cf85
0x0040cf8f
0x0040cf50
0x0040cf50
0x0040cf55
0x0040cf58
0x0040cf5b
0x0040cf9d
0x0040cf5d
0x0040cf64
0x0040cf64
0x0040cf5b
0x0040cf69
0x0040cf6b
0x0040cf6d
0x0040cf6d
0x0040cf6d
0x0040cf6d
0x0040cf70
0x0040cf81
0x0040ce5a
0x0040ce5d
0x0040cee0
0x0040cee3
0x0040cee7
0x0040ceea
0x0040cef0
0x0040cef0
0x0040cef4
0x0040cf00
0x0040cf0c
0x0040cf12
0x0040cf12
0x0040cf12
0x0040cf1a
0x00000000
0x0040cf44
0x0040cf44
0x00000000
0x0040ce63
0x0040ce63
0x0040ce63
0x0040ce6a
0x0040ce6a
0x0040ce6f
0x0040ce76
0x0040ce9b
0x0040ce9e
0x0040cea6
0x0040cea9
0x0040ceba
0x0040cebf
0x0040cec2
0x00000000
0x00000000
0x0040cec4
0x0040cec6
0x0040ceca
0x0040ceca
0x0040ce8b
0x0040ce8e
0x0040ce93
0x0040ce95
0x00000000
0x00000000
0x00000000
0x0040ce95
0x0040ce78
0x0040cf2d
0x0040cf2d
0x0040cf2d
0x0040cf33
0x0040cf38
0x00000000
0x00000000
0x0040cf2c
0x0040cf2c
0x0040cf2c
0x0040cf2c
0x00000000
0x0040cf2d
0x00000000
0x0040ce76
0x00000000

Strings

%-*.*S, xrefs: 0040CF96
%*.*S, xrefs: 0040CF5D
%.*S, xrefs: 0040CF88

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID: %*.*S$%-*.*S$%.*S
API String ID: 0-2115465065
Opcode ID: dad0347ec67f5794da4a6d8fc76f4fe1b6cd43a7292eaf67df468db9194bceed
Instruction ID: 8ec9b0c159eb4337206ff08faf36ac2ad669e2e6ac23e9a1201355e5d05c7c7d
Opcode Fuzzy Hash: dad0347ec67f5794da4a6d8fc76f4fe1b6cd43a7292eaf67df468db9194bceed
Instruction Fuzzy Hash: 6431A2B3710642C6D7209B26E88075AB692E784BD8F18C336EF48577C8DA3DC585CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00401C70 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00401C70(void* __r9, void* __r12, unsigned long long _a32, long long _a40, signed long long _a48) {
				int _t26;
				void* _t33;
				intOrPtr _t35;
				void* _t41;
				void* _t42;

				_t42 = __r9;
				if( *0x424120 != 0) {
					_t26 = E004017A0(_t26,  *((intOrPtr*)(__r12 + 0x30)));
					_t35 =  *0x424178;
					goto L4;
				} else {
					__r11 =  *0x424178;
					if( *0x424104 != 0) {
						L12:
						__r10 =  *__r12;
						__r8 =  *((intOrPtr*)(__r12 + 0x10));
						__rax = 0x540be3ff;
						if(__r10 > 0x540be3ff) {
							__r9 = L"GiB";
							__rcx = 0x1e;
							L21:
							__rax = __r8 + __r8 * 4;
							__rax = __r8 + __r8 * 4 + (__r8 + __r8 * 4) * 4;
							__rax = __r8 + __r8 * 4 + (__r8 + __r8 * 4) * 4 << 2;
							__eax = __eax / __r10;
							L16:
							if(__r11 == 0) {
								L6:
								return _t26;
							}
							__r10 = __r10 >> __cl;
							_a48 = __rax;
							__r8 = __r8 >> __cl;
							__rcx = __r11;
							_a40 = __r9;
							_a32 = __r10;
							__eax = E00401650(__r8, __r9);
							__rcx =  *0x424178;
							__rax =  *__r12;
							if( *((intOrPtr*)(__r12 + 0x10)) <  *__r12) {
								L4:
								if(_t35 != 0) {
									_t26 = fflush();
								}
								goto L6;
							}
							goto L1;
						}
						if(__r10 > 0x98967f) {
							__r9 = L"MiB";
							__rcx = 0x14;
							 *0x2540BE38C =  *((long long*)(0x2540be38c)) - 1;
							L15:
							__rax = 0;
							if(__r10 != 0) {
								goto L21;
							}
							goto L16;
						}
						__r9 = L"bytes";
						__rcx = 0;
						if(__r10 > 0x270f) {
							__r9 = L"KiB";
							__rcx = 0xa;
							 *((long long*)(__rbp + 0xfffbfba400000035)) =  *((long long*)(__rbp + 0xfffbfba400000035)) - 1;
							goto L21;
						}
						goto L15;
					}
					if(__rcx != 0 && __r11 != 0) {
						__rax = "s";
						__rbx =  !=  ? __rax : 0x41717e;
						L00409100();
						__rcx =  *0x424178;
						r9d =  *((intOrPtr*)(__r12 + 0x20));
						_a32 =  !=  ? __rax : 0x41717e;
						__r8 = __rax;
						__eax = E00401650(__rax, __r9);
						__r11 =  *0x424178;
					}
					 *0x424104 = 1;
					goto L12;
				}
				L1:
				if(_t33 == 0) {
					goto L6;
				}
				_t26 = E00401650(_t41, _t42);
				_t35 =  *0x424178;
				goto L4;
			}

0x00401c70
0x00401c78
0x004021c5
0x004021ca
0x00000000
0x00401c7e
0x00401c85
0x00401c8c
0x00401ce7
0x00401ce7
0x00401ceb
0x00401cf0
0x00401cfd
0x00402267
0x0040226e
0x00402273
0x00402273
0x00402279
0x0040227d
0x00402281
0x00401d31
0x00401d34
0x00401981
0x0040198c
0x0040198c
0x00401d3a
0x00401d3d
0x00401d41
0x00401d44
0x00401d47
0x00401d53
0x00401d58
0x00401d5d
0x00401d64
0x00401d6d
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00000000
0x0040197a
0x00000000
0x00401d73
0x00401d0a
0x00402375
0x0040237c
0x00402385
0x00401d26
0x00401d26
0x00401d2b
0x00000000
0x00000000
0x00000000
0x00401d2b
0x00401d10
0x00401d17
0x00401d20
0x00402364
0x0040236b
0x00402374
0x00000000
0x00402374
0x00000000
0x00401d20
0x00401c95
0x00401ca1
0x00401cb2
0x00401cb6
0x00401cbb
0x00401cc2
0x00401ccc
0x00401cd1
0x00401cd4
0x00401cd9
0x00401cd9
0x00401ce0
0x00000000
0x00401ce0
0x00401958
0x0040195b
0x00000000
0x00000000
0x00401964
0x00401970
0x00000000

Strings

GiB, xrefs: 00402267
MiB, xrefs: 00402375
Archiving file data: %llu %ls of %llu %ls (%u%%) done, xrefs: 00401D4C
Using %ls compression with %u thread%ls, xrefs: 00401CC5
KiB, xrefs: 00402364
bytes, xrefs: 00401D10

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID: Archiving file data: %llu %ls of %llu %ls (%u%%) done$GiB$KiB$MiB$Using %ls compression with %u thread%ls$bytes
API String ID: 0-829042426
Opcode ID: 65ffe6d2d61c5d671bb63e3ef258d98866aff2602f9a5989fd71adf220eec2ec
Instruction ID: 5d179143940cff15f60169afbc1925701f22ed008fefb763889c2b2c91b0b5cf
Opcode Fuzzy Hash: 65ffe6d2d61c5d671bb63e3ef258d98866aff2602f9a5989fd71adf220eec2ec
Instruction Fuzzy Hash: E13137B1708B0496EB14CB61E858BAA2364F398784F850137EE4E633A0DB7CC595C34C

Uniqueness

Uniqueness Score: -1.00%

Function 00401560 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401578
LoadLibraryA.KERNEL32 ref: 0040158D
GetProcAddress.KERNEL32 ref: 004015AB
GetProcAddress.KERNEL32 ref: 004015BA

Strings

__register_frame_info, xrefs: 0040159A
libgcc_s_dw2-1.dll, xrefs: 00401571, 00401586
__deregister_frame_info, xrefs: 004015AD

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: f8ced96382eabce680b73a676b673300398fe8d5e500dc106b0868b6cf86dce7
Instruction ID: 78fe966581bf46e89f722872e322ef5bcd8051b9b8e69b33802c57285b0baf56
Opcode Fuzzy Hash: f8ced96382eabce680b73a676b673300398fe8d5e500dc106b0868b6cf86dce7
Instruction Fuzzy Hash: CD01A2B1716E09A0EE11DB15FC5079467A4BB98784F880522EF4E563B4EF3CC58AD708

Uniqueness

Uniqueness Score: -1.00%

Function 004038A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E004038A0(void* __ecx, void* __edx, void* __fp0, intOrPtr* __rax, void* __rcx, void* __rdx) {
				char _v80;
				void* _v88;
				long long _v104;
				void* _t18;
				void* _t25;
				void* _t30;
				intOrPtr* _t31;
				short* _t33;
				void* _t34;
				signed long long _t49;
				void* _t55;
				intOrPtr* _t56;
				void* _t60;
				void* _t62;

				_t31 = __rax;
				_t30 = __fp0;
				asm("movaps [esp+0x40], xmm6");
				r13d = 0;
				_t34 = __rcx;
				_t55 = __rdx;
				while(1) {
					_t62 = 0x41dbe0;
					_t60 = 0x41717e;
					_v104 = 0;
					r12d = E00408FE0();
					if(_t31 == 0xffffffff) {
						break;
					}
					if(r12d == 3) {
						r13d = 1;
						L7:
						continue;
					}
					if(r12d == 0x15) {
						goto L7;
					}
					L4:
					asm("invalid");
					 *0x416040();
					asm("sbb bh, ch");
					asm("invalid");
					L5:
					asm("movaps xmm6, [esp+0x40]");
					return r12d;
				}
				_t31 =  *0x4201c0; // 0x416038
				_t49 =  *_t31;
				_t56 = _t55 + _t49 * 8;
				if(_t34 - _t49 != 3) {
					goto L4;
				}
				_t18 = E0040A4B0(_t30,  *((intOrPtr*)(_t56 + 0x10)),  &_v88);
				_t51 =  *((intOrPtr*)(_t56 + 0x10));
				_t33 = _v88;
				asm("movapd xmm6, xmm0");
				if( *((intOrPtr*)(_t56 + 0x10)) == _t33 ||  *_t33 != 0) {
					E004024D0(L"Invalid part size \"%ls\"", _t51, _t60, _t62);
					E004024D0(L"The part size must be an integer or floating-point number of megabytes.", _t51, _t60, _t62);
				} else {
					_v104 = 0;
					L004090A8();
					r12d = _t18;
					if(_t33 == 0) {
						asm("mulsd xmm6, [0x1b652]");
						r9d = _t25;
						asm("repne dec esp");
						L00409020();
						r12d = _t18;
						E004023A0(_t33, L"\nFinished splitting \"%ls\"\n",  *_t56,  &_v80, 0x401890);
						L00409108();
					}
				}
				goto L5;
			}

0x004038a0
0x004038a0
0x004038ae
0x004038b5
0x004038c6
0x004038c8
0x004038cb
0x004038cb
0x004038ce
0x004038d6
0x004038e4
0x004038ea
0x00000000
0x00000000
0x004038f0
0x00403930
0x00403936
0x00000000
0x00403936
0x004038f6
0x00000000
0x00000000
0x004038f8
0x00403901
0x00403903
0x00403912
0x00403914
0x00403917
0x00403917
0x0040392d
0x0040392d
0x00403940
0x00403947
0x0040394c
0x00403953
0x00000000
0x00000000
0x0040395e
0x00403963
0x00403967
0x0040396c
0x00403973
0x004039ef
0x004039fb
0x0040397b
0x0040398a
0x00403996
0x0040399b
0x004039a0
0x004039a6
0x004039b2
0x004039ba
0x004039c2
0x004039d1
0x004039d4
0x004039de
0x004039de
0x004039a0
0x00000000

APIs

wimlib_add_image_multisource.LIBWIM-15 ref: 00403996
wimlib_add_image_multisource.LIBWIM-15 ref: 004039DE

Strings

The part size must be an integer or floating-point number of megabytes., xrefs: 004039F4
Finished splitting "%ls", xrefs: 004039CA
Invalid part size "%ls", xrefs: 004039E8
8`A, xrefs: 00403940

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource
String ID: Finished splitting "%ls"$8`A$Invalid part size "%ls"$The part size must be an integer or floating-point number of megabytes.
API String ID: 1578821148-3593460420
Opcode ID: 47cf9bc5e6b0aa68ac9b7225f7600fbbe33311981d9e70543fac23ff9242d9cd
Instruction ID: 83878e3c3884a32e8de5d90eb66646991ae976c9bab819e0dfdb066f059236b0
Opcode Fuzzy Hash: 47cf9bc5e6b0aa68ac9b7225f7600fbbe33311981d9e70543fac23ff9242d9cd
Instruction Fuzzy Hash: 1C31E4B2214A4151DB209B26E8443AB6764B784BD8F405227EF4E677E5DFBDC986C308

Uniqueness

Uniqueness Score: -1.00%

Function 004030A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004030A0(void* __rax, intOrPtr* __rcx, void* __rdx, long long __r9) {
				void* _t12;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				signed long long _t23;
				signed long long _t24;
				long long _t43;
				intOrPtr* _t44;
				void* _t45;
				intOrPtr _t53;

				_t50 = __r9;
				_t44 = __rcx;
				_t14 = r8d;
				 *((long long*)(_t45 + 0x98)) = __r9;
				_t15 =  *((intOrPtr*)(__rcx + 8));
				if(_t15 == 0) {
					r13d = 0;
					goto L11;
				} else {
					_t24 = 0;
					r13d = 0;
					goto L6;
					do {
						while(1) {
							L6:
							_t23 = _t24;
							_t53 =  *((intOrPtr*)( *_t44 + _t23 * 8));
							if (_t15 < 0) goto 0x40318c;
							 *_t23 =  *_t23 + _t12;
							 *_t23 = _t13;
							_t7 = _t23 + 2; // 0x2
							_t43 = _t7;
							L004090F0();
							if(_t23 == 0) {
								break;
							}
							L00409198();
							if(_t23 != 0) {
								break;
							} else {
								if( *0x424178 != 0) {
									 *((long long*)(_t45 + 0x20)) = _t43;
									r9d = _t14;
									_t12 = E00401650(_t53, _t50);
								}
								_t24 = _t24 + 1;
								if( *((intOrPtr*)(_t44 + 8)) <= _t24) {
									goto L11;
								} else {
									continue;
								}
							}
							goto L13;
						}
						if( *0x424178 != 0) {
							 *((long long*)(_t45 + 0x20)) = _t43;
							r9d = _t14;
							_t12 = E00401650(_t53, _t50);
						}
						_t50 = _t43;
						L00409058();
						if(_t23 == 0) {
							goto L10;
						}
						goto L13;
						L10:
						r13d = 1;
						_t24 = _t24 + 1;
					} while ( *((intOrPtr*)(_t44 + 8)) > _t24);
					L11:
					if( *((long long*)(_t45 + 0x98)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x98)))) = r13b;
						return _t12;
					}
				}
				L13:
				return _t12;
			}

0x004030a0
0x004030b0
0x004030b9
0x004030bc
0x004030c4
0x004030c6
0x004031b6
0x00000000
0x004030cc
0x004030cc
0x004030ce
0x004030d8
0x00403117
0x00403117
0x00403117
0x0040311b
0x0040311d
0x0040312a
0x0040312c
0x00403136
0x0040313b
0x0040313b
0x0040313f
0x0040314a
0x00000000
0x00000000
0x004030e3
0x004030ea
0x00000000
0x004030ec
0x004030f6
0x004030f8
0x004030fd
0x0040310a
0x0040310a
0x0040310f
0x00403115
0x00000000
0x00000000
0x00000000
0x00000000
0x00403115
0x00000000
0x004030ea
0x00403156
0x00403158
0x0040315d
0x00403166
0x00403166
0x0040316b
0x00403176
0x0040317d
0x00000000
0x00000000
0x00000000
0x0040317f
0x0040317f
0x00403185
0x00403188
0x0040318d
0x00403198
0x004031a2
0x00000000
0x004031a2
0x00403198
0x004031b5
0x004031b5

APIs

wcscmp.MSVCRT ref: 004030E3
wcschr.MSVCRT ref: 00403129
wimlib_add_image_multisource.LIBWIM-15 ref: 0040313F
wimlib_add_image_multisource.LIBWIM-15 ref: 00403176

Strings

Setting the %ls property of image %d to "%ls"., xrefs: 004030D1
The %ls property of image %d already has value "%ls"., xrefs: 00403103

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: wimlib_add_image_multisource$wcschrwcscmp
String ID: Setting the %ls property of image %d to "%ls".$The %ls property of image %d already has value "%ls".
API String ID: 4233608177-537554600
Opcode ID: fbdc7c8f605ea163405bcc4d532bd3df9434eead2f15ba7ea1b608b174f14f85
Instruction ID: 0bbe192b331c958278586b9224fc57870e830b6fdf78e152a54004230fee9c75
Opcode Fuzzy Hash: fbdc7c8f605ea163405bcc4d532bd3df9434eead2f15ba7ea1b608b174f14f85
Instruction Fuzzy Hash: BE210B72305A8045E721DF27AC407976A59B799FC9F48843BAE0D6B795DE3CCA82C308

Uniqueness

Uniqueness Score: -1.00%

Function 00403260 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 004032A3
fread.MSVCRT ref: 004032C9
feof.MSVCRT ref: 004032DD
free.MSVCRT ref: 00403312

Strings

error reading stdin, xrefs: 00403300
out of memory while reading stdin, xrefs: 00403319

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: feoffreadfreerealloc
String ID: error reading stdin$out of memory while reading stdin
API String ID: 1166608578-2254877540
Opcode ID: 76533965038960bf2aa180062b2d547b2ef283f29ddfb266491c6ac5a14d4d29
Instruction ID: 5c0f754348fd6594c1bc83c33a954f0aad35533595692d0342a20ffc6d00ad00
Opcode Fuzzy Hash: 76533965038960bf2aa180062b2d547b2ef283f29ddfb266491c6ac5a14d4d29
Instruction Fuzzy Hash: 1E012B6230151451EA14AB63AD597BB1B486B58BD8F48043F9E0A677C1FD3CC583C30C

Uniqueness

Uniqueness Score: -1.00%

Function 004018C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E004018C0(intOrPtr* __r12, long long _a32, unsigned long long _a40, long long _a48, signed long long _a56) {
				int _t19;
				signed char _t20;
				signed long long _t35;
				intOrPtr _t41;
				void* _t49;
				unsigned long long _t53;
				long long _t56;
				intOrPtr* _t62;

				_t62 = __r12;
				_t53 =  *__r12;
				if(_t53 > 0x540be3ff) {
					_t56 = L"GiB";
					goto L14;
				} else {
					if(_t53 > 0x98967f) {
						goto ( *((intOrPtr*)(_t49 - 0x7d)));
						goto L3;
					} else {
						_t56 = L"bytes";
						if(_t53 > 0x270f) {
							goto ( *((intOrPtr*)(_t49 + 0x41)));
							goto L14;
						} else {
							L3:
							_t35 = 0;
							if(_t53 != 0) {
								L14:
								_t35 =  *(_t62 + 8) +  *(_t62 + 8) * 4 + ( *(_t62 + 8) +  *(_t62 + 8) * 4) * 4 << 2;
								_t19 = _t19 / _t53;
							}
						}
					}
				}
				if( *0x424178 != 0) {
					_a48 = _t56;
					_a40 = _t53 >> _t20;
					_t55 =  *((intOrPtr*)(_t62 + 0x20));
					_a32 = _t56;
					_a56 = _t35;
					_t58 =  *(_t62 + 8) >> _t20;
					_t19 = E00401650( *((intOrPtr*)(_t62 + 0x20)),  *(_t62 + 8) >> _t20);
					_t41 =  *0x424178;
					if( *(_t62 + 8) !=  *_t62) {
						L10:
						if(_t41 != 0) {
							_t19 = fflush();
						}
					} else {
						if(_t41 != 0) {
							_t19 = E00401650(_t55, _t58);
							_t41 =  *0x424178;
							goto L10;
						}
					}
				}
				return _t19;
			}

0x004018c0
0x004018ca
0x004018d1
0x00402210
0x00000000
0x004018d7
0x004018de
0x00402353
0x00000000
0x004018e4
0x004018e4
0x004018f4
0x00402308
0x00000000
0x004018fa
0x004018fa
0x004018fa
0x004018ff
0x0040221c
0x0040222b
0x0040222f
0x0040222f
0x004018ff
0x004018f4
0x004018de
0x0040190f
0x00401914
0x00401920
0x00401925
0x0040192a
0x00401934
0x00401938
0x0040193e
0x00401943
0x00401953
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00401958
0x0040195b
0x00401964
0x00401970
0x00000000
0x00401970
0x0040195b
0x00401953
0x0040198c

APIs

fflush.MSVCRT ref: 0040197C

Strings

GiB, xrefs: 00402210
MiB, xrefs: 00402343
Verifying integrity of "%ls": %llu %ls of %llu %ls (%u%%) done, xrefs: 00401919
KiB, xrefs: 004022F8
bytes, xrefs: 004018E4

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: Verifying integrity of "%ls": %llu %ls of %llu %ls (%u%%) done$GiB$KiB$MiB$bytes
API String ID: 497872470-3734933048
Opcode ID: 4173576c873890b88c02bda3bbc3a80de3dc6b7890c0080e901e720b39a614b4
Instruction ID: c1e12124bf1c5b8adc4bbca27e843d80fbf49527d2693edc90bbce6b99a89a6d
Opcode Fuzzy Hash: 4173576c873890b88c02bda3bbc3a80de3dc6b7890c0080e901e720b39a614b4
Instruction Fuzzy Hash: 92214CB6205B8885EB14CBA5E458BE97760F395B90F85413BEE4E233E0DB7CC194C708

Uniqueness

Uniqueness Score: -1.00%

Function 00401D80 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00401D80(int __eax, void* __r12, unsigned long long _a32, long long _a40, long long _a48) {
				int _t17;
				signed char _t18;
				intOrPtr _t27;
				unsigned long long _t36;
				long long _t37;
				unsigned long long _t38;
				void* _t41;

				_t41 = __r12;
				_t17 = __eax;
				_t38 =  *((intOrPtr*)(__r12 + 0x28));
				_t36 =  *((intOrPtr*)(__r12 + 0x30));
				if(_t38 == 0) {
					_t37 = L"bytes";
				} else {
					__rax = __r8 + __r8 * 4;
					__r9 = L"GiB";
					__rax = __r8 + __r8 * 4 << 2;
					__eax = __eax / __r10;
					if(__r10 <= 0x540be3ff) {
						__r9 = L"MiB";
						_t9 = __rax;
						__rax = __rsi;
						__rsi = _t9;
						__eax = __rax;
						 *__rdi =  *__rdi + __cl;
						_t10 = __rdi + 2;
						_t11 = __rbp;
						__rbp =  *_t10;
						 *_t10 = _t11;
						 *__rax =  *__rax + __al;
					}
				}
				if( *0x424178 != 0) {
					_a48 = 0;
					_t36 = _t36 >> _t18;
					_a40 = _t37;
					_a32 = _t38 >> _t18;
					_t17 = E00401650(_t36, _t37);
					_t27 =  *0x424178;
					if( *((intOrPtr*)(_t41 + 0x30)) >=  *((intOrPtr*)(_t41 + 0x28))) {
						if(_t27 != 0) {
							_t17 = E00401650(_t36, _t37);
							_t27 =  *0x424178;
							goto L4;
						}
					} else {
						L4:
						if(_t27 != 0) {
							_t17 = fflush();
						}
					}
				}
				return _t17;
			}

0x00401d80
0x00401d80
0x00401d80
0x00401d85
0x00401d8d
0x00402042
0x00401d93
0x00401d93
0x00401da2
0x00401da9
0x00401dad
0x00401dbd
0x00401dc3
0x00401dd3
0x00401dd3
0x00401dd3
0x00401dd4
0x00401dd5
0x00401dd7
0x00401dd7
0x00401dd7
0x00401dd7
0x00401dda
0x00401dda
0x00401dbd
0x00402055
0x0040205e
0x00402062
0x00402068
0x00402074
0x00402079
0x00402083
0x0040208f
0x0040195b
0x00401964
0x00401970
0x00000000
0x00401970
0x00402095
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x0040197a
0x0040208f
0x0040198c

APIs

fflush.MSVCRT ref: 0040197C

Strings

GiB, xrefs: 00401DA2
MiB, xrefs: 00401DC3
Extracting file data: %llu %ls of %llu %ls (%u%%) done, xrefs: 0040206D
KiB, xrefs: 00401DE3
bytes, xrefs: 00401DEA, 00402042

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: Extracting file data: %llu %ls of %llu %ls (%u%%) done$GiB$KiB$MiB$bytes
API String ID: 497872470-3722678368
Opcode ID: b257d7ede31905746a7b6f3f96161e7b33066cdc0853ebbc7078651683df471e
Instruction ID: 75c0a73b273446fbd05aba8a274ae9b9e52c344955c9cfd8870e8cab57902adc
Opcode Fuzzy Hash: b257d7ede31905746a7b6f3f96161e7b33066cdc0853ebbc7078651683df471e
Instruction Fuzzy Hash: EB215BB2305A0486EB18CB65E868BEA3760F348784F85453BAE0E527E1DF7CC589C30C

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E004019C0(intOrPtr* __r12, unsigned long long _a32, long long _a40, signed long long _a48) {
				int _t21;
				signed char _t22;
				signed long long _t32;
				intOrPtr _t36;
				long long _t49;
				intOrPtr* _t51;

				_t51 = __r12;
				_t46 =  *__r12;
				if(_t46 > 0x540be3ff) {
					_t49 = L"GiB";
					goto L14;
				} else {
					if(__r8 > 0x98967f) {
						__r9 = L"MiB";
						 *((long long*)(__rbp + 0xffdadfa40000005d)) =  *((long long*)(__rbp + 0xffdadfa40000005d)) - 1;
						goto L9;
					} else {
						__r9 = L"bytes";
						if(__r8 > 0x270f) {
							__r9 = L"KiB";
							 *__rdi =  *__rdi - 1;
							goto L14;
						} else {
							L9:
							if(__r8 != 0) {
								L14:
								_t32 =  *(_t51 + 8) +  *(_t51 + 8) * 4 + ( *(_t51 + 8) +  *(_t51 + 8) * 4) * 4 << 2;
								_t21 = _t21 / _t46;
							}
						}
					}
				}
				if( *0x424178 != 0) {
					_a48 = _t32;
					_a32 = _t46 >> _t22;
					_a40 = _t49;
					_t46 =  *(_t51 + 8) >> _t22;
					_t21 = E00401650( *(_t51 + 8) >> _t22, _t49);
					_t36 =  *0x424178;
					if( *(_t51 + 8) !=  *_t51) {
						L4:
						if(_t36 != 0) {
							_t21 = fflush();
						}
					} else {
						if(_t36 != 0) {
							_t21 = E00401650(_t46, _t49);
							_t36 =  *0x424178;
							goto L4;
						}
					}
				}
				return _t21;
			}

0x004019c0
0x004019ca
0x004019d1
0x00402240
0x00000000
0x004019d7
0x004019de
0x00402332
0x00402342
0x00000000
0x004019e4
0x004019e4
0x004019f4
0x004022e0
0x004022f0
0x00000000
0x004019fa
0x004019fa
0x004019ff
0x0040224c
0x0040225b
0x0040225f
0x0040225f
0x004019ff
0x004019f4
0x004019de
0x00401a0f
0x00401a18
0x00401a23
0x00401a2d
0x00401a32
0x00401a38
0x00401a3d
0x00401a4d
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00401a53
0x0040195b
0x00401964
0x00401970
0x00000000
0x00401970
0x0040195b
0x00401a4d
0x0040198c

APIs

fflush.MSVCRT ref: 0040197C

Strings

Calculating integrity table for WIM: %llu %ls of %llu %ls (%u%%) done, xrefs: 00401A1C
GiB, xrefs: 00402240
MiB, xrefs: 00402332
KiB, xrefs: 004022E0
bytes, xrefs: 004019E4

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: Calculating integrity table for WIM: %llu %ls of %llu %ls (%u%%) done$GiB$KiB$MiB$bytes
API String ID: 497872470-3668557735
Opcode ID: a1d2d1736db9b5036067edc71767c656012c346a40bf27e5e472dd8f9045c7d6
Instruction ID: f7c79ae686fe6af3faa14e44f75740de3e1626a10c350c1faf1f779aaa5df93d
Opcode Fuzzy Hash: a1d2d1736db9b5036067edc71767c656012c346a40bf27e5e472dd8f9045c7d6
Instruction Fuzzy Hash: 132136B2205B8485EB18CBA5E4587EA3760E399780F85453BEA0E227E0DB7CC585D70C

Uniqueness

Uniqueness Score: -1.00%

Function 00401B68 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00401B68(int __eax, void* __r12, unsigned long long _a32, long long _a40, long long _a48) {
				int _t18;
				signed char _t19;
				intOrPtr _t28;
				unsigned long long _t37;
				long long _t38;
				unsigned long long _t39;
				void* _t42;

				_t42 = __r12;
				_t18 = __eax;
				_t39 =  *((intOrPtr*)(__r12 + 0x10));
				_t37 =  *((intOrPtr*)(__r12 + 0x20));
				if(_t39 == 0) {
					_t38 = L"bytes";
				} else {
					__rax = __r8 + __r8 * 4;
					__r9 = L"GiB";
					__rax = __r8 + __r8 * 4 << 2;
					__eax = __eax / __r10;
					if(__r10 <= 0x540be3ff) {
						__r9 = L"MiB";
						_t9 = __rax;
						__rax = __rsi;
						__rsi = _t9;
						__eax = __rax;
						 *__rdi =  *__rdi + __cl;
						_t10 = __rsp;
						__rsp = __rdi;
						__rdi = _t10;
						__al = __al;
						 *0x7FFA8148FFFFFF95 =  *((intOrPtr*)(0x7ffa8148ffffff95)) + __cl;
					}
				}
				if( *0x424178 != 0) {
					_a48 = 0;
					_t37 = _t37 >> _t19;
					_a40 = _t38;
					_a32 = _t39 >> _t19;
					_t18 = E00401650(_t37, _t38);
					_t28 =  *0x424178;
					if( *((intOrPtr*)(_t42 + 0x20)) !=  *((intOrPtr*)(_t42 + 0x10))) {
						L4:
						if(_t28 != 0) {
							_t18 = fflush();
						}
					} else {
						if(_t28 != 0) {
							_t18 = E00401650(_t37, _t38);
							_t28 =  *0x424178;
							goto L4;
						}
					}
				}
				return _t18;
			}

0x00401b68
0x00401b68
0x00401b68
0x00401b6d
0x00401b75
0x004020a2
0x00401b7b
0x00401b7b
0x00401b8a
0x00401b91
0x00401b95
0x00401ba5
0x00401bab
0x00401bbb
0x00401bbb
0x00401bbb
0x00401bbc
0x00401bbd
0x00401bbf
0x00401bbf
0x00401bbf
0x00401bc1
0x00401bc3
0x00401bc3
0x00401ba5
0x004020b5
0x004020be
0x004020c2
0x004020c8
0x004020d4
0x004020d9
0x004020de
0x004020ef
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x004020f5
0x0040195b
0x00401964
0x00401970
0x00000000
0x00401970
0x0040195b
0x004020ef
0x0040198c

Strings

GiB, xrefs: 00401B8A
MiB, xrefs: 00401BAB
Verifying file data: %llu %ls of %llu %ls (%u%%) done, xrefs: 004020CD
KiB, xrefs: 00401BCB
bytes, xrefs: 00401BD2, 004020A2

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID: Verifying file data: %llu %ls of %llu %ls (%u%%) done$GiB$KiB$MiB$bytes
API String ID: 0-217642830
Opcode ID: 23edecfd5d391f2a98f70048e78784b1938bc847399c139772da97936a713f55
Instruction ID: d4cc1725faeebfb01ba316b042eacfe84777155a34aa2b393c9ba6394b61edb8
Opcode Fuzzy Hash: 23edecfd5d391f2a98f70048e78784b1938bc847399c139772da97936a713f55
Instruction Fuzzy Hash: 1E115EB2314B0492EB14CB65E858BEA2764F358784F85453BAE4E523E0DF7CC589C30D

Uniqueness

Uniqueness Score: -1.00%

Function 00407F90 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00407F90(void* __eax, void* __ebx, void* __edx, void* __rcx, void* __rdx, long long* __r8) {
				long long _v64;
				long long _v72;
				void* _t41;

				_t13 = __eax;
				if(__rdx > 0x7fffffff) {
					asm("adc eax, 0xdfc2");
					_t13 = E00407F10(__rdx, _t41);
				} else {
					if(__rdx != 0) {
						r9d = __edx;
						_v64 = 0;
						_v72 = 0;
						 *((char*)(__r8 + 0x4c427ec0)) = 0x63;
					} else {
						 *__r8 = 0;
					}
				}
				return _t13;
			}

0x00407f90
0x00407fae
0x00408079
0x0040808b
0x00407fb4
0x00407fb7
0x00407fd8
0x00407fe0
0x00407fe8
0x00408001
0x00407fb9
0x00407fb9
0x00407fc0
0x00407fb7
0x00407fd4

APIs

MultiByteToWideChar.KERNEL32 ref: 00407FFD
malloc.MSVCRT ref: 0040800D
MultiByteToWideChar.KERNEL32 ref: 00408030

Strings

ERROR: out of memory!, xrefs: 004080A0
ERROR: too much data (%zu bytes)!, xrefs: 00408081
ERROR: Invalid multi-byte string in the text file you provided as input! Maybe try converting your text file to UTF-16LE?, xrefs: 00408056

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: ByteCharMultiWide$malloc
String ID: ERROR: Invalid multi-byte string in the text file you provided as input! Maybe try converting your text file to UTF-16LE?$ERROR: out of memory!$ERROR: too much data (%zu bytes)!
API String ID: 1811578439-1293987992
Opcode ID: 4f853d5e21fa4d2221cf58dbdd23c3d405790181fcdb317980f1f4cba2719215
Instruction ID: a068e4925605278294436b360811e87e69664c16a5c79f3c7d28a02f9a3bc9fe
Opcode Fuzzy Hash: 4f853d5e21fa4d2221cf58dbdd23c3d405790181fcdb317980f1f4cba2719215
Instruction Fuzzy Hash: E3218BB170860241EB24DB16F91476A6A81BB487D8F40853FEE4E6B3C6EE3CC449C309

Uniqueness

Uniqueness Score: -1.00%

Function 004031C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 004031DC
fputws.MSVCRT ref: 00403207
_wcserror.MSVCRT ref: 00403229

Strings

ERROR: , xrefs: 004031FD
: %ls, xrefs: 0040323C

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: _errno_wcserrorfputws
String ID: : %ls$ERROR:
API String ID: 3089782697-2470117166
Opcode ID: c032ebdbecb0167f0600dd5c411c2d8ef86cb6149d41d0046cdcf7b14489bcd1
Instruction ID: 76ed61f3ed5eb3273cb6b509df7e86a3884476202aed73b3ddccbf2953777d93
Opcode Fuzzy Hash: c032ebdbecb0167f0600dd5c411c2d8ef86cb6149d41d0046cdcf7b14489bcd1
Instruction Fuzzy Hash: C6018FB1600B0581EA00EB52F84939A67A5F7897D4F44003AAF4A173A5DE3CC041C704

Uniqueness

Uniqueness Score: -1.00%

Function 04096080 Relevance: 8.0, APIs: 5, Instructions: 472COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409646B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04096471
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04096477
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409647D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04096483

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 30b34bfc52453d5ff660477592df7c2a93500b66f1a98a88ba5b7d6f969ffee2
Instruction ID: 7d4dbba32b5f298f7d49856665d66c8307ddb7c58bf250d5d25743b3538aa267
Opcode Fuzzy Hash: 30b34bfc52453d5ff660477592df7c2a93500b66f1a98a88ba5b7d6f969ffee2
Instruction Fuzzy Hash: F3D1F630628E1D8FDF08EFACD8897A973E1FB59305F544A1AD805E7299DA71F881C781

Uniqueness

Uniqueness Score: -1.00%

Function 00409C59 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00409CFA

Strings

CCG , xrefs: 00409C76

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: c75b79cc0ba044434e57489e1930b301e123fbb47112206801e5abcf27b66e08
Instruction ID: fc76618b0d027ad374409ed45c38ce2b7487395df75b4d7d93c693437ee9f3a7
Opcode Fuzzy Hash: c75b79cc0ba044434e57489e1930b301e123fbb47112206801e5abcf27b66e08
Instruction Fuzzy Hash: 712192B1B5850446FB785679949137A1581AF89378F684B3BD63D973E2DA3CCCC2830E

Uniqueness

Uniqueness Score: -1.00%

Function 00401010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401010() {
				void* _t11;
				void* _t13;
				void* _t15;
				void* _t16;
				signed int _t17;
				void* _t18;
				long long* _t25;
				long long* _t26;
				long long* _t27;
				long long* _t28;
				short* _t29;
				intOrPtr* _t30;
				long long* _t31;
				long long* _t32;
				long long* _t33;
				long long _t36;
				intOrPtr* _t40;
				intOrPtr* _t42;

				_t25 =  *0x420180; // 0x424208
				_t36 = 0;
				 *_t25 = 1;
				_t26 =  *0x420190; // 0x424204
				 *_t26 = 1;
				_t27 =  *0x4201a0; // 0x424200
				 *_t27 = 1;
				_t28 =  *0x420170; // 0x4241e0
				 *_t28 = 1;
				_t29 =  *0x420020; // 0x400000
				if( *_t29 == 0x5a4d) {
					_t1 = _t29 + 0x3c; // 0xeba1f0e00000080
					_t32 = _t29 +  *_t1;
					if( *_t32 == 0x4550) {
						if(_t18 == 0x10b) {
							if( *((long long*)(_t32 + 0x74)) > 0xe) {
								_t8 = _t32 + 0xe8; // 0x1000
								r8d =  *_t8;
								_t36 = 0;
								_t17 = _t17 & 0xffffff00 | r8d != 0x00000000;
							}
						} else {
							if(_t18 == 0x20b &&  *((long long*)(_t32 + 0x84)) > 0xe) {
								_t4 = _t32 + 0xf8; // 0x1000
								_t36 = 0;
								_t17 = _t17 & 0xffffff00 |  *_t4 != 0x00000000;
							}
						}
					}
				}
				_t30 =  *0x420160; // 0x424220
				 *0x424020 = _t36;
				_t31 =  *_t30;
				if(_t31 == 0) {
					_t36 = 0x1;
					_t16 = _t16 + bpl;
					_t32 = 0x401f0f;
				} else {
					_t12 = _t11 + bpl;
				}
				_t13 = E00409490(_t12);
				_t40 =  *0x420120; // 0x424250
				 *_t31 =  *_t40;
				E00409480(_t13);
				_t42 =  *0x420100; // 0x424210
				 *_t31 =  *_t42;
				_t15 = E00409770();
				_t33 =  *0x41ffb0; // 0x4160f0
				if( *_t33 == 1) {
					L00409C50();
					return _t15;
				} else {
					return _t15;
				}
			}

0x00401014
0x0040101b
0x0040101d
0x00401023
0x0040102a
0x00401030
0x00401037
0x0040103d
0x00401044
0x0040104a
0x00401056
0x00401058
0x0040105c
0x00401065
0x004010d9
0x00401124
0x0040112a
0x0040112a
0x00401131
0x00401136
0x00401136
0x004010db
0x004010e0
0x004010ef
0x004010f5
0x004010f9
0x004010f9
0x004010e0
0x004010d9
0x00401065
0x00401067
0x0040106e
0x00401074
0x00401078
0x004010c0
0x004010c9
0x004010cb
0x0040107a
0x00401083
0x00401083
0x00401084
0x00401089
0x00401092
0x00401094
0x00401099
0x004010a2
0x004010a4
0x004010a9
0x004010b3
0x0040110f
0x0040111a
0x004010b5
0x004010bb
0x004010bb

APIs

__set_app_type.MSVCRT ref: 0040107F

Strings

PBB, xrefs: 00401089
AB, xrefs: 0040103D
BB, xrefs: 00401067

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: __set_app_type
String ID: BB$PBB$AB
API String ID: 1108511539-2904604019
Opcode ID: 68730ea85796befe5fb465e178c039c480b432673663430f81e2548b1e4d787f
Instruction ID: 6adb2652bc7d6ce0888929b503afbc77f8abb846ac86c12595dfeba70ca8f7cc
Opcode Fuzzy Hash: 68730ea85796befe5fb465e178c039c480b432673663430f81e2548b1e4d787f
Instruction Fuzzy Hash: B5217CB5700644C6D7159F26D84136A33A1B789B48FC1803AEB4967BA6CB7ECC81CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00403E00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00403E00(void* __eax, void* __ecx, void* __esi, void* __r8, void* __r9) {
				void* _t256;
				long long _t265;
				void* _t273;
				void* _t276;
				void* _t282;
				void* _t283;

				_t283 = __r9;
				_t282 = __r8;
				_t256 = __eax;
				_t265 =  *0x4201b0; // 0x424188
				_t273 = _t276 + 0x70;
				r8d = 0xa;
				L00409168();
				 *((long long*)(_t276 - 8)) = _t265;
				if(_t265 == 0xffffffff) {
					L16:
					r15d = 0xffffffff;
					E004024D0(L"Number of threads must be a non-negative integer!", _t273, _t282, _t283);
					goto L13;
				} else {
					__rax =  *((intOrPtr*)(__rbp + 0x70));
					__eflags =  *__rax;
					if( *__rax != 0) {
						goto L16;
					} else {
						__eflags = __r15 - __rax;
						if(__r15 != __rax) {
							 *(__rsp + 0x20) = 0;
							__r9 = 0x41e9e0;
							__rdx = __rdi;
							__rcx = __rsi;
							__r8 = 0x41717e;
							__eax = E00408FE0();
							__eflags = __rax - 0xffffffff;
							if(__rax == 0xffffffff) {
								__rax =  *0x4201c0; // 0x416038
								__rax =  *__rax;
								__rsi = __rsi - __rax;
								__rbx = __rdi + __rax * 8;
								__rax = __rsi - 2;
								r15d = __esi;
								__eflags = __rax - 2;
								if(__rax > 2) {
									L12:
									__rcx = 0x2;
									asm("invalid");
									__eax =  *0x416040();
									__ecx = r14d;
									__rdx = __rax;
									__eax = E00403630(r14d, __rax, __rax, __r8, __r9, __r12, __r13);
									goto L13;
								} else {
									__rax =  *((intOrPtr*)(__rbx + 8));
									__eflags =  *(__rbp + 0x14) - 0xffffffff;
									__rsi =  *__rbx;
									 *(__rbp - 0x20) = __rax;
									if( *(__rbp + 0x14) == 0xffffffff) {
										 *(__rbp + 0x14) = 1;
										__eflags = r13d & 0x00001000;
										if((r13d & 0x00001000) == 0) {
											__rax = 0;
											__eflags = r12d & 0x00001000;
											__eax = __eax & 0xffffff00 | (r12d & 0x00001000) != 0x00000000;
											__rax = 2;
											 *(__rbp + 0x14) = 2;
										}
									}
									_t22 = __rbp - 0x20; // 0x0
									__rcx =  *_t22;
									__rdx = "-";
									L00409198();
									__eflags = __rax;
									if(__rax == 0) {
										__eax = r12d;
										__rax = __rax | 0x00000004;
										__eflags =  *((char*)(__rbp + 0x12));
										 *(__rbp - 0x18) = __rax;
										if( *((char*)(__rbp + 0x12)) != 0) {
											L71:
											__eflags =  *0x424178;
											if( *0x424178 != 0) {
												__rcx = 0x2;
												 *__rax =  *__rax + __rax;
												__eflags =  *__rax;
												 *0x424178 = __rax;
											}
											__rcx = 0x1;
											 *0x3C40E7FFFFFF82 =  *((intOrPtr*)(0x3c40e7ffffff82)) + __al;
											asm("in al, 0x0");
											 *__rax =  *__rax;
											__eflags =  *__rax;
											if( *__rax != 0) {
												goto L175;
											} else {
												 *(__rbp - 0x20) = 0;
												 *((char*)(__rbp + 0x12)) = 0;
												goto L25;
											}
										} else {
											__eflags = r14d;
											if(r14d == 0) {
												__rcx = L"Using standard output for append does not make sense.";
												r15d = r15d | 0xffffffff;
												__eax = E004024D0(L"Using standard output for append does not make sense.", "-", __r8, __r9);
												goto L13;
											} else {
												goto L71;
											}
										}
									} else {
										__rdi = __rdi & 0x00008000;
										__eflags =  *((char*)(__rbp + 0x12));
										if( *((char*)(__rbp + 0x12)) != 0) {
											_t177 = __rbp - 0x20; // 0x0
											__rcx =  *_t177;
											_t178 = __rbp + 0x70; // 0x108f4
											__rdx = _t178;
											__imp___wstat64();
											__eflags = __rax;
											if(__rax == 0) {
												goto L22;
											} else {
												__imp___errno();
												__eflags =  *__rax - 2;
												if( *__rax != 2) {
													goto L22;
												} else {
													__eflags =  *((long long*)(__rbp + 0x18));
													if( *((long long*)(__rbp + 0x18)) == 0) {
														L173:
														__eflags = __rdi;
														if(__rdi != 0) {
															goto L175;
														} else {
															 *(__rbp - 0x18) = r12d;
															 *((char*)(__rbp + 0x12)) = 0;
															goto L30;
														}
													} else {
														__eflags =  *(__rbp + 8);
														if( *(__rbp + 8) == 0) {
															__eflags = __rdi;
															if(__rdi != 0) {
																goto L175;
															} else {
																 *((long long*)(__rbp + 0x18)) = 0;
																 *(__rbp - 0x18) = r12d;
																 *((char*)(__rbp + 0x12)) = 0;
																goto L30;
															}
														} else {
															_t181 = __rbp - 0x20; // 0x0
															__rdx =  *_t181;
															_t182 = __rbp + 8; // 0x0
															__rcx =  *_t182;
															L00409198();
															__eflags = __rax;
															if(__rax != 0) {
																goto L173;
															} else {
																__eflags = __rdi;
																if(__rdi != 0) {
																	goto L175;
																} else {
																	 *(__rbp - 0x18) = r12d;
																	 *((long long*)(__rbp + 0x18)) = 0;
																	 *((char*)(__rbp + 0x12)) = 0;
																	 *(__rbp + 8) = 0;
																	goto L30;
																}
															}
														}
													}
												}
											}
										} else {
											L22:
											__eflags = __rdi;
											if(__rdi == 0) {
												__eflags = r14d;
												 *(__rbp - 0x18) = r12d;
												_t247 = __rbp + 0x12; // 0x0
												 *_t247 = r14d == 0;
												goto L25;
											} else {
												__eflags = r14d;
												if(r14d != 0) {
													L175:
													__rcx = L"\'--unsafe-compact\' is only valid for append!";
													r15d = 0xffffffff;
													__eax = E004024D0(L"\'--unsafe-compact\' is only valid for append!", __rdx, __r8, __r9);
													goto L13;
												} else {
													 *(__rbp - 0x18) = r12d;
													 *((char*)(__rbp + 0x12)) = 1;
													L25:
													__eflags =  *((long long*)(__rbp + 0x18));
													if( *((long long*)(__rbp + 0x18)) == 0) {
														L30:
														__eflags = r15d - 2;
														if(r15d == 2) {
															__rcx = __rsi;
															L00409180();
															__rax = __rax + __rax + 0x43;
															__rax = __rax & 0xfffffff0;
															__eax = E0040A470(__eax);
															__rsp = __rsp - __rax;
															__rdx = __rsi;
															__rcx = __rsp + 0x30;
															L00409190();
															__rcx = __rax;
															__eax = E00402DF0(__eax, __rax, __rax);
															 *((char*)(__rbp + 0x11)) = 1;
															 *(__rbp - 0x48) = __rax;
															goto L33;
														} else {
															__rax =  *((intOrPtr*)(__rbx + 0x10));
															 *(__rbp - 0x48) = __rax;
															__eflags = r15d - 4;
															if(r15d == 4) {
																__rcx =  *((intOrPtr*)(__rbx + 0x18));
																L00409180();
																__rax = __rax + __rax + 0x29;
																__rax = __rax & 0xfffffff0;
																__eax = E0040A470(__eax);
																__rdx = L"DESCRIPTION=%ls";
																__r8 =  *((intOrPtr*)(__rbx + 0x18));
																__rsp = __rsp - __rax;
																__r12 = __rsp + 0x30;
																__rcx = __r12;
																__eax = E0040A630(__r12, L"DESCRIPTION=%ls", __r8, __r9);
																_t169 = __rbp + 0x50; // 0x108d4
																__rcx = _t169;
																__rdx = __r12;
																__eax = E00402550(__esi, __rax, _t169, __r12);
																r15d = __eax;
																__eflags = __rax;
																if(__rax == 0) {
																	goto L32;
																} else {
																	goto L13;
																}
															} else {
																L32:
																 *((char*)(__rbp + 0x11)) = 0;
																L33:
																__eflags =  *((char*)(__rbp + 0x13));
																if( *((char*)(__rbp + 0x13)) == 0) {
																	__rsp = __rsp - 0x20;
																	__rax = "\\";
																	__eflags =  *((char*)(__rbp + 0x12));
																	 *(__rbp + 0x38) = 0;
																	 *((long long*)(__rsp + 0x38)) = "\\";
																	_t143 = __rbp + 0x40; // 0x108c4
																	__rax = _t143;
																	__r12 = __rsp + 0x30;
																	 *__r12 = __rsi;
																	__rsi = 0x1;
																	 *((intOrPtr*)(__r12 + 0x10)) = 0;
																	if( *((char*)(__rbp + 0x12)) != 0) {
																		_t59 = __rbp - 0x14; // 0x0
																		__rdx =  *_t59;
																		_t60 = __rbp - 0x40; // 0x0
																		__r8 =  *_t60;
																		 *(__rsp + 0x20) = 0;
																		__r9 = 0x401890;
																		_t63 = __rbp - 0x20; // 0x0
																		__rcx =  *_t63;
																		__rdx =  *_t59 | 0x00000004;
																		L004090A8();
																		r15d = __eax;
																		__eflags = __rax;
																		if(__rax == 0) {
																			goto L56;
																		}
																	} else {
																		_t146 = __rbp - 0x40; // 0x0
																		__rdx =  *_t146;
																		_t147 = __rbp + 0x14; // 0x0
																		__rcx =  *_t147;
																		L00409148();
																		r15d = __eax;
																		__eflags = __rax;
																		if(__rax == 0) {
																			_t148 = __rbp + 0x40; // 0x30003b00330003
																			__rcx =  *_t148;
																			r8d = 0;
																			__rdx = 0x401890;
																			L00409070();
																			L56:
																			__rdx =  *__rbp;
																			__eflags =  *__rbp - 0xffffffff;
																			if( *__rbp == 0xffffffff) {
																				__eflags = r13d & 0x00001000;
																				if((r13d & 0x00001000) == 0) {
																					goto L58;
																				} else {
																					__eflags =  *((char*)(__rbp + 0x12));
																					if( *((char*)(__rbp + 0x12)) != 0) {
																						_t218 = __rbp + 0x40; // 0x30003b00330003
																						__rcx =  *_t218;
																						_t219 = __rbp + 0x70; // 0x108f4
																						__rdx = _t219;
																						L004090E0();
																						_t220 = __rbp + 0x94; // 0x0
																						__rax =  *_t220;
																						 *(__rbp + 0x14) = __rax;
																					}
																					__eflags =  *(__rbp + 0x14) - 1;
																					__rdx = 0x1000;
																					asm("invalid");
																				}
																				goto L103;
																			} else {
																				_t64 = __rbp + 0x40; // 0x30003b00330003
																				__rcx =  *_t64;
																				L00409050();
																				r15d = __eax;
																				__eflags = __rax;
																				if(__rax == 0) {
																					L58:
																					__eflags =  *((long long*)(__rbp + 4)) - 0xffffffff;
																					if( *((long long*)(__rbp + 4)) == 0xffffffff) {
																						L60:
																						__eflags =  *((long long*)(__rbp - 4)) - 0xffffffff;
																						if( *((long long*)(__rbp - 4)) == 0xffffffff) {
																							L62:
																							__eflags =  *((char*)(__rbp + 0x11));
																							if( *((char*)(__rbp + 0x11)) != 0) {
																								__eflags =  *((char*)(__rbp + 0x12));
																								if( *((char*)(__rbp + 0x12)) != 0) {
																									_t187 = __rbp - 0x48; // 0x0
																									__r15 =  *_t187;
																									__rdx = 0;
																									__rbx = 0x1;
																									 *__r8 =  *__r8 + __r8;
																									__rcx = __r15;
																									L004091A0();
																									__rdi = __rax;
																									while(1) {
																										_t188 = __rbp + 0x40; // 0x30003b00330003
																										__rcx =  *_t188;
																										__rdx = __r15;
																										L004090C8();
																										__eflags = __al;
																										if(__al == 0) {
																											break;
																										}
																										r8d = __ebx;
																										__rdx = __r14;
																										__rcx = __rdi;
																										__rbx = __rbx + 1;
																										__eflags = __rbx;
																										__eax = E0040A630(__rdi, __r14, __r8, __r9);
																									}
																								}
																							}
																							_t73 = __rbp + 0x68; // 0x1000000390038
																							__rax =  *_t73;
																							r14d = 0;
																							__eflags = __rax;
																							if(__rax != 0) {
																								__rcx = __rax;
																								__rdx = 0x8;
																								 *((intOrPtr*)(__rax - 0x77)) =  *((intOrPtr*)(__rax - 0x77)) + __cl;
																								asm("invalid");
																								__eflags = __rax;
																								if(__rax == 0) {
																									__rcx = L"Out of memory!";
																									r15d = r15d | 0xffffffff;
																									__eax = E004024D0(L"Out of memory!", 0x8, __r8, __r9);
																									goto L101;
																								} else {
																									_t196 = __rbp - 0x14; // 0x0
																									r15d =  *_t196;
																									__rdi = __rax;
																									__rbx = 0;
																									__r9 = 0x401890;
																									while(1) {
																										_t199 = __rbp + 0x60; // 0x37003600350034
																										__rax =  *_t199;
																										__r8 = __rdi;
																										__rcx =  *((intOrPtr*)(__rax + __rbx * 8));
																										 *(__rsp + 0x20) = 0;
																										L004090A8();
																										__r9 = 0x401890;
																										__eflags = __rax;
																										if(__rax != 0) {
																											break;
																										}
																										_t198 = __rbp + 0x68; // 0x1000000390038
																										__rax =  *_t198;
																										__rbx = __rbx + 1;
																										__rdi = __rdi + 8;
																										__r8 = __rax;
																										__eflags = __rax - __rbx;
																										if(__rax <= __rbx) {
																											_t216 = __rbp + 0x40; // 0x30003b00330003
																											__rcx =  *_t216;
																											r9d = 0;
																											__rdx = __r14;
																											L00409080();
																											r15d = __eax;
																											__eflags = __rax;
																											if(__rax != 0) {
																												goto L141;
																											} else {
																												_t217 = __rbp + 0x68; // 0x1000000390038
																												r8d =  *_t217;
																												__rcx =  *0x424178;
																												__eflags = r8d - 1;
																												if(r8d == 1) {
																													__eflags = __rcx;
																													if(__rcx != 0) {
																														_t242 = __rbp + 0x60; // 0x37003600350034
																														__rax =  *_t242;
																														__rdx = L"Capturing delta WIM based on \"%ls\"\n";
																														__r8 =  *__rax;
																														__eax = E00401650(__r8, 0x401890);
																													}
																												} else {
																													__eflags = __rcx;
																													if(__rcx != 0) {
																														__rdx = L"Capturing delta WIM based on %u WIMs\n";
																														__eax = E00401650(__r8, 0x401890);
																													}
																												}
																												goto L65;
																											}
																										} else {
																											continue;
																										}
																										goto L102;
																									}
																									_t204 = __rbp + 0x68; // 0x1000000390038
																									__rdx =  *_t204;
																									r15d = __eax;
																									goto L142;
																								}
																								goto L103;
																							} else {
																								L65:
																								__eflags =  *((long long*)(__rbp + 0x18));
																								if( *((long long*)(__rbp + 0x18)) == 0) {
																									L156:
																									__rbx = 0;
																									goto L82;
																								} else {
																									__eflags =  *((char*)(__rbp + 0x12));
																									if( *((char*)(__rbp + 0x12)) != 0) {
																										_t189 = __rbp - 0x20; // 0x0
																										__rdx =  *_t189;
																										_t190 = __rbp + 8; // 0x0
																										__rcx =  *_t190;
																										L00409198();
																										__eflags = __rax;
																										if(__rax != 0) {
																											goto L67;
																										} else {
																											_t191 = __rbp + 0x40; // 0x30003b00330003
																											__rcx =  *_t191;
																											 *(__rbp + 0x28) = __rcx;
																											goto L78;
																										}
																										goto L103;
																									} else {
																										L67:
																										_t76 = __rbp + 0x68; // 0x1000000390038
																										__rdx =  *_t76;
																										_t77 = __rbp + 8; // 0x0
																										__r15 =  *_t77;
																										__rdi = 0;
																										__eflags =  *_t76;
																										if( *_t76 != 0) {
																											while(1) {
																												_t86 = __rbp + 0x60; // 0x37003600350034
																												__rax =  *_t86;
																												__rcx = __r15;
																												__rbx = __rdi * 8;
																												__rdx =  *((intOrPtr*)(__rax + __rdi * 8));
																												L00409198();
																												__eflags = __rax;
																												if(__rax == 0) {
																													break;
																												}
																												_t85 = __rbp + 0x68; // 0x1000000390038
																												__rax =  *_t85;
																												__rdi = __rdi + 1;
																												__eflags = __rax - __rdi;
																												if(__rax <= __rdi) {
																													goto L68;
																												} else {
																													continue;
																												}
																												goto L78;
																											}
																											__rcx =  *((intOrPtr*)(__r14 + __rbx));
																											 *(__rbp + 0x28) = __rcx;
																										} else {
																											L68:
																											_t78 = __rbp + 0x28; // 0x2e000100000000
																											__rcx =  *_t78;
																										}
																									}
																									L78:
																									__eflags = __rcx;
																									if(__rcx == 0) {
																										 *(__rsp + 0x20) = 0;
																										_t209 = __rbp + 8; // 0x0
																										__rcx =  *_t209;
																										_t210 = __rbp + 0x28; // 0x108ac
																										__r8 = _t210;
																										__r9 = 0x401890;
																										_t212 = __rbp - 0x14; // 0x0
																										__rdx =  *_t212;
																										L004090A8();
																										_t213 = __rbp + 0x28; // 0x2e000100000000
																										__rcx =  *_t213;
																										r15d = __eax;
																										__eflags = __rax;
																										if(__rax == 0) {
																											goto L79;
																										} else {
																											goto L141;
																										}
																										goto L102;
																									} else {
																										L79:
																										_t92 = __rbp + 0x18; // 0x0
																										__rdi =  *_t92;
																										__rdx = __rdi;
																										L00409068();
																										__eflags =  *__rdi - 0x2d;
																										__rbx = __rax;
																										if( *__rdi == 0x2d) {
																											_t222 = __rbp + 0x28; // 0x2e000100000000
																											__rcx =  *_t222;
																											_t223 = __rbp + 0x70; // 0x108f4
																											__rdx = _t223;
																											L004090E0();
																											_t224 = __rbp + 0x18; // 0x0
																											__rax =  *_t224;
																											_t225 = __rbp + 0x48; // 0x108cc
																											__rdx = _t225;
																											r8d = 0xa;
																											_t226 = __rax + 2; // 0xc
																											__rdi = _t226;
																											__rcx = __rdi;
																											L00409168();
																											__rdx = __rax;
																											__eflags = __rax;
																											if(__rax != 0) {
																												_t227 = __rbp + 0x80; // 0x3b003300030000
																												__rax =  *_t227;
																												__eflags = __rax - __rdx;
																												if(__rax >= __rdx) {
																													_t228 = __rbp + 0x48; // 0x0
																													__rcx =  *_t228;
																													__eflags =  *__rcx;
																													if( *__rcx == 0) {
																														__eflags = __rdi - __rcx;
																														__ecx = __ecx & 0xffffff00 | __rdi != __rcx;
																														__rax = __rax + 1;
																														__rax = __rax - __rdx;
																														__eflags = __cl;
																														__rbx =  !=  ? __rax : __rbx;
																													}
																												}
																											}
																										}
																										__eflags = __rbx;
																										if(__rbx == 0) {
																											_t214 = __rbp + 8; // 0x0
																											__rdx =  *_t214;
																											_t215 = __rbp + 0x18; // 0x0
																											__rcx =  *_t215;
																											__eax = E00403BB0( *_t215,  *_t214, __r9);
																											r15d = __eax;
																											__eflags = __rax;
																											if(__rax != 0) {
																												goto L93;
																											} else {
																												goto L156;
																											}
																											goto L103;
																										} else {
																											__eflags = __rbx - 0xffffffff;
																											if(__rbx == 0xffffffff) {
																												__rcx = L"Cannot specify all images for this action!";
																												r15d = 0x12;
																												__eax = E004024D0(L"Cannot specify all images for this action!", __rdx, __r8, __r9);
																											} else {
																												L82:
																												_t93 = __rbp - 0x10; // 0x0
																												__rax =  *_t93;
																												 *(__rsp + 0x28) = r13d;
																												__r8 = __rsi;
																												__rdx = __r12;
																												_t95 = __rbp - 0x48; // 0x0
																												__r9 =  *_t95;
																												_t96 = __rbp + 0x40; // 0x30003b00330003
																												__rcx =  *_t96;
																												 *(__rsp + 0x20) = __rax;
																												L00409150();
																												r15d = __eax;
																												__eflags = __rax;
																												if(__rax == 0) {
																													_t98 = __rbp + 0x58; // 0x33003200310030
																													__rax =  *_t98;
																													_t99 = __rbp + 0x40; // 0x30003b00330003
																													__rcx =  *_t99;
																													__eflags = __rax;
																													if(__rax != 0) {
																														_t231 = __rbp + 0x70; // 0x108f4
																														__rdx = _t231;
																														L004090E0();
																														_t232 = __rbp + 0x40; // 0x30003b00330003
																														__rdx =  *_t232;
																														_t233 = __rbp + 0x50; // 0x108d4
																														__rcx = _t233;
																														r9d = 0;
																														_t234 = __rbp + 0x80; // 0x3b003300030000
																														r8d =  *_t234;
																														__eax = E004030A0(__rax, _t233,  *_t232, __r9);
																														r15d = __eax;
																														__eflags = __rax;
																														if(__rax != 0) {
																															goto L93;
																														} else {
																															__eflags =  *((long long*)(__rbp + 0x18));
																															if( *((long long*)(__rbp + 0x18)) == 0) {
																																goto L89;
																															} else {
																																goto L86;
																															}
																														}
																														goto L103;
																													} else {
																														__eflags =  *((long long*)(__rbp + 0x18));
																														if( *((long long*)(__rbp + 0x18)) == 0) {
																															L90:
																															__eflags =  *((char*)(__rbp + 0x12));
																															if( *((char*)(__rbp + 0x12)) != 0) {
																																_t236 = __rbp - 8; // 0x0
																																r8d =  *_t236;
																																_t237 = __rbp - 0x18; // 0x0
																																__rdx =  *_t237;
																																L004090A0();
																																r15d = __eax;
																															} else {
																																_t112 = __rbp - 8; // 0x0
																																__rax =  *_t112;
																																_t113 = __rbp - 0x20; // 0x0
																																__rdx =  *_t113;
																																r8d = 0xffffffff;
																																_t114 = __rbp - 0x18; // 0x0
																																r9d =  *_t114;
																																 *(__rsp + 0x20) =  *_t112;
																																__eflags =  *_t113;
																																if( *_t113 == 0) {
																																	__rdx = 0x1;
																																	 *((intOrPtr*)(__rcx - 0x77)) =  *((intOrPtr*)(__rcx - 0x77)) + __al;
																																	asm("invalid");
																																	asm("lodsd");
																																	asm("stc");
																																	asm("invalid");
																																} else {
																																	L00409008();
																																	r15d = __eax;
																																}
																															}
																														} else {
																															_t101 = __rbp + 0x70; // 0x108f4
																															__rdx = _t101;
																															L004090E0();
																															_t102 = __rbp + 0x40; // 0x30003b00330003
																															__rdx =  *_t102;
																															_t103 = __rbp + 0x50; // 0x108d4
																															__rcx = _t103;
																															r9d = 0;
																															_t104 = __rbp + 0x80; // 0x3b003300030000
																															r8d =  *_t104;
																															__eax = E004030A0(__rax, _t103,  *_t102, __r9);
																															r15d = __eax;
																															__eflags = __rax;
																															if(__rax == 0) {
																																L86:
																																__rcx =  *0x424178;
																																__eflags =  *0x424178;
																																if( *0x424178 != 0) {
																																	_t105 = __rbp + 8; // 0x0
																																	__r9 =  *_t105;
																																	r8d = __ebx;
																																	__rdx = L"Using image %d from \"%ls\" as template\n";
																																	__eax = E00401650(__r8,  *_t105);
																																}
																																 *(__rsp + 0x20) = 0;
																																_t107 = __rbp + 0x28; // 0x2e000100000000
																																__r8 =  *_t107;
																																r9d = __ebx;
																																_t108 = __rbp + 0x80; // 0x3b003300030000
																																__rdx =  *_t108;
																																_t109 = __rbp + 0x40; // 0x30003b00330003
																																__rcx =  *_t109;
																																L00409078();
																																r15d = __eax;
																																__eflags = __rax;
																																if(__rax == 0) {
																																	L89:
																																	_t110 = __rbp + 0x40; // 0x30003b00330003
																																	__rcx =  *_t110;
																																	goto L90;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																										L93:
																										_t116 = __rbp + 0x68; // 0x1000000390038
																										r8d =  *_t116;
																										_t117 = __rbp + 0x28; // 0x2e000100000000
																										__rcx =  *_t117;
																										__rdx = __r8;
																										_t118 = __rbp + 0x40; // 0x30003b00330003
																										__eflags = __rcx -  *_t118;
																										if(__rcx ==  *_t118) {
																											L142:
																											__eflags = __rdx;
																											if(__rdx != 0) {
																												goto L98;
																											} else {
																												goto L100;
																											}
																											goto L102;
																										} else {
																											__eflags = __r8;
																											if(__r8 == 0) {
																												L140:
																												L00409108();
																												L141:
																												_t193 = __rbp + 0x68; // 0x1000000390038
																												__rdx =  *_t193;
																												goto L142;
																											} else {
																												__rdx = 0;
																												while(1) {
																													__eflags = __rcx -  *((intOrPtr*)(__r14 + __rdx * 8));
																													if(__rcx ==  *((intOrPtr*)(__r14 + __rdx * 8))) {
																														break;
																													}
																													__rdx = __rdx + 1;
																													__eflags = __rdx - __r8;
																													if(__rdx == __r8) {
																														goto L140;
																													} else {
																														continue;
																													}
																													goto L100;
																												}
																												L98:
																												__rbx = 0;
																												__eflags = 0;
																												do {
																													__rcx =  *((intOrPtr*)(__r14 + __rbx * 8));
																													__rbx = __rbx + 1;
																													L00409108();
																													_t123 = __rbp + 0x68; // 0x1000000390038
																													__rax =  *_t123;
																													__eflags =  *_t123 - __rbx;
																												} while ( *_t123 > __rbx);
																											}
																										}
																									}
																								}
																								L100:
																								__rcx = __r14;
																								free(??);
																							}
																						} else {
																							_t69 = __rbp - 4; // 0x0
																							__rdx =  *_t69;
																							_t70 = __rbp + 0x40; // 0x30003b00330003
																							__rcx =  *_t70;
																							L00409040();
																							r15d = __eax;
																							__eflags = __rax;
																							if(__rax == 0) {
																								goto L62;
																							}
																						}
																					} else {
																						_t66 = __rbp + 4; // 0x0
																						__rdx =  *_t66;
																						_t67 = __rbp + 0x40; // 0x30003b00330003
																						__rcx =  *_t67;
																						L00409038();
																						r15d = __eax;
																						__eflags = __rax;
																						if(__rax == 0) {
																							goto L60;
																						}
																					}
																				}
																			}
																			L101:
																			_t124 = __rbp + 0x40; // 0x30003b00330003
																			__rcx =  *_t124;
																			L00409108();
																		}
																	}
																	L102:
																	__eflags =  *((char*)(__rbp + 0x13));
																	if( *((char*)(__rbp + 0x13)) != 0) {
																		__rcx = __r12;
																		free(??);
																	}
																	goto L103;
																} else {
																	__eflags =  *__rsi - 0x2d;
																	_t36 = __rbp + 0x70; // 0x108f4
																	__rdi = _t36;
																	if( *__rsi != 0x2d) {
																		L36:
																		__rdx = __rdi;
																		__rcx = __rsi;
																		__imp___wstat64();
																		__eflags = __rax;
																		if(__eflags != 0) {
																			__rdx = __rsi;
																			__rcx = L"Failed to stat the file \"%ls\"";
																			__eax = E004031C0(__eflags, __rax, L"Failed to stat the file \"%ls\"", __rsi, __r8, __r9);
																			goto L17;
																		} else {
																			_t38 = __rbp + 0x88; // 0x30
																			__r12 =  *_t38;
																			__rdx = L"rb";
																			__rcx = __rsi;
																			__imp___wfopen();
																			__r14 = __rax;
																			__eflags = __rax;
																			if(__eflags == 0) {
																				__rdx = __rsi;
																				__rcx = L"Failed to open the file \"%ls\"";
																				__eax = E004031C0(__eflags, __rax, L"Failed to open the file \"%ls\"", __rsi, __r8, __r9);
																				goto L17;
																			} else {
																				__eflags = __r12;
																				__rcx = 0x1;
																				__eax = malloc(??);
																				__r15 = __rax;
																				__eflags = __rax;
																				if(__rax == 0) {
																					__r8 = __rsi;
																					__rdx = __r12;
																					__rcx = L"Failed to allocate buffer of %zu bytes to hold contents of file \"%ls\"";
																					__eax = E004024D0(L"Failed to allocate buffer of %zu bytes to hold contents of file \"%ls\"", __r12, __rsi, __r9);
																					__rcx = __r14;
																					__eax = fclose(??);
																					goto L17;
																				} else {
																					__r9 = __r14;
																					__r8 = __r12;
																					__rdx = 0x1;
																					cs =  *__rdi;
																					 *0xCC450F490000003A =  *0xCC450F490000003A + __cl;
																					__eflags =  *0xCC450F490000003A;
																					asm("les ecx, [edi]");
																					if(__eflags != 0) {
																						__r8 = __rsi;
																						__rdx = __r12;
																						__rcx = L"Failed to read %zu bytes from the file \"%ls\"";
																						__eax = E004031C0(__eflags, __rax, L"Failed to read %zu bytes from the file \"%ls\"", __r12, __rsi, __r9);
																						__rcx = __r15;
																						free(??);
																						__rcx = __r14;
																						__eax = fclose(??);
																						goto L17;
																					} else {
																						__rcx = __r14;
																						__eax = fclose(??);
																						_t41 = __rbp + 0x30; // 0x108b4
																						__r8 = _t41;
																						__rdx = __r12;
																						__rcx = __r15;
																						__eax = E004023F0(__rax, __r15, __r12, _t41);
																						 *(__rbp + 0x38) = __rax;
																						goto L41;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags =  *((short*)(__rsi + 2));
																		if( *((short*)(__rsi + 2)) == 0) {
																			__rcx = __rdi;
																			__eax = E00403260(__rax, __rdi);
																			__rcx = __rax;
																			__eflags = __rax;
																			if(__rax == 0) {
																				L17:
																				r15d = 0xffffffff;
																				goto L13;
																			} else {
																				_t205 = __rbp + 0x70; // 0x2e
																				__rdx =  *_t205;
																				_t206 = __rbp + 0x30; // 0x108b4
																				__r8 = _t206;
																				__eax = E004023F0(__rax, __rcx,  *_t205, _t206);
																				 *(__rbp + 0x38) = __rax;
																				L41:
																				__eflags = __rax;
																				if(__rax == 0) {
																					goto L17;
																				} else {
																					_t43 = __rbp + 0x30; // 0x1000000000000
																					__rax =  *_t43;
																					_t44 = __rbp + 0x38; // 0x108bc
																					__rcx = _t44;
																					 *((long long*)(__rbp + 0x40)) =  *_t43;
																					_t46 = __rbp + 0x40; // 0x108c4
																					__rax = _t46;
																					__rdx = __rax;
																					 *(__rbp - 0x40) = __rax;
																					__eax = E004025C0(__eax, _t44, __rax);
																					__rbx = __rax;
																					__eflags = __rax;
																					if(__rax < 0) {
																						r15d = 0xffffffff;
																						L103:
																						_t126 = __rbp + 0x38; // 0x2c
																						__rcx =  *_t126;
																						free(??);
																						L13:
																						free();
																						free(??);
																						return r15d;
																					} else {
																						__rdx = 0x18;
																						 *__rax =  *__rax + __al;
																						__eflags =  *__rax;
																					}
																				}
																			}
																		} else {
																			goto L36;
																		}
																	}
																}
															}
														}
													} else {
														__eflags =  *(__rbp + 8);
														if( *(__rbp + 8) != 0) {
															goto L30;
														} else {
															_t28 = __rbp + 0x68; // 0x1000000390038
															__rax =  *_t28;
															__eflags = __rax - 1;
															if(__rax == 1) {
																_t175 = __rbp + 0x60; // 0x37003600350034
																__rax =  *_t175;
																__rax =  *((intOrPtr*)( *_t175));
																 *(__rbp + 8) = __rax;
																goto L30;
															} else {
																__eflags =  *((char*)(__rbp + 0x12));
																if( *((char*)(__rbp + 0x12)) == 0) {
																	__eflags = __rax - 1;
																	if(__rax <= 1) {
																		__rcx = L"For capture of non-delta WIM, \'--update-of\' must specify WIMFILE:IMAGE!";
																		__eax = E004024D0(L"For capture of non-delta WIM, \'--update-of\' must specify WIMFILE:IMAGE!", __rdx, __r8, __r9);
																	} else {
																		__rcx = L"For capture of delta WIM based on multiple existing WIMs,\n      \'--update-of\' must specify WIMFILE:IMAGE!";
																		__eax = E004024D0(L"For capture of delta WIM based on multiple existing WIMs,\n      \'--update-of\' must specify WIMFILE:IMAGE!", __rdx, __r8, __r9);
																	}
																	goto L12;
																} else {
																	_t30 = __rbp - 0x20; // 0x0
																	__rax =  *_t30;
																	 *(__rbp + 8) = __rax;
																	goto L30;
																}
															}
														}
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = __rax - 0x3d;
								if(__rax > 0x3d) {
									goto L12;
								} else {
									__rax =  *((intOrPtr*)(__rbx + __rax * 4));
									goto __rax;
								}
							}
						} else {
							goto L16;
						}
					}
				}
			}

0x00403e00
0x00403e00
0x00403e00
0x00403e00
0x00403e07
0x00403e0b
0x00403e17
0x00403e1c
0x00403e22
0x00403e37
0x00403e3e
0x00403e44
0x00000000
0x00403e24
0x00403e24
0x00403e28
0x00403e2c
0x00000000
0x00403e2e
0x00403e2e
0x00403e31
0x00403cf0
0x00403cf9
0x00403d00
0x00403d03
0x00403d05
0x00403d0c
0x00403d11
0x00403d14
0x00404110
0x00404117
0x0040411a
0x0040411c
0x00404120
0x00404123
0x00404126
0x00404129
0x00403d40
0x00403d40
0x00403d49
0x00403d4b
0x00403d51
0x00403d54
0x00403d57
0x00000000
0x0040412f
0x0040412f
0x00404133
0x00404137
0x0040413a
0x0040413e
0x00404777
0x0040477e
0x00404785
0x0040478b
0x0040478d
0x00404794
0x00404797
0x0040479a
0x0040479a
0x00404785
0x00404144
0x00404144
0x00404148
0x0040414f
0x00404154
0x00404156
0x00404442
0x00404445
0x00404448
0x0040444c
0x0040444f
0x0040445a
0x0040445a
0x00404462
0x00404464
0x0040446d
0x0040446d
0x0040446f
0x0040446f
0x00404476
0x0040447f
0x00404482
0x00404484
0x00404484
0x00404487
0x00000000
0x0040448d
0x0040448d
0x00404495
0x00000000
0x00404495
0x00404451
0x00404451
0x00404454
0x00404d12
0x00404d19
0x00404d1d
0x00000000
0x00000000
0x00000000
0x00000000
0x00404454
0x0040415c
0x0040415f
0x00404165
0x00404169
0x004048b4
0x004048b4
0x004048b8
0x004048b8
0x004048bc
0x004048c2
0x004048c4
0x00000000
0x004048ca
0x004048ca
0x004048d0
0x004048d3
0x00000000
0x004048d9
0x004048d9
0x004048de
0x00404c5a
0x00404c5a
0x00404c5c
0x00000000
0x00404c5e
0x00404c5e
0x00404c62
0x00000000
0x00404c62
0x004048e4
0x004048e4
0x004048e9
0x00404ca3
0x00404ca5
0x00000000
0x00404ca7
0x00404ca7
0x00404caf
0x00404cb3
0x00000000
0x00404cb3
0x004048ef
0x004048ef
0x004048ef
0x004048f3
0x004048f3
0x004048f7
0x004048fc
0x004048fe
0x00000000
0x00404904
0x00404904
0x00404906
0x00000000
0x0040490c
0x0040490c
0x00404910
0x00404918
0x0040491c
0x00000000
0x0040491c
0x00404906
0x004048fe
0x004048e9
0x004048de
0x004048d3
0x0040416f
0x0040416f
0x0040416f
0x00404171
0x00404d27
0x00404d2a
0x00404d2e
0x00404d2e
0x00000000
0x00404177
0x00404177
0x0040417a
0x00404c6b
0x00404c6b
0x00404c72
0x00404c78
0x00000000
0x00404180
0x00404180
0x00404184
0x00404188
0x00404188
0x0040418d
0x004041b4
0x004041b4
0x004041b8
0x00404869
0x0040486c
0x00404871
0x00404876
0x0040487a
0x0040487f
0x00404882
0x00404885
0x0040488a
0x0040488f
0x00404892
0x00404897
0x0040489b
0x00000000
0x004041be
0x004041be
0x004041c2
0x004041c6
0x004041ca
0x0040481b
0x0040481f
0x00404824
0x00404829
0x0040482d
0x00404832
0x00404839
0x0040483d
0x00404840
0x00404845
0x00404848
0x0040484d
0x0040484d
0x00404851
0x00404854
0x00404859
0x0040485c
0x0040485e
0x00000000
0x00404864
0x00000000
0x00404864
0x004041d0
0x004041d0
0x004041d0
0x004041d4
0x004041d4
0x004041d8
0x00404707
0x0040470b
0x00404712
0x00404716
0x0040471e
0x00404723
0x00404723
0x00404727
0x0040472c
0x00404730
0x00404739
0x00404742
0x0040436d
0x0040436d
0x00404370
0x00404370
0x00404374
0x0040437d
0x00404384
0x00404384
0x00404388
0x0040438b
0x00404390
0x00404393
0x00404395
0x00000000
0x00000000
0x00404748
0x00404748
0x00404748
0x0040474c
0x0040474c
0x0040474f
0x00404754
0x00404757
0x00404759
0x0040475f
0x0040475f
0x00404763
0x00404766
0x0040476d
0x0040439b
0x0040439b
0x0040439e
0x004043a1
0x004047c1
0x004047c8
0x00000000
0x004047ce
0x004047ce
0x004047d2
0x00404b23
0x00404b23
0x00404b27
0x00404b27
0x00404b2b
0x00404b30
0x00404b30
0x00404b36
0x00404b36
0x004047d8
0x004047dc
0x004047e5
0x004047e5
0x00000000
0x004043a7
0x004043a7
0x004043a7
0x004043ab
0x004043b0
0x004043b3
0x004043b5
0x004043bb
0x004043bb
0x004043bf
0x004043d8
0x004043d8
0x004043dc
0x004043f5
0x004043f5
0x004043f9
0x004043fb
0x004043ff
0x00404930
0x00404930
0x00404934
0x00404936
0x0040493f
0x00404942
0x00404945
0x0040494a
0x00404961
0x00404961
0x00404961
0x00404965
0x00404968
0x0040496d
0x0040496f
0x00000000
0x00000000
0x00404950
0x00404953
0x00404956
0x00404959
0x00404959
0x0040495c
0x0040495c
0x00404971
0x004043ff
0x00404405
0x00404405
0x00404408
0x0040440b
0x0040440d
0x004049d4
0x004049d6
0x004049df
0x004049e2
0x004049e4
0x004049e6
0x00404cec
0x00404cf3
0x00404cf7
0x00000000
0x004049ec
0x004049ec
0x004049ec
0x004049f0
0x004049f3
0x004049f5
0x00404a17
0x00404a17
0x00404a17
0x00404a1b
0x00404a21
0x00404a25
0x00404a2e
0x00404a33
0x00404a3a
0x00404a3c
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404a03
0x00404a07
0x00404a0b
0x00404a0e
0x00404a11
0x00404ada
0x00404ada
0x00404ade
0x00404ae1
0x00404ae4
0x00404ae9
0x00404aec
0x00404aee
0x00000000
0x00404af4
0x00404af4
0x00404af4
0x00404af8
0x00404aff
0x00404b03
0x00404c82
0x00404c85
0x00404c8b
0x00404c8b
0x00404c8f
0x00404c96
0x00404c99
0x00404c99
0x00404b09
0x00404b09
0x00404b0c
0x00404b12
0x00404b19
0x00404b19
0x00404b0c
0x00000000
0x00404b03
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a11
0x00404a3e
0x00404a3e
0x00404a41
0x00000000
0x00404a41
0x00000000
0x00404413
0x00404413
0x00404413
0x00404418
0x00404ad3
0x00404ad3
0x00000000
0x0040441e
0x0040441e
0x00404422
0x00404976
0x00404976
0x0040497a
0x0040497a
0x0040497e
0x00404983
0x00404985
0x00000000
0x0040498b
0x0040498b
0x0040498b
0x0040498f
0x00000000
0x0040498f
0x00000000
0x00404428
0x00404428
0x00404428
0x00404428
0x0040442b
0x0040442b
0x0040442f
0x00404431
0x00404433
0x004044d0
0x004044d0
0x004044d0
0x004044d4
0x004044d7
0x004044df
0x004044e3
0x004044e8
0x004044ea
0x00000000
0x00000000
0x004044c0
0x004044c0
0x004044c3
0x004044c7
0x004044ca
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004044ca
0x004044ec
0x004044f0
0x00404439
0x00404439
0x00404439
0x00404439
0x00404439
0x00404433
0x004044f4
0x004044f4
0x004044f7
0x00404a87
0x00404a90
0x00404a90
0x00404a94
0x00404a94
0x00404a98
0x00404a9f
0x00404a9f
0x00404aa2
0x00404aa7
0x00404aa7
0x00404aab
0x00404aae
0x00404ab0
0x00000000
0x00404ab6
0x00000000
0x00404ab6
0x00000000
0x004044fd
0x004044fd
0x004044fd
0x004044fd
0x00404501
0x00404504
0x00404509
0x0040450d
0x0040450f
0x00404b3e
0x00404b3e
0x00404b42
0x00404b42
0x00404b46
0x00404b4b
0x00404b4b
0x00404b4f
0x00404b4f
0x00404b53
0x00404b59
0x00404b59
0x00404b5d
0x00404b60
0x00404b65
0x00404b67
0x00404b69
0x00404b6f
0x00404b6f
0x00404b75
0x00404b77
0x00404b7d
0x00404b7d
0x00404b81
0x00404b85
0x00404b8b
0x00404b8e
0x00404b91
0x00404b94
0x00404b96
0x00404b98
0x00404b98
0x00404b85
0x00404b77
0x00404b69
0x00404515
0x00404517
0x00404abb
0x00404abb
0x00404abf
0x00404abf
0x00404ac3
0x00404ac8
0x00404acb
0x00404acd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040451d
0x0040451d
0x00404520
0x00404c31
0x00404c38
0x00404c3e
0x00404526
0x00404526
0x00404526
0x00404526
0x0040452a
0x0040452f
0x00404532
0x00404535
0x00404535
0x00404539
0x00404539
0x0040453d
0x00404542
0x00404547
0x0040454a
0x0040454c
0x00404552
0x00404552
0x00404555
0x00404555
0x00404559
0x0040455b
0x00404bce
0x00404bce
0x00404bd2
0x00404bd7
0x00404bd7
0x00404bdb
0x00404bdb
0x00404bdf
0x00404be2
0x00404be2
0x00404be9
0x00404bee
0x00404bf1
0x00404bf3
0x00000000
0x00404bf9
0x00404bf9
0x00404bfe
0x00000000
0x00404c04
0x00000000
0x00404c04
0x00404bfe
0x00000000
0x00404561
0x00404561
0x00404566
0x004045d7
0x004045d7
0x004045db
0x00404c1d
0x00404c1d
0x00404c21
0x00404c21
0x00404c24
0x00404c29
0x004045e1
0x004045e1
0x004045e1
0x004045e4
0x004045e4
0x004045e8
0x004045ee
0x004045ee
0x004045f2
0x004045f6
0x004045f9
0x00404c48
0x00404c51
0x00404c54
0x00404c56
0x00404c57
0x00404c58
0x004045ff
0x004045ff
0x00404604
0x00404604
0x004045f9
0x00404568
0x00404568
0x00404568
0x0040456c
0x00404571
0x00404571
0x00404575
0x00404575
0x00404579
0x0040457c
0x0040457c
0x00404583
0x00404588
0x0040458b
0x0040458d
0x0040458f
0x0040458f
0x00404596
0x00404599
0x0040459b
0x0040459b
0x0040459f
0x004045a2
0x004045a9
0x004045a9
0x004045ae
0x004045b6
0x004045b6
0x004045ba
0x004045bd
0x004045bd
0x004045c3
0x004045c3
0x004045c7
0x004045cc
0x004045cf
0x004045d1
0x004045d3
0x004045d3
0x004045d3
0x00000000
0x004045d3
0x004045d1
0x0040458d
0x00404566
0x0040455b
0x0040454c
0x00404520
0x00404607
0x00404607
0x00404607
0x0040460b
0x0040460b
0x0040460f
0x00404612
0x00404612
0x00404616
0x004049a0
0x004049a0
0x004049a2
0x00000000
0x004049a8
0x00000000
0x004049a8
0x00000000
0x0040461c
0x0040461c
0x0040461f
0x00404998
0x00404998
0x0040499d
0x0040499d
0x0040499d
0x00000000
0x00404625
0x00404625
0x0040463d
0x0040463d
0x00404641
0x00000000
0x00000000
0x00404630
0x00404634
0x00404637
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404637
0x00404643
0x00404643
0x00404643
0x00404648
0x00404648
0x0040464c
0x00404650
0x00404655
0x00404655
0x00404658
0x00404658
0x00404648
0x0040461f
0x00404616
0x004044f7
0x0040465d
0x0040465d
0x00404660
0x00404660
0x004043de
0x004043de
0x004043de
0x004043e1
0x004043e1
0x004043e5
0x004043ea
0x004043ed
0x004043ef
0x00000000
0x00000000
0x004043ef
0x004043c1
0x004043c1
0x004043c1
0x004043c4
0x004043c4
0x004043c8
0x004043cd
0x004043d0
0x004043d2
0x00000000
0x00000000
0x004043d2
0x004043bf
0x004043b5
0x00404665
0x00404665
0x00404665
0x00404669
0x00404669
0x00404759
0x0040466e
0x0040466e
0x00404672
0x004047b4
0x004047b7
0x004047b7
0x00000000
0x004041de
0x004041de
0x004041e2
0x004041e2
0x004041e6
0x004041f3
0x004041f3
0x004041f6
0x004041f9
0x004041ff
0x00404201
0x00404a73
0x00404a76
0x00404a7d
0x00000000
0x00404207
0x00404207
0x00404207
0x0040420e
0x00404215
0x00404218
0x0040421e
0x00404221
0x00404224
0x00404c09
0x00404c0c
0x00404c13
0x00000000
0x0040422a
0x0040422a
0x0040422d
0x00404236
0x0040423b
0x0040423e
0x00404241
0x00404ccd
0x00404cd0
0x00404cd3
0x00404cda
0x00404cdf
0x00404ce2
0x00000000
0x00404247
0x00404247
0x0040424a
0x0040424d
0x00404256
0x00404259
0x00404259
0x0040425c
0x0040425d
0x004049ad
0x004049b0
0x004049b3
0x004049ba
0x004049bf
0x004049c2
0x004049c7
0x004049ca
0x00000000
0x00404263
0x00404263
0x00404266
0x0040426b
0x0040426b
0x0040426f
0x00404272
0x00404275
0x0040427a
0x00000000
0x0040427a
0x0040425d
0x00404241
0x00404224
0x004041e8
0x004041e8
0x004041ed
0x00404a49
0x00404a4c
0x00404a51
0x00404a54
0x00404a57
0x00403e90
0x00403e90
0x00000000
0x00404a5d
0x00404a5d
0x00404a5d
0x00404a61
0x00404a61
0x00404a65
0x00404a6a
0x0040427e
0x0040427e
0x00404281
0x00000000
0x00404287
0x00404287
0x00404287
0x0040428b
0x0040428b
0x0040428f
0x00404293
0x00404293
0x00404297
0x0040429a
0x0040429e
0x004042a3
0x004042a6
0x004042a9
0x00404810
0x00404678
0x00404678
0x00404678
0x0040467c
0x00403d5c
0x00403d60
0x00403d69
0x00403d84
0x004042af
0x004042af
0x004042b8
0x004042b8
0x004042b8
0x004042a9
0x00404281
0x00000000
0x00000000
0x00000000
0x004041ed
0x004041e6
0x004041d8
0x004041ca
0x0040418f
0x0040418f
0x00404194
0x00000000
0x00404196
0x00404196
0x00404196
0x00404199
0x0040419c
0x004048a4
0x004048a4
0x004048a8
0x004048ab
0x00000000
0x004041a2
0x004041a2
0x004041a6
0x00403d2a
0x00403d2d
0x00404d01
0x00404d08
0x00403d33
0x00403d33
0x00403d3a
0x00403d3f
0x00000000
0x004041ac
0x004041ac
0x004041ac
0x004041b0
0x00000000
0x004041b0
0x004041a6
0x0040419c
0x00404194
0x0040418d
0x0040417a
0x00404171
0x00404169
0x00404156
0x00403d1a
0x00403d1a
0x00403d1d
0x00000000
0x00403d21
0x00403d21
0x00403d28
0x00403d28
0x00403d1d
0x00000000
0x00000000
0x00000000
0x00403e31
0x00403e2c

APIs

free.MSVCRT ref: 00403D60
free.MSVCRT ref: 00403D69
wcstoul.MSVCRT ref: 00403E17

Strings

Number of threads must be a non-negative integer!, xrefs: 00403E37

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: free$wcstoul
String ID: Number of threads must be a non-negative integer!
API String ID: 4004876702-3844074275
Opcode ID: 2969e85e22a5a5a23aa6ddb0b74d1f5cee911b7e101995561b9a549e26d1c0a6
Instruction ID: 8f4e445ffa375ed658149eb25e51f4218fbca56692324cf9836b1baa334c8c8f
Opcode Fuzzy Hash: 2969e85e22a5a5a23aa6ddb0b74d1f5cee911b7e101995561b9a549e26d1c0a6
Instruction Fuzzy Hash: 1A01A172300A4085DB10DF39D8453992764F744BB9F800627EA1D977E4CF3CCA86C304

Uniqueness

Uniqueness Score: -1.00%

Function 00403DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00403DA0(void* __esi, intOrPtr* __rax) {
				void* _t254;
				intOrPtr* _t262;
				void* _t279;
				void* _t280;

				_t262 = __rax;
				asm("in al, dx");
				 *__rax =  *__rax + _t254;
				if(__rax == 0) {
					E004024D0(L"\'--image-property\' argument must be in the form NAME=VALUE", 0x3d, _t279, _t280);
					goto L16;
				} else {
					__rdx =  *__r15;
					__rcx = __rbp + 0x50;
					__eax = E00402550(__esi, __rax, __rbp + 0x50,  *__r15);
					__eflags = __rax;
					if(__rax == 0) {
						 *(__rsp + 0x20) = 0;
						__r9 = 0x41e9e0;
						__rdx = __rdi;
						__rcx = __rsi;
						__r8 = 0x41717e;
						__eax = E00408FE0();
						__eflags = __rax - 0xffffffff;
						if(__rax == 0xffffffff) {
							__rax =  *0x4201c0; // 0x416038
							__rax =  *__rax;
							__rsi = __rsi - __rax;
							__rbx = __rdi + __rax * 8;
							__rax = __rsi - 2;
							r15d = __esi;
							__eflags = __rax - 2;
							if(__rax > 2) {
								L12:
								__rcx = 0x2;
								asm("invalid");
								__eax =  *0x416040();
								__ecx = r14d;
								__rdx = __rax;
								__eax = E00403630(r14d, __rax, __rax, __r8, __r9, __r12, __r13);
								goto L13;
							} else {
								__rax =  *((intOrPtr*)(__rbx + 8));
								__eflags =  *(__rbp + 0x14) - 0xffffffff;
								__rsi =  *__rbx;
								 *(__rbp - 0x20) = __rax;
								if( *(__rbp + 0x14) == 0xffffffff) {
									 *(__rbp + 0x14) = 1;
									__eflags = r13d & 0x00001000;
									if((r13d & 0x00001000) == 0) {
										__rax = 0;
										__eflags = r12d & 0x00001000;
										__eax = __eax & 0xffffff00 | (r12d & 0x00001000) != 0x00000000;
										__rax = 2;
										 *(__rbp + 0x14) = 2;
									}
								}
								_t20 = __rbp - 0x20; // 0x0
								__rcx =  *_t20;
								__rdx = "-";
								L00409198();
								__eflags = __rax;
								if(__rax == 0) {
									__eax = r12d;
									__rax = __rax | 0x00000004;
									__eflags =  *((char*)(__rbp + 0x12));
									 *(__rbp - 0x18) = __rax;
									if( *((char*)(__rbp + 0x12)) != 0) {
										L70:
										__eflags =  *0x424178;
										if( *0x424178 != 0) {
											__rcx = 0x2;
											 *__rax =  *__rax + __rax;
											__eflags =  *__rax;
											 *0x424178 = __rax;
										}
										__rcx = 0x1;
										 *0x3C40E7FFFFFF82 =  *((intOrPtr*)(0x3c40e7ffffff82)) + __al;
										asm("in al, 0x0");
										 *__rax =  *__rax;
										__eflags =  *__rax;
										if( *__rax != 0) {
											goto L174;
										} else {
											 *(__rbp - 0x20) = 0;
											 *((char*)(__rbp + 0x12)) = 0;
											goto L24;
										}
									} else {
										__eflags = r14d;
										if(r14d == 0) {
											__rcx = L"Using standard output for append does not make sense.";
											r15d = r15d | 0xffffffff;
											__eax = E004024D0(L"Using standard output for append does not make sense.", "-", __r8, __r9);
											goto L13;
										} else {
											goto L70;
										}
									}
								} else {
									__rdi = __rdi & 0x00008000;
									__eflags =  *((char*)(__rbp + 0x12));
									if( *((char*)(__rbp + 0x12)) != 0) {
										_t175 = __rbp - 0x20; // 0x0
										__rcx =  *_t175;
										_t176 = __rbp + 0x70; // 0x108f4
										__rdx = _t176;
										__imp___wstat64();
										__eflags = __rax;
										if(__rax == 0) {
											goto L21;
										} else {
											__imp___errno();
											__eflags =  *__rax - 2;
											if( *__rax != 2) {
												goto L21;
											} else {
												__eflags =  *((long long*)(__rbp + 0x18));
												if( *((long long*)(__rbp + 0x18)) == 0) {
													L172:
													__eflags = __rdi;
													if(__rdi != 0) {
														goto L174;
													} else {
														 *(__rbp - 0x18) = r12d;
														 *((char*)(__rbp + 0x12)) = 0;
														goto L29;
													}
												} else {
													__eflags =  *(__rbp + 8);
													if( *(__rbp + 8) == 0) {
														__eflags = __rdi;
														if(__rdi != 0) {
															goto L174;
														} else {
															 *((long long*)(__rbp + 0x18)) = 0;
															 *(__rbp - 0x18) = r12d;
															 *((char*)(__rbp + 0x12)) = 0;
															goto L29;
														}
													} else {
														_t179 = __rbp - 0x20; // 0x0
														__rdx =  *_t179;
														_t180 = __rbp + 8; // 0x0
														__rcx =  *_t180;
														L00409198();
														__eflags = __rax;
														if(__rax != 0) {
															goto L172;
														} else {
															__eflags = __rdi;
															if(__rdi != 0) {
																goto L174;
															} else {
																 *(__rbp - 0x18) = r12d;
																 *((long long*)(__rbp + 0x18)) = 0;
																 *((char*)(__rbp + 0x12)) = 0;
																 *(__rbp + 8) = 0;
																goto L29;
															}
														}
													}
												}
											}
										}
									} else {
										L21:
										__eflags = __rdi;
										if(__rdi == 0) {
											__eflags = r14d;
											 *(__rbp - 0x18) = r12d;
											_t245 = __rbp + 0x12; // 0x0
											 *_t245 = r14d == 0;
											goto L24;
										} else {
											__eflags = r14d;
											if(r14d != 0) {
												L174:
												__rcx = L"\'--unsafe-compact\' is only valid for append!";
												r15d = 0xffffffff;
												__eax = E004024D0(L"\'--unsafe-compact\' is only valid for append!", __rdx, __r8, __r9);
												goto L13;
											} else {
												 *(__rbp - 0x18) = r12d;
												 *((char*)(__rbp + 0x12)) = 1;
												L24:
												__eflags =  *((long long*)(__rbp + 0x18));
												if( *((long long*)(__rbp + 0x18)) == 0) {
													L29:
													__eflags = r15d - 2;
													if(r15d == 2) {
														__rcx = __rsi;
														L00409180();
														__rax = __rax + __rax + 0x43;
														__rax = __rax & 0xfffffff0;
														__eax = E0040A470(__eax);
														__rsp = __rsp - __rax;
														__rdx = __rsi;
														__rcx = __rsp + 0x30;
														L00409190();
														__rcx = __rax;
														__eax = E00402DF0(__eax, __rax, __rax);
														 *((char*)(__rbp + 0x11)) = 1;
														 *(__rbp - 0x48) = __rax;
														goto L32;
													} else {
														__rax =  *((intOrPtr*)(__rbx + 0x10));
														 *(__rbp - 0x48) = __rax;
														__eflags = r15d - 4;
														if(r15d == 4) {
															__rcx =  *((intOrPtr*)(__rbx + 0x18));
															L00409180();
															__rax = __rax + __rax + 0x29;
															__rax = __rax & 0xfffffff0;
															__eax = E0040A470(__eax);
															__rdx = L"DESCRIPTION=%ls";
															__r8 =  *((intOrPtr*)(__rbx + 0x18));
															__rsp = __rsp - __rax;
															__r12 = __rsp + 0x30;
															__rcx = __r12;
															__eax = E0040A630(__r12, L"DESCRIPTION=%ls", __r8, __r9);
															_t167 = __rbp + 0x50; // 0x108d4
															__rcx = _t167;
															__rdx = __r12;
															__eax = E00402550(__esi, __rax, _t167, __r12);
															r15d = __eax;
															__eflags = __rax;
															if(__rax == 0) {
																goto L31;
															} else {
																goto L13;
															}
														} else {
															L31:
															 *((char*)(__rbp + 0x11)) = 0;
															L32:
															__eflags =  *((char*)(__rbp + 0x13));
															if( *((char*)(__rbp + 0x13)) == 0) {
																__rsp = __rsp - 0x20;
																__rax = "\\";
																__eflags =  *((char*)(__rbp + 0x12));
																 *(__rbp + 0x38) = 0;
																 *((long long*)(__rsp + 0x38)) = "\\";
																_t141 = __rbp + 0x40; // 0x108c4
																__rax = _t141;
																__r12 = __rsp + 0x30;
																 *__r12 = __rsi;
																__rsi = 0x1;
																 *((intOrPtr*)(__r12 + 0x10)) = 0;
																if( *((char*)(__rbp + 0x12)) != 0) {
																	_t57 = __rbp - 0x14; // 0x0
																	__rdx =  *_t57;
																	_t58 = __rbp - 0x40; // 0x0
																	__r8 =  *_t58;
																	 *(__rsp + 0x20) = 0;
																	__r9 = 0x401890;
																	_t61 = __rbp - 0x20; // 0x0
																	__rcx =  *_t61;
																	__rdx =  *_t57 | 0x00000004;
																	L004090A8();
																	r15d = __eax;
																	__eflags = __rax;
																	if(__rax == 0) {
																		goto L55;
																	}
																} else {
																	_t144 = __rbp - 0x40; // 0x0
																	__rdx =  *_t144;
																	_t145 = __rbp + 0x14; // 0x0
																	__rcx =  *_t145;
																	L00409148();
																	r15d = __eax;
																	__eflags = __rax;
																	if(__rax == 0) {
																		_t146 = __rbp + 0x40; // 0x30003b00330003
																		__rcx =  *_t146;
																		r8d = 0;
																		__rdx = 0x401890;
																		L00409070();
																		L55:
																		__rdx =  *__rbp;
																		__eflags =  *__rbp - 0xffffffff;
																		if( *__rbp == 0xffffffff) {
																			__eflags = r13d & 0x00001000;
																			if((r13d & 0x00001000) == 0) {
																				goto L57;
																			} else {
																				__eflags =  *((char*)(__rbp + 0x12));
																				if( *((char*)(__rbp + 0x12)) != 0) {
																					_t216 = __rbp + 0x40; // 0x30003b00330003
																					__rcx =  *_t216;
																					_t217 = __rbp + 0x70; // 0x108f4
																					__rdx = _t217;
																					L004090E0();
																					_t218 = __rbp + 0x94; // 0x0
																					__rax =  *_t218;
																					 *(__rbp + 0x14) = __rax;
																				}
																				__eflags =  *(__rbp + 0x14) - 1;
																				__rdx = 0x1000;
																				asm("invalid");
																			}
																			goto L102;
																		} else {
																			_t62 = __rbp + 0x40; // 0x30003b00330003
																			__rcx =  *_t62;
																			L00409050();
																			r15d = __eax;
																			__eflags = __rax;
																			if(__rax == 0) {
																				L57:
																				__eflags =  *((long long*)(__rbp + 4)) - 0xffffffff;
																				if( *((long long*)(__rbp + 4)) == 0xffffffff) {
																					L59:
																					__eflags =  *((long long*)(__rbp - 4)) - 0xffffffff;
																					if( *((long long*)(__rbp - 4)) == 0xffffffff) {
																						L61:
																						__eflags =  *((char*)(__rbp + 0x11));
																						if( *((char*)(__rbp + 0x11)) != 0) {
																							__eflags =  *((char*)(__rbp + 0x12));
																							if( *((char*)(__rbp + 0x12)) != 0) {
																								_t185 = __rbp - 0x48; // 0x0
																								__r15 =  *_t185;
																								__rdx = 0;
																								__rbx = 0x1;
																								 *__r8 =  *__r8 + __r8;
																								__rcx = __r15;
																								L004091A0();
																								__rdi = __rax;
																								while(1) {
																									_t186 = __rbp + 0x40; // 0x30003b00330003
																									__rcx =  *_t186;
																									__rdx = __r15;
																									L004090C8();
																									__eflags = __al;
																									if(__al == 0) {
																										break;
																									}
																									r8d = __ebx;
																									__rdx = __r14;
																									__rcx = __rdi;
																									__rbx = __rbx + 1;
																									__eflags = __rbx;
																									__eax = E0040A630(__rdi, __r14, __r8, __r9);
																								}
																							}
																						}
																						_t71 = __rbp + 0x68; // 0x1000000390038
																						__rax =  *_t71;
																						r14d = 0;
																						__eflags = __rax;
																						if(__rax != 0) {
																							__rcx = __rax;
																							__rdx = 0x8;
																							 *((intOrPtr*)(__rax - 0x77)) =  *((intOrPtr*)(__rax - 0x77)) + __cl;
																							asm("invalid");
																							__eflags = __rax;
																							if(__rax == 0) {
																								__rcx = L"Out of memory!";
																								r15d = r15d | 0xffffffff;
																								__eax = E004024D0(L"Out of memory!", 0x8, __r8, __r9);
																								goto L100;
																							} else {
																								_t194 = __rbp - 0x14; // 0x0
																								r15d =  *_t194;
																								__rdi = __rax;
																								__rbx = 0;
																								__r9 = 0x401890;
																								while(1) {
																									_t197 = __rbp + 0x60; // 0x37003600350034
																									__rax =  *_t197;
																									__r8 = __rdi;
																									__rcx =  *((intOrPtr*)(__rax + __rbx * 8));
																									 *(__rsp + 0x20) = 0;
																									L004090A8();
																									__r9 = 0x401890;
																									__eflags = __rax;
																									if(__rax != 0) {
																										break;
																									}
																									_t196 = __rbp + 0x68; // 0x1000000390038
																									__rax =  *_t196;
																									__rbx = __rbx + 1;
																									__rdi = __rdi + 8;
																									__r8 = __rax;
																									__eflags = __rax - __rbx;
																									if(__rax <= __rbx) {
																										_t214 = __rbp + 0x40; // 0x30003b00330003
																										__rcx =  *_t214;
																										r9d = 0;
																										__rdx = __r14;
																										L00409080();
																										r15d = __eax;
																										__eflags = __rax;
																										if(__rax != 0) {
																											goto L140;
																										} else {
																											_t215 = __rbp + 0x68; // 0x1000000390038
																											r8d =  *_t215;
																											__rcx =  *0x424178;
																											__eflags = r8d - 1;
																											if(r8d == 1) {
																												__eflags = __rcx;
																												if(__rcx != 0) {
																													_t240 = __rbp + 0x60; // 0x37003600350034
																													__rax =  *_t240;
																													__rdx = L"Capturing delta WIM based on \"%ls\"\n";
																													__r8 =  *__rax;
																													__eax = E00401650(__r8, 0x401890);
																												}
																											} else {
																												__eflags = __rcx;
																												if(__rcx != 0) {
																													__rdx = L"Capturing delta WIM based on %u WIMs\n";
																													__eax = E00401650(__r8, 0x401890);
																												}
																											}
																											goto L64;
																										}
																									} else {
																										continue;
																									}
																									goto L101;
																								}
																								_t202 = __rbp + 0x68; // 0x1000000390038
																								__rdx =  *_t202;
																								r15d = __eax;
																								goto L141;
																							}
																							goto L102;
																						} else {
																							L64:
																							__eflags =  *((long long*)(__rbp + 0x18));
																							if( *((long long*)(__rbp + 0x18)) == 0) {
																								L155:
																								__rbx = 0;
																								goto L81;
																							} else {
																								__eflags =  *((char*)(__rbp + 0x12));
																								if( *((char*)(__rbp + 0x12)) != 0) {
																									_t187 = __rbp - 0x20; // 0x0
																									__rdx =  *_t187;
																									_t188 = __rbp + 8; // 0x0
																									__rcx =  *_t188;
																									L00409198();
																									__eflags = __rax;
																									if(__rax != 0) {
																										goto L66;
																									} else {
																										_t189 = __rbp + 0x40; // 0x30003b00330003
																										__rcx =  *_t189;
																										 *(__rbp + 0x28) = __rcx;
																										goto L77;
																									}
																									goto L102;
																								} else {
																									L66:
																									_t74 = __rbp + 0x68; // 0x1000000390038
																									__rdx =  *_t74;
																									_t75 = __rbp + 8; // 0x0
																									__r15 =  *_t75;
																									__rdi = 0;
																									__eflags =  *_t74;
																									if( *_t74 != 0) {
																										while(1) {
																											_t84 = __rbp + 0x60; // 0x37003600350034
																											__rax =  *_t84;
																											__rcx = __r15;
																											__rbx = __rdi * 8;
																											__rdx =  *((intOrPtr*)(__rax + __rdi * 8));
																											L00409198();
																											__eflags = __rax;
																											if(__rax == 0) {
																												break;
																											}
																											_t83 = __rbp + 0x68; // 0x1000000390038
																											__rax =  *_t83;
																											__rdi = __rdi + 1;
																											__eflags = __rax - __rdi;
																											if(__rax <= __rdi) {
																												goto L67;
																											} else {
																												continue;
																											}
																											goto L77;
																										}
																										__rcx =  *((intOrPtr*)(__r14 + __rbx));
																										 *(__rbp + 0x28) = __rcx;
																									} else {
																										L67:
																										_t76 = __rbp + 0x28; // 0x2e000100000000
																										__rcx =  *_t76;
																									}
																								}
																								L77:
																								__eflags = __rcx;
																								if(__rcx == 0) {
																									 *(__rsp + 0x20) = 0;
																									_t207 = __rbp + 8; // 0x0
																									__rcx =  *_t207;
																									_t208 = __rbp + 0x28; // 0x108ac
																									__r8 = _t208;
																									__r9 = 0x401890;
																									_t210 = __rbp - 0x14; // 0x0
																									__rdx =  *_t210;
																									L004090A8();
																									_t211 = __rbp + 0x28; // 0x2e000100000000
																									__rcx =  *_t211;
																									r15d = __eax;
																									__eflags = __rax;
																									if(__rax == 0) {
																										goto L78;
																									} else {
																										goto L140;
																									}
																									goto L101;
																								} else {
																									L78:
																									_t90 = __rbp + 0x18; // 0x0
																									__rdi =  *_t90;
																									__rdx = __rdi;
																									L00409068();
																									__eflags =  *__rdi - 0x2d;
																									__rbx = __rax;
																									if( *__rdi == 0x2d) {
																										_t220 = __rbp + 0x28; // 0x2e000100000000
																										__rcx =  *_t220;
																										_t221 = __rbp + 0x70; // 0x108f4
																										__rdx = _t221;
																										L004090E0();
																										_t222 = __rbp + 0x18; // 0x0
																										__rax =  *_t222;
																										_t223 = __rbp + 0x48; // 0x108cc
																										__rdx = _t223;
																										r8d = 0xa;
																										_t224 = __rax + 2; // 0xc
																										__rdi = _t224;
																										__rcx = __rdi;
																										L00409168();
																										__rdx = __rax;
																										__eflags = __rax;
																										if(__rax != 0) {
																											_t225 = __rbp + 0x80; // 0x3b003300030000
																											__rax =  *_t225;
																											__eflags = __rax - __rdx;
																											if(__rax >= __rdx) {
																												_t226 = __rbp + 0x48; // 0x0
																												__rcx =  *_t226;
																												__eflags =  *__rcx;
																												if( *__rcx == 0) {
																													__eflags = __rdi - __rcx;
																													__ecx = __ecx & 0xffffff00 | __rdi != __rcx;
																													__rax = __rax + 1;
																													__rax = __rax - __rdx;
																													__eflags = __cl;
																													__rbx =  !=  ? __rax : __rbx;
																												}
																											}
																										}
																									}
																									__eflags = __rbx;
																									if(__rbx == 0) {
																										_t212 = __rbp + 8; // 0x0
																										__rdx =  *_t212;
																										_t213 = __rbp + 0x18; // 0x0
																										__rcx =  *_t213;
																										__eax = E00403BB0( *_t213,  *_t212, __r9);
																										r15d = __eax;
																										__eflags = __rax;
																										if(__rax != 0) {
																											goto L92;
																										} else {
																											goto L155;
																										}
																										goto L102;
																									} else {
																										__eflags = __rbx - 0xffffffff;
																										if(__rbx == 0xffffffff) {
																											__rcx = L"Cannot specify all images for this action!";
																											r15d = 0x12;
																											__eax = E004024D0(L"Cannot specify all images for this action!", __rdx, __r8, __r9);
																										} else {
																											L81:
																											_t91 = __rbp - 0x10; // 0x0
																											__rax =  *_t91;
																											 *(__rsp + 0x28) = r13d;
																											__r8 = __rsi;
																											__rdx = __r12;
																											_t93 = __rbp - 0x48; // 0x0
																											__r9 =  *_t93;
																											_t94 = __rbp + 0x40; // 0x30003b00330003
																											__rcx =  *_t94;
																											 *(__rsp + 0x20) = __rax;
																											L00409150();
																											r15d = __eax;
																											__eflags = __rax;
																											if(__rax == 0) {
																												_t96 = __rbp + 0x58; // 0x33003200310030
																												__rax =  *_t96;
																												_t97 = __rbp + 0x40; // 0x30003b00330003
																												__rcx =  *_t97;
																												__eflags = __rax;
																												if(__rax != 0) {
																													_t229 = __rbp + 0x70; // 0x108f4
																													__rdx = _t229;
																													L004090E0();
																													_t230 = __rbp + 0x40; // 0x30003b00330003
																													__rdx =  *_t230;
																													_t231 = __rbp + 0x50; // 0x108d4
																													__rcx = _t231;
																													r9d = 0;
																													_t232 = __rbp + 0x80; // 0x3b003300030000
																													r8d =  *_t232;
																													__eax = E004030A0(__rax, _t231,  *_t230, __r9);
																													r15d = __eax;
																													__eflags = __rax;
																													if(__rax != 0) {
																														goto L92;
																													} else {
																														__eflags =  *((long long*)(__rbp + 0x18));
																														if( *((long long*)(__rbp + 0x18)) == 0) {
																															goto L88;
																														} else {
																															goto L85;
																														}
																													}
																													goto L102;
																												} else {
																													__eflags =  *((long long*)(__rbp + 0x18));
																													if( *((long long*)(__rbp + 0x18)) == 0) {
																														L89:
																														__eflags =  *((char*)(__rbp + 0x12));
																														if( *((char*)(__rbp + 0x12)) != 0) {
																															_t234 = __rbp - 8; // 0x0
																															r8d =  *_t234;
																															_t235 = __rbp - 0x18; // 0x0
																															__rdx =  *_t235;
																															L004090A0();
																															r15d = __eax;
																														} else {
																															_t110 = __rbp - 8; // 0x0
																															__rax =  *_t110;
																															_t111 = __rbp - 0x20; // 0x0
																															__rdx =  *_t111;
																															r8d = 0xffffffff;
																															_t112 = __rbp - 0x18; // 0x0
																															r9d =  *_t112;
																															 *(__rsp + 0x20) =  *_t110;
																															__eflags =  *_t111;
																															if( *_t111 == 0) {
																																__rdx = 0x1;
																																 *((intOrPtr*)(__rcx - 0x77)) =  *((intOrPtr*)(__rcx - 0x77)) + __al;
																																asm("invalid");
																																asm("lodsd");
																																asm("stc");
																																asm("invalid");
																															} else {
																																L00409008();
																																r15d = __eax;
																															}
																														}
																													} else {
																														_t99 = __rbp + 0x70; // 0x108f4
																														__rdx = _t99;
																														L004090E0();
																														_t100 = __rbp + 0x40; // 0x30003b00330003
																														__rdx =  *_t100;
																														_t101 = __rbp + 0x50; // 0x108d4
																														__rcx = _t101;
																														r9d = 0;
																														_t102 = __rbp + 0x80; // 0x3b003300030000
																														r8d =  *_t102;
																														__eax = E004030A0(__rax, _t101,  *_t100, __r9);
																														r15d = __eax;
																														__eflags = __rax;
																														if(__rax == 0) {
																															L85:
																															__rcx =  *0x424178;
																															__eflags =  *0x424178;
																															if( *0x424178 != 0) {
																																_t103 = __rbp + 8; // 0x0
																																__r9 =  *_t103;
																																r8d = __ebx;
																																__rdx = L"Using image %d from \"%ls\" as template\n";
																																__eax = E00401650(__r8,  *_t103);
																															}
																															 *(__rsp + 0x20) = 0;
																															_t105 = __rbp + 0x28; // 0x2e000100000000
																															__r8 =  *_t105;
																															r9d = __ebx;
																															_t106 = __rbp + 0x80; // 0x3b003300030000
																															__rdx =  *_t106;
																															_t107 = __rbp + 0x40; // 0x30003b00330003
																															__rcx =  *_t107;
																															L00409078();
																															r15d = __eax;
																															__eflags = __rax;
																															if(__rax == 0) {
																																L88:
																																_t108 = __rbp + 0x40; // 0x30003b00330003
																																__rcx =  *_t108;
																																goto L89;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																									L92:
																									_t114 = __rbp + 0x68; // 0x1000000390038
																									r8d =  *_t114;
																									_t115 = __rbp + 0x28; // 0x2e000100000000
																									__rcx =  *_t115;
																									__rdx = __r8;
																									_t116 = __rbp + 0x40; // 0x30003b00330003
																									__eflags = __rcx -  *_t116;
																									if(__rcx ==  *_t116) {
																										L141:
																										__eflags = __rdx;
																										if(__rdx != 0) {
																											goto L97;
																										} else {
																											goto L99;
																										}
																										goto L101;
																									} else {
																										__eflags = __r8;
																										if(__r8 == 0) {
																											L139:
																											L00409108();
																											L140:
																											_t191 = __rbp + 0x68; // 0x1000000390038
																											__rdx =  *_t191;
																											goto L141;
																										} else {
																											__rdx = 0;
																											while(1) {
																												__eflags = __rcx -  *((intOrPtr*)(__r14 + __rdx * 8));
																												if(__rcx ==  *((intOrPtr*)(__r14 + __rdx * 8))) {
																													break;
																												}
																												__rdx = __rdx + 1;
																												__eflags = __rdx - __r8;
																												if(__rdx == __r8) {
																													goto L139;
																												} else {
																													continue;
																												}
																												goto L99;
																											}
																											L97:
																											__rbx = 0;
																											__eflags = 0;
																											do {
																												__rcx =  *((intOrPtr*)(__r14 + __rbx * 8));
																												__rbx = __rbx + 1;
																												L00409108();
																												_t121 = __rbp + 0x68; // 0x1000000390038
																												__rax =  *_t121;
																												__eflags =  *_t121 - __rbx;
																											} while ( *_t121 > __rbx);
																										}
																									}
																								}
																							}
																							L99:
																							__rcx = __r14;
																							free(??);
																						}
																					} else {
																						_t67 = __rbp - 4; // 0x0
																						__rdx =  *_t67;
																						_t68 = __rbp + 0x40; // 0x30003b00330003
																						__rcx =  *_t68;
																						L00409040();
																						r15d = __eax;
																						__eflags = __rax;
																						if(__rax == 0) {
																							goto L61;
																						}
																					}
																				} else {
																					_t64 = __rbp + 4; // 0x0
																					__rdx =  *_t64;
																					_t65 = __rbp + 0x40; // 0x30003b00330003
																					__rcx =  *_t65;
																					L00409038();
																					r15d = __eax;
																					__eflags = __rax;
																					if(__rax == 0) {
																						goto L59;
																					}
																				}
																			}
																		}
																		L100:
																		_t122 = __rbp + 0x40; // 0x30003b00330003
																		__rcx =  *_t122;
																		L00409108();
																	}
																}
																L101:
																__eflags =  *((char*)(__rbp + 0x13));
																if( *((char*)(__rbp + 0x13)) != 0) {
																	__rcx = __r12;
																	free(??);
																}
																goto L102;
															} else {
																__eflags =  *__rsi - 0x2d;
																_t34 = __rbp + 0x70; // 0x108f4
																__rdi = _t34;
																if( *__rsi != 0x2d) {
																	L35:
																	__rdx = __rdi;
																	__rcx = __rsi;
																	__imp___wstat64();
																	__eflags = __rax;
																	if(__eflags != 0) {
																		__rdx = __rsi;
																		__rcx = L"Failed to stat the file \"%ls\"";
																		__eax = E004031C0(__eflags, __rax, L"Failed to stat the file \"%ls\"", __rsi, __r8, __r9);
																		goto L16;
																	} else {
																		_t36 = __rbp + 0x88; // 0x30
																		__r12 =  *_t36;
																		__rdx = L"rb";
																		__rcx = __rsi;
																		__imp___wfopen();
																		__r14 = __rax;
																		__eflags = __rax;
																		if(__eflags == 0) {
																			__rdx = __rsi;
																			__rcx = L"Failed to open the file \"%ls\"";
																			__eax = E004031C0(__eflags, __rax, L"Failed to open the file \"%ls\"", __rsi, __r8, __r9);
																			goto L16;
																		} else {
																			__eflags = __r12;
																			__rcx = 0x1;
																			__eax = malloc(??);
																			__r15 = __rax;
																			__eflags = __rax;
																			if(__rax == 0) {
																				__r8 = __rsi;
																				__rdx = __r12;
																				__rcx = L"Failed to allocate buffer of %zu bytes to hold contents of file \"%ls\"";
																				__eax = E004024D0(L"Failed to allocate buffer of %zu bytes to hold contents of file \"%ls\"", __r12, __rsi, __r9);
																				__rcx = __r14;
																				__eax = fclose(??);
																				goto L16;
																			} else {
																				__r9 = __r14;
																				__r8 = __r12;
																				__rdx = 0x1;
																				cs =  *__rdi;
																				 *0xCC450F490000003A =  *0xCC450F490000003A + __cl;
																				__eflags =  *0xCC450F490000003A;
																				asm("les ecx, [edi]");
																				if(__eflags != 0) {
																					__r8 = __rsi;
																					__rdx = __r12;
																					__rcx = L"Failed to read %zu bytes from the file \"%ls\"";
																					__eax = E004031C0(__eflags, __rax, L"Failed to read %zu bytes from the file \"%ls\"", __r12, __rsi, __r9);
																					__rcx = __r15;
																					free(??);
																					__rcx = __r14;
																					__eax = fclose(??);
																					goto L16;
																				} else {
																					__rcx = __r14;
																					__eax = fclose(??);
																					_t39 = __rbp + 0x30; // 0x108b4
																					__r8 = _t39;
																					__rdx = __r12;
																					__rcx = __r15;
																					__eax = E004023F0(__rax, __r15, __r12, _t39);
																					 *(__rbp + 0x38) = __rax;
																					goto L40;
																				}
																			}
																		}
																	}
																} else {
																	__eflags =  *((short*)(__rsi + 2));
																	if( *((short*)(__rsi + 2)) == 0) {
																		__rcx = __rdi;
																		__eax = E00403260(__rax, __rdi);
																		__rcx = __rax;
																		__eflags = __rax;
																		if(__rax == 0) {
																			L16:
																			r15d = 0xffffffff;
																			goto L13;
																		} else {
																			_t203 = __rbp + 0x70; // 0x2e
																			__rdx =  *_t203;
																			_t204 = __rbp + 0x30; // 0x108b4
																			__r8 = _t204;
																			__eax = E004023F0(__rax, __rcx,  *_t203, _t204);
																			 *(__rbp + 0x38) = __rax;
																			L40:
																			__eflags = __rax;
																			if(__rax == 0) {
																				goto L16;
																			} else {
																				_t41 = __rbp + 0x30; // 0x1000000000000
																				__rax =  *_t41;
																				_t42 = __rbp + 0x38; // 0x108bc
																				__rcx = _t42;
																				 *((long long*)(__rbp + 0x40)) =  *_t41;
																				_t44 = __rbp + 0x40; // 0x108c4
																				__rax = _t44;
																				__rdx = __rax;
																				 *(__rbp - 0x40) = __rax;
																				__eax = E004025C0(__eax, _t42, __rax);
																				__rbx = __rax;
																				__eflags = __rax;
																				if(__rax < 0) {
																					r15d = 0xffffffff;
																					L102:
																					_t124 = __rbp + 0x38; // 0x2c
																					__rcx =  *_t124;
																					free(??);
																					goto L13;
																				} else {
																					__rdx = 0x18;
																					 *__rax =  *__rax + __al;
																					__eflags =  *__rax;
																				}
																			}
																		}
																	} else {
																		goto L35;
																	}
																}
															}
														}
													}
												} else {
													__eflags =  *(__rbp + 8);
													if( *(__rbp + 8) != 0) {
														goto L29;
													} else {
														_t26 = __rbp + 0x68; // 0x1000000390038
														__rax =  *_t26;
														__eflags = __rax - 1;
														if(__rax == 1) {
															_t173 = __rbp + 0x60; // 0x37003600350034
															__rax =  *_t173;
															__rax =  *((intOrPtr*)( *_t173));
															 *(__rbp + 8) = __rax;
															goto L29;
														} else {
															__eflags =  *((char*)(__rbp + 0x12));
															if( *((char*)(__rbp + 0x12)) == 0) {
																__eflags = __rax - 1;
																if(__rax <= 1) {
																	__rcx = L"For capture of non-delta WIM, \'--update-of\' must specify WIMFILE:IMAGE!";
																	__eax = E004024D0(L"For capture of non-delta WIM, \'--update-of\' must specify WIMFILE:IMAGE!", __rdx, __r8, __r9);
																} else {
																	__rcx = L"For capture of delta WIM based on multiple existing WIMs,\n      \'--update-of\' must specify WIMFILE:IMAGE!";
																	__eax = E004024D0(L"For capture of delta WIM based on multiple existing WIMs,\n      \'--update-of\' must specify WIMFILE:IMAGE!", __rdx, __r8, __r9);
																}
																goto L12;
															} else {
																_t28 = __rbp - 0x20; // 0x0
																__rax =  *_t28;
																 *(__rbp + 8) = __rax;
																goto L29;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = __rax - 0x3d;
							if(__rax > 0x3d) {
								goto L12;
							} else {
								__rax =  *((intOrPtr*)(__rbx + __rax * 4));
								goto __rax;
							}
						}
					} else {
						r15d = __eax;
						L13:
						free();
						free(??);
						return r15d;
					}
				}
			}

0x00403da0
0x00403db0
0x00403db2
0x00403db7
0x00404cc3
0x00000000
0x00403dbd
0x00403dbd
0x00403dc0
0x00403dc4
0x00403dc9
0x00403dcb
0x00403cf0
0x00403cf9
0x00403d00
0x00403d03
0x00403d05
0x00403d0c
0x00403d11
0x00403d14
0x00404110
0x00404117
0x0040411a
0x0040411c
0x00404120
0x00404123
0x00404126
0x00404129
0x00403d40
0x00403d40
0x00403d49
0x00403d4b
0x00403d51
0x00403d54
0x00403d57
0x00000000
0x0040412f
0x0040412f
0x00404133
0x00404137
0x0040413a
0x0040413e
0x00404777
0x0040477e
0x00404785
0x0040478b
0x0040478d
0x00404794
0x00404797
0x0040479a
0x0040479a
0x00404785
0x00404144
0x00404144
0x00404148
0x0040414f
0x00404154
0x00404156
0x00404442
0x00404445
0x00404448
0x0040444c
0x0040444f
0x0040445a
0x0040445a
0x00404462
0x00404464
0x0040446d
0x0040446d
0x0040446f
0x0040446f
0x00404476
0x0040447f
0x00404482
0x00404484
0x00404484
0x00404487
0x00000000
0x0040448d
0x0040448d
0x00404495
0x00000000
0x00404495
0x00404451
0x00404451
0x00404454
0x00404d12
0x00404d19
0x00404d1d
0x00000000
0x00000000
0x00000000
0x00000000
0x00404454
0x0040415c
0x0040415f
0x00404165
0x00404169
0x004048b4
0x004048b4
0x004048b8
0x004048b8
0x004048bc
0x004048c2
0x004048c4
0x00000000
0x004048ca
0x004048ca
0x004048d0
0x004048d3
0x00000000
0x004048d9
0x004048d9
0x004048de
0x00404c5a
0x00404c5a
0x00404c5c
0x00000000
0x00404c5e
0x00404c5e
0x00404c62
0x00000000
0x00404c62
0x004048e4
0x004048e4
0x004048e9
0x00404ca3
0x00404ca5
0x00000000
0x00404ca7
0x00404ca7
0x00404caf
0x00404cb3
0x00000000
0x00404cb3
0x004048ef
0x004048ef
0x004048ef
0x004048f3
0x004048f3
0x004048f7
0x004048fc
0x004048fe
0x00000000
0x00404904
0x00404904
0x00404906
0x00000000
0x0040490c
0x0040490c
0x00404910
0x00404918
0x0040491c
0x00000000
0x0040491c
0x00404906
0x004048fe
0x004048e9
0x004048de
0x004048d3
0x0040416f
0x0040416f
0x0040416f
0x00404171
0x00404d27
0x00404d2a
0x00404d2e
0x00404d2e
0x00000000
0x00404177
0x00404177
0x0040417a
0x00404c6b
0x00404c6b
0x00404c72
0x00404c78
0x00000000
0x00404180
0x00404180
0x00404184
0x00404188
0x00404188
0x0040418d
0x004041b4
0x004041b4
0x004041b8
0x00404869
0x0040486c
0x00404871
0x00404876
0x0040487a
0x0040487f
0x00404882
0x00404885
0x0040488a
0x0040488f
0x00404892
0x00404897
0x0040489b
0x00000000
0x004041be
0x004041be
0x004041c2
0x004041c6
0x004041ca
0x0040481b
0x0040481f
0x00404824
0x00404829
0x0040482d
0x00404832
0x00404839
0x0040483d
0x00404840
0x00404845
0x00404848
0x0040484d
0x0040484d
0x00404851
0x00404854
0x00404859
0x0040485c
0x0040485e
0x00000000
0x00404864
0x00000000
0x00404864
0x004041d0
0x004041d0
0x004041d0
0x004041d4
0x004041d4
0x004041d8
0x00404707
0x0040470b
0x00404712
0x00404716
0x0040471e
0x00404723
0x00404723
0x00404727
0x0040472c
0x00404730
0x00404739
0x00404742
0x0040436d
0x0040436d
0x00404370
0x00404370
0x00404374
0x0040437d
0x00404384
0x00404384
0x00404388
0x0040438b
0x00404390
0x00404393
0x00404395
0x00000000
0x00000000
0x00404748
0x00404748
0x00404748
0x0040474c
0x0040474c
0x0040474f
0x00404754
0x00404757
0x00404759
0x0040475f
0x0040475f
0x00404763
0x00404766
0x0040476d
0x0040439b
0x0040439b
0x0040439e
0x004043a1
0x004047c1
0x004047c8
0x00000000
0x004047ce
0x004047ce
0x004047d2
0x00404b23
0x00404b23
0x00404b27
0x00404b27
0x00404b2b
0x00404b30
0x00404b30
0x00404b36
0x00404b36
0x004047d8
0x004047dc
0x004047e5
0x004047e5
0x00000000
0x004043a7
0x004043a7
0x004043a7
0x004043ab
0x004043b0
0x004043b3
0x004043b5
0x004043bb
0x004043bb
0x004043bf
0x004043d8
0x004043d8
0x004043dc
0x004043f5
0x004043f5
0x004043f9
0x004043fb
0x004043ff
0x00404930
0x00404930
0x00404934
0x00404936
0x0040493f
0x00404942
0x00404945
0x0040494a
0x00404961
0x00404961
0x00404961
0x00404965
0x00404968
0x0040496d
0x0040496f
0x00000000
0x00000000
0x00404950
0x00404953
0x00404956
0x00404959
0x00404959
0x0040495c
0x0040495c
0x00404971
0x004043ff
0x00404405
0x00404405
0x00404408
0x0040440b
0x0040440d
0x004049d4
0x004049d6
0x004049df
0x004049e2
0x004049e4
0x004049e6
0x00404cec
0x00404cf3
0x00404cf7
0x00000000
0x004049ec
0x004049ec
0x004049ec
0x004049f0
0x004049f3
0x004049f5
0x00404a17
0x00404a17
0x00404a17
0x00404a1b
0x00404a21
0x00404a25
0x00404a2e
0x00404a33
0x00404a3a
0x00404a3c
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404a03
0x00404a07
0x00404a0b
0x00404a0e
0x00404a11
0x00404ada
0x00404ada
0x00404ade
0x00404ae1
0x00404ae4
0x00404ae9
0x00404aec
0x00404aee
0x00000000
0x00404af4
0x00404af4
0x00404af4
0x00404af8
0x00404aff
0x00404b03
0x00404c82
0x00404c85
0x00404c8b
0x00404c8b
0x00404c8f
0x00404c96
0x00404c99
0x00404c99
0x00404b09
0x00404b09
0x00404b0c
0x00404b12
0x00404b19
0x00404b19
0x00404b0c
0x00000000
0x00404b03
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a11
0x00404a3e
0x00404a3e
0x00404a41
0x00000000
0x00404a41
0x00000000
0x00404413
0x00404413
0x00404413
0x00404418
0x00404ad3
0x00404ad3
0x00000000
0x0040441e
0x0040441e
0x00404422
0x00404976
0x00404976
0x0040497a
0x0040497a
0x0040497e
0x00404983
0x00404985
0x00000000
0x0040498b
0x0040498b
0x0040498b
0x0040498f
0x00000000
0x0040498f
0x00000000
0x00404428
0x00404428
0x00404428
0x00404428
0x0040442b
0x0040442b
0x0040442f
0x00404431
0x00404433
0x004044d0
0x004044d0
0x004044d0
0x004044d4
0x004044d7
0x004044df
0x004044e3
0x004044e8
0x004044ea
0x00000000
0x00000000
0x004044c0
0x004044c0
0x004044c3
0x004044c7
0x004044ca
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004044ca
0x004044ec
0x004044f0
0x00404439
0x00404439
0x00404439
0x00404439
0x00404439
0x00404433
0x004044f4
0x004044f4
0x004044f7
0x00404a87
0x00404a90
0x00404a90
0x00404a94
0x00404a94
0x00404a98
0x00404a9f
0x00404a9f
0x00404aa2
0x00404aa7
0x00404aa7
0x00404aab
0x00404aae
0x00404ab0
0x00000000
0x00404ab6
0x00000000
0x00404ab6
0x00000000
0x004044fd
0x004044fd
0x004044fd
0x004044fd
0x00404501
0x00404504
0x00404509
0x0040450d
0x0040450f
0x00404b3e
0x00404b3e
0x00404b42
0x00404b42
0x00404b46
0x00404b4b
0x00404b4b
0x00404b4f
0x00404b4f
0x00404b53
0x00404b59
0x00404b59
0x00404b5d
0x00404b60
0x00404b65
0x00404b67
0x00404b69
0x00404b6f
0x00404b6f
0x00404b75
0x00404b77
0x00404b7d
0x00404b7d
0x00404b81
0x00404b85
0x00404b8b
0x00404b8e
0x00404b91
0x00404b94
0x00404b96
0x00404b98
0x00404b98
0x00404b85
0x00404b77
0x00404b69
0x00404515
0x00404517
0x00404abb
0x00404abb
0x00404abf
0x00404abf
0x00404ac3
0x00404ac8
0x00404acb
0x00404acd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040451d
0x0040451d
0x00404520
0x00404c31
0x00404c38
0x00404c3e
0x00404526
0x00404526
0x00404526
0x00404526
0x0040452a
0x0040452f
0x00404532
0x00404535
0x00404535
0x00404539
0x00404539
0x0040453d
0x00404542
0x00404547
0x0040454a
0x0040454c
0x00404552
0x00404552
0x00404555
0x00404555
0x00404559
0x0040455b
0x00404bce
0x00404bce
0x00404bd2
0x00404bd7
0x00404bd7
0x00404bdb
0x00404bdb
0x00404bdf
0x00404be2
0x00404be2
0x00404be9
0x00404bee
0x00404bf1
0x00404bf3
0x00000000
0x00404bf9
0x00404bf9
0x00404bfe
0x00000000
0x00404c04
0x00000000
0x00404c04
0x00404bfe
0x00000000
0x00404561
0x00404561
0x00404566
0x004045d7
0x004045d7
0x004045db
0x00404c1d
0x00404c1d
0x00404c21
0x00404c21
0x00404c24
0x00404c29
0x004045e1
0x004045e1
0x004045e1
0x004045e4
0x004045e4
0x004045e8
0x004045ee
0x004045ee
0x004045f2
0x004045f6
0x004045f9
0x00404c48
0x00404c51
0x00404c54
0x00404c56
0x00404c57
0x00404c58
0x004045ff
0x004045ff
0x00404604
0x00404604
0x004045f9
0x00404568
0x00404568
0x00404568
0x0040456c
0x00404571
0x00404571
0x00404575
0x00404575
0x00404579
0x0040457c
0x0040457c
0x00404583
0x00404588
0x0040458b
0x0040458d
0x0040458f
0x0040458f
0x00404596
0x00404599
0x0040459b
0x0040459b
0x0040459f
0x004045a2
0x004045a9
0x004045a9
0x004045ae
0x004045b6
0x004045b6
0x004045ba
0x004045bd
0x004045bd
0x004045c3
0x004045c3
0x004045c7
0x004045cc
0x004045cf
0x004045d1
0x004045d3
0x004045d3
0x004045d3
0x00000000
0x004045d3
0x004045d1
0x0040458d
0x00404566
0x0040455b
0x0040454c
0x00404520
0x00404607
0x00404607
0x00404607
0x0040460b
0x0040460b
0x0040460f
0x00404612
0x00404612
0x00404616
0x004049a0
0x004049a0
0x004049a2
0x00000000
0x004049a8
0x00000000
0x004049a8
0x00000000
0x0040461c
0x0040461c
0x0040461f
0x00404998
0x00404998
0x0040499d
0x0040499d
0x0040499d
0x00000000
0x00404625
0x00404625
0x0040463d
0x0040463d
0x00404641
0x00000000
0x00000000
0x00404630
0x00404634
0x00404637
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404637
0x00404643
0x00404643
0x00404643
0x00404648
0x00404648
0x0040464c
0x00404650
0x00404655
0x00404655
0x00404658
0x00404658
0x00404648
0x0040461f
0x00404616
0x004044f7
0x0040465d
0x0040465d
0x00404660
0x00404660
0x004043de
0x004043de
0x004043de
0x004043e1
0x004043e1
0x004043e5
0x004043ea
0x004043ed
0x004043ef
0x00000000
0x00000000
0x004043ef
0x004043c1
0x004043c1
0x004043c1
0x004043c4
0x004043c4
0x004043c8
0x004043cd
0x004043d0
0x004043d2
0x00000000
0x00000000
0x004043d2
0x004043bf
0x004043b5
0x00404665
0x00404665
0x00404665
0x00404669
0x00404669
0x00404759
0x0040466e
0x0040466e
0x00404672
0x004047b4
0x004047b7
0x004047b7
0x00000000
0x004041de
0x004041de
0x004041e2
0x004041e2
0x004041e6
0x004041f3
0x004041f3
0x004041f6
0x004041f9
0x004041ff
0x00404201
0x00404a73
0x00404a76
0x00404a7d
0x00000000
0x00404207
0x00404207
0x00404207
0x0040420e
0x00404215
0x00404218
0x0040421e
0x00404221
0x00404224
0x00404c09
0x00404c0c
0x00404c13
0x00000000
0x0040422a
0x0040422a
0x0040422d
0x00404236
0x0040423b
0x0040423e
0x00404241
0x00404ccd
0x00404cd0
0x00404cd3
0x00404cda
0x00404cdf
0x00404ce2
0x00000000
0x00404247
0x00404247
0x0040424a
0x0040424d
0x00404256
0x00404259
0x00404259
0x0040425c
0x0040425d
0x004049ad
0x004049b0
0x004049b3
0x004049ba
0x004049bf
0x004049c2
0x004049c7
0x004049ca
0x00000000
0x00404263
0x00404263
0x00404266
0x0040426b
0x0040426b
0x0040426f
0x00404272
0x00404275
0x0040427a
0x00000000
0x0040427a
0x0040425d
0x00404241
0x00404224
0x004041e8
0x004041e8
0x004041ed
0x00404a49
0x00404a4c
0x00404a51
0x00404a54
0x00404a57
0x00403e90
0x00403e90
0x00000000
0x00404a5d
0x00404a5d
0x00404a5d
0x00404a61
0x00404a61
0x00404a65
0x00404a6a
0x0040427e
0x0040427e
0x00404281
0x00000000
0x00404287
0x00404287
0x00404287
0x0040428b
0x0040428b
0x0040428f
0x00404293
0x00404293
0x00404297
0x0040429a
0x0040429e
0x004042a3
0x004042a6
0x004042a9
0x00404810
0x00404678
0x00404678
0x00404678
0x0040467c
0x00000000
0x004042af
0x004042af
0x004042b8
0x004042b8
0x004042b8
0x004042a9
0x00404281
0x00000000
0x00000000
0x00000000
0x004041ed
0x004041e6
0x004041d8
0x004041ca
0x0040418f
0x0040418f
0x00404194
0x00000000
0x00404196
0x00404196
0x00404196
0x00404199
0x0040419c
0x004048a4
0x004048a4
0x004048a8
0x004048ab
0x00000000
0x004041a2
0x004041a2
0x004041a6
0x00403d2a
0x00403d2d
0x00404d01
0x00404d08
0x00403d33
0x00403d33
0x00403d3a
0x00403d3f
0x00000000
0x004041ac
0x004041ac
0x004041ac
0x004041b0
0x00000000
0x004041b0
0x004041a6
0x0040419c
0x00404194
0x0040418d
0x0040417a
0x00404171
0x00404169
0x00404156
0x00403d1a
0x00403d1a
0x00403d1d
0x00000000
0x00403d21
0x00403d21
0x00403d28
0x00403d28
0x00403d1d
0x00403dd1
0x00403dd1
0x00403d5c
0x00403d60
0x00403d69
0x00403d84
0x00403d84
0x00403dcb

APIs

free.MSVCRT ref: 00403D60
free.MSVCRT ref: 00403D69
wcschr.MSVCRT ref: 00403DAF

Strings

'--image-property' argument must be in the form NAME=VALUE, xrefs: 00404CBC

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: free$wcschr
String ID: '--image-property' argument must be in the form NAME=VALUE
API String ID: 2094429401-4034809873
Opcode ID: 0f00957e08ae017f9e250d606a1f86fbee5b939d1dc7ccd0474023052950550f
Instruction ID: b7d1c37603b2d14ab5405563699550f70b3991c380415c7c1b7503e45e54606c
Opcode Fuzzy Hash: 0f00957e08ae017f9e250d606a1f86fbee5b939d1dc7ccd0474023052950550f
Instruction Fuzzy Hash: 54019E7230094185EB11EF66EC4539A2354BB887A9F400537AE0DA73E5DE7CCA86C348

Uniqueness

Uniqueness Score: -1.00%

Function 00401C20 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401C20(void* __r12) {
				int _t11;
				intOrPtr _t17;

				_t17 =  *0x424178;
				if(( *(__r12 + 0x14) & 0x00000001) != 0) {
					if(( *(__r12 + 0x18) & 0x00000002) == 0) {
						if(__rcx == 0) {
							L3:
							return _t11;
						}
						r9d =  *((intOrPtr*)(__r12 + 0x10));
						__r8 =  *((intOrPtr*)(__r12 + 8));
						E00401650(__r8, __r9);
						__rcx =  *0x424178;
						if( *0x424178 == 0) {
							goto L3;
						}
						E00401650(__r8, __r9);
						__rcx =  *0x424178;
						goto L1;
					}
					if(__rcx == 0) {
						goto L3;
					}
					r9d =  *((intOrPtr*)(__r12 + 0x10));
					__r8 =  *((intOrPtr*)(__r12 + 8));
					E00401650( *((intOrPtr*)(__r12 + 8)), __r9);
					__rcx =  *0x424178;
				}
				L1:
				if(_t17 != 0) {
					_t11 = fflush();
				}
				goto L3;
			}

0x00401c20
0x00401c2d
0x00401c39
0x00402293
0x00401981
0x0040198c
0x0040198c
0x00402299
0x0040229e
0x004022aa
0x004022af
0x004022b9
0x00000000
0x00000000
0x004022c6
0x004022cb
0x00000000
0x004022cb
0x00401c42
0x00000000
0x00000000
0x00401c48
0x00401c4d
0x00401c59
0x00401c5e
0x00401c5e
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00000000

APIs

fflush.MSVCRT ref: 0040197C

Strings

(Use --commit to keep changes.), xrefs: 004022BF
Discarding changes to %ls (image %d), xrefs: 004022A3
Committing changes to %ls (image %d), xrefs: 00401C52

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: (Use --commit to keep changes.)$Committing changes to %ls (image %d)$Discarding changes to %ls (image %d)
API String ID: 497872470-1681448024
Opcode ID: 8e4f54ad10b1f1783fe56623f666cc3d9575b2b78e1c91064c3d65c601905043
Instruction ID: 920ca20d89fe4f8ce0235071e3a485c65bca952b064c3df7e5e3de6ceb77b080
Opcode Fuzzy Hash: 8e4f54ad10b1f1783fe56623f666cc3d9575b2b78e1c91064c3d65c601905043
Instruction Fuzzy Hash: 04012CF130560085EE09EB51E86DBB63760EB907C8F8904B79E0A266B1CB7CC881C348

Uniqueness

Uniqueness Score: -1.00%

Function 00409400 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0040943F
GetProcAddress.KERNEL32 ref: 0040944F

Strings

msvcrt.dll, xrefs: 00409438
_gmtime64_s, xrefs: 00409445

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _gmtime64_s$msvcrt.dll
API String ID: 1646373207-3395360201
Opcode ID: dc0ebcdafb1de981fea444f289583091972639fa4215578395139f56d6305665
Instruction ID: 71b2490c4265472d171e91919c5e165ceba20acad21f1f8bd95b671014d94e36
Opcode Fuzzy Hash: dc0ebcdafb1de981fea444f289583091972639fa4215578395139f56d6305665
Instruction Fuzzy Hash: 1FF012E4742B09A0ED09DB12FD453867365BB09BD4FC09426DE0D17325EA7CC5CAD308

Uniqueness

Uniqueness Score: -1.00%

Function 00409380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 004093BF
GetProcAddress.KERNEL32 ref: 004093CF

Strings

msvcrt.dll, xrefs: 004093B8
_gmtime64_s, xrefs: 004093C5

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _gmtime64_s$msvcrt.dll
API String ID: 1646373207-3395360201
Opcode ID: 7fff6f9f71eebbe1a458d55586438c8729f500e91ad07d5972697da02185eec1
Instruction ID: bba6a31db331a833b2f8d462eab442b0e034bbefee3e38b777b2c053f93052df
Opcode Fuzzy Hash: 7fff6f9f71eebbe1a458d55586438c8729f500e91ad07d5972697da02185eec1
Instruction Fuzzy Hash: A3F012E4742B09A0ED09DB12FD453867365B709BD4FC05426DE0D17325EA7CC5CAD348

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8B0 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D9A1
fputwc.MSVCRT ref: 0040DA37

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fputwcmemset
String ID:
API String ID: 3604838441-0
Opcode ID: 2dca4f9da45ed04844e5f96588ad490fc4f9fe9f8a621186bfa4a36d3396afe8
Instruction ID: 5d679ac041b2d015425151fa7c2666fcf80eed7a8682a3c1c87c8ba2ca36920a
Opcode Fuzzy Hash: 2dca4f9da45ed04844e5f96588ad490fc4f9fe9f8a621186bfa4a36d3396afe8
Instruction Fuzzy Hash: 39B1F8B7F1428046D7249F69C00436B3AA1BB44B6CF294227DE5A7B7C5C23DDD4AC749

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 6.3, APIs: 4, Instructions: 316COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040ADD1
fputc.MSVCRT ref: 0040AE62

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fputcmemset
String ID:
API String ID: 947785774-0
Opcode ID: aca019a02637ece2b20ad70e7a6a0f199abbda3e7909984d6697d277fe2b2917
Instruction ID: f1292abd09014f1ee4cb0f9446d06b7e0be6628cd6956981d4e47bb0d337fd5f
Opcode Fuzzy Hash: aca019a02637ece2b20ad70e7a6a0f199abbda3e7909984d6697d277fe2b2917
Instruction Fuzzy Hash: 41B1D5B371038046D7219B29C00476F3AA1F754BACF298226DE696B7C5C33DDD56C78A

Uniqueness

Uniqueness Score: -1.00%

Function 040C1228 Relevance: 6.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 040C1269
_invalid_parameter_noinfo.LIBCMT ref: 040C12E9
_invalid_parameter_noinfo.LIBCMT ref: 040C133D
_get_daylight.LIBCMT ref: 040C1395

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 87a569f0fa6007840772e124cd826e80d107d2790002830bb39cc444fd406606
Instruction ID: b3c6bc6de4e0f17a8820f8e17e8204a90d585bb6266d3bb9a624d68ceb704736
Opcode Fuzzy Hash: 87a569f0fa6007840772e124cd826e80d107d2790002830bb39cc444fd406606
Instruction Fuzzy Hash: AC71E330604604CBEBA99F6CC4943BE76D1EB45318F184A6DD896EF6D3E638E4419BC2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDE0 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc6feb7fe04ea989e8fcd2158f801aa4f843536839c595c0aba5afa4381fec7
Instruction ID: 46dce538465e99bac77914c0914078a4b6980a48908e3e86e8cdf8fdbd915579
Opcode Fuzzy Hash: 6dc6feb7fe04ea989e8fcd2158f801aa4f843536839c595c0aba5afa4381fec7
Instruction Fuzzy Hash: 5581EF73F106A686D7248F6AC40476A3BA1F744B98F59C626DE096B3C9C33CD84AC749

Uniqueness

Uniqueness Score: -1.00%

Function 0040B200 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47da5739ac3a8c85d87c053138458dba7af4b078d55216447f2a9a1c33c3308d
Instruction ID: 4168a1c11c9bf874992cf24d1742127d390db73f518ce36853a0eb5210f5681c
Opcode Fuzzy Hash: 47da5739ac3a8c85d87c053138458dba7af4b078d55216447f2a9a1c33c3308d
Instruction Fuzzy Hash: 5981C073B116958AD7258F29C40572F3BA1F745BA8F698226CE086B3C9D33CD842C78D

Uniqueness

Uniqueness Score: -1.00%

Function 04093F60 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 040940BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 04094134
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0409413A
__std_exception_copy.LIBVCRUNTIME ref: 04094168

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1109970293-0
Opcode ID: 2ddde359a4c76f64a287a0466cb481edb4d8d4c56d2aca505f6527ea16d1a565
Instruction ID: 71d91704bdf9fa641fcd2380ec22d8a95d2f034453ace391628c4ae93c5c9ac7
Opcode Fuzzy Hash: 2ddde359a4c76f64a287a0466cb481edb4d8d4c56d2aca505f6527ea16d1a565
Instruction Fuzzy Hash: 4B719030618E0C9FEB49EF2CC588B99B3E1FFA9304B50865AD449E7155DB71E985C780

Uniqueness

Uniqueness Score: -1.00%

Function 00414EF0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00414F4A
MultiByteToWideChar.KERNEL32 ref: 00414F8A

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 87632f0c763a38967d88bcb118b997cd977141d194ba9a95af8727dc9ae16e66
Instruction ID: df6f895952ddbc0c4fcb260adda5a10ba60424968cf48acdc198f42db56f52dd
Opcode Fuzzy Hash: 87632f0c763a38967d88bcb118b997cd977141d194ba9a95af8727dc9ae16e66
Instruction Fuzzy Hash: 4831C4B2308680CAD3218F68F4107DE7AA0F7D5798F948216EA9887BD5DB3DC5C6CB05

Uniqueness

Uniqueness Score: -1.00%

Function 040B4700 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 040B473B
_invalid_parameter_noinfo.LIBCMT ref: 040B490A

Strings

, xrefs: 040B4887

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 42607ea121f4b8465da573385795880991e12f7badba955f0a3b6c699c5e8b2a
Instruction ID: d090f50b991d80eb31397d0127f698214e4fbcbbf5b1be459612f25f50465481
Opcode Fuzzy Hash: 42607ea121f4b8465da573385795880991e12f7badba955f0a3b6c699c5e8b2a
Instruction Fuzzy Hash: A3519D701186948FDB999F18C0D41EC37E5FB4A304B54119ECCC6AB21BD331A682DBCA

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00409970(int __eax, void* __ebx, void* __ecx, signed long long __rax, void* __rbx, void* __rdx, void* __rdi, signed short* __rsi, void* __r9, void* __r12, intOrPtr __r13, signed long long __r14, void* __r15) {
				int _t26;
				void* _t29;
				void* _t31;
				signed long long _t33;
				signed long long _t35;
				void* _t41;
				signed long long _t45;
				long long* _t49;
				intOrPtr* _t53;
				signed long long _t55;
				long long _t60;
				signed long long _t62;
				signed long long _t69;
				signed long long _t71;
				signed long long _t72;
				signed long long _t78;
				signed long long _t81;
				long long _t85;
				intOrPtr* _t90;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t105;
				intOrPtr _t108;
				intOrPtr _t115;
				signed short _t119;

				_t116 = __r15;
				_t113 = __r14;
				_t111 = __r13;
				_t105 = __r9;
				_t87 = __rsi;
				_t35 = __rax;
				_t31 = __ebx;
				_t26 = __eax;
				_push(__r15);
				_push(__r14);
				_push(__r13);
				_push(__r12);
				_push(__rdi);
				_push(__rsi);
				_push(__rbx);
				_t97 = _t96 - 0x38;
				_t85 =  *0x424230;
				if(_t85 == 0) {
					 *0x424230 = 1;
					E0040A230();
					_t26 = E0040A470(_t35);
					_t108 =  *0x41ffd0; // 0x4208f0
					_t53 =  *0x41ffe0; // 0x4208f0
					 *0x424234 = 0;
					_t98 = _t97 - (0x0000000f + (_t35 + _t35 * 0x00000004) * 0x00000008 & 0xfffffff0);
					 *0x424238 = _t98 + 0x20;
					_t41 = _t108 - _t53;
					__eflags = _t41 - 7;
					if(_t41 <= 7) {
						goto L1;
					} else {
						_t69 =  *_t53;
						__eflags = _t41 - 0xb;
						if(_t41 > 0xb) {
							__eflags = _t69;
							if(_t69 != 0) {
								goto L30;
							} else {
								_t15 = _t53 + 4; // 0x0
								_t45 =  *_t15;
								_t16 = _t53 + 8; // 0x0
								__eflags = _t45 |  *_t16;
								if((_t45 |  *_t16) != 0) {
									goto L6;
								} else {
									_t17 = _t53 + 0xc; // 0x0
									_t69 =  *_t17;
									_t53 = _t53 + 0xc;
									goto L4;
								}
							}
						} else {
							L4:
							__eflags = _t69;
							if(_t69 != 0) {
								L30:
								__eflags = _t53 - _t108;
								if(_t53 < _t108) {
									_t115 =  *0x420020; // 0x400000
									do {
										_t18 = _t53 + 4; // 0x0
										r13d =  *_t53;
										_t53 = _t53 + 8;
										_t90 =  *_t18 + _t115;
										r13d = r13d +  *_t90;
										_t26 = E00409800(_t31, _t53, _t90, _t85, _t90, _t108, _t111, _t115, _t116);
										 *_t90 = r13d;
										__eflags = _t53 - _t108;
									} while (_t53 < _t108);
									goto L18;
								}
								goto L1;
							} else {
								_t8 = _t53 + 4; // 0x0
								_t45 =  *_t8;
								L6:
								__eflags = _t45;
								if(_t45 != 0) {
									goto L30;
								} else {
									_t9 = _t53 + 8; // 0x0
									_t71 =  *_t9;
									__eflags = _t71 - 1;
									if(__eflags != 0) {
										L35:
										_t60 = "  Unknown pseudo relocation protocol version %d.\n";
										_t29 = E00409790(_t31, __eflags, _t53, _t60, _t71, _t85, _t87, _t102, _t105, _t108, _t111, _t113, _t116);
										_t100 = _t98 - 0x58;
										_t49 =  *0x424240;
										__eflags = _t49;
										if(_t49 != 0) {
											asm("movsd xmm0, [esp+0x80]");
											 *((long long*)(_t100 + 0x20)) = _t60;
											 *(_t100 + 0x28) = _t71;
											asm("movsd [esp+0x30], xmm2");
											asm("movsd [esp+0x38], xmm3");
											asm("movsd [esp+0x40], xmm0");
											_t29 =  *_t49();
										}
										return _t29;
									} else {
										_t53 = _t53 + 0xc;
										__eflags = _t53 - _t108;
										if(_t53 < _t108) {
											_t111 =  *0x420020; // 0x400000
											_t113 = 0;
											goto L12;
											do {
												while(1) {
													L12:
													_t10 = _t53 + 4; // 0x302e322e30
													_t11 = _t53 + 8; // 0x30
													_t71 =  *_t11 & 0x000000ff;
													_t45 =  *_t53 + _t111;
													_t87 =  *_t10 + _t111;
													_t116 =  *_t45;
													__eflags = _t71 - 0x20;
													if(__eflags == 0) {
														break;
													}
													if(__eflags > 0) {
														__eflags = _t71 - 0x40;
														if(__eflags != 0) {
															goto L34;
														} else {
															_t119 = _t116 +  *_t87 - _t45;
															_t26 = E00409800(_t31, _t53, _t87, _t85, _t87, _t108, _t111, _t113, _t119);
															 *_t87 = _t119;
															goto L11;
														}
													} else {
														__eflags = _t71 - 8;
														if(_t71 == 8) {
															_t78 =  *_t87 & 0x000000ff;
															_t102 = _t78 | 0xffffff00;
															__eflags = _t33;
															_t79 =  <  ? _t78 | 0xffffff00 : _t78;
															_t80 = ( <  ? _t78 | 0xffffff00 : _t78) - _t45;
															_t120 = _t116 + ( <  ? _t78 | 0xffffff00 : _t78) - _t45;
															__eflags = _t116 + ( <  ? _t78 | 0xffffff00 : _t78) - _t45;
															_t26 = E00409800(_t31, _t53, _t87, _t85, _t87, _t108, _t111, _t113, _t116 + ( <  ? _t78 | 0xffffff00 : _t78) - _t45);
															 *_t87 = r15b;
															goto L11;
														} else {
															__eflags = _t71 - 0x10;
															if(__eflags != 0) {
																L34:
																E00409790(_t31, __eflags, _t53, "  Unknown pseudo relocation bit size %d.\n", _t71, _t85, _t87, _t102, _t105, _t108, _t111, _t113, _t116);
																goto L35;
															} else {
																_t81 =  *_t87 & 0x0000ffff;
																_t102 = _t81 | 0xffff0000;
																__eflags = _t33;
																_t82 =  <  ? _t81 | 0xffff0000 : _t81;
																_t53 = _t53 + 0xc;
																_t83 = ( <  ? _t81 | 0xffff0000 : _t81) - _t45;
																_t121 = _t116 + ( <  ? _t81 | 0xffff0000 : _t81) - _t45;
																_t26 = E00409800(_t31, _t53, _t87, _t85, _t87, _t108, _t111, _t113, _t116 + ( <  ? _t81 | 0xffff0000 : _t81) - _t45);
																 *_t87 = r15w;
																__eflags = _t53 - _t108;
																if(_t53 < _t108) {
																	continue;
																} else {
																	goto L18;
																}
															}
														}
													}
													goto L38;
												}
												_t72 =  *_t87;
												_t62 = _t72;
												__eflags = _t62;
												_t74 =  >=  ? _t62 : _t72 | _t113;
												_t75 = ( >=  ? _t62 : _t72 | _t113) - _t45;
												_t118 = _t116 + ( >=  ? _t62 : _t72 | _t113) - _t45;
												_t26 = E00409800(_t31, _t53, _t87, _t85, _t87, _t108, _t111, _t113, _t116 + ( >=  ? _t62 : _t72 | _t113) - _t45);
												 *_t87 = r15d;
												L11:
												_t53 = _t53 + 0xc;
												__eflags = _t53 - _t108;
											} while (_t53 < _t108);
											L18:
											__eflags =  *0x424234;
											if( *0x424234 > 0) {
												_t55 = 0;
												__eflags = 0;
												do {
													r8d =  *( *0x424238 + _t55);
													__eflags = r8d;
													if(r8d != 0) {
														_t26 = VirtualProtect();
													}
													_t85 = _t85 + 1;
													_t55 = _t55 + 0x28;
													__eflags = _t85 -  *0x424234;
												} while (_t85 <  *0x424234);
											}
										}
										goto L1;
									}
								}
							}
						}
					}
				} else {
					L1:
					return _t26;
				}
				L38:
			}

0x00409970
0x00409970
0x00409970
0x00409970
0x00409970
0x00409970
0x00409970
0x00409970
0x00409971
0x00409973
0x00409975
0x00409977
0x00409979
0x0040997a
0x0040997b
0x0040997c
0x00409988
0x00409990
0x004099a8
0x004099b2
0x004099c9
0x004099ce
0x004099d5
0x004099dc
0x004099e6
0x004099ee
0x004099f8
0x004099fb
0x004099ff
0x00000000
0x00409a01
0x00409a01
0x00409a03
0x00409a07
0x00409b38
0x00409b3a
0x00000000
0x00409b3c
0x00409b3c
0x00409b3c
0x00409b41
0x00409b41
0x00409b44
0x00000000
0x00409b4a
0x00409b4a
0x00409b4a
0x00409b4d
0x00000000
0x00409b4d
0x00409b44
0x00409a0d
0x00409a0d
0x00409a0d
0x00409a0f
0x00409bb0
0x00409bb0
0x00409bb3
0x00409bb9
0x00409bc0
0x00409bc0
0x00409bc3
0x00409bc6
0x00409bca
0x00409bcd
0x00409bd3
0x00409bd8
0x00409bdb
0x00409bdb
0x00000000
0x00409be0
0x00000000
0x00409a15
0x00409a15
0x00409a15
0x00409a18
0x00409a18
0x00409a1a
0x00000000
0x00409a20
0x00409a20
0x00409a20
0x00409a23
0x00409a26
0x00409bf1
0x00409bf1
0x00409bf8
0x00409c00
0x00409c04
0x00409c0b
0x00409c0e
0x00409c10
0x00409c19
0x00409c22
0x00409c27
0x00409c2d
0x00409c33
0x00409c39
0x00409c3b
0x00409c40
0x00409a2c
0x00409a2c
0x00409a30
0x00409a33
0x00409a39
0x00409a40
0x00409a4a
0x00409a7d
0x00409a7d
0x00409a7d
0x00409a7f
0x00409a82
0x00409a82
0x00409a86
0x00409a89
0x00409a8c
0x00409a8f
0x00409a92
0x00000000
0x00000000
0x00409a98
0x00409b60
0x00409b63
0x00000000
0x00409b69
0x00409b72
0x00409b75
0x00409b7a
0x00000000
0x00409b7a
0x00409a9e
0x00409a9e
0x00409aa1
0x00409a50
0x00409a59
0x00409a60
0x00409a62
0x00409a66
0x00409a69
0x00409a69
0x00409a6c
0x00409a71
0x00000000
0x00409aa3
0x00409aa3
0x00409aa6
0x00409be5
0x00409bec
0x00000000
0x00409aac
0x00409aac
0x00409ab5
0x00409abc
0x00409abf
0x00409ac3
0x00409ac7
0x00409aca
0x00409acd
0x00409ad2
0x00409ad6
0x00409ad9
0x00000000
0x00000000
0x00000000
0x00000000
0x00409ad9
0x00409aa6
0x00409aa1
0x00000000
0x00409a98
0x00409b88
0x00409b8a
0x00409b90
0x00409b92
0x00409b99
0x00409b9c
0x00409b9f
0x00409ba4
0x00409a74
0x00409a74
0x00409a78
0x00409a78
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af5
0x00409af5
0x00409b00
0x00409b0a
0x00409b0d
0x00409b10
0x00409b1d
0x00409b1d
0x00409b1f
0x00409b22
0x00409b26
0x00409b26
0x00409b2e
0x00409ae8
0x00000000
0x00409a33
0x00409a26
0x00409a1a
0x00409a0f
0x00409a07
0x00409992
0x00409992
0x004099a2
0x004099a2
0x00000000

APIs

VirtualProtect.KERNEL32(004241D8,00007FFD614C3CA0,?,?,?,00000001,00401261), ref: 00409B1D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00409BF1
Unknown pseudo relocation bit size %d., xrefs: 00409BE5

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 99edb8779e21182a023743e8fa0a0713b2a565dac6949b17c5e0ca7b91b2fc43
Instruction ID: 6b657599dc8a9262150217a7cd1582a390bfbe104cda5ee65c6d69ee2a94dc9d
Opcode Fuzzy Hash: 99edb8779e21182a023743e8fa0a0713b2a565dac6949b17c5e0ca7b91b2fc43
Instruction Fuzzy Hash: 0061F9B671064086DB109F25F84036EB771F79A7A4F54C226EE59273DADB3CC841C718

Uniqueness

Uniqueness Score: -1.00%

Function 040B44EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 040B4519
_invalid_parameter_noinfo.LIBCMT ref: 040B454C

Strings

, xrefs: 040B469A

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 02b0828145c19fb40d0812e79b14cc2a1aae0b86c4faaee812754153f4eeb9e2
Instruction ID: a74717feae713f87b9cacd0a7aa7e618156f1d5517b65b2fd728a7dc2944c73b
Opcode Fuzzy Hash: 02b0828145c19fb40d0812e79b14cc2a1aae0b86c4faaee812754153f4eeb9e2
Instruction Fuzzy Hash: 88517030214A058FDF989F28C0D83E537E5FB15319F541299CCC6AA26BD735EA85CE8B

Uniqueness

Uniqueness Score: -1.00%

Function 040C37FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 040C382C

Strings

., xrefs: 040C3888
:., xrefs: 040C3879

Memory Dump Source

Source File: 00000001.00000002.616811178.0000000004091000.00000040.00001000.00020000.00000000.sdmp, Offset: 04091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4091000_bReporter.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: .$:.
API String ID: 3215553584-2811378331
Opcode ID: 1ea4800d8b44ef1669b90b623a200da13e8714a78d6dac0b46a84644a872e05c
Instruction ID: b2ec3c14d0b3ff46097fed093cdd83133ba65c49b2a2136de9674b6b3806c0be
Opcode Fuzzy Hash: 1ea4800d8b44ef1669b90b623a200da13e8714a78d6dac0b46a84644a872e05c
Instruction Fuzzy Hash: 3B418130938B5DDEEB95EF9888456ED7BE0FF48A08F50416E9D45F3211E770A44487D2

Uniqueness

Uniqueness Score: -1.00%

Function 00402670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402670(signed int __eax, signed int** __rcx, long long* __rdx, signed short** __r8) {
				signed int _t5;
				void* _t14;
				intOrPtr _t18;
				signed int** _t19;
				signed short* _t21;
				intOrPtr _t25;
				long long* _t30;
				signed int** _t31;
				signed short** _t32;
				void* _t34;
				signed short* _t35;
				signed int* _t36;

				_t33 = __r8;
				_t19 = __rcx;
				_t5 = __eax;
				_t18 =  *((intOrPtr*)(__rdx));
				_t35 =  *((intOrPtr*)(__rcx));
				_t31 = __rcx;
				_t30 = __rdx;
				_t32 = __r8;
				if(_t18 == 0) {
					L5:
					r12d = 2;
				} else {
					asm("o16 nop [eax+eax]");
					do {
						 *((intOrPtr*)(_t19 - 0x77)) =  *((intOrPtr*)(_t19 - 0x77)) + _t5;
						asm("les eax, [ebp+0x410a75c0]");
						if(_t14 != 0) {
							goto L4;
						} else {
							_t5 =  *_t35 & 0x0000ffff;
							if(_t5 != 0) {
								if(_t5 == 0x22) {
									L9:
									_t18 = _t18 - 1;
									if(_t18 == 0) {
										L18:
										r12d = 1;
										E004024D0(L"Missing closing quote: %ls", _t35, _t33, _t34);
									} else {
										_t21 =  &(_t35[1]);
										_t25 = _t18;
										_t36 = _t21;
										while(_t5 !=  *_t36) {
											_t36 =  &(_t36[0]);
											_t25 = _t25 - 1;
											if(_t25 == 0) {
												goto L18;
											} else {
												continue;
											}
											goto L6;
										}
										_t35 = _t21;
										goto L14;
									}
								} else {
									_t36 = _t35;
									if(_t5 != 0x27) {
										while(1) {
											L004091D0();
											if(_t14 != 0) {
												break;
											}
											if( *_t36 != 0) {
												continue;
											}
											L14:
											 *_t36 = _t5;
											 *_t30 = _t18 - (_t36 - _t35 >> 1);
											 *_t31 = _t36;
											 *_t32 = _t35;
											goto L6;
										}
										goto L14;
									} else {
										goto L9;
									}
								}
							} else {
								goto L4;
							}
						}
						goto L6;
						L4:
						_t35 =  &(_t35[1]);
						_t18 = _t18 - 1;
					} while (_t18 != 0);
					goto L5;
				}
				L6:
				return r12d;
			}

0x00402670
0x00402670
0x00402670
0x0040267e
0x00402681
0x00402684
0x00402687
0x0040268a
0x00402690
0x004026c2
0x004026c2
0x00402692
0x00402692
0x00402698
0x004026a6
0x004026a9
0x004026ac
0x00000000
0x004026ae
0x004026ae
0x004026b6
0x004026e4
0x004026ef
0x004026ef
0x004026f3
0x00402760
0x0040276a
0x00402770
0x004026f5
0x004026f5
0x004026f9
0x004026fc
0x00402712
0x00402708
0x0040270c
0x00402710
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402710
0x00402718
0x00000000
0x00402718
0x004026e6
0x004026e6
0x004026ed
0x00402747
0x00402755
0x0040275c
0x00000000
0x00000000
0x00402745
0x00000000
0x00000000
0x0040271b
0x00402723
0x00402730
0x00402733
0x00402736
0x00000000
0x00402736
0x00000000
0x00000000
0x00000000
0x00000000
0x004026ed
0x00000000
0x00000000
0x00000000
0x004026b6
0x00000000
0x004026b8
0x004026b8
0x004026bc
0x004026bc
0x00000000
0x00402698
0x004026c8
0x004026d9

APIs

iswctype.MSVCRT ref: 004026A2

Strings

Missing closing quote: %ls, xrefs: 00402763

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: iswctype
String ID: Missing closing quote: %ls
API String ID: 304682654-2461220523
Opcode ID: 64194693ac4a1278ce873fc46642fd242d127058a8a79400a1bd1b68cd11b839
Instruction ID: 817ebb28f0835e74eb2a51d629620d6249634de0d8582994a730f412881b0e7d
Opcode Fuzzy Hash: 64194693ac4a1278ce873fc46642fd242d127058a8a79400a1bd1b68cd11b839
Instruction Fuzzy Hash: D121E77632155181DB25AF269E0C67B6614B718BC8F98C033DE49677D0F6FDC882C309

Uniqueness

Uniqueness Score: -1.00%

Function 00406800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00406800(intOrPtr __eax, void* __ebx, void* __ecx, void* __edx, void* __ebp, void* __r8, void* __r9, long long _a32, long long _a56, long long _a64, long long _a72, char _a88, long long _a96, char _a104, char _a112, char _a120, long long _a128, long long _a136, long long _a144, long long _a152, long long _a160) {
				intOrPtr _t72;
				void* _t77;
				void* _t78;
				intOrPtr* _t85;
				intOrPtr* _t86;
				long long _t87;
				intOrPtr* _t90;
				void* _t94;
				void* _t95;
				long long _t113;
				char* _t114;
				void* _t121;
				signed long long _t130;
				intOrPtr _t141;
				long long _t147;
				intOrPtr* _t154;
				long long _t156;
				signed long long _t157;
				signed long long _t172;
				long long _t173;
				long long _t174;
				long long _t178;

				_t78 = __ecx;
				_t77 = __ebx;
				_t72 = __eax;
				_t85 =  *0x4201b0; // 0x424188
				r8d = 0xa;
				_a72 =  *_t85;
				L00409168();
				r14d = __eax;
				if(_t85 == 0xffffffff) {
					L9:
					_t147 = 0xffffffff;
					asm("invalid");
					asm("dec ecx");
					 *0xffffffff =  *0xffffffff - 1;
					L6:
					free();
					return _t72;
				} else {
					__rax = _a128;
					if( *__rax != 0) {
						goto L9;
					}
					__rcx = _a72;
					if(__rcx != __rax) {
						goto L1;
					}
					goto L9;
				}
				L1:
				_a32 = 0;
				_t171 = 0x41d9a0;
				_t72 = E00408FE0();
				if(_t85 == 0xffffffff) {
					_t86 =  *0x4201c0; // 0x416038
					_t130 =  *_t86;
					_t95 = _t94 - _t130;
					_t173 = _t147 + _t130 * 8;
					_t87 = _t95 - 1;
					if(_t87 > 1) {
						L5:
						asm("invalid");
						asm("adc eax, 0xf8a8");
						asm("invalid");
						goto L6;
					}
					_t154 =  *_t173;
					_a32 = 0;
					_t171 = 0x401890;
					_a72 = _t173;
					L004090A8();
					_t147 = _t87;
					if(_t87 != 0) {
						goto L6;
					}
					_t174 = _a72;
					if(_t95 == 2) {
						_a64 = _t174;
						L00409068();
						_t174 = _a64;
						if(_t87 == 0) {
							_t72 = E00403BB0( *((intOrPtr*)(_t174 + 8)), _t154, 0x401890);
							_t147 = _t87;
							if(_t87 == 0) {
								L15:
								_t156 = _a120;
								if(_t156 == 0) {
									if(_a56 == 0) {
										L00409158();
										if(_t87 != 0) {
											__imp___putws();
											 *_t87 =  *_t87 + _t72;
											_t156 = _t87;
											E0040A630(0x4240a0, L"wim%ls", L"update", _t171);
											E00401650(0x4240a0, _t171);
										}
										E00403260(_t87,  &_a128);
										_t113 = _t87;
										if(_t87 == 0) {
											_a96 = 0;
											asm("invalid");
											L29:
											L00409108();
											goto L6;
										}
										E004023F0(_t87, _t113, _a128,  &_a104);
										_a96 = _t87;
										if(_t87 == 0) {
											goto ( *((intOrPtr*)(_t156 + 0xf)));
											goto L29;
										}
										_t114 =  &_a96;
										_t72 = E00402780(_t77, _t78, _t87, _t114, _a104,  &_a112);
										_t154 = _t87;
										if(_t87 != 0) {
											L17:
											_t172 = _a112;
											if(_t172 == 0) {
												L24:
												_a32 = 1;
												L00409018();
												_t147 = _t87;
												if(_t87 != 0) {
													L27:
													free();
													L28:
													free();
													goto L29;
												}
												if(_a56 != 0) {
													L32:
													r9d = 1;
													_a32 = 1;
													_a128 = 0;
													_a136 = _a56;
													_t87 = L"/Windows/System32/WimBootCompress.ini";
													_a144 = _t87;
													_a152 = 0;
													_a160 = 0;
													L00409018();
													_t147 = _t87;
													if(_t87 == 0) {
														goto L26;
													}
													goto L27;
												}
												L26:
												r8d = r14d;
												L004090A0();
												_t147 = _t87;
												goto L27;
											}
											_t90 = _t154;
											_t121 = _t154 + (_t172 + _t172 * 4) * 8;
											while(1) {
												L22:
												_t141 =  *_t90;
												if(_t141 == 0) {
													break;
												}
												if(_t141 == 1) {
													 *(_t90 + 0x10) =  *(_t90 + 0x10) | r13d;
												}
												_t87 = _t90 + 0x28;
												if(_t87 == _t121) {
													goto L24;
												} else {
													continue;
												}
											}
											 *(_t90 + 0x20) =  *(_t90 + 0x20) | _t157;
											_t90 = _t90 + 0x28;
											 *((long long*)(_t90 - 0x10)) = _t178;
											if(_t90 != _t121) {
												goto L22;
											}
											goto L24;
										}
										L41:
										 *((long long*)(_t114 - 0x75)) =  *((long long*)(_t114 - 0x75)) - 1;
										goto L28;
									}
									_a32 = 1;
									r9d = 0;
									r8d = 0;
									_a96 = 0;
									_a112 = 0;
									L00409018();
									_t147 = _t87;
									if(_t87 != 0) {
										goto L27;
									}
									goto L32;
								}
								_a96 = 0;
								L00409180();
								_t114 =  &_a120;
								_t72 = E00402780(_t77, _t78, _t87, _t114, _t87,  &_a112);
								_t154 = _t87;
								if(_t87 == 0) {
									goto L41;
								}
								goto L17;
							}
							goto L29;
						}
						if(_t87 != 0xffffffff) {
							goto L15;
						}
						asm("invalid");
						asm("invalid");
						goto L29;
					}
					L004090E0();
					r8d = _a144;
					if(r8d != 1) {
						_t72 = E004024D0(L"\"%ls\" contains %d images; Please select one.", _t154,  &_a88, 0x401890);
						L00409108();
						goto L5;
					}
					goto L15;
				}
				if(_t85 - 3 > 0x39) {
					goto L5;
				}
				goto __rax;
			}

0x00406800
0x00406800
0x00406800
0x00406800
0x0040680f
0x00406818
0x0040681d
0x00406822
0x00406828
0x00406846
0x0040684d
0x00406856
0x00406858
0x0040685b
0x004067a5
0x004067aa
0x004067c4
0x0040682a
0x0040682a
0x00406836
0x00000000
0x00000000
0x00406838
0x00406840
0x00000000
0x00000000
0x00000000
0x00406840
0x00406730
0x00406730
0x00406739
0x0040674c
0x00406754
0x00406940
0x00406947
0x0040694a
0x0040694c
0x00406950
0x00406956
0x00406788
0x00406791
0x00406793
0x004067a3
0x00000000
0x004067a3
0x0040695c
0x00406968
0x00406971
0x00406978
0x00406980
0x00406985
0x00406989
0x00000000
0x00000000
0x00406997
0x0040699c
0x00406b56
0x00406b5b
0x00406b60
0x00406b69
0x00406c19
0x00406c1e
0x00406c22
0x004069c6
0x004069c6
0x004069ce
0x00406aa6
0x00406ba6
0x00406bad
0x00406c34
0x00406c43
0x00406c53
0x00406c5d
0x00406c73
0x00406c73
0x00406bb7
0x00406bbc
0x00406bc2
0x00406c7d
0x00406c8f
0x00406a91
0x00406a96
0x00000000
0x00406a96
0x00406bd5
0x00406bda
0x00406be2
0x00406c99
0x00000000
0x00406c99
0x00406bed
0x00406bf7
0x00406bfc
0x00406c02
0x00406a03
0x00406a03
0x00406a0b
0x00406a48
0x00406a48
0x00406a5a
0x00406a5f
0x00406a63
0x00406a7f
0x00406a82
0x00406a87
0x00406a8c
0x00000000
0x00406a8c
0x00406a70
0x00406ae3
0x00406ae8
0x00406af0
0x00406b00
0x00406b0b
0x00406b13
0x00406b1a
0x00406b22
0x00406b2e
0x00406b39
0x00406b43
0x00406b47
0x00000000
0x00000000
0x00000000
0x00406b4d
0x00406a72
0x00406a72
0x00406a78
0x00406a7d
0x00000000
0x00406a7d
0x00406a11
0x00406a14
0x00406a32
0x00406a32
0x00406a32
0x00406a36
0x00000000
0x00000000
0x00406a23
0x00406a25
0x00406a25
0x00406a29
0x00406a30
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a30
0x00406a38
0x00406a3b
0x00406a3f
0x00406a46
0x00000000
0x00000000
0x00000000
0x00406a46
0x00406c08
0x00406c11
0x00000000
0x00406c11
0x00406aac
0x00406ab4
0x00406ab7
0x00406abc
0x00406aca
0x00406ad3
0x00406add
0x00406ae1
0x00000000
0x00000000
0x00000000
0x00406ae1
0x004069d4
0x004069e0
0x004069e5
0x004069f2
0x004069f7
0x004069fd
0x00000000
0x00000000
0x00000000
0x004069fd
0x00000000
0x00406c28
0x00406b72
0x00000000
0x00000000
0x00406b88
0x00406b8c
0x00000000
0x00406b8c
0x004069aa
0x004069af
0x004069bb
0x00406775
0x0040677f
0x00000000
0x0040677f
0x00000000
0x004069c1
0x00406760
0x00000000
0x00000000
0x00406769

APIs

free.MSVCRT ref: 004067AA
wcstoul.MSVCRT ref: 0040681D

Strings

Number of threads must be a non-negative integer!, xrefs: 00406846

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: freewcstoul
String ID: Number of threads must be a non-negative integer!
API String ID: 132300894-3844074275
Opcode ID: 8dad26491f9d99fe455c766087c5536372d54d872731eb5379bc934a12d2289f
Instruction ID: 74f70e1efe0a0e39690f64d44262212058fe371f09b4d12ba41b8844f4237b2a
Opcode Fuzzy Hash: 8dad26491f9d99fe455c766087c5536372d54d872731eb5379bc934a12d2289f
Instruction Fuzzy Hash: 27018463305A4441EA21DB29E9403AD6364F7857B8F954227DE6E577E4DF3CC8D6C304

Uniqueness

Uniqueness Score: -1.00%

Function 004052B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004052B0(void* __ebx, void* __edi, void* __esi, void* __rax, void* __r14) {
				void* _t160;
				void* _t161;
				void* _t166;
				void* _t171;

				_t171 = __rax;
				_t166 = __esi;
				_t160 = __ebx;
				 *((intOrPtr*)(__rax - 0x7b)) =  *((intOrPtr*)(__rax - 0x7b)) + _t161;
				asm("ror byte [edi], 0x84");
			}

0x004052b0
0x004052b0
0x004052b0
0x004052bc
0x004052bf

APIs

free.MSVCRT ref: 00405282
wcschr.MSVCRT ref: 004052B8

Strings

'--image-property' argument must be in the form NAME=VALUE, xrefs: 00405982

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: freewcschr
String ID: '--image-property' argument must be in the form NAME=VALUE
API String ID: 1210221023-4034809873
Opcode ID: 14dbbb981616571a350a80babb3ccf8200a55c41fd3bc28b9e10605d77ee15fd
Instruction ID: 0633e450003343f249e1e83d0d6b7fc98bf02fd46d36629974300171c84c2fdf
Opcode Fuzzy Hash: 14dbbb981616571a350a80babb3ccf8200a55c41fd3bc28b9e10605d77ee15fd
Instruction Fuzzy Hash: 61012172300D0194EA11D775A94539A2350FB487A8F8406379E1DA67D4EE7CC986C719

Uniqueness

Uniqueness Score: -1.00%

Function 00401F60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00401F60(void* __ecx, void* __r12) {
				int _t4;
				void* _t9;
				intOrPtr _t13;
				void* _t20;

				_t4 =  *(__r12 + 0x10);
				if(_t9 == 1) {
					if( *0x424178 == 0) {
						goto L4;
					}
					_t4 = E00401650( *((intOrPtr*)(__r12 + 8)), _t20);
					_t13 =  *0x424178;
					goto L2;
				} else {
					if(__rax == 2) {
						__rcx =  *0x424178;
						if( *0x424178 == 0) {
							goto L4;
						}
						__r8 =  *((intOrPtr*)(__r12 + 8));
						E00401650( *((intOrPtr*)(__r12 + 8)), __r9);
						__rcx =  *0x424178;
						goto L2;
					} else {
						if(__rax != 0) {
							_t13 =  *0x424178;
						} else {
							__rcx = __r12;
							E00401680(__ecx, __edx, __r12);
							__rcx =  *0x424178;
						}
						L2:
						if(_t13 != 0) {
							_t4 = fflush();
						}
						L4:
						return _t4;
					}
				}
			}

0x00401f60
0x00401f68
0x004021ea
0x00000000
0x00000000
0x004021fc
0x00402201
0x00000000
0x00401f6e
0x00401f71
0x00402190
0x0040219a
0x00000000
0x00000000
0x004021a0
0x004021ac
0x004021b1
0x00000000
0x00401f77
0x00401f79
0x00401970
0x00401f7f
0x00401f7f
0x00401f84
0x00401f89
0x00401f89
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00401981
0x0040198c
0x0040198c
0x00401f71

APIs

fflush.MSVCRT ref: 0040197C

Strings

Excluding "%ls" from capture, xrefs: 004021F5
WARNING: Excluding unsupported file or directory "%ls" from capture, xrefs: 004021A5

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: Excluding "%ls" from capture$WARNING: Excluding unsupported file or directory "%ls" from capture
API String ID: 497872470-2676024377
Opcode ID: 7432d0de6a80f92b7174b770c95231d9bc1e203650dfe45d13fd90591c0db56f
Instruction ID: 20336014340f0ca1ed26f9e34d22fd7c9b84654a2cca776e5e1969608b828be9
Opcode Fuzzy Hash: 7432d0de6a80f92b7174b770c95231d9bc1e203650dfe45d13fd90591c0db56f
Instruction Fuzzy Hash: DF01FFF130550084EE19DB62D8A9BB62320ABD17C4F890477EE0AA66B0CF3CC8C1D34C

Uniqueness

Uniqueness Score: -1.00%

Function 00409670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Unknown error, xrefs: 0040975C

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: b7580efc999c12ae6c52d18cf91d16191a256256735d331d18fe5e48523d3fd2
Instruction ID: 1a5c30fc7afacaadb550e3258ade1a5ee3848ae5b43a4c0a026b9338ad7cf452
Opcode Fuzzy Hash: b7580efc999c12ae6c52d18cf91d16191a256256735d331d18fe5e48523d3fd2
Instruction Fuzzy Hash: FD018472504E88C2D6068F1CE8013EA7374FF9979AF245316EF8826264DB39C593C704

Uniqueness

Uniqueness Score: -1.00%

Function 00401FC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00401FC0(intOrPtr* __r12) {
				int _t4;
				intOrPtr _t11;
				void* _t19;

				_t12 =  *__r12;
				_t11 =  *0x424178;
				if( *((intOrPtr*)( *__r12)) == 1) {
					if(_t11 == 0) {
						goto L3;
					}
					_t4 = E00401650( *((intOrPtr*)(_t12 + 8)), _t19);
					_t11 =  *0x424178;
				} else {
					if(__rax != 2) {
						goto L1;
					}
					if(__rcx == 0) {
						L3:
						return _t4;
					}
					__r9 =  *((intOrPtr*)(__rdx + 0x10));
					__r8 =  *((intOrPtr*)(__rdx + 8));
					__rdx = L"Renamed WIM path \"%ls\" => \"%ls\"\n";
					E00401650(__r8, __r9);
					__rcx =  *0x424178;
				}
				L1:
				if(_t11 != 0) {
					_t4 = fflush();
				}
				goto L3;
			}

0x00401fc0
0x00401fc4
0x00401fd0
0x0040216b
0x00000000
0x00000000
0x0040217c
0x00402181
0x00401fd6
0x00401fd9
0x00000000
0x00000000
0x00401fe2
0x00401981
0x0040198c
0x0040198c
0x00401fe8
0x00401fec
0x00401ff0
0x00401ff7
0x00401ffc
0x00401ffc
0x00401977
0x0040197a
0x0040197c
0x0040197c
0x00000000

APIs

fflush.MSVCRT ref: 0040197C

Strings

Deleted WIM path "%ls", xrefs: 00402175
Renamed WIM path "%ls" => "%ls", xrefs: 00401FF0

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fflush
String ID: Deleted WIM path "%ls"$Renamed WIM path "%ls" => "%ls"
API String ID: 497872470-426739877
Opcode ID: 100278284b0586cf47abcd3162fde09daefbeed84c3d13495997b12ecd1e1248
Instruction ID: aee1bc39010e2e034253dfc8855ac4b7af89f1cfa7b0fa5e6bc72db0f317c9ef
Opcode Fuzzy Hash: 100278284b0586cf47abcd3162fde09daefbeed84c3d13495997b12ecd1e1248
Instruction Fuzzy Hash: A1F030F570660184EE19DB95D8697B97320EB91794F844973DE09677B0CB3CC8D2C348

Uniqueness

Uniqueness Score: -1.00%

Function 00409740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
The result is too small to be represented (UNDERFLOW), xrefs: 00409740

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 4f42ae78522b9adfd06e5f6224eca55d5b63b740a77b715c63cf5e8994fa63d4
Instruction ID: 2b56adfce5a4955e0ff200bf9e209a54d769b0347b05c978e0e86939207d0dbd
Opcode Fuzzy Hash: 4f42ae78522b9adfd06e5f6224eca55d5b63b740a77b715c63cf5e8994fa63d4
Instruction Fuzzy Hash: D1F06262404E8482D2028F1CA4003EB7370FF8D799F255316EF8936124DB29C583C704

Uniqueness

Uniqueness Score: -1.00%

Function 00409750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Total loss of significance (TLOSS), xrefs: 00409750

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 4ed97901502a43df3565ae674dca60e9214c427c683790a6de3191af6a036574
Instruction ID: 305ca96ece36f20401a3aacd9eb3a82883af0587df52f0bfd82f4ed2412058e2
Opcode Fuzzy Hash: 4ed97901502a43df3565ae674dca60e9214c427c683790a6de3191af6a036574
Instruction Fuzzy Hash: DAF01262504E8482D202DF2DA4003EB7374FF9D799F255316EF8936525DB29C5878704

Uniqueness

Uniqueness Score: -1.00%

Function 00409710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Argument domain error (DOMAIN), xrefs: 00409710

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: ef120d6b24b0c611415dcbb4ade9d88ba25bfeded99b118d11087b207bfee5a8
Instruction ID: d18ca3fb07da6f42c7d7a45ddd02c8d74ecf17cacf86c35729dc7f9b779cc35c
Opcode Fuzzy Hash: ef120d6b24b0c611415dcbb4ade9d88ba25bfeded99b118d11087b207bfee5a8
Instruction Fuzzy Hash: 19F06D62504E8882D2028F2CA4003EBB370FF8E799F29531AEF893A124DB29C5838704

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Partial loss of significance (PLOSS), xrefs: 00409720

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 45ea01acc59c440a0592831e22a28f640b4c57234a1fb32cdf665f8641da7a35
Instruction ID: 312a80739d5aa63e5e50db4d0a12543d99f24057f7928139b1738915ce2b256f
Opcode Fuzzy Hash: 45ea01acc59c440a0592831e22a28f640b4c57234a1fb32cdf665f8641da7a35
Instruction Fuzzy Hash: 4AF01D62504E8882D2029F2DA4003EBB374FF9E799F29531AEF893A575DB29D5878704

Uniqueness

Uniqueness Score: -1.00%

Function 00409730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Overflow range error (OVERFLOW), xrefs: 00409730

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 4dfc1c9434079849a0df407a7116bc0ad7a21efea8e3d469cd01d116ad4c418c
Instruction ID: d78f1c32a114f2b3e5e21883bed0a9cf648df70f82a2c2b79fb1d90f3c9e88e2
Opcode Fuzzy Hash: 4dfc1c9434079849a0df407a7116bc0ad7a21efea8e3d469cd01d116ad4c418c
Instruction Fuzzy Hash: D1F01D62514E8882D2029F2DA4003EBB374FF9E799F29531AEF893A565DB29C5878704

Uniqueness

Uniqueness Score: -1.00%

Function 004096A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004096F0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004096D7
Argument singularity (SIGN), xrefs: 004096A8

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 26d6939e0f7ea36c4c6f34f601c39c9a8ccddf85add789f11490a540e154c123
Instruction ID: fc4f2b011dd1311329065b1e82ebdd3eca42b071f854411719dccd10150b02b3
Opcode Fuzzy Hash: 26d6939e0f7ea36c4c6f34f601c39c9a8ccddf85add789f11490a540e154c123
Instruction Fuzzy Hash: 0EF01D62504E8882D202DF29A4003ABB364FF9E79AF255316EF892A524DB29C5838704

Uniqueness

Uniqueness Score: -1.00%

Function 00411330 Relevance: 5.1, APIs: 4, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00411330(void* __edx, void* __edi, void* __esi, void* __ebp, void* __rax, signed long long __rcx, void* __r10) {
				void* _t18;
				signed char _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				signed long long _t26;
				void* _t31;
				signed long long _t34;
				signed long long _t36;
				signed long long _t37;
				signed long long _t49;
				signed long long _t55;
				signed long long _t56;
				signed long long _t57;
				void* _t59;
				signed long long _t60;
				signed long long _t61;

				_t59 = __r10;
				_t25 = __ebp;
				_t23 = __edi;
				_t61 = __rcx;
				_t36 = _t49;
				_t34 = _t49 & 0x00000003;
				_t26 = _t34;
				if(_t26 != 0) {
					_t34 = _t34 - 1;
					r8d = 0;
					_t18 = E00411060(_t20, __edx, _t34, __rcx,  *((intOrPtr*)(0x41fca0 + _t34 * 4)));
					_t61 = _t34;
					__eflags = _t34;
					if(__eflags != 0) {
						goto L1;
					}
					L23:
					r12d = 0;
					L12:
					return _t18;
				}
				L1:
				_t37 = _t36 >> 2;
				_t60 = _t61;
				if(_t26 == 0) {
					goto L12;
				}
				_t55 =  *0x424320;
				if(_t55 == 0) {
					 *((long long*)(_t34 - 0x75)) =  *((long long*)(_t34 - 0x75)) - 1;
					_t34 - 0x12e57 = _t55;
					if(_t55 == 0) {
						 *((long long*)(_t34 - 0x77)) =  *((long long*)(_t34 - 0x77)) - 1;
						asm("invalid");
						__eflags = _t34;
						if(_t34 == 0) {
							 *0x424320 = 0;
							r12d = 0;
							goto L12;
						}
						_t34 = 0x1;
					}
					__eflags =  *0x424c90 - 2;
					if(__eflags == 0) {
						LeaveCriticalSection();
					}
				}
				_t60 = _t61;
				L7:
				while(1) {
					if((_t20 & 0x00000001) == 0) {
						L4:
						_t37 = _t37 >> 1;
						if(__eflags == 0) {
							goto L12;
						}
						L5:
						_t56 =  *_t55;
						__eflags = _t56;
						if(__eflags == 0) {
							 *((long long*)(_t34 - 0x75)) =  *((long long*)(_t34 - 0x75)) - 1;
							asm("aaa");
							__eflags = _t56;
							if(_t56 == 0) {
								_t18 = E004111D0(_t23, _t25, _t34, _t55, _t55, _t59);
								 *_t55 = _t34;
								_t56 = _t34;
								__eflags = _t34;
								if(_t34 == 0) {
									goto L23;
								}
								 *_t34 = 0;
							}
							__eflags =  *0x424c90 - 2;
							if(__eflags == 0) {
								LeaveCriticalSection();
							}
						}
						_t55 = _t56;
						continue;
					}
					_t18 = E004111D0(_t23, _t25, _t34, _t60, _t55, _t59);
					_t57 = _t34;
					if(_t34 == 0) {
						goto L23;
					}
					if(_t60 == 0) {
						_t60 = _t34;
						goto L4;
					}
					_t31 =  *((intOrPtr*)(_t60 + 8)) - 9;
					if(_t31 <= 0) {
						_t18 = E00410DC0(_t21);
						_t34 =  *((intOrPtr*)(_t60 + 8));
						__eflags =  *0x424c90 - 2;
						 *(0x424c40 + _t34 * 8) = _t60;
						 *_t60 =  *(0x424c40 + _t34 * 8);
						_t60 = _t57;
						if(__eflags == 0) {
							LeaveCriticalSection();
						}
						goto L4;
					}
					_t60 = _t57;
					free(??);
					_t37 = _t37 >> 1;
					if(_t31 != 0) {
						goto L5;
					}
					goto L12;
				}
			}

0x00411330
0x00411330
0x00411330
0x00411340
0x00411343
0x00411345
0x00411345
0x00411348
0x00411488
0x00411492
0x0041149a
0x0041149f
0x004114a2
0x004114a5
0x00000000
0x00000000
0x004114b0
0x004114b0
0x004113cb
0x004113dc
0x004113dc
0x0041134e
0x0041134e
0x00411351
0x00411354
0x00000000
0x00000000
0x00411356
0x00411360
0x004114c1
0x004114c9
0x004114cc
0x004114f6
0x004114f9
0x004114fb
0x004114fd
0x0041151d
0x00411528
0x00000000
0x00411528
0x004114ff
0x004114ff
0x004114ce
0x004114d5
0x004114e2
0x004114e2
0x004114d5
0x00411366
0x00000000
0x0041138f
0x00411392
0x00411380
0x00411380
0x00411382
0x00000000
0x00000000
0x00411384
0x00411384
0x00411387
0x0041138a
0x004113e9
0x004113ec
0x004113ed
0x004113f0
0x00411466
0x0041146b
0x0041146e
0x00411471
0x00411474
0x00000000
0x00000000
0x00411476
0x00411476
0x004113f2
0x004113f9
0x00411402
0x00411402
0x004113f9
0x0041138c
0x00000000
0x0041138c
0x0041139a
0x0041139f
0x004113a5
0x00000000
0x00000000
0x004113ae
0x00411450
0x00000000
0x00411450
0x004113b4
0x004113ba
0x00411412
0x00411417
0x0041141c
0x00411428
0x0041142d
0x00411431
0x00411434
0x00411441
0x00411441
0x00000000
0x00411434
0x004113bf
0x004113c2
0x004113c7
0x004113c9
0x00000000
0x00000000
0x00000000
0x004113c9

APIs

free.MSVCRT ref: 004113C2
LeaveCriticalSection.KERNEL32 ref: 004114E2

Memory Dump Source

Source File: 00000001.00000002.615841722.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.615836128.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615863745.0000000000417000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615877290.0000000000422000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615882818.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.615889598.0000000000426000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_bReporter.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 31ae993848a131c90640e5cb92f0a77a9547eda6f9260fdc456a57c41ec4dad1
Instruction ID: ab81d3e00906465ce2ebc4eb11a463b070bf3d15a8c8ee94d981df7622594b4a
Opcode Fuzzy Hash: 31ae993848a131c90640e5cb92f0a77a9547eda6f9260fdc456a57c41ec4dad1
Instruction Fuzzy Hash: D641B471342A1481FB25DB16AA453AB6261FB44BD8F89412BEF1907B68DF3C98D2C34C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4a9OE5cKJo.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_4a9OE5cKJo.exe_5d821032eba26e5e17f9a2465f70afed96fa7875_98ba9ed1_1833c5a4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF6B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0C3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC132.tmp.xml

C:\Users\Public\Music\Picture\bReporter.exe

C:\Users\Public\Music\Picture\libwim-15.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\service[1].log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
4a9OE5cKJo.exe

Function 00007FF739CC0890 Relevance: 92.9, APIs: 24, Strings: 29, Instructions: 151
libraryCOMMON

Function 00007FF739CBDDF0 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 288
libraryfilenativeCOMMONCrypto

Function 00007FF739CBFE20 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 222
windowkeyboardregistryCOMMON

Function 00007FF739CC3520 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 191
COMMON

Function 00007FF739CC66C4 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61
libraryloaderCOMMON

Function 00007FF739CE2180 Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Function 00007FF739CD8E50 Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Function 00007FF739CC6930 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Function 00007FF739C83A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
filewindowCOMMON

Function 00007FF739C83B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
filewindowCOMMON

Function 00007FF739C836B0 Relevance: 4.6, APIs: 3, Instructions: 126
COMMON

Function 00007FF739CC5888 Relevance: 4.6, APIs: 3, Instructions: 66
COMMON